berbew | a38f4a599cc1c4c3279da387decffd4c2b98a1de0afdc1aca33166d523c9e344

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Size 204KB
Sample261006-vhxe1abs21
SHA256 a38f4a599cc1c4c3279da387decffd4c2b98a1de0afdc1aca33166d523c9e344
MD5 471359712b54b6aecde24e84fe8d2b73
SHA1 ff3b1e2b587bdf29463aafdbcad2c3e56bf880a0
SHA512 98d678b05427300e2843310b5dd5e2705d3ee9b256df039c1e1547a66ad3177d6e17fb3e1b567196feb4f500fef70a67c4f592f04e5e024dfde0022bbee73787
SSDEEP 6144:zMtIwzwR2vCcIuTHsHZ2e4yXD6NTHsHZ:zMtIJR2acLIIbWoI
TLSH
T1E51415C111240D8DD31EB9F535ABF663ADF38E7702126E786E938102EE6B2E74CA1355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgejkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlkiaece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlkiaece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enpknplq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjaiac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cejjdlap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cejjdlap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dabhomea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbijinfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enpknplq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eangjkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eejcki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cghgpgqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djbbhafj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dndlba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dabhomea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnienqbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dehgejep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dehgejep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhfcae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjaiac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cghgpgqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgaiffii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eejcki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgejkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgaiffii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehhpge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfcae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eangjkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dndlba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnienqbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehhpge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djbbhafj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbijinfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe

Executes dropped EXE 18 IoCs

pid	Process
3352	Cjaiac32.exe
1516	Cgejkh32.exe
2132	Cejjdlap.exe
4924	Cghgpgqd.exe
4732	Dndlba32.exe
4180	Dabhomea.exe
1284	Dlkiaece.exe
2912	Dnienqbi.exe
3336	Dgaiffii.exe
224	Djbbhafj.exe
3120	Dbijinfl.exe
5088	Dehgejep.exe
4484	Dhfcae32.exe
1972	Enpknplq.exe
632	Eangjkkd.exe
4788	Eejcki32.exe
2772	Ehhpge32.exe
3800	Eldlhckj.exe

Drops file in System32 directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cgejkh32.exe	Cjaiac32.exe
File created	C:\Windows\SysWOW64\Dndlba32.exe	Cghgpgqd.exe
File created	C:\Windows\SysWOW64\Ppdpcn32.dll	Dabhomea.exe
File created	C:\Windows\SysWOW64\Djbbhafj.exe	Dgaiffii.exe
File opened for modification	C:\Windows\SysWOW64\Djbbhafj.exe	Dgaiffii.exe
File opened for modification	C:\Windows\SysWOW64\Cghgpgqd.exe	Cejjdlap.exe
File created	C:\Windows\SysWOW64\Dgaiffii.exe	Dnienqbi.exe
File created	C:\Windows\SysWOW64\Apjppniq.dll	Dbijinfl.exe
File created	C:\Windows\SysWOW64\Cjaiac32.exe	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
File created	C:\Windows\SysWOW64\Mbfggf32.dll	Cjaiac32.exe
File opened for modification	C:\Windows\SysWOW64\Cejjdlap.exe	Cgejkh32.exe
File created	C:\Windows\SysWOW64\Lkcancmc.dll	Cgejkh32.exe
File created	C:\Windows\SysWOW64\Clbcll32.dll	Dndlba32.exe
File created	C:\Windows\SysWOW64\Hceook32.dll	Dlkiaece.exe
File created	C:\Windows\SysWOW64\Dhfcae32.exe	Dehgejep.exe
File opened for modification	C:\Windows\SysWOW64\Eangjkkd.exe	Enpknplq.exe
File created	C:\Windows\SysWOW64\Cgejkh32.exe	Cjaiac32.exe
File created	C:\Windows\SysWOW64\Jibdpo32.dll	Cghgpgqd.exe
File opened for modification	C:\Windows\SysWOW64\Dgaiffii.exe	Dnienqbi.exe
File created	C:\Windows\SysWOW64\Neknbkci.dll	Dnienqbi.exe
File created	C:\Windows\SysWOW64\Nopkoobi.dll	Dgaiffii.exe
File opened for modification	C:\Windows\SysWOW64\Dbijinfl.exe	Djbbhafj.exe
File created	C:\Windows\SysWOW64\Enpknplq.exe	Dhfcae32.exe
File opened for modification	C:\Windows\SysWOW64\Enpknplq.exe	Dhfcae32.exe
File created	C:\Windows\SysWOW64\Dabhomea.exe	Dndlba32.exe
File opened for modification	C:\Windows\SysWOW64\Dabhomea.exe	Dndlba32.exe
File created	C:\Windows\SysWOW64\Mlkngglh.dll	Djbbhafj.exe
File created	C:\Windows\SysWOW64\Mmdcde32.dll	Dhfcae32.exe
File created	C:\Windows\SysWOW64\Eangjkkd.exe	Enpknplq.exe
File created	C:\Windows\SysWOW64\Eejcki32.exe	Eangjkkd.exe
File created	C:\Windows\SysWOW64\Lifmdfkg.dll	Eangjkkd.exe
File opened for modification	C:\Windows\SysWOW64\Cjaiac32.exe	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
File created	C:\Windows\SysWOW64\Dnienqbi.exe	Dlkiaece.exe
File opened for modification	C:\Windows\SysWOW64\Dhfcae32.exe	Dehgejep.exe
File opened for modification	C:\Windows\SysWOW64\Eejcki32.exe	Eangjkkd.exe
File created	C:\Windows\SysWOW64\Ehhpge32.exe	Eejcki32.exe
File created	C:\Windows\SysWOW64\Bjnlnaiq.dll	Eejcki32.exe
File opened for modification	C:\Windows\SysWOW64\Eldlhckj.exe	Ehhpge32.exe
File created	C:\Windows\SysWOW64\Apleaenp.dll	Ehhpge32.exe
File opened for modification	C:\Windows\SysWOW64\Dndlba32.exe	Cghgpgqd.exe
File created	C:\Windows\SysWOW64\Cghgpgqd.exe	Cejjdlap.exe
File created	C:\Windows\SysWOW64\Dlkiaece.exe	Dabhomea.exe
File created	C:\Windows\SysWOW64\Dehgejep.exe	Dbijinfl.exe
File opened for modification	C:\Windows\SysWOW64\Dehgejep.exe	Dbijinfl.exe
File opened for modification	C:\Windows\SysWOW64\Ehhpge32.exe	Eejcki32.exe
File created	C:\Windows\SysWOW64\Eldlhckj.exe	Ehhpge32.exe
File created	C:\Windows\SysWOW64\Cejjdlap.exe	Cgejkh32.exe
File created	C:\Windows\SysWOW64\Miagbi32.dll	Cejjdlap.exe
File opened for modification	C:\Windows\SysWOW64\Dlkiaece.exe	Dabhomea.exe
File opened for modification	C:\Windows\SysWOW64\Dnienqbi.exe	Dlkiaece.exe
File created	C:\Windows\SysWOW64\Dbijinfl.exe	Djbbhafj.exe
File created	C:\Windows\SysWOW64\Momael32.dll	Dehgejep.exe
File created	C:\Windows\SysWOW64\Foaeccgp.dll	Enpknplq.exe
File created	C:\Windows\SysWOW64\Jnbecgdc.dll	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe

Program crash 1 IoCs

pid	pid_target	Process
716	3800	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgaiffii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dehgejep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eejcki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehhpge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eangjkkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eldlhckj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjaiac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgejkh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cejjdlap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dabhomea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnienqbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfcae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cghgpgqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dndlba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djbbhafj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbijinfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enpknplq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlkiaece.exe

Modifies registry class 57 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cejjdlap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neknbkci.dll"	Dnienqbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eejcki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehhpge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dabhomea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnienqbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgaiffii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cghgpgqd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enpknplq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eejcki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dabhomea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhfcae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eangjkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgejkh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlkiaece.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjaiac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbijinfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dehgejep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cghgpgqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nopkoobi.dll"	Dgaiffii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djbbhafj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cejjdlap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dndlba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlkngglh.dll"	Djbbhafj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbijinfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Momael32.dll"	Dehgejep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enpknplq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjnlnaiq.dll"	Eejcki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehhpge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbfggf32.dll"	Cjaiac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnienqbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifmdfkg.dll"	Eangjkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apleaenp.dll"	Ehhpge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkcancmc.dll"	Cgejkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jibdpo32.dll"	Cghgpgqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clbcll32.dll"	Dndlba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmdcde32.dll"	Dhfcae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhfcae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjaiac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppdpcn32.dll"	Dabhomea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlkiaece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgaiffii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dehgejep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnbecgdc.dll"	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apjppniq.dll"	Dbijinfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgejkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miagbi32.dll"	Cejjdlap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hceook32.dll"	Dlkiaece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dndlba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djbbhafj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foaeccgp.dll"	Enpknplq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eangjkkd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 3352	4880	jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe	86
PID 3352 wrote to memory of 1516	3352	Cjaiac32.exe	87
PID 1516 wrote to memory of 2132	1516	Cgejkh32.exe	88
PID 2132 wrote to memory of 4924	2132	Cejjdlap.exe	89
PID 4924 wrote to memory of 4732	4924	Cghgpgqd.exe	90
PID 4732 wrote to memory of 4180	4732	Dndlba32.exe	91
PID 4180 wrote to memory of 1284	4180	Dabhomea.exe	94
PID 1284 wrote to memory of 2912	1284	Dlkiaece.exe	95
PID 2912 wrote to memory of 3336	2912	Dnienqbi.exe	96
PID 3336 wrote to memory of 224	3336	Dgaiffii.exe	98
PID 224 wrote to memory of 3120	224	Djbbhafj.exe	99
PID 3120 wrote to memory of 5088	3120	Dbijinfl.exe	100
PID 5088 wrote to memory of 4484	5088	Dehgejep.exe	101
PID 4484 wrote to memory of 1972	4484	Dhfcae32.exe	102
PID 1972 wrote to memory of 632	1972	Enpknplq.exe	103
PID 632 wrote to memory of 4788	632	Eangjkkd.exe	104
PID 4788 wrote to memory of 2772	4788	Eejcki32.exe	105
PID 2772 wrote to memory of 3800	2772	Ehhpge32.exe	106

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\Cjaiac32.exe
  C:\Windows\system32\Cjaiac32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\Cgejkh32.exe
    C:\Windows\system32\Cgejkh32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\SysWOW64\Cejjdlap.exe
      C:\Windows\system32\Cejjdlap.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\Windows\SysWOW64\Cghgpgqd.exe
        
        C:\Windows\system32\Cghgpgqd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
      - C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Dabhomea.exe
        
        C:\Windows\system32\Dabhomea.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Dlkiaece.exe
        
        C:\Windows\system32\Dlkiaece.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\Dgaiffii.exe
        
        C:\Windows\system32\Dgaiffii.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Djbbhafj.exe
        
        C:\Windows\system32\Djbbhafj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\Dbijinfl.exe
        
        C:\Windows\system32\Dbijinfl.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SysWOW64\Eangjkkd.exe
        
        C:\Windows\system32\Eangjkkd.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:632
        
        C:\Windows\SysWOW64\Eejcki32.exe
        
        C:\Windows\system32\Eejcki32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\Ehhpge32.exe
        
        C:\Windows\system32\Ehhpge32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 400
        20⤵
        Program crash
        
        PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3800 -ip 3800
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cejjdlap.exe

Path C:\Windows\SysWOW64\Cejjdlap.exe
Size 204KB
SHA256 b55d269aee4ae2c9cdfe2f7f4df5ce24b6d3593db6d21cb6fd584035f8b5179e
MD5 8dbc2ba9f7bc5c34f34d12ca757b7441
SHA1 43d4bb5645157555abcaea35a4ee8b95212affd7
SHA512 9ec208e14fb918e05a04cb11477a629c88a2bb0db7b9996922e9686797574b2f27ea003d963e84992387c0def496dee9140bd3f49c1e6b09842a73e8c035f5e1
SSDEEP 3072:W6ZHoBtRhFvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:W8HoBtRhqTHsHZ2e4yXD6NTHsHZ
TLSH
T15C1448D145601C91DF1EBAF439A7E766BDF04E5E03024EA3AE8181C0EE6B2E76C60F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cgejkh32.exe

Path C:\Windows\SysWOW64\Cgejkh32.exe
Size 204KB
SHA256 977134d5fc47f6f560f619f8130f0f51ce7ee9438411b940384f8c72fce66bee
MD5 313351cf405c2b21f9a5cad37494cf36
SHA1 1b20fabc8a8c4e295d82d72b7c63a9c2127e2eba
SHA512 cb17469227852e07642b96a3f201cf9a97a9cb0f0fb8f5a9e806a2ba586d76e47d2ba79fbb2633fcbde6083a7bfc698c44b2863401eb63c91fe538d4c68243fb
SSDEEP 3072:wRmafM9K/cdy3Kw3TX7Kf3zUg0vcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:wRhadTHsHZ2e4yXD6NTHsHZ
TLSH
T1411415D10D230C93D21ABAF539E7E2E2BDF05E7603324E91BA449115EE6B3EB5C60395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cghgpgqd.exe

Path C:\Windows\SysWOW64\Cghgpgqd.exe
Size 204KB
SHA256 75a60edb2c879d68de9973f2cce2f65b19185350dd635e00f4c752bf246952c8
MD5 40692d9e4843d44a76eea894bd76e889
SHA1 a19aa166f85a5846d7268e00cfc606093f9be7db
SHA512 1aca2a6f1e0a0819cf59297ce001bdf1127ccab20936cf3585484fba54a012cf9b01083d910caa073a69fa308ec32978512303ce2008fccad359dfefcf62d738
SSDEEP 3072:2u8cAYNAz/BblHvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:2u8AIzETHsHZ2e4yXD6NTHsHZ
TLSH
T10A1426D1006C2DB1F20AF9F53DA7E6A2BDF14E5606D10E606E408534EE6B3E75CA93E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cjaiac32.exe

Path C:\Windows\SysWOW64\Cjaiac32.exe
Size 204KB
SHA256 43fa839a7ac4b819602ce6334a9d5ff36cabf70b01c7a162188abce428cf0b33
MD5 60f9451af8e764cf73b13f746e03444c
SHA1 d016e08aaf6c999ce78e7b1303b9890ed14f3e2b
SHA512 5e4207888c45de5b9c1f486a2de8dfeff8358e00c8011980acccf8cc0d8fbd171d46c738bfb4f00532aab086decdf714bf0cf07f75e20aafcc00f347d9086f2f
SSDEEP 3072:Pt2KJeMOMC/DYvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:PYK0YkJTHsHZ2e4yXD6NTHsHZ
TLSH
T10F1429C101610DB2E31AF9F574A7E6A6BDF19F4623224E506E814310EF6BFE79C6035A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dabhomea.exe

Path C:\Windows\SysWOW64\Dabhomea.exe
Size 204KB
SHA256 a924941f084ffc910ef681056fa194047f534802e2c55da225b5f26bdedf3ac8
MD5 a28350b132958e94fc5c2423a6307088
SHA1 6354adc864fd2198f23631d45f085cee7dfbc96a
SHA512 cbfbd456406efb7e5da7802bc06d4c5e78a89e772672d37bf866d77d6b73bf43d9717c1a6f62856283546596d8212f98419c1365d39c4a93518cb05f22c335fd
SSDEEP 3072:QYKqIHK2CMp3NdUpvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:QYKjHK2bddUWTHsHZ2e4yXD6NTHsHZ
TLSH
T1BF1406CD006C0C86D30BB9F637ABD26E6DF14F4A06516E50AE508517EF6BAE35EA03D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbijinfl.exe

Path C:\Windows\SysWOW64\Dbijinfl.exe
Size 204KB
SHA256 56c1f20404a7b3ae7b38216441961ee0fd7a56ba503dfb75bdc0bc8e88de82ec
MD5 85c6ad536d9396ac2286b283ec6dc0fe
SHA1 47bb7e966473f69cb814c3ac553745238f07a4f8
SHA512 308d85d1356848d4cbc872c099f463bfe4a53027887c9b9a5c6c25df4be8c7ece032c2a12b7a5698eccfa823bb080c625908b1341ffa096e42429e1519c670ff
SSDEEP 6144:UpfwTc+9H7miQxO288TTHsHZ2e4yXD6NTHsHZ:UpfwBHQRIIbWoI
TLSH
T1FB1427C505650D91D31EBAF835A7E2A2BEF08E5702114EE0AF518110EE6B3E7BC693DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dehgejep.exe

Path C:\Windows\SysWOW64\Dehgejep.exe
Size 204KB
SHA256 80565b9f44b7393db621c0d3043ed03a2345c063bb6394f60b54eede9a202199
MD5 00b03934207eb476eaf59a36bb240ee5
SHA1 894e517b372f14b7ecaddc9a65be3e703a52aa2f
SHA512 202eeab838952c1943bd3bf88331a03ad7006e615d96708457b028900273767faac98e2f212171019e43a95b80bc4b6cf43f20f5f26f299e247195c06ffd25d2
SSDEEP 6144:TkdZzQVieHIbM3kOTHsHZ2e4yXD6NTHsHZ:TkCig5IIbWoI
TLSH
T1421427D500650E81E21ABAF437F7E662BDF14E8603114E747A44C171EEAB3E79CA13E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dgaiffii.exe

Path C:\Windows\SysWOW64\Dgaiffii.exe
Size 204KB
SHA256 81d0f79e39e1d306e2cf46160976d6709152e556f2a55daba63116da76d49f2b
MD5 6228eef803752e7365f932264ac0c516
SHA1 ba8bea7238b241fe54b68a402ae71204d6966650
SHA512 15cf10c33e2b2d54bf793f5adc8002e038e56bc2dd190221203c2e09c7bc29a336e6db130b5fde9e01062cc0a9caaa169f214904b8b2172f499bc8e1c6d91f7b
SSDEEP 3072:WA0OrFj4XVJNcNvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:YOrF0VkyTHsHZ2e4yXD6NTHsHZ
TLSH
T1AF1427C5012D4C91F22ABAF579A7F265BDFD4E4627024E686E41C203EF6B2EF5CA0311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dhfcae32.exe

Path C:\Windows\SysWOW64\Dhfcae32.exe
Size 204KB
SHA256 c8024660c294d9252d3c25ed533d126cf4ed54f769e4d251c7ccbfb9c0447dc0
MD5 7e1d7d504af1302baea4caac242befb1
SHA1 128e40e47c058f74885c54d9cd4c784e038bafd8
SHA512 49547a4b49443f774243ff7f48d2dab7d15064d1563d1f506c8139b81393095531f35641e34aaecfd1ce96ccaeff93baf1a0c404cd269bc12535092b08e25b44
SSDEEP 6144:ZIrQ3B7CuS6ak/THsHZ2e4yXD6NTHsHZ:ZgeawIIbWoI
TLSH
T13014F5D5C6640C81D21AB9FC3CA7D662AFF1CE5A03014E50AA82D174EE6B2E75CE3357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Djbbhafj.exe

Path C:\Windows\SysWOW64\Djbbhafj.exe
Size 204KB
SHA256 f8eae9179eb97160a745430bb42dec514878b79ef1f20a3ab429c2e8266aa6e5
MD5 61eecdaf9003e5276d1a8af0c3187377
SHA1 85a99cf7308ed5ddc34246e5d645e79b2ff615e5
SHA512 f28a150ffa6af4e235f302883de81939687c4c817c0bdc4eb23ea15d84592f3318a92bbd13458669631ab94f3d8275bd8829415047488e158b03f96e51183800
SSDEEP 3072:DdKxAQTso6R3bWtvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:Ix3sBRqSTHsHZ2e4yXD6NTHsHZ
TLSH
T1971438D104640DD1D30ABAF939ABD2B6BFF18E5A02314EA0AE449170FF6B3E75DA0355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dlkiaece.exe

Path C:\Windows\SysWOW64\Dlkiaece.exe
Size 204KB
SHA256 372908eb55527c96084000ae37b71afd5a5ab4b654045eb0dbfa9681f75f5c1f
MD5 582ff89e3d41114b4dbbc342d78e526a
SHA1 6f98dab6560773a484282ff6564b92c5b624b865
SHA512 17938e5492d0d6710b332a54cc6989ac9ac232b79dfe7ddbcf9bca2546a0fb01c9796a24de184b7cffb9b3fd242ba0ec4272f19436979583fe4a9e854166e830
SSDEEP 3072:nvxfGvmzozul6vcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:nZfGvm0+DTHsHZ2e4yXD6NTHsHZ
TLSH
T11E1415ED43600D99DB0AB9F4F8ABD6A6BFF94E4502094E50AE408110EF6B2E75C733D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dndlba32.exe

Path C:\Windows\SysWOW64\Dndlba32.exe
Size 204KB
SHA256 c2c38b01d3879e27edbe38ddd44728af8e6bd97151285261a69170eb79c86748
MD5 abcd53b2375d20b5395358f2371634ce
SHA1 86ea803056ee33f8e177f92414ab08ca3de34317
SHA512 6ee8979a5cee6ded8a9354e79e546a994408868e5feb00260e42ebf48cecc092e46ccc231dd4cc1456c734b435d61758208ca7749379722298785652667d62ae
SSDEEP 3072:WqAXpWDtJvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:WO2THsHZ2e4yXD6NTHsHZ
TLSH
T1651406C1452C0DC1D21ABAF5B4BBE2A3BDF15E7A07116E606E90C007EE6B2EF5C69315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dnienqbi.exe

Path C:\Windows\SysWOW64\Dnienqbi.exe
Size 204KB
SHA256 c43b44d4e2a7d9fde4bb76a4974616774b701b4f041a9e48f2f9da92b2012f03
MD5 4a4e656c4bf32d0c12804092ca971df6
SHA1 597c12c9819bbf50226eb234ed5c8973685e6116
SHA512 01232bbd7e180af8f1f24229b14ad1922eb013a11688459f0fc3806d2102c3c6114aea30e087405ee28e2dcc7815e3cb1ff2284db29d7b838bea136c4b6738c5
SSDEEP 3072:f5BP1aGct0FrGgvaIeqvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:fT1krgvaIeTTHsHZ2e4yXD6NTHsHZ
TLSH
T18D14F4E200250C99D21AB9F535A7F6F3BDF05E5F06528E60EA508140EE3B2E75CAD36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eangjkkd.exe

Path C:\Windows\SysWOW64\Eangjkkd.exe
Size 204KB
SHA256 b3af644e3657e767aec131dd284f1b7c79616490b400eeb0da2a0969f9accc92
MD5 4a8ea750989852176f134ffce97a1735
SHA1 0d75dba8afa9a07e2636f292f0dcb8c0bea714cd
SHA512 88077aaebf89ed29d9903515b996e5ac4804fc4c55865224a42a80bf2d0d928910ffc4cd702f4089c59397a41f6ac8dc3a23e6235ac2dc3a7fc9aa5b8138338c
SSDEEP 6144:eYXKjdcvun45i61HTHsHZ2e4yXD6NTHsHZ:eYXKjiv40IIbWoI
TLSH
T1441416F144644CC1E21AB9F438AFE666BDFF5E4723924FA06A704100EF6B2E76C61365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eejcki32.exe

Path C:\Windows\SysWOW64\Eejcki32.exe
Size 204KB
SHA256 6655f39cc311f09e6ae0de9491e8a32e158567c59dc5347a62406935a8e9cf00
MD5 f232f5cf0b5507cf981ded1ffca773d3
SHA1 60e4b2c32c33137377936c954fc369d4a42fda88
SHA512 e4f1e7b1a9c8f706d2ee23edeab1f85c8f350c6cc07b5ece25d777f2705560457a45f4aebb2765babd147470d67994d113549be47b68fa8839f7e4ab86601b87
SSDEEP 3072:nngyQ3UMDVQx3cvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:nnglNAFTHsHZ2e4yXD6NTHsHZ
TLSH
T1381428C505A41D91E31AFAF435ABEAA3FDF17E5A03114EA0AD414100EEEB3E7BCA1355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ehhpge32.exe

Path C:\Windows\SysWOW64\Ehhpge32.exe
Size 204KB
SHA256 1a74c9e68bec87847de3dd5ffb5690741dcd42efaf2b00f30075121c511d1e16
MD5 16a0ebe1c785e2f269df29b369cae4d5
SHA1 b8d335d27fdb96ad82248abc743847e13fa50c6a
SHA512 02a8a60ec1014b4e502ecaff676d2da99cd2850d67a985c3ece19696f704f74151fc10f7ee5fa1a302de4301e7ca3f39966152c5d68e4a8323465f3adf8f0660
SSDEEP 3072:PZhSd7YfjIDvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:P/Sd7YbIYTHsHZ2e4yXD6NTHsHZ
TLSH
T1871405D500250CD3E31ABAF5F8B7D662ADF24F4A8A128EA66E504140EF6B3D75CB3351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eldlhckj.exe

Path C:\Windows\SysWOW64\Eldlhckj.exe
Size 204KB
SHA256 9815196337398764bcf945c329427f62b43e85df26313cb6b86a3e0d8e7e8463
MD5 31b034ab702a422bdeaed5598a36e4fd
SHA1 fe6e7a217099c866b1634eea889d2d3e7bc83e00
SHA512 7ed99df20d1d759f52de247e413a59982dabbbb7e3ad4c8ff674ac946be1d3bd1e2733cb07a47cff64e0bd93c9a1802754be959dfe34775e3c24c08a3a276fd3
SSDEEP 3072:cwLOaYXj7DZJ6vcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:cwLY7DZJDTHsHZ2e4yXD6NTHsHZ
TLSH
T1561417C101230CB1E20EBAF53DA7D665ADF19E5B0E156E6C6A70814CEE6B2E75CE0353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enpknplq.exe

Path C:\Windows\SysWOW64\Enpknplq.exe
Size 204KB
SHA256 83fda5547fd4727c12a90eb451a7bd8ffd6b13f859854d25476a4b4dd8a3bb37
MD5 e3395cb8355a9bbf141f438d7b3394a5
SHA1 644117f365919ad7b3d799296412066c2c39f3f1
SHA512 86310e6659613b4db50100f30a3fe57b0112af0940d0739face59da17071d9177f6b97192094bbd2269e808a434f079637c0568197a0cfc4dd5fff5f593db9eb
SSDEEP 3072:HJaIkpNzbf0wcXxwmfNvcTy8/9mHH52GxfAyXDEG7nwEvcTy8/9mHH5:Lef0hVfyTHsHZ2e4yXD6NTHsHZ
TLSH
T1DD1407C101640CB2F23AF9F47CA7F266ADF17E1682194E64BE504192EE672E7CCA3355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-79-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/224-155-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/632-125-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1284-157-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1284-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1516-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1516-168-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1972-117-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2132-166-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2132-24-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2772-141-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2912-68-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3120-93-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3336-160-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3336-72-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3352-7-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3352-170-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3800-144-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4180-48-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4180-162-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4484-109-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4732-45-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4788-147-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4788-128-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4880-172-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4880-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4924-165-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4924-32-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5088-101-0x0000000000400000-0x0000000000431000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads