berbew | 7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
Size 79KB
Sample260908-msjynahr21
SHA256 7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb
MD5 6892d5449ebc5a5539bdfe7ddfe4e50f
SHA1 0ef7eb617024e441d4880a6e379d25528869baba
SHA512 17c12a6e8d812928c27e0f81260f8cd10bfc2ad703266df2a05b728618d69c59a64d80c86e1d94c8e1b00592ff721ca19a86d21f5260077e1b45abb3c7b69c8f
SSDEEP 1536:fFY6aXWy6soovEUpv+IS5YAQRQJRbRUs3cO57OWxXPu4b:fFH66Rk7ASAQeJlj9puE
TLSH
T1BD839D2FBAF76E81CEB48AFC4128C0BC6D19D564883030B25839555CE65F94A0FADDF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew padodor persistence trojan

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Family: Padodor
Padodor is a Windows trojan/backdoor written in C.
trojan backdoor padodor

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojemig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omfekbdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Piocecgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pcbkml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojemig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojhiogdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppikbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfccogfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Omfekbdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piocecgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omdieb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppikbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Padnaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfojdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Padnaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbkml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pcegclgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pciqnk32.exe

Detects Padodor trojan 40 IoCs

resource	yara_rule
behavioral1/memory/2000-0-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x001a000000024450-6.dat	family_padodor
behavioral1/memory/2216-8-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024688-14.dat	family_padodor
behavioral1/memory/2200-16-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x000700000002468a-23.dat	family_padodor
behavioral1/memory/3884-28-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x000700000002468c-30.dat	family_padodor
behavioral1/memory/3512-31-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x000700000002468e-39.dat	family_padodor
behavioral1/memory/3548-40-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024690-48.dat	family_padodor
behavioral1/memory/3616-55-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024692-54.dat	family_padodor
behavioral1/files/0x0007000000024694-63.dat	family_padodor
behavioral1/memory/452-68-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024696-70.dat	family_padodor
behavioral1/memory/4544-77-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x000700000002469c-95.dat	family_padodor
behavioral1/memory/3076-101-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/memory/4176-104-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x000700000002469e-103.dat	family_padodor
behavioral1/memory/2724-93-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x000700000002469a-87.dat	family_padodor
behavioral1/memory/2044-85-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024698-79.dat	family_padodor
behavioral1/memory/3552-47-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x00070000000246a0-110.dat	family_padodor
behavioral1/memory/540-111-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/files/0x00070000000246a2-118.dat	family_padodor
behavioral1/memory/1976-120-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/memory/540-121-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/memory/3616-123-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/memory/2216-128-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/memory/2000-129-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/memory/2200-127-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/memory/3512-126-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/memory/3548-125-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/memory/3552-124-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor
behavioral1/memory/4176-122-0x0000000000400000-0x0000000000435000-memory.dmp	family_padodor

Executes dropped EXE 15 IoCs

pid	Process
2216	Ojemig32.exe
2200	Omdieb32.exe
3884	Ojhiogdd.exe
3512	Omfekbdh.exe
3548	Pfojdh32.exe
3552	Padnaq32.exe
3616	Pcbkml32.exe
452	Pfagighf.exe
4544	Piocecgj.exe
2044	Ppikbm32.exe
2724	Pcegclgp.exe
3076	Pfccogfc.exe
4176	Pjoppf32.exe
540	Pciqnk32.exe
1976	Pififb32.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pjoppf32.exe	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Pciqnk32.exe	Pjoppf32.exe
File opened for modification	C:\Windows\SysWOW64\Pififb32.exe	Pciqnk32.exe
File opened for modification	C:\Windows\SysWOW64\Pciqnk32.exe	Pjoppf32.exe
File opened for modification	C:\Windows\SysWOW64\Ojhiogdd.exe	Omdieb32.exe
File opened for modification	C:\Windows\SysWOW64\Omfekbdh.exe	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Kjmgil32.dll	Omfekbdh.exe
File opened for modification	C:\Windows\SysWOW64\Piocecgj.exe	Pfagighf.exe
File created	C:\Windows\SysWOW64\Hejeak32.dll	Piocecgj.exe
File created	C:\Windows\SysWOW64\Pjoppf32.exe	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Iheocj32.dll	Pfagighf.exe
File opened for modification	C:\Windows\SysWOW64\Ojemig32.exe	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
File created	C:\Windows\SysWOW64\Padnaq32.exe	Pfojdh32.exe
File created	C:\Windows\SysWOW64\Ojgljk32.dll	Pfojdh32.exe
File created	C:\Windows\SysWOW64\Pcbkml32.exe	Padnaq32.exe
File created	C:\Windows\SysWOW64\Pfagighf.exe	Pcbkml32.exe
File opened for modification	C:\Windows\SysWOW64\Ppikbm32.exe	Piocecgj.exe
File created	C:\Windows\SysWOW64\Onnnbnbp.dll	Ppikbm32.exe
File created	C:\Windows\SysWOW64\Kajefoog.dll	Padnaq32.exe
File created	C:\Windows\SysWOW64\Pcegclgp.exe	Ppikbm32.exe
File created	C:\Windows\SysWOW64\Pfccogfc.exe	Pcegclgp.exe
File created	C:\Windows\SysWOW64\Cohddjgl.dll	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Bfmpaf32.dll	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
File created	C:\Windows\SysWOW64\Omdieb32.exe	Ojemig32.exe
File created	C:\Windows\SysWOW64\Gflonn32.dll	Ojemig32.exe
File created	C:\Windows\SysWOW64\Chjjqebm.dll	Pcegclgp.exe
File created	C:\Windows\SysWOW64\Gcilohid.dll	Pjoppf32.exe
File created	C:\Windows\SysWOW64\Pififb32.exe	Pciqnk32.exe
File opened for modification	C:\Windows\SysWOW64\Pfojdh32.exe	Omfekbdh.exe
File opened for modification	C:\Windows\SysWOW64\Pcbkml32.exe	Padnaq32.exe
File created	C:\Windows\SysWOW64\Ppikbm32.exe	Piocecgj.exe
File created	C:\Windows\SysWOW64\Gaaklfpn.dll	Pciqnk32.exe
File created	C:\Windows\SysWOW64\Pfojdh32.exe	Omfekbdh.exe
File created	C:\Windows\SysWOW64\Ojemig32.exe	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
File created	C:\Windows\SysWOW64\Fllhjc32.dll	Omdieb32.exe
File created	C:\Windows\SysWOW64\Omfekbdh.exe	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Iaidib32.dll	Ojhiogdd.exe
File opened for modification	C:\Windows\SysWOW64\Padnaq32.exe	Pfojdh32.exe
File opened for modification	C:\Windows\SysWOW64\Pfagighf.exe	Pcbkml32.exe
File created	C:\Windows\SysWOW64\Nffaen32.dll	Pcbkml32.exe
File opened for modification	C:\Windows\SysWOW64\Omdieb32.exe	Ojemig32.exe
File created	C:\Windows\SysWOW64\Ojhiogdd.exe	Omdieb32.exe
File created	C:\Windows\SysWOW64\Piocecgj.exe	Pfagighf.exe
File opened for modification	C:\Windows\SysWOW64\Pcegclgp.exe	Ppikbm32.exe
File opened for modification	C:\Windows\SysWOW64\Pfccogfc.exe	Pcegclgp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4996	1976	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pififb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhiogdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omfekbdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcegclgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Padnaq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfagighf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piocecgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojemig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfojdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbkml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjoppf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omdieb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppikbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfccogfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pciqnk32.exe

Modifies registry class 48 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cohddjgl.dll"	Pfccogfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pciqnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ojemig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojgljk32.dll"	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kajefoog.dll"	Padnaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iheocj32.dll"	Pfagighf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaaklfpn.dll"	Pciqnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfagighf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Omdieb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfojdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Padnaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Padnaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfmpaf32.dll"	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pcbkml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Piocecgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hejeak32.dll"	Piocecgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chjjqebm.dll"	Pcegclgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfccogfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojemig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ppikbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcilohid.dll"	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaidib32.dll"	Ojhiogdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Omfekbdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onnnbnbp.dll"	Ppikbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ppikbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjoppf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjmgil32.dll"	Omfekbdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nffaen32.dll"	Pcbkml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcbkml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gflonn32.dll"	Ojemig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fllhjc32.dll"	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Omfekbdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Piocecgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfojdh32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2216	2000	7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe	85
PID 2216 wrote to memory of 2200	2216	Ojemig32.exe	86
PID 2200 wrote to memory of 3884	2200	Omdieb32.exe	87
PID 3884 wrote to memory of 3512	3884	Ojhiogdd.exe	88
PID 3512 wrote to memory of 3548	3512	Omfekbdh.exe	89
PID 3548 wrote to memory of 3552	3548	Pfojdh32.exe	90
PID 3552 wrote to memory of 3616	3552	Padnaq32.exe	91
PID 3616 wrote to memory of 452	3616	Pcbkml32.exe	92
PID 452 wrote to memory of 4544	452	Pfagighf.exe	93
PID 4544 wrote to memory of 2044	4544	Piocecgj.exe	94
PID 2044 wrote to memory of 2724	2044	Ppikbm32.exe	95
PID 2724 wrote to memory of 3076	2724	Pcegclgp.exe	96
PID 3076 wrote to memory of 4176	3076	Pfccogfc.exe	97
PID 4176 wrote to memory of 540	4176	Pjoppf32.exe	98
PID 540 wrote to memory of 1976	540	Pciqnk32.exe	99

C:\Users\Admin\AppData\Local\Temp\7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe
"C:\Users\Admin\AppData\Local\Temp\7614a74c28321461adca32b43b05a82d60d9da150bbeba04f1b9ed45754fbceb.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\Ojemig32.exe
  C:\Windows\system32\Ojemig32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\Omdieb32.exe
    C:\Windows\system32\Omdieb32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\Ojhiogdd.exe
      C:\Windows\system32\Ojhiogdd.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3884
    - - C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3512
      - C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3548
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 412
        17⤵
        Program crash
        
        PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1976 -ip 1976
1⤵
PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Kjmgil32.dll

Path C:\Windows\SysWOW64\Kjmgil32.dll
Size 7KB
SHA256 04b2d95a97738930456743f375f98500a7451cd3b55a21963ebe0a50ecdce509
MD5 9def718111f97abad9370d35ada2f72b
SHA1 e29434486e57df6432cb0039a81c5408a0856333
SHA512 3df7df22990aca44e0d6af93fb0b61879bf6a167b805cbb49bbfcd0fc82708ab8ef66b9e4449aafffa2cb03638c4147684d1c73abf9b16ea97b51ffcd3bee359
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPqd3cX5aXW:wUaJf/aFbP0ON2JaX
TLSH
T1FDE16493FD8041FBC08C0A7911FF26229B2E69342AD880056B8899351C9CFEFFF78546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojemig32.exe

Path C:\Windows\SysWOW64\Ojemig32.exe
Size 79KB
SHA256 467c044c1c5993e687b3aea30b0f5ecfae4ee9008c456b818e15725f8df211e6
MD5 2eeb8707d4f1ba2fff42b65db8d360fb
SHA1 aa6a2de93ddc5a4b77de9724da6513e9ad3676cc
SHA512 8cf5c01d15a1cfb9829dc11c5a0546328faf250dedcb8c6d0f64e3f5e2672f5879aa63725f7526b13e8699dff8989bc17bf73b016d101701afea10a11779ef2a
SSDEEP 1536:aAJ4V+1pMOKAEXgpgN5J16o2koIzqd2GjXRDdF1jHQRQDRbRUs3cO57OWxXPu4b:2cpP47J16o2k+2G5djHQeDlj9puE
TLSH
T1E0839EEAD9B31F76E4ACC9F7220607352A26FF68A2ECC5304D4D409E991BC465F647C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojhiogdd.exe

Path C:\Windows\SysWOW64\Ojhiogdd.exe
Size 79KB
SHA256 0c9757794060d7563439bb422ee02f8f035f3a42bcfa29f578dcb837a9ea1959
MD5 a761d180bf0eb5dc8450f5b006c3c6cb
SHA1 599a91686df11e3bc4f7f762273e8a997921a845
SHA512 f8ba73fd0b798444ea80972044928100fc5fcd878b7d82e83323ff05d04788d4cff97384535093313a25270004775f16c7463692358a70fa55cfdb508a79018e
SSDEEP 1536:jJBKyzjM9jt//FFUoF8FX7h4CJBU6Wo88iwRQgRRbRUs3cO57OWxXPu4b:jLKy3M9t//FV+X7h98hweilj9puE
TLSH
T112837C6A9D2A8E34C4BDF1F14191EAAF48CBD152525820AF7168BEC3E63D37CC81E175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Omdieb32.exe

Path C:\Windows\SysWOW64\Omdieb32.exe
Size 79KB
SHA256 7a344cdb2d044aecc5ec368c44ec01c523e4784cb871de33e21f1fe39d63cade
MD5 9b46a34f58de700bc25d2e8fdc0d0ab2
SHA1 d57295b50e4d9bbad41aa4d4cbbed8c1e965c3f5
SHA512 40135e312f35455584ddbcc100bb00acc7022bc2e94ebe553c0a533e6f1d2a27a74db9221f8b4e244e18be7c600fe95cdd86759e5c299ca23cc7a9a7dc12d075
SSDEEP 1536:8C1IwnnTdCYzHDLGjn0FJoBqt/GEsUimXCF/qQf/RUufbENPRQ9RbRUs3cO57OWv:L1IwRNfLI0+qYEHK//BU6bENPe9lj9p5
TLSH
T178839F6F525DBFE5C99D2FF203326C3CE2E4C518212EED5E20BA2415CA3622515D4EBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Omfekbdh.exe

Path C:\Windows\SysWOW64\Omfekbdh.exe
Size 79KB
SHA256 1757c9e090af58e9eade2ae8ce571cc07d1d7b42bd304d4a841df58d0d6e2d78
MD5 f88debbbfbef5aea3c3a5eea4c5870b7
SHA1 8047e5fcb5d792da863b89ec7261bd9c9c684e7c
SHA512 8e3502393de76be889b839d36bf12a4762f612030620724d738e471d77f36040e94ae2364308f6f11bff3988dc9346f2ae89b078a3e0a7eb811b056855225c38
SSDEEP 1536:IcW1lVccMJwST8S3hlwq3/+3KaQ7hcYoaEveDRQbzRbRUs3cO57OWxXPu4b:Ic2hMJ2S0qP+HQ7seDe3lj9puE
TLSH
T1F0838B9A65B19DBDF8B933F386C24C689640D67212B6B7C5C0E74C9F400AD8E6B743C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Padnaq32.exe

Path C:\Windows\SysWOW64\Padnaq32.exe
Size 79KB
SHA256 cb0274f1ec4790745570f13f0e26dba77d1f6ea9d0bf95a7478e0786db903ff6
MD5 1af5b598e1a672223dd7e34e0689423a
SHA1 59ad9ea6740c08035d11ef51c2f1aa3ab66357ee
SHA512 86d292eec76889df0fd976b1afeae4df7db2a9ce948255928912e46e47006b5c47c6709a9cf0c43d51f4a89eff1081978240b44ea19f5eb1438f168601cc5e80
SSDEEP 1536:0fkGZGGlqYy+29obRQNRbRUs3cO57OWxXPu4b:YkGZGGMYyCeNlj9puE
TLSH
T13A839C6D40B7DE3AD87C0CB16D6670EC5924D1FB243D0D886A8BCF489D6E76C929E342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcbkml32.exe

Path C:\Windows\SysWOW64\Pcbkml32.exe
Size 79KB
SHA256 65c6669e04ef593e435346c04f6f8a87b124bb95bd79d4b70bf30f3c4cb02671
MD5 b627cb105cefaef25ef4e011ae3dddb8
SHA1 6b2570ef84882a2e3c995ef78311848ca2b03924
SHA512 0043e9645b23a7dd276934d197ed841229ef06d8043e0d91b2bf99e67a8649f8a263d79f3c4f5afddc4193d3a05ca0be3fefe31b7d6ba5cdd3210b2c6e490b53
SSDEEP 1536:BXMpfdF1uze1BXPklkaR5XvSSRzwHddYRRQE0RbRUs3cO57OWxXPu4b:BGfd2CP2ky5XDwHddYReblj9puE
TLSH
T12A835ADD84AB6D3BC44C02B47D32CD38F551EE21D12840862AA2B16F56FF19A4FCE636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcegclgp.exe

Path C:\Windows\SysWOW64\Pcegclgp.exe
Size 79KB
SHA256 011db0590ad33c906bd2280c1eecf22398c0e5594c4e9c63512abc722e261e47
MD5 d206ac96d641c411827354b3cbd2e7c8
SHA1 ba386042d5fa0de71c000a9ed3494c31bb9b0d48
SHA512 1d8819276c8d6b6163a1c2caa6e5817d7c2b41bf985024a1ae83d79b7e88ed63bc1f307ca8273d608c62723bb8dc87ef5fbef09958a9113b3199badede9f1602
SSDEEP 1536:Pztsw6OtCh8OhVyeXQz8zvheokhkmzKqDDttu0RQ5RbRUs3cO57OWxXPu4b:PztpRCLNgz84qcj/Pu0e5lj9puE
TLSH
T18E838E156529FD21EFA7027844C25CA0F62DF37C1638D37A4B9C84779D8A2C3E931A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pciqnk32.exe

Path C:\Windows\SysWOW64\Pciqnk32.exe
Size 79KB
SHA256 8ed07e719b5d08314be22666dbecd0e79233cc1f305d90fb7b5378840a878231
MD5 1ad790e29e26e6c1236224772c3c5225
SHA1 ad52da100e8ddb5affb534ce8d30cd2166f83f01
SHA512 6a2f1ebe6822c2deccc163758f918ccd3f38f9f15c6b1b23b869f7ced1929345ccc662e7798be96edf1fc7d61610bc6d0390fac121bb4cc19d6ca6c080bd2a70
SSDEEP 1536:4hbrvncCEE8cJHJbajmQNTTCeE/b1M9o/r73HGXRQNRbRUs3cO57OWxXPu4b:w6E5JprQNTTCeA/r73seNlj9puE
TLSH
T181839D9C342F0D4EE4780AF14607C90845D9E6744D3F88C30CEEA87E5CBA5F26E695EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfagighf.exe

Path C:\Windows\SysWOW64\Pfagighf.exe
Size 79KB
SHA256 341faf4fe0834b4ccf9c82443ada7c9db8382fd7c650911ef2586cb7c8c3f58f
MD5 590ec8cc84f4cb4b546c8dddda63992e
SHA1 61094890d98231da381e2854f35f8aa0ba2cd51c
SHA512 0fef067666a306a97eb741a9e1e9e95adcceed9f7d105d216b05d06b8ddbebd69944f60b0b1a0c9521ec11d0dddb06e93bf5169f9be2f78fe194a1d890cbf5da
SSDEEP 1536:SmTgkIal27oXXXe0MyOvIDeCFr32sgepb5F+B5nfCaNRQvkRbRUs3cO57OWxXPuE:AValCYnuWeCFrNgqb5FSNeslj9puE
TLSH
T19B838E9772BC1D69E7ECC9F37116796B8148AA334DF539C9AAAF0E0672430329D1C40E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfccogfc.exe

Path C:\Windows\SysWOW64\Pfccogfc.exe
Size 79KB
SHA256 a017b2dad728b115ab9a1a375c4c567695722e07b0d59d70457d2e3b6d9e4192
MD5 987b3c72519f44e0c4c998a38fe5f61e
SHA1 002eb4f25da72e64ec15b64c8545bb0b94717325
SHA512 1d4e9329a10a1e7dc2f2a387147c0f9c8e100956f821175c61f1f057652e7e90e0c22347308c12ec3ca6efc1e7fd9c9e6455f67df199303439695f7602267fd0
SSDEEP 1536:gUZ+JyhsLAEbshTAT9Fu/Hjia6dkfnRQqRbRUs3cO57OWxXPu4b:RZe8sLJIkTLu/HjiaEk/eqlj9puE
TLSH
T15F83AE99AC7B5C4ED44E12F33593FDB9BDBD8610130AB3B184A7A1BBCB16C5107881E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfojdh32.exe

Path C:\Windows\SysWOW64\Pfojdh32.exe
Size 79KB
SHA256 e487c8b39b8d83b1818145a1f6c37f4fba00bbb54b410add9945f7cb37f1ac03
MD5 e26cd35e71d1e37c66fb504abc83ec88
SHA1 6a5d11d90cc3305473c1669e5bf864646f3a1dd8
SHA512 5441413e3287318bcefb49937fa0006ea37efe5642fc3fb9a0eb33436ba586fb2d7e07c4c571dd2cd0bda622ce8896015e01c18902f020c530f7ff71b9cebd26
SSDEEP 1536:e845uAiAnB8MksZTCVTALF9hYdCwgGm9aWoznaEnyRQyRbRUs3cO57OWxXPu4b:e848mB8vsZTyTwudzDraEnyeylj9puE
TLSH
T1D0837C97C6372E97EBE5B4703B27052C5960822C6F143EFBDE64CB3456CE22AE618147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pififb32.exe

Path C:\Windows\SysWOW64\Pififb32.exe
Size 79KB
SHA256 60a1ac21d629a9c8aeeccc1151daaca6e26a70adbfa153121f6a6750502c8dae
MD5 e7b25d5eecff83f1acd2ab591a6e93c5
SHA1 34820ea49c71728a91fe7952f92e47a826b6417b
SHA512 4705d4a6a2bf388c9564272e10464a717cb6c3639b375b947b6447a422f3b0cc0d7e56fcfbfb9253f21e39003388ae87ecbab7b68b2c61c3a706bfd533b7321c
SSDEEP 1536:gBuEpDHP/Yf6813K2oWQEF8zJradyZW0ySRQ/ORbRUs3cO57OWxXPu4b:gBzYiCKfeFAJrcyZDveGlj9puE
TLSH
T1FA837D6C42AA2FC4D43C06F83734B622B5F4A6FF11281C57387CA4945A5C52F7FA92E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Piocecgj.exe

Path C:\Windows\SysWOW64\Piocecgj.exe
Size 79KB
SHA256 9cb618431f526aaec3254bb7b50e1b6f9b13d00ef81331cb259ab14c4c82c813
MD5 34d5d0c07344a2870bf3848018d87dc6
SHA1 0aa4731541af1a048b2cfa8dfabd5aaea9b4ddc4
SHA512 d9606757b76f143b4622d0a57f1283e786ef12b73d1b1391162ba9e4d9c1dbe4b3f3c2bf551eedf5bf6112c5c916bc8924f1b79a1ecac9c0aa8c65c4ab9a1d5a
SSDEEP 1536:U+uV3X6LdLUQT+m3OpSHnHzE8Lk0nSqFwHKEvJWHQRQBRbRUs3cO57OWxXPu4b:RuV3XwBap0LFSqCHjJWweBlj9puE
TLSH
T11183AFA7CC2A6D95D81C07B6EE33CA381943C67500A2B8449B359A7DED1BEC1CC2DF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjoppf32.exe

Path C:\Windows\SysWOW64\Pjoppf32.exe
Size 79KB
SHA256 2ba6186691be6ff52f1df56ff497b8ced92f2c4ec26cc92c0a0fedad3e177334
MD5 7b14658b626f0ceebd12ae9632983f5f
SHA1 495a8e3efce12fff1b526270d69c520b79f07663
SHA512 dfcae11268d092610ba6821af66acc507a4bcb0271259bf5de634f40695730ef5e64bd878ba0ffbf59e1645330fd7342d9b91713bee015b55ebd1cde95c1c221
SSDEEP 1536:RDzHigJSyeUbQZjro8CLog+xPrMty3bh81yISQ/ui8DsXRQtRbRUs3cO57OWxXP5:pm7ydEtdeJ1RSU8DsXetlj9puE
TLSH
T135837D7A17FE2C05ED8C48B25109C81F51E8F2E42615896729A3ED731BFA687F2540BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppikbm32.exe

Path C:\Windows\SysWOW64\Ppikbm32.exe
Size 79KB
SHA256 2134238a46f1ebeab2da0c53a0d1aa64a98c5454e6e0e21397a9af587aa8c0ed
MD5 9ce549b3fd413efafebc9ffab9ce4125
SHA1 00c669c88ea86a235a6b39a88cdb73f275cd0d33
SHA512 8c21d2441db3f89169969c121b896a9186cdb652f49d8fd8e288314e003b3ded513ca6b313d6a21cf0eeb9d7b62dc467b427c38e28c2f0221f9e3e46e238677e
SSDEEP 1536:syVBa8VRMOjxf+9FICRPpxE63mQE2H7kyjJTghDMLqxxxhTjV0JpdPRQLRbRUs3l:/VU8jMWI9OCNpy642oy5IDMLqxxxhT5D
TLSH
T1E0837C643EDA3C5FE4193AB96FE694D386C4ECBD003043BBADE6903F6A550DC44582A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/452-68-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/540-121-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/540-111-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1976-120-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2000-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2000-129-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2044-85-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2200-16-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2200-127-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2216-8-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2216-128-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2724-93-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3076-101-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3512-31-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3512-126-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3548-40-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3548-125-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3552-47-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3552-124-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3616-55-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3616-123-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3884-28-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4176-104-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4176-122-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4544-77-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads