berbew | 7526ece772f73e29ef6e936297bd17b82346f084b2666bfa3a26709e4f328a4c

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Size 429KB
Sample260930-pf91esvsd1
SHA256 7526ece772f73e29ef6e936297bd17b82346f084b2666bfa3a26709e4f328a4c
MD5 3a5e5da8ff06c8d566d0d0610c6f8356
SHA1 ca20518f4ca1fa4df5c23cb41f151a8e3836c3e5
SHA512 6c78d60511981df5327b3c49fe520cd49a6949012e7d33f47ce8b402b2a2c142bcb8d3a303d8915389c61f6caf395314943034348b31e304eba25253b4acb68f
SSDEEP 6144:D8/X14q//3V/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:D4iIm/NcZ7/N
TLSH
T1BE94746566342AE6EDEEABB9AC1249D881C1E4B114F1F13E6633DFDCC8E5D61CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eaceghcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eddnic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqfojblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaceghcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egbken32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgqgfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqikob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjeplijj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egbken32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekngemhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekngemhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjocbhbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eddnic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqfojblo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjocbhbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqikob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjeplijj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnffhgon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbdnne32.exe

Executes dropped EXE 16 IoCs

pid	Process
3596	Eaceghcg.exe
4976	Eddnic32.exe
908	Egbken32.exe
4092	Ekngemhd.exe
3364	Fjeplijj.exe
2088	Fjjjgh32.exe
4344	Fnffhgon.exe
2112	Fjmfmh32.exe
1440	Fbdnne32.exe
1592	Fqfojblo.exe
2340	Fcekfnkb.exe
960	Fgqgfl32.exe
5000	Fjocbhbo.exe
1868	Fbfkceca.exe
2948	Fqikob32.exe
2196	Gddgpqbe.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mkhpmopi.dll	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Fqikob32.exe	Fbfkceca.exe
File opened for modification	C:\Windows\SysWOW64\Eaceghcg.exe	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Egbken32.exe	Eddnic32.exe
File created	C:\Windows\SysWOW64\Kamonn32.dll	Egbken32.exe
File created	C:\Windows\SysWOW64\Fjjjgh32.exe	Fjeplijj.exe
File opened for modification	C:\Windows\SysWOW64\Fjjjgh32.exe	Fjeplijj.exe
File created	C:\Windows\SysWOW64\Hdeeipfp.dll	Fjeplijj.exe
File opened for modification	C:\Windows\SysWOW64\Gddgpqbe.exe	Fqikob32.exe
File created	C:\Windows\SysWOW64\Eddnic32.exe	Eaceghcg.exe
File opened for modification	C:\Windows\SysWOW64\Eddnic32.exe	Eaceghcg.exe
File created	C:\Windows\SysWOW64\Fbjbac32.dll	Eaceghcg.exe
File created	C:\Windows\SysWOW64\Eacdhhjj.dll	Ekngemhd.exe
File opened for modification	C:\Windows\SysWOW64\Fbdnne32.exe	Fjmfmh32.exe
File created	C:\Windows\SysWOW64\Fhgmqghl.dll	Fjmfmh32.exe
File opened for modification	C:\Windows\SysWOW64\Fcekfnkb.exe	Fqfojblo.exe
File created	C:\Windows\SysWOW64\Fpiedd32.dll	Fjocbhbo.exe
File created	C:\Windows\SysWOW64\Fjeplijj.exe	Ekngemhd.exe
File created	C:\Windows\SysWOW64\Fbdnne32.exe	Fjmfmh32.exe
File created	C:\Windows\SysWOW64\Fqfojblo.exe	Fbdnne32.exe
File opened for modification	C:\Windows\SysWOW64\Fqfojblo.exe	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Fjocbhbo.exe	Fgqgfl32.exe
File opened for modification	C:\Windows\SysWOW64\Fqikob32.exe	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Jcggmk32.dll	Fqikob32.exe
File created	C:\Windows\SysWOW64\Flpbbbdk.dll	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Ekngemhd.exe	Egbken32.exe
File created	C:\Windows\SysWOW64\Nnimkcjf.dll	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Fachkklb.dll	Fqfojblo.exe
File created	C:\Windows\SysWOW64\Fohoiloe.dll	Fgqgfl32.exe
File opened for modification	C:\Windows\SysWOW64\Fbfkceca.exe	Fjocbhbo.exe
File created	C:\Windows\SysWOW64\Kminigbj.dll	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Eaceghcg.exe	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Egbken32.exe	Eddnic32.exe
File created	C:\Windows\SysWOW64\Nhbjnc32.dll	Eddnic32.exe
File opened for modification	C:\Windows\SysWOW64\Fjmfmh32.exe	Fnffhgon.exe
File created	C:\Windows\SysWOW64\Ldicpljn.dll	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Fgqgfl32.exe	Fcekfnkb.exe
File opened for modification	C:\Windows\SysWOW64\Fgqgfl32.exe	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Fbfkceca.exe	Fjocbhbo.exe
File opened for modification	C:\Windows\SysWOW64\Fjeplijj.exe	Ekngemhd.exe
File created	C:\Windows\SysWOW64\Fjmfmh32.exe	Fnffhgon.exe
File created	C:\Windows\SysWOW64\Klfhhpnk.dll	Fnffhgon.exe
File opened for modification	C:\Windows\SysWOW64\Fjocbhbo.exe	Fgqgfl32.exe
File created	C:\Windows\SysWOW64\Gddgpqbe.exe	Fqikob32.exe
File opened for modification	C:\Windows\SysWOW64\Ekngemhd.exe	Egbken32.exe
File created	C:\Windows\SysWOW64\Fnffhgon.exe	Fjjjgh32.exe
File opened for modification	C:\Windows\SysWOW64\Fnffhgon.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Fcekfnkb.exe	Fqfojblo.exe

Program crash 1 IoCs

pid	pid_target	Process
1884	2196	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eaceghcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egbken32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekngemhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnffhgon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbfkceca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gddgpqbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjjjgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjmfmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcekfnkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eddnic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdnne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqfojblo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjocbhbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjeplijj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgqgfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqikob32.exe

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Egbken32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekngemhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eacdhhjj.dll"	Ekngemhd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klfhhpnk.dll"	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldicpljn.dll"	Fbdnne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqfojblo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eaceghcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnffhgon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjocbhbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kminigbj.dll"	Fbfkceca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flpbbbdk.dll"	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eddnic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnimkcjf.dll"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohoiloe.dll"	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcggmk32.dll"	Fqikob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjocbhbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqikob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eaceghcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkhpmopi.dll"	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpiedd32.dll"	Fjocbhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekngemhd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhgmqghl.dll"	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbdnne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhbjnc32.dll"	Eddnic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egbken32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kamonn32.dll"	Egbken32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdeeipfp.dll"	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqfojblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqikob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjbac32.dll"	Eaceghcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eddnic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fachkklb.dll"	Fqfojblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbfkceca.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 3596	3216	2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe	84
PID 3596 wrote to memory of 4976	3596	Eaceghcg.exe	85
PID 4976 wrote to memory of 908	4976	Eddnic32.exe	86
PID 908 wrote to memory of 4092	908	Egbken32.exe	87
PID 4092 wrote to memory of 3364	4092	Ekngemhd.exe	88
PID 3364 wrote to memory of 2088	3364	Fjeplijj.exe	90
PID 2088 wrote to memory of 4344	2088	Fjjjgh32.exe	91
PID 4344 wrote to memory of 2112	4344	Fnffhgon.exe	93
PID 2112 wrote to memory of 1440	2112	Fjmfmh32.exe	94
PID 1440 wrote to memory of 1592	1440	Fbdnne32.exe	95
PID 1592 wrote to memory of 2340	1592	Fqfojblo.exe	96
PID 2340 wrote to memory of 960	2340	Fcekfnkb.exe	97
PID 960 wrote to memory of 5000	960	Fgqgfl32.exe	98
PID 5000 wrote to memory of 1868	5000	Fjocbhbo.exe	99
PID 1868 wrote to memory of 2948	1868	Fbfkceca.exe	100
PID 2948 wrote to memory of 2196	2948	Fqikob32.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_3a5e5da8ff06c8d566d0d0610c6f8356_elex_wannacry.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\Eaceghcg.exe
  C:\Windows\system32\Eaceghcg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\Eddnic32.exe
    C:\Windows\system32\Eddnic32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\SysWOW64\Egbken32.exe
      C:\Windows\system32\Egbken32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:908
    - - C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4092
      - C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 400
        18⤵
        Program crash
        
        PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2196 -ip 2196
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eaceghcg.exe

Path C:\Windows\SysWOW64\Eaceghcg.exe
Size 429KB
SHA256 74c4e5d64806dab5b65121f9137887b8b5b479840de233a47a809a402571f42c
MD5 a30c3b42e22b3fdc25975c1e9ddc51dc
SHA1 a19a640375e51af073b97680f7430e7080600e7c
SHA512 d14979f898a33a7e824b8600778412d813f060642f78c7bc7bd0062f7c03718b5e639b2e339307f2493c91953515886407a638d578ef2640999cb0f733db4d94
SSDEEP 6144:vW+BFe/ayV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:e+Br/NcZ7/N
TLSH
T1579472256A301AEADDEE6BB5AC5249D88182E4B114F2F13E5633DFDDC8E4DA5CC04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eddnic32.exe

Path C:\Windows\SysWOW64\Eddnic32.exe
Size 429KB
SHA256 ca30fba9ab4ba27a02a54373fc2c39f20e97a831b463ef7190170c7ef18581ed
MD5 6e912e2b96363038e6651584d13c8635
SHA1 bf386b6209aa9bf4a257a3551c7ab3aaa13c1558
SHA512 81bbb1923a7ee478a8d770154e3d909a9078b6e78568b2c6884cb38c29c48afbd7846e502029a2fc6d77acceb5a57a7b526c17917e4b07e23a079181bedae5a4
SSDEEP 6144:jKz96OHpV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:OzC/NcZ7/N
TLSH
T1189460656A3019E6EDEEABB5EC1249D88181E5B118F1F13E6633DFECC8E4D61CC05B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egbken32.exe

Path C:\Windows\SysWOW64\Egbken32.exe
Size 429KB
SHA256 473da2ec05312f9c7fa968c6191ff199519d10b4479e9d17f652ec18edc5f34f
MD5 beaa92dcf0cac386c59255ace0ed2fc8
SHA1 26751da979e84dfa81ade88ec61e7e3737d8d888
SHA512 dbf77c8c28d58994f8a27b4b02c98d30424b451cb87755f8897f2c62c69951f0d3f5c1ea37417f654276feee9f75b60cdbedc9c56ca123acf931fb6d32919462
SSDEEP 6144:AYicRNCHvV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:mcRNv/NcZ7/N
TLSH
T171945076263419E6DDEE6BB5AC1289D89182E9B104F1F13F6633EFDCC8E4D61C844B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ekngemhd.exe

Path C:\Windows\SysWOW64\Ekngemhd.exe
Size 429KB
SHA256 160f8cbc00c81930a094d16123c422ed4a1bc0eb065a1845ffe3ae31cb0907c8
MD5 752e2ab16b7f6ae2236928ff434cd8f8
SHA1 19c406234f7d75b755aecf54dc5ac3cdc5c4f611
SHA512 b745bb56e4db7c561a64d31d899c255d993c082738766b5473d1bb9b3fb31c0960ca9fb1dbcd806a3c6e13b55375321b77d6e4f3558b2055e3bd88e306e25922
SSDEEP 6144:QYsi6B7wV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:QTiiV/NcZ7/N
TLSH
T1C9944E652A3019E6DDEE6BB5AC1249E88181E9F114F1F13E6663DFDDC8F4DA2CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbdnne32.exe

Path C:\Windows\SysWOW64\Fbdnne32.exe
Size 429KB
SHA256 d07f02ffe7b896e6914bdaae0e8c6c6b243dad22bf3c2443fee2583dcc0f9c9f
MD5 2669fb99311d7bee8f96ae5da1b794f0
SHA1 67320306bfb0b25785b90ed5f98d88e5491379ee
SHA512 2f88b16ea645df1e25eee1ea1cb456aebc690445447b306876b502978b961144c3cf0b9c2825f4ce9a8572295da3636bfd1178e4f651f958c7aaa55ec738878c
SSDEEP 6144:nEFUgV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:EFe/NcZ7/N
TLSH
T1919450656A3029E5DDEE6FB6AC1249D89181E4B114F1F13E6A33DFDCCAE4E61CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbfkceca.exe

Path C:\Windows\SysWOW64\Fbfkceca.exe
Size 429KB
SHA256 247e0d3f4326bab8d76193995c5b2d47b5d9287c42204a31262a0e6a6c36764c
MD5 cc28430c8a2bddcede3169b42941e72d
SHA1 4855665898a832170e04ab5c29b599eb128d4b7b
SHA512 4d66afc53207d148eb741c5d3d5970f773e5526ef6e06c8199fa171018e3c0a64896ad22e3ad20b8a101a1161526d239c4f73c96ac31558a8dd4758398789d3c
SSDEEP 6144:0V3EV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:0n/NcZ7/N
TLSH
T17A9471A5663019E6DDEEABB5AC1249E98181E5B114F1F13E6633DFDCC8F4DA2CC44B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcekfnkb.exe

Path C:\Windows\SysWOW64\Fcekfnkb.exe
Size 429KB
SHA256 1967a826adeabbf5c842df9c261dfd34e064596f7349631455faa98f9c08b81f
MD5 acb7e4472b2f8e5cbff6df247a57d374
SHA1 9db724b35d89851e7fe5f4b669bdd885cd75c184
SHA512 ff74998c6c8e3b4a5785fc2b7b452566d3f0f8846a99fd3df8ff413f09599fda07c2ac72b71bac4e0673faafc73424bbc210acfd3266bf9463de25f225fda466
SSDEEP 6144:+5y1dog22xV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:+5y1dog2l/NcZ7/N
TLSH
T18894836A663059E5EDEE6BB5AC1249D88189E9B214F1F13E6633DFDCC8E4D61CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fgqgfl32.exe

Path C:\Windows\SysWOW64\Fgqgfl32.exe
Size 429KB
SHA256 4f47b86a1ef6671f3f0861e2c84d488ab68c7650d961a318b132082b54594cca
MD5 953c95173b0ebd0a1f5c544316a0125f
SHA1 71686a5de91c2332ddd2994519a254a7dfc07b60
SHA512 e1e3fa6aba79aa270a0b7ceb1950d61504516569fb24a1550ebba9de43393379abeccb0e71e15e24dfb1415ed43a96e85b470b2a1508ee885e2a68fe2c8a2571
SSDEEP 6144:5AifT3o78nV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:5Ai07N/NcZ7/N
TLSH
T12F9481A92B301AE6DDEE6BB5AC5249E88081E5B114F1F13E6637DFDCD9E4D61CC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjeplijj.exe

Path C:\Windows\SysWOW64\Fjeplijj.exe
Size 429KB
SHA256 e40e7ca2e54df5dd1debe9ae20fd4b6027387099759fcde5fd572bacb9bd5d80
MD5 69cb3e6b21313121efd690089a2371af
SHA1 37e3872ee59266233501eb2c46bd591747afa4c5
SHA512 8d60bf0585f60751b0a00add2441c743d2fad8fd07cd5776c8c092a13eaa0a3620e9654f7770f0c6a6ac3de7d237043180c134d698245c47de0ed1e9d06918db
SSDEEP 6144:XwxolV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:Y/NcZ7/N
TLSH
T1F6945E252A3419E5DDEE6BF5AC5289D89181E4B124F1FA3E6623DFDCC8E4DB1CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjjjgh32.exe

Path C:\Windows\SysWOW64\Fjjjgh32.exe
Size 429KB
SHA256 2cff730d30e5bd9961ac83f4cfef72322da7de4c97e1b00a5f6f9045b0b1a32c
MD5 00b4c0c0d6e895e8754054a09d991469
SHA1 217668991e8c805cd41d05f7964fe421010de2d3
SHA512 33285e161eab27837b4e1372b8b188e2ebbf5ecac166e78aaf9b5992670f93e25cc4b998fe450b46e5c8674cd60d7ee9402eb19127cf78bbfa5005c84bd63d7f
SSDEEP 6144:UzXhEHTtIkTV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:UzXkI9/NcZ7/N
TLSH
T1E79481252A3019E9DDEE6BF1AC1249E89181E4B114F1F23E6637DFDCC9E4D69DC04B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjmfmh32.exe

Path C:\Windows\SysWOW64\Fjmfmh32.exe
Size 429KB
SHA256 0055f71aaa54c7eebe50eba4a59b45a549779080f67e058a4371415f4a6cc5cc
MD5 490ff5bf2e90ecac5c18c282f61c8a2a
SHA1 61f0a53b8ba353cd2a4fe5faac5540ef17cd1b1f
SHA512 d521ec86dd8d8538bbe0842f06a74caa90a72db3054e13652f133e1619933527f4b005107cdeef499b46f0576e06a419a609da8b06689f07d94b490070f9631d
SSDEEP 6144:pdGR+dV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:pQ1/NcZ7/N
TLSH
T15A9483A9263419E6DDEE6FB5AC1249D88181E5B115F1F13E6A33DFECC8E4D62CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjocbhbo.exe

Path C:\Windows\SysWOW64\Fjocbhbo.exe
Size 429KB
SHA256 2ea7b99f199d6e925020790f45950eef6e8e8dad248161196b7c92221855c906
MD5 d4197652bf502210695cbb027b6a59a3
SHA1 90220b17dfad696d2504de863a6b3baa6bb3e994
SHA512 23cc563ef42cbef25b90dc36f7c3b998d29fe918e9cd549018586aeff08bada938a6f581829d8351356f575ff9165514ca831a816b2e2ec593025dce68d2cba7
SSDEEP 6144:2+RfljoHXV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:2+R9l/NcZ7/N
TLSH
T17F9460652A3019E6DDEE6BB5AC1349E88181E9B114F1F13EA633DFDCC8E4E61DC44B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fnffhgon.exe

Path C:\Windows\SysWOW64\Fnffhgon.exe
Size 429KB
SHA256 133674415460e3949aebfe3e69959f9b43c0375d9ce1fd85debaced88b38f001
MD5 c3d64d191a784c59678d2ab70812e782
SHA1 e03dd4b2efb8f613b27b301dba38895e0785dc28
SHA512 9dd158ed0b3b4358699275adb4dd02610ffe188700388e69dbbbad7e339eb3dce9f5784b8f930b0a4336c198d53029b8ca9b317207bf3fbb630f8cef7d7a21de
SSDEEP 6144:ZpsQjOkV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:cME/NcZ7/N
TLSH
T1519462253A7429E6EEEE6BB5AD1249D88181E9B114F1F13E6633DFDCC8E4D61CC04B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fqfojblo.exe

Path C:\Windows\SysWOW64\Fqfojblo.exe
Size 429KB
SHA256 12ee201c22bd8c65c88afb07a911fbf7b26f045b240283175786d53bda947723
MD5 3c14cdb3149001e75ce1dcb01e3557ab
SHA1 952b9a6c488585d7e82a445558cfdd6b0743e547
SHA512 faaefa7aa33a8a80e1d7cda42eb549c70a27ef56c4848cdfafdfbdca39d81e66428008ca0bd487a45a3f4a1b108330aa7a9d27f3b18275f07a528c5b0196a747
SSDEEP 6144:EvsLEafV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:EGEb/NcZ7/N
TLSH
T100945F256A7019E6DDEE6BB5AC1249D89181E4B118F1F23E6633DFDCC8F5DA1CC84B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fqikob32.exe

Path C:\Windows\SysWOW64\Fqikob32.exe
Size 429KB
SHA256 3ffebd3ca0ddedef12bfc022f0f7ae972f475b27d638ae884130a4756a7c405d
MD5 5fce417f61dbafa2221c5f857d8aa2e6
SHA1 95bd94021dc27af6d2f734c2e9f6cfa580bf1ca3
SHA512 cfbc948712a4180c0f3508103d876903a114fe9e762ce6b12798aec5b22c9c6b6e67c2b3e313383974c79ccd6ed628f4d11be66faaedeaaa3ac63344780f2f84
SSDEEP 6144:ubyLV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:un/NcZ7/N
TLSH
T1DB9460252B3019E6DDEEAFB5AC1249D88181E5B114F1F13EA627DFECC9E4D69CC05B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gddgpqbe.exe

Path C:\Windows\SysWOW64\Gddgpqbe.exe
Size 429KB
SHA256 b4a1a9c7a06bd59233d46ac344c9c7538540c01b7b467344176b1a98e846da95
MD5 1f244a9057e2eb244f9d424b0b78a973
SHA1 22b93049d8d57332fc357468b4120b75795faa2e
SHA512 c45b9b0a0acf4abdb67606d18cea8f472a2f8e944b9c152fb1607b337a832b39575fa67e1d25254594ce27dc8a1027ec36fe5bb6a2c1a95182b0c94a02750b0a
SSDEEP 6144:q7o/NeeeeeNVV/Ah1G/AcQ///NR5fLYG3eujPQ///NR5f:q7UZ/NcZ7/N
TLSH
T1149491652A341DEADDEE6BB1AC5249E88581E4B204F1F13E6633DFDEC8E5D61DC04B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-29-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/908-157-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/960-139-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/960-101-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1440-78-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1440-145-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1592-85-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1592-143-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1868-135-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1868-117-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2088-151-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2088-48-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2112-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2112-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2196-129-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2196-131-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2340-93-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2340-141-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2948-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2948-125-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3216-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/3216-163-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3216-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3364-41-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3364-153-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3596-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3596-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4092-155-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4092-33-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4344-149-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4344-62-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4976-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4976-159-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5000-109-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5000-137-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads