Analysis
-
max time kernel
146s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 18:17
Static task
static1
Behavioral task
behavioral1
Sample
04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe
Resource
win10v2004-20240611-en
General
-
Target
04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe
-
Size
163KB
-
MD5
120c0771acd947f0bb4a6d5e83ca1e77
-
SHA1
f0a0763a3824eaf194dcb282584091900b45f912
-
SHA256
04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca
-
SHA512
9a6e6c71ed436cf8e39631de24a94e37f116aa49f8e78c7c6462ae3d3e0af70fb622ce402b4a6d3cc6d15a56078e2259b32ea7a9942b7489259ce692d35cd3c3
-
SSDEEP
1536:PIR31rQAe88bONnrDSeMlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:k3ZzwONnrDBMltOrWKDBr+yJb
Malware Config
Extracted
gozi
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Qhkipdeb.exeBabbng32.exeEaphjp32.exeAoaill32.exeGnmifk32.exeJpajbl32.exePlndcmmj.exePkdgpo32.exeCkmnbg32.exeMdgmbhgh.exeLdjpbign.exeImjkpb32.exeNipefmkb.exeNcmfqkdj.exeGldmoepi.exeEpbpbnan.exeJqgoiokm.exeMdepmh32.exeHhogaamj.exeHkogpn32.exeEheglk32.exeEbqngb32.exeAqjdgmgd.exeMndmoaog.exeGbqbaofc.exeDafoikjb.exePkfghh32.exeMnbpjb32.exeBddbjhlp.exeLepclldc.exeHdecea32.exeLkmldbcj.exeKlhbdclg.exeFeddombd.exeFolhgbid.exeMeffjjln.exeDddfdejn.exePpcbgkka.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qhkipdeb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Babbng32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eaphjp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aoaill32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnmifk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jpajbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aoaill32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Plndcmmj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkdgpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckmnbg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdgmbhgh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldjpbign.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imjkpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nipefmkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncmfqkdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gldmoepi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Epbpbnan.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jqgoiokm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mdepmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhogaamj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkogpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eheglk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebqngb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqjdgmgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mndmoaog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbqbaofc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dafoikjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkfghh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnbpjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bddbjhlp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lepclldc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdecea32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkmldbcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klhbdclg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Feddombd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Folhgbid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Meffjjln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dddfdejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dafoikjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppcbgkka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" -
Detects executables built or packed with MPress PE compressor 64 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\Ieidmbcc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Idnaoohk.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Jqgoiokm.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Jqilooij.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jdgdempa.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jmbiipml.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Jfknbe32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kbbngf32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Kkjcplpa.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Kfpgmdog.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kfbcbd32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Knmhgf32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Kkaiqk32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Leimip32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Lmebnb32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Lfmffhde.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Llohjo32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Meijhc32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Modkfi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mofglh32.exe INDICATOR_EXE_Packed_MPress behavioral1/memory/2796-308-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mmldme32.exe INDICATOR_EXE_Packed_MPress behavioral1/memory/2920-320-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nmpnhdfc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ocfigjlp.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ohendqhd.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Oopfakpa.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pkidlk32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Onecbg32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pjpnbg32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pkdgpo32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pcibkm32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pnimnfpc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ogkkfmml.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Oomjlk32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Oebimf32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pbnoliap.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ocdmaj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Afnagk32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bajomhbl.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bjbcfn32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bbikgk32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bhfcpb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bmclhi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bdmddc32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bkglameg.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bmeimhdj.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Chkmkacq.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cilibi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cdanpb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cgpjlnhh.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cmjbhh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ciqcmiei.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cgdcgm32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cejphiik.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dldhdc32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dhkiid32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dngabk32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Deojci32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dahgni32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dkpkfooh.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dpmdofno.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ddhpod32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Efjlgmlf.exe INDICATOR_EXE_Packed_MPress -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\Ieidmbcc.exe UPX C:\Windows\SysWOW64\Idnaoohk.exe UPX \Windows\SysWOW64\Jqgoiokm.exe UPX \Windows\SysWOW64\Jqilooij.exe UPX C:\Windows\SysWOW64\Jdgdempa.exe UPX C:\Windows\SysWOW64\Jmbiipml.exe UPX \Windows\SysWOW64\Jfknbe32.exe UPX C:\Windows\SysWOW64\Kbbngf32.exe UPX \Windows\SysWOW64\Kkjcplpa.exe UPX \Windows\SysWOW64\Kfpgmdog.exe UPX C:\Windows\SysWOW64\Kfbcbd32.exe UPX \Windows\SysWOW64\Knmhgf32.exe UPX \Windows\SysWOW64\Kkaiqk32.exe UPX C:\Windows\SysWOW64\Leimip32.exe UPX \Windows\SysWOW64\Lmebnb32.exe UPX \Windows\SysWOW64\Lfmffhde.exe UPX C:\Windows\SysWOW64\Llohjo32.exe UPX C:\Windows\SysWOW64\Meijhc32.exe UPX C:\Windows\SysWOW64\Modkfi32.exe UPX C:\Windows\SysWOW64\Mofglh32.exe UPX behavioral1/memory/2796-308-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Mmldme32.exe UPX behavioral1/memory/2920-320-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Nmpnhdfc.exe UPX C:\Windows\SysWOW64\Ocfigjlp.exe UPX C:\Windows\SysWOW64\Ohendqhd.exe UPX C:\Windows\SysWOW64\Oopfakpa.exe UPX C:\Windows\SysWOW64\Pkidlk32.exe UPX C:\Windows\SysWOW64\Onecbg32.exe UPX C:\Windows\SysWOW64\Pjpnbg32.exe UPX C:\Windows\SysWOW64\Pkdgpo32.exe UPX C:\Windows\SysWOW64\Pcibkm32.exe UPX C:\Windows\SysWOW64\Pnimnfpc.exe UPX C:\Windows\SysWOW64\Ogkkfmml.exe UPX C:\Windows\SysWOW64\Oomjlk32.exe UPX C:\Windows\SysWOW64\Oebimf32.exe UPX C:\Windows\SysWOW64\Pbnoliap.exe UPX C:\Windows\SysWOW64\Ocdmaj32.exe UPX C:\Windows\SysWOW64\Afnagk32.exe UPX C:\Windows\SysWOW64\Bajomhbl.exe UPX C:\Windows\SysWOW64\Bjbcfn32.exe UPX C:\Windows\SysWOW64\Bbikgk32.exe UPX C:\Windows\SysWOW64\Bhfcpb32.exe UPX C:\Windows\SysWOW64\Bmclhi32.exe UPX C:\Windows\SysWOW64\Bdmddc32.exe UPX C:\Windows\SysWOW64\Bkglameg.exe UPX C:\Windows\SysWOW64\Bmeimhdj.exe UPX C:\Windows\SysWOW64\Chkmkacq.exe UPX C:\Windows\SysWOW64\Cilibi32.exe UPX C:\Windows\SysWOW64\Cdanpb32.exe UPX C:\Windows\SysWOW64\Cgpjlnhh.exe UPX C:\Windows\SysWOW64\Cmjbhh32.exe UPX C:\Windows\SysWOW64\Ciqcmiei.exe UPX C:\Windows\SysWOW64\Cgdcgm32.exe UPX C:\Windows\SysWOW64\Cejphiik.exe UPX C:\Windows\SysWOW64\Dldhdc32.exe UPX C:\Windows\SysWOW64\Dhkiid32.exe UPX C:\Windows\SysWOW64\Dngabk32.exe UPX C:\Windows\SysWOW64\Deojci32.exe UPX C:\Windows\SysWOW64\Dahgni32.exe UPX C:\Windows\SysWOW64\Dkpkfooh.exe UPX C:\Windows\SysWOW64\Dpmdofno.exe UPX C:\Windows\SysWOW64\Ddhpod32.exe UPX C:\Windows\SysWOW64\Efjlgmlf.exe UPX -
Executes dropped EXE 64 IoCs
Processes:
Ieidmbcc.exeIdnaoohk.exeJqgoiokm.exeJqilooij.exeJdgdempa.exeJmbiipml.exeJfknbe32.exeKbbngf32.exeKkjcplpa.exeKfpgmdog.exeKfbcbd32.exeKnmhgf32.exeKkaiqk32.exeLeimip32.exeLmebnb32.exeLfmffhde.exeLgmcqkkh.exeLphhenhc.exeLlohjo32.exeLegmbd32.exeMeijhc32.exeMbmjah32.exeModkfi32.exeMofglh32.exeMmldme32.exeNgdifkpi.exeNckjkl32.exeNmpnhdfc.exeNcmfqkdj.exeNodgel32.exeNhllob32.exeNofdklgl.exeNilhhdga.exeOcdmaj32.exeOebimf32.exeOcfigjlp.exeOomjlk32.exeOhendqhd.exeOopfakpa.exeOgkkfmml.exeOnecbg32.exePkidlk32.exePnimnfpc.exePjpnbg32.exePcibkm32.exePkdgpo32.exePbnoliap.exeAfnagk32.exeBajomhbl.exeBjbcfn32.exeBbikgk32.exeBhfcpb32.exeBmclhi32.exeBdmddc32.exeBkglameg.exeBmeimhdj.exeChkmkacq.exeCilibi32.exeCdanpb32.exeCgpjlnhh.exeCmjbhh32.exeCddjebgb.exeCiqcmiei.exeCpkkjc32.exepid process 3024 Ieidmbcc.exe 2756 Idnaoohk.exe 2764 Jqgoiokm.exe 2280 Jqilooij.exe 2532 Jdgdempa.exe 2168 Jmbiipml.exe 264 Jfknbe32.exe 2728 Kbbngf32.exe 2932 Kkjcplpa.exe 1656 Kfpgmdog.exe 2024 Kfbcbd32.exe 876 Knmhgf32.exe 1616 Kkaiqk32.exe 1684 Leimip32.exe 1980 Lmebnb32.exe 1544 Lfmffhde.exe 912 Lgmcqkkh.exe 436 Lphhenhc.exe 1160 Llohjo32.exe 1672 Legmbd32.exe 1316 Meijhc32.exe 1940 Mbmjah32.exe 2844 Modkfi32.exe 2796 Mofglh32.exe 2920 Mmldme32.exe 1664 Ngdifkpi.exe 2220 Nckjkl32.exe 2612 Nmpnhdfc.exe 2712 Ncmfqkdj.exe 2656 Nodgel32.exe 2636 Nhllob32.exe 2448 Nofdklgl.exe 2736 Nilhhdga.exe 2564 Ocdmaj32.exe 2952 Oebimf32.exe 1036 Ocfigjlp.exe 2412 Oomjlk32.exe 752 Ohendqhd.exe 936 Oopfakpa.exe 1644 Ogkkfmml.exe 1264 Onecbg32.exe 3016 Pkidlk32.exe 1208 Pnimnfpc.exe 3000 Pjpnbg32.exe 592 Pcibkm32.exe 952 Pkdgpo32.exe 984 Pbnoliap.exe 1244 Afnagk32.exe 1864 Bajomhbl.exe 1536 Bjbcfn32.exe 1932 Bbikgk32.exe 2428 Bhfcpb32.exe 884 Bmclhi32.exe 2840 Bdmddc32.exe 636 Bkglameg.exe 2864 Bmeimhdj.exe 2968 Chkmkacq.exe 1660 Cilibi32.exe 1052 Cdanpb32.exe 1992 Cgpjlnhh.exe 2008 Cmjbhh32.exe 2044 Cddjebgb.exe 2032 Ciqcmiei.exe 1648 Cpkkjc32.exe -
Loads dropped DLL 64 IoCs
Processes:
04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exeIeidmbcc.exeIdnaoohk.exeJqgoiokm.exeJqilooij.exeJdgdempa.exeJmbiipml.exeJfknbe32.exeKbbngf32.exeKkjcplpa.exeKfpgmdog.exeKfbcbd32.exeKnmhgf32.exeKkaiqk32.exeLeimip32.exeLmebnb32.exeLfmffhde.exeLgmcqkkh.exeLphhenhc.exeLlohjo32.exeLegmbd32.exeMeijhc32.exeMbmjah32.exeModkfi32.exeMofglh32.exeMmldme32.exeNgdifkpi.exeNckjkl32.exeNmpnhdfc.exeNcmfqkdj.exeNodgel32.exeNhllob32.exepid process 2240 04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe 2240 04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe 3024 Ieidmbcc.exe 3024 Ieidmbcc.exe 2756 Idnaoohk.exe 2756 Idnaoohk.exe 2764 Jqgoiokm.exe 2764 Jqgoiokm.exe 2280 Jqilooij.exe 2280 Jqilooij.exe 2532 Jdgdempa.exe 2532 Jdgdempa.exe 2168 Jmbiipml.exe 2168 Jmbiipml.exe 264 Jfknbe32.exe 264 Jfknbe32.exe 2728 Kbbngf32.exe 2728 Kbbngf32.exe 2932 Kkjcplpa.exe 2932 Kkjcplpa.exe 1656 Kfpgmdog.exe 1656 Kfpgmdog.exe 2024 Kfbcbd32.exe 2024 Kfbcbd32.exe 876 Knmhgf32.exe 876 Knmhgf32.exe 1616 Kkaiqk32.exe 1616 Kkaiqk32.exe 1684 Leimip32.exe 1684 Leimip32.exe 1980 Lmebnb32.exe 1980 Lmebnb32.exe 1544 Lfmffhde.exe 1544 Lfmffhde.exe 912 Lgmcqkkh.exe 912 Lgmcqkkh.exe 436 Lphhenhc.exe 436 Lphhenhc.exe 1160 Llohjo32.exe 1160 Llohjo32.exe 1672 Legmbd32.exe 1672 Legmbd32.exe 1316 Meijhc32.exe 1316 Meijhc32.exe 1940 Mbmjah32.exe 1940 Mbmjah32.exe 2844 Modkfi32.exe 2844 Modkfi32.exe 2796 Mofglh32.exe 2796 Mofglh32.exe 2920 Mmldme32.exe 2920 Mmldme32.exe 1664 Ngdifkpi.exe 1664 Ngdifkpi.exe 2220 Nckjkl32.exe 2220 Nckjkl32.exe 2612 Nmpnhdfc.exe 2612 Nmpnhdfc.exe 2712 Ncmfqkdj.exe 2712 Ncmfqkdj.exe 2656 Nodgel32.exe 2656 Nodgel32.exe 2636 Nhllob32.exe 2636 Nhllob32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Occlcg32.exeKhjgel32.exeCckdlnjg.exeHfpfdeon.exeAhmefdcp.exeGlklejoo.exeDmbcen32.exeBddbjhlp.exeGdnfjl32.exeKndbko32.exeHdiejfej.exeJbjpom32.exeLdheebad.exeAknlofim.exePndalkgf.exeKindeddf.exeOkinik32.exeDicnkdnf.exeFfodjh32.exeFphgbn32.exeFbmfkkbm.exeJolghndm.exeKnhjjj32.exeHgoadp32.exeKgclio32.exeIlcoce32.exeHdecea32.exePjihmmbk.exeLjjhdm32.exedescription ioc process File created C:\Windows\SysWOW64\Nddobb32.dll File opened for modification C:\Windows\SysWOW64\Ojndpqpq.exe Occlcg32.exe File created C:\Windows\SysWOW64\Indnqb32.exe File created C:\Windows\SysWOW64\Ihlbih32.exe File created C:\Windows\SysWOW64\Pjchjcmf.exe File created C:\Windows\SysWOW64\Ffakjm32.dll Khjgel32.exe File created C:\Windows\SysWOW64\Infjfblm.exe File created C:\Windows\SysWOW64\Bgdalf32.dll File created C:\Windows\SysWOW64\Hnecjgch.exe File opened for modification C:\Windows\SysWOW64\Cejphiik.exe Cckdlnjg.exe File created C:\Windows\SysWOW64\Qnhhline.dll Hfpfdeon.exe File opened for modification C:\Windows\SysWOW64\Aognbnkm.exe Ahmefdcp.exe File opened for modification C:\Windows\SysWOW64\Gcedad32.exe Glklejoo.exe File opened for modification C:\Windows\SysWOW64\Bacgohjk.exe File opened for modification C:\Windows\SysWOW64\Jddbpmpm.exe File created C:\Windows\SysWOW64\Fjgmobcq.dll File opened for modification C:\Windows\SysWOW64\Ieaekdkn.exe File created C:\Windows\SysWOW64\Pibgfjdh.exe File created C:\Windows\SysWOW64\Cbehjc32.dll Dmbcen32.exe File opened for modification C:\Windows\SysWOW64\Blkjkflb.exe Bddbjhlp.exe File created C:\Windows\SysWOW64\Gockgdeh.exe Gdnfjl32.exe File opened for modification C:\Windows\SysWOW64\Kabngjla.exe Kndbko32.exe File opened for modification C:\Windows\SysWOW64\Enlncdio.exe File opened for modification C:\Windows\SysWOW64\Hifmbmda.exe Hdiejfej.exe File opened for modification C:\Windows\SysWOW64\Khghgchk.exe Jbjpom32.exe File created C:\Windows\SysWOW64\Fdjlhdag.dll File created C:\Windows\SysWOW64\Mnlilb32.exe File created C:\Windows\SysWOW64\Ldjbkb32.exe Ldheebad.exe File opened for modification C:\Windows\SysWOW64\Kocodbpk.exe File created C:\Windows\SysWOW64\Nnbdij32.dll File created C:\Windows\SysWOW64\Mchadifq.exe File created C:\Windows\SysWOW64\Nlklik32.exe File created C:\Windows\SysWOW64\Oakmlgcg.dll File opened for modification C:\Windows\SysWOW64\Aqjdgmgd.exe Aknlofim.exe File created C:\Windows\SysWOW64\Pfkimhhi.exe Pndalkgf.exe File opened for modification C:\Windows\SysWOW64\Igcjgk32.exe File created C:\Windows\SysWOW64\Mcekkkmc.exe File opened for modification C:\Windows\SysWOW64\Piiekp32.exe File created C:\Windows\SysWOW64\Jchhhjjg.exe File created C:\Windows\SysWOW64\Kokmmkcm.exe Kindeddf.exe File opened for modification C:\Windows\SysWOW64\Ofobgc32.exe Okinik32.exe File opened for modification C:\Windows\SysWOW64\Cbljgpja.exe File opened for modification C:\Windows\SysWOW64\Chkoef32.exe File created C:\Windows\SysWOW64\Eclbcj32.exe Dicnkdnf.exe File created C:\Windows\SysWOW64\Ddonghfa.dll Ffodjh32.exe File created C:\Windows\SysWOW64\Fpkchm32.exe Fphgbn32.exe File created C:\Windows\SysWOW64\Jdjgfomh.exe File created C:\Windows\SysWOW64\Hqnpad32.dll File created C:\Windows\SysWOW64\Lijepc32.exe File opened for modification C:\Windows\SysWOW64\Pccdqloh.exe File opened for modification C:\Windows\SysWOW64\Fkejcq32.exe Fbmfkkbm.exe File created C:\Windows\SysWOW64\Gdhclbka.dll Jolghndm.exe File created C:\Windows\SysWOW64\Kadfkhkf.exe Knhjjj32.exe File opened for modification C:\Windows\SysWOW64\Hadfah32.exe Hgoadp32.exe File created C:\Windows\SysWOW64\Knmdeioh.exe Kgclio32.exe File opened for modification C:\Windows\SysWOW64\Gkaljdaf.exe File created C:\Windows\SysWOW64\Eddkbl32.dll File created C:\Windows\SysWOW64\Boakgapg.exe File created C:\Windows\SysWOW64\Jhjphfgi.exe Ilcoce32.exe File created C:\Windows\SysWOW64\Hehiqh32.dll Hdecea32.exe File created C:\Windows\SysWOW64\Pmjaohol.exe Pjihmmbk.exe File created C:\Windows\SysWOW64\Hgmoqm32.dll File created C:\Windows\SysWOW64\Mfqiingf.exe Ljjhdm32.exe File created C:\Windows\SysWOW64\Mdahnmck.exe -
Modifies registry class 64 IoCs
Processes:
Mfmndn32.exeEphbal32.exeLdheebad.exeLmnhgjmp.exeIfoqjo32.exeBiolanld.exeDomccejd.exeIchmgl32.exeDgoopkgh.exeKcdjoaee.exeDhgccbhp.exeNcdpdcfh.exeLflplbpi.exeOjmpooah.exePnchhllf.exeBnhoag32.exeCacclpae.exePpkjac32.exeDghjkpck.exeCgjgol32.exeEgpena32.exeDflmpebj.exeFapeic32.exeKlhioioc.exeLjplkonl.exeDpmdofno.exeLnhdqdnd.exeEblelb32.exeGamnhq32.exeNqeapo32.exeNodgel32.exeIihfgp32.exePoklngnf.exeBccmmf32.exePfkimhhi.exeFidhof32.exeJeafjiop.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mfmndn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgdqap32.dll" Ephbal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldheebad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lmnhgjmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ifoqjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnhlgpao.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Biolanld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keeolpie.dll" Domccejd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ichmgl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dgoopkgh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kcdjoaee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dhgccbhp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ncdpdcfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlhjll32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pppnpb32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lflplbpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ojmpooah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pnchhllf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlqoffkq.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeopfn32.dll" Bnhoag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beimfpfn.dll" Cacclpae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeebpcpj.dll" Ppkjac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dghjkpck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cgjgol32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Egpena32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dflmpebj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fapeic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Klhioioc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ljplkonl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpmdofno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lnhdqdnd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eblelb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gamnhq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nqeapo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kejpdk32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naipph32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgocca32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Encjfc32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkoclfip.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nodgel32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iihfgp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pniqhlqh.dll" Poklngnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bccmmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfkimhhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Majlhbai.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fidhof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphgph32.dll" Jeafjiop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exeIeidmbcc.exeIdnaoohk.exeJqgoiokm.exeJqilooij.exeJdgdempa.exeJmbiipml.exeJfknbe32.exeKbbngf32.exeKkjcplpa.exeKfpgmdog.exeKfbcbd32.exeKnmhgf32.exeKkaiqk32.exeLeimip32.exeLmebnb32.exedescription pid process target process PID 2240 wrote to memory of 3024 2240 04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe Ieidmbcc.exe PID 2240 wrote to memory of 3024 2240 04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe Ieidmbcc.exe PID 2240 wrote to memory of 3024 2240 04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe Ieidmbcc.exe PID 2240 wrote to memory of 3024 2240 04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe Ieidmbcc.exe PID 3024 wrote to memory of 2756 3024 Ieidmbcc.exe Idnaoohk.exe PID 3024 wrote to memory of 2756 3024 Ieidmbcc.exe Idnaoohk.exe PID 3024 wrote to memory of 2756 3024 Ieidmbcc.exe Idnaoohk.exe PID 3024 wrote to memory of 2756 3024 Ieidmbcc.exe Idnaoohk.exe PID 2756 wrote to memory of 2764 2756 Idnaoohk.exe Jqgoiokm.exe PID 2756 wrote to memory of 2764 2756 Idnaoohk.exe Jqgoiokm.exe PID 2756 wrote to memory of 2764 2756 Idnaoohk.exe Jqgoiokm.exe PID 2756 wrote to memory of 2764 2756 Idnaoohk.exe Jqgoiokm.exe PID 2764 wrote to memory of 2280 2764 Jqgoiokm.exe Jqilooij.exe PID 2764 wrote to memory of 2280 2764 Jqgoiokm.exe Jqilooij.exe PID 2764 wrote to memory of 2280 2764 Jqgoiokm.exe Jqilooij.exe PID 2764 wrote to memory of 2280 2764 Jqgoiokm.exe Jqilooij.exe PID 2280 wrote to memory of 2532 2280 Jqilooij.exe Jdgdempa.exe PID 2280 wrote to memory of 2532 2280 Jqilooij.exe Jdgdempa.exe PID 2280 wrote to memory of 2532 2280 Jqilooij.exe Jdgdempa.exe PID 2280 wrote to memory of 2532 2280 Jqilooij.exe Jdgdempa.exe PID 2532 wrote to memory of 2168 2532 Jdgdempa.exe Jmbiipml.exe PID 2532 wrote to memory of 2168 2532 Jdgdempa.exe Jmbiipml.exe PID 2532 wrote to memory of 2168 2532 Jdgdempa.exe Jmbiipml.exe PID 2532 wrote to memory of 2168 2532 Jdgdempa.exe Jmbiipml.exe PID 2168 wrote to memory of 264 2168 Jmbiipml.exe Jfknbe32.exe PID 2168 wrote to memory of 264 2168 Jmbiipml.exe Jfknbe32.exe PID 2168 wrote to memory of 264 2168 Jmbiipml.exe Jfknbe32.exe PID 2168 wrote to memory of 264 2168 Jmbiipml.exe Jfknbe32.exe PID 264 wrote to memory of 2728 264 Jfknbe32.exe Kbbngf32.exe PID 264 wrote to memory of 2728 264 Jfknbe32.exe Kbbngf32.exe PID 264 wrote to memory of 2728 264 Jfknbe32.exe Kbbngf32.exe PID 264 wrote to memory of 2728 264 Jfknbe32.exe Kbbngf32.exe PID 2728 wrote to memory of 2932 2728 Kbbngf32.exe Kkjcplpa.exe PID 2728 wrote to memory of 2932 2728 Kbbngf32.exe Kkjcplpa.exe PID 2728 wrote to memory of 2932 2728 Kbbngf32.exe Kkjcplpa.exe PID 2728 wrote to memory of 2932 2728 Kbbngf32.exe Kkjcplpa.exe PID 2932 wrote to memory of 1656 2932 Kkjcplpa.exe Kfpgmdog.exe PID 2932 wrote to memory of 1656 2932 Kkjcplpa.exe Kfpgmdog.exe PID 2932 wrote to memory of 1656 2932 Kkjcplpa.exe Kfpgmdog.exe PID 2932 wrote to memory of 1656 2932 Kkjcplpa.exe Kfpgmdog.exe PID 1656 wrote to memory of 2024 1656 Kfpgmdog.exe Kfbcbd32.exe PID 1656 wrote to memory of 2024 1656 Kfpgmdog.exe Kfbcbd32.exe PID 1656 wrote to memory of 2024 1656 Kfpgmdog.exe Kfbcbd32.exe PID 1656 wrote to memory of 2024 1656 Kfpgmdog.exe Kfbcbd32.exe PID 2024 wrote to memory of 876 2024 Kfbcbd32.exe Knmhgf32.exe PID 2024 wrote to memory of 876 2024 Kfbcbd32.exe Knmhgf32.exe PID 2024 wrote to memory of 876 2024 Kfbcbd32.exe Knmhgf32.exe PID 2024 wrote to memory of 876 2024 Kfbcbd32.exe Knmhgf32.exe PID 876 wrote to memory of 1616 876 Knmhgf32.exe Kkaiqk32.exe PID 876 wrote to memory of 1616 876 Knmhgf32.exe Kkaiqk32.exe PID 876 wrote to memory of 1616 876 Knmhgf32.exe Kkaiqk32.exe PID 876 wrote to memory of 1616 876 Knmhgf32.exe Kkaiqk32.exe PID 1616 wrote to memory of 1684 1616 Kkaiqk32.exe Leimip32.exe PID 1616 wrote to memory of 1684 1616 Kkaiqk32.exe Leimip32.exe PID 1616 wrote to memory of 1684 1616 Kkaiqk32.exe Leimip32.exe PID 1616 wrote to memory of 1684 1616 Kkaiqk32.exe Leimip32.exe PID 1684 wrote to memory of 1980 1684 Leimip32.exe Lmebnb32.exe PID 1684 wrote to memory of 1980 1684 Leimip32.exe Lmebnb32.exe PID 1684 wrote to memory of 1980 1684 Leimip32.exe Lmebnb32.exe PID 1684 wrote to memory of 1980 1684 Leimip32.exe Lmebnb32.exe PID 1980 wrote to memory of 1544 1980 Lmebnb32.exe Lfmffhde.exe PID 1980 wrote to memory of 1544 1980 Lmebnb32.exe Lfmffhde.exe PID 1980 wrote to memory of 1544 1980 Lmebnb32.exe Lfmffhde.exe PID 1980 wrote to memory of 1544 1980 Lmebnb32.exe Lfmffhde.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe"C:\Users\Admin\AppData\Local\Temp\04831dd00929efd718be9515c87198e74dc8fa58f5fcea450c6806f22a1913ca.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ieidmbcc.exeC:\Windows\system32\Ieidmbcc.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Idnaoohk.exeC:\Windows\system32\Idnaoohk.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jqgoiokm.exeC:\Windows\system32\Jqgoiokm.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jqilooij.exeC:\Windows\system32\Jqilooij.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jdgdempa.exeC:\Windows\system32\Jdgdempa.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jmbiipml.exeC:\Windows\system32\Jmbiipml.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jfknbe32.exeC:\Windows\system32\Jfknbe32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kbbngf32.exeC:\Windows\system32\Kbbngf32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kkjcplpa.exeC:\Windows\system32\Kkjcplpa.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kfpgmdog.exeC:\Windows\system32\Kfpgmdog.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kfbcbd32.exeC:\Windows\system32\Kfbcbd32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Knmhgf32.exeC:\Windows\system32\Knmhgf32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kkaiqk32.exeC:\Windows\system32\Kkaiqk32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Leimip32.exeC:\Windows\system32\Leimip32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lmebnb32.exeC:\Windows\system32\Lmebnb32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lfmffhde.exeC:\Windows\system32\Lfmffhde.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lgmcqkkh.exeC:\Windows\system32\Lgmcqkkh.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lphhenhc.exeC:\Windows\system32\Lphhenhc.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Llohjo32.exeC:\Windows\system32\Llohjo32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Legmbd32.exeC:\Windows\system32\Legmbd32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Meijhc32.exeC:\Windows\system32\Meijhc32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mbmjah32.exeC:\Windows\system32\Mbmjah32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Modkfi32.exeC:\Windows\system32\Modkfi32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mofglh32.exeC:\Windows\system32\Mofglh32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mmldme32.exeC:\Windows\system32\Mmldme32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ngdifkpi.exeC:\Windows\system32\Ngdifkpi.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Nckjkl32.exeC:\Windows\system32\Nckjkl32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Nmpnhdfc.exeC:\Windows\system32\Nmpnhdfc.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ncmfqkdj.exeC:\Windows\system32\Ncmfqkdj.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Nodgel32.exeC:\Windows\system32\Nodgel32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Nhllob32.exeC:\Windows\system32\Nhllob32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Nofdklgl.exeC:\Windows\system32\Nofdklgl.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nilhhdga.exeC:\Windows\system32\Nilhhdga.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ocdmaj32.exeC:\Windows\system32\Ocdmaj32.exe35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oebimf32.exeC:\Windows\system32\Oebimf32.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ocfigjlp.exeC:\Windows\system32\Ocfigjlp.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oomjlk32.exeC:\Windows\system32\Oomjlk32.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ohendqhd.exeC:\Windows\system32\Ohendqhd.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oopfakpa.exeC:\Windows\system32\Oopfakpa.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ogkkfmml.exeC:\Windows\system32\Ogkkfmml.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Onecbg32.exeC:\Windows\system32\Onecbg32.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pkidlk32.exeC:\Windows\system32\Pkidlk32.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pnimnfpc.exeC:\Windows\system32\Pnimnfpc.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pjpnbg32.exeC:\Windows\system32\Pjpnbg32.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pcibkm32.exeC:\Windows\system32\Pcibkm32.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pkdgpo32.exeC:\Windows\system32\Pkdgpo32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pbnoliap.exeC:\Windows\system32\Pbnoliap.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Afnagk32.exeC:\Windows\system32\Afnagk32.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bajomhbl.exeC:\Windows\system32\Bajomhbl.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bjbcfn32.exeC:\Windows\system32\Bjbcfn32.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bbikgk32.exeC:\Windows\system32\Bbikgk32.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bhfcpb32.exeC:\Windows\system32\Bhfcpb32.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bmclhi32.exeC:\Windows\system32\Bmclhi32.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bdmddc32.exeC:\Windows\system32\Bdmddc32.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bkglameg.exeC:\Windows\system32\Bkglameg.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bmeimhdj.exeC:\Windows\system32\Bmeimhdj.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Chkmkacq.exeC:\Windows\system32\Chkmkacq.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cilibi32.exeC:\Windows\system32\Cilibi32.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cdanpb32.exeC:\Windows\system32\Cdanpb32.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cgpjlnhh.exeC:\Windows\system32\Cgpjlnhh.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cmjbhh32.exeC:\Windows\system32\Cmjbhh32.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cddjebgb.exeC:\Windows\system32\Cddjebgb.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ciqcmiei.exeC:\Windows\system32\Ciqcmiei.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cpkkjc32.exeC:\Windows\system32\Cpkkjc32.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cgdcgm32.exeC:\Windows\system32\Cgdcgm32.exe66⤵
-
C:\Windows\SysWOW64\Clalod32.exeC:\Windows\system32\Clalod32.exe67⤵
-
C:\Windows\SysWOW64\Cckdlnjg.exeC:\Windows\system32\Cckdlnjg.exe68⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cejphiik.exeC:\Windows\system32\Cejphiik.exe69⤵
-
C:\Windows\SysWOW64\Dldhdc32.exeC:\Windows\system32\Dldhdc32.exe70⤵
-
C:\Windows\SysWOW64\Dcnqanhd.exeC:\Windows\system32\Dcnqanhd.exe71⤵
-
C:\Windows\SysWOW64\Delmmigh.exeC:\Windows\system32\Delmmigh.exe72⤵
-
C:\Windows\SysWOW64\Dhkiid32.exeC:\Windows\system32\Dhkiid32.exe73⤵
-
C:\Windows\SysWOW64\Dngabk32.exeC:\Windows\system32\Dngabk32.exe74⤵
-
C:\Windows\SysWOW64\Deojci32.exeC:\Windows\system32\Deojci32.exe75⤵
-
C:\Windows\SysWOW64\Dkkbkp32.exeC:\Windows\system32\Dkkbkp32.exe76⤵
-
C:\Windows\SysWOW64\Dognlnlf.exeC:\Windows\system32\Dognlnlf.exe77⤵
-
C:\Windows\SysWOW64\Dddfdejn.exeC:\Windows\system32\Dddfdejn.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dknoaoaj.exeC:\Windows\system32\Dknoaoaj.exe79⤵
-
C:\Windows\SysWOW64\Dahgni32.exeC:\Windows\system32\Dahgni32.exe80⤵
-
C:\Windows\SysWOW64\Ddfcje32.exeC:\Windows\system32\Ddfcje32.exe81⤵
-
C:\Windows\SysWOW64\Dkpkfooh.exeC:\Windows\system32\Dkpkfooh.exe82⤵
-
C:\Windows\SysWOW64\Dpmdofno.exeC:\Windows\system32\Dpmdofno.exe83⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ddhpod32.exeC:\Windows\system32\Ddhpod32.exe84⤵
-
C:\Windows\SysWOW64\Efjlgmlf.exeC:\Windows\system32\Efjlgmlf.exe85⤵
-
C:\Windows\SysWOW64\Eobapbbg.exeC:\Windows\system32\Eobapbbg.exe86⤵
-
C:\Windows\SysWOW64\Eflill32.exeC:\Windows\system32\Eflill32.exe87⤵
-
C:\Windows\SysWOW64\Elfaifaq.exeC:\Windows\system32\Elfaifaq.exe88⤵
-
C:\Windows\SysWOW64\Ecpjfq32.exeC:\Windows\system32\Ecpjfq32.exe89⤵
-
C:\Windows\SysWOW64\Ejjbbkpj.exeC:\Windows\system32\Ejjbbkpj.exe90⤵
-
C:\Windows\SysWOW64\Ecbfkpfk.exeC:\Windows\system32\Ecbfkpfk.exe91⤵
-
C:\Windows\SysWOW64\Edccch32.exeC:\Windows\system32\Edccch32.exe92⤵
-
C:\Windows\SysWOW64\Eknkpbdf.exeC:\Windows\system32\Eknkpbdf.exe93⤵
-
C:\Windows\SysWOW64\Efcomkcl.exeC:\Windows\system32\Efcomkcl.exe94⤵
-
C:\Windows\SysWOW64\Egdlec32.exeC:\Windows\system32\Egdlec32.exe95⤵
-
C:\Windows\SysWOW64\Fbjpblip.exeC:\Windows\system32\Fbjpblip.exe96⤵
-
C:\Windows\SysWOW64\Fidhof32.exeC:\Windows\system32\Fidhof32.exe97⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fnqqgm32.exeC:\Windows\system32\Fnqqgm32.exe98⤵
-
C:\Windows\SysWOW64\Fqomci32.exeC:\Windows\system32\Fqomci32.exe99⤵
-
C:\Windows\SysWOW64\Fgiepced.exeC:\Windows\system32\Fgiepced.exe100⤵
-
C:\Windows\SysWOW64\Fmfnhj32.exeC:\Windows\system32\Fmfnhj32.exe101⤵
-
C:\Windows\SysWOW64\Fgkbeb32.exeC:\Windows\system32\Fgkbeb32.exe102⤵
-
C:\Windows\SysWOW64\Fjjnan32.exeC:\Windows\system32\Fjjnan32.exe103⤵
-
C:\Windows\SysWOW64\Fqcfnhjb.exeC:\Windows\system32\Fqcfnhjb.exe104⤵
-
C:\Windows\SysWOW64\Fpffje32.exeC:\Windows\system32\Fpffje32.exe105⤵
-
C:\Windows\SysWOW64\Fjlkgn32.exeC:\Windows\system32\Fjlkgn32.exe106⤵
-
C:\Windows\SysWOW64\Fafcdh32.exeC:\Windows\system32\Fafcdh32.exe107⤵
-
C:\Windows\SysWOW64\Ffcllo32.exeC:\Windows\system32\Ffcllo32.exe108⤵
-
C:\Windows\SysWOW64\Gmmdiind.exeC:\Windows\system32\Gmmdiind.exe109⤵
-
C:\Windows\SysWOW64\Gfehan32.exeC:\Windows\system32\Gfehan32.exe110⤵
-
C:\Windows\SysWOW64\Gmoqnhla.exeC:\Windows\system32\Gmoqnhla.exe111⤵
-
C:\Windows\SysWOW64\Gnpmfqap.exeC:\Windows\system32\Gnpmfqap.exe112⤵
-
C:\Windows\SysWOW64\Gifaciae.exeC:\Windows\system32\Gifaciae.exe113⤵
-
C:\Windows\SysWOW64\Gldmoepi.exeC:\Windows\system32\Gldmoepi.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gnbjlpom.exeC:\Windows\system32\Gnbjlpom.exe115⤵
-
C:\Windows\SysWOW64\Gaafhloq.exeC:\Windows\system32\Gaafhloq.exe116⤵
-
C:\Windows\SysWOW64\Gbqbaofc.exeC:\Windows\system32\Gbqbaofc.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gdboig32.exeC:\Windows\system32\Gdboig32.exe118⤵
-
C:\Windows\SysWOW64\Gngcgp32.exeC:\Windows\system32\Gngcgp32.exe119⤵
-
C:\Windows\SysWOW64\Hddlof32.exeC:\Windows\system32\Hddlof32.exe120⤵
-
C:\Windows\SysWOW64\Hjndlqal.exeC:\Windows\system32\Hjndlqal.exe121⤵
-
C:\Windows\SysWOW64\Hpkldg32.exeC:\Windows\system32\Hpkldg32.exe122⤵
-
C:\Windows\SysWOW64\Hhbdee32.exeC:\Windows\system32\Hhbdee32.exe123⤵
-
C:\Windows\SysWOW64\Hicqmmfc.exeC:\Windows\system32\Hicqmmfc.exe124⤵
-
C:\Windows\SysWOW64\Hdiejfej.exeC:\Windows\system32\Hdiejfej.exe125⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hifmbmda.exeC:\Windows\system32\Hifmbmda.exe126⤵
-
C:\Windows\SysWOW64\Hbnbkbja.exeC:\Windows\system32\Hbnbkbja.exe127⤵
-
C:\Windows\SysWOW64\Hihjhl32.exeC:\Windows\system32\Hihjhl32.exe128⤵
-
C:\Windows\SysWOW64\Hpbbdfik.exeC:\Windows\system32\Hpbbdfik.exe129⤵
-
C:\Windows\SysWOW64\Hbqoqbho.exeC:\Windows\system32\Hbqoqbho.exe130⤵
-
C:\Windows\SysWOW64\Ihmgiiff.exeC:\Windows\system32\Ihmgiiff.exe131⤵
-
C:\Windows\SysWOW64\Iogoec32.exeC:\Windows\system32\Iogoec32.exe132⤵
-
C:\Windows\SysWOW64\Iaelanmg.exeC:\Windows\system32\Iaelanmg.exe133⤵
-
C:\Windows\SysWOW64\Ihpdoh32.exeC:\Windows\system32\Ihpdoh32.exe134⤵
-
C:\Windows\SysWOW64\Ibehla32.exeC:\Windows\system32\Ibehla32.exe135⤵
-
C:\Windows\SysWOW64\Idfdcijh.exeC:\Windows\system32\Idfdcijh.exe136⤵
-
C:\Windows\SysWOW64\Ikpmpc32.exeC:\Windows\system32\Ikpmpc32.exe137⤵
-
C:\Windows\SysWOW64\Imoilo32.exeC:\Windows\system32\Imoilo32.exe138⤵
-
C:\Windows\SysWOW64\Iefamlak.exeC:\Windows\system32\Iefamlak.exe139⤵
-
C:\Windows\SysWOW64\Ikbifcpb.exeC:\Windows\system32\Ikbifcpb.exe140⤵
-
C:\Windows\SysWOW64\Iamabm32.exeC:\Windows\system32\Iamabm32.exe141⤵
-
C:\Windows\SysWOW64\Igijkd32.exeC:\Windows\system32\Igijkd32.exe142⤵
-
C:\Windows\SysWOW64\Iihfgp32.exeC:\Windows\system32\Iihfgp32.exe143⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jcpkpe32.exeC:\Windows\system32\Jcpkpe32.exe144⤵
-
C:\Windows\SysWOW64\Jnfomn32.exeC:\Windows\system32\Jnfomn32.exe145⤵
-
C:\Windows\SysWOW64\Jpdkii32.exeC:\Windows\system32\Jpdkii32.exe146⤵
-
C:\Windows\SysWOW64\Jcbhee32.exeC:\Windows\system32\Jcbhee32.exe147⤵
-
C:\Windows\SysWOW64\Jjmpbopd.exeC:\Windows\system32\Jjmpbopd.exe148⤵
-
C:\Windows\SysWOW64\Jcedkd32.exeC:\Windows\system32\Jcedkd32.exe149⤵
-
C:\Windows\SysWOW64\Lflplbpi.exeC:\Windows\system32\Lflplbpi.exe150⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lnhdqdnd.exeC:\Windows\system32\Lnhdqdnd.exe151⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ljabkeaf.exeC:\Windows\system32\Ljabkeaf.exe152⤵
-
C:\Windows\SysWOW64\Mcifdj32.exeC:\Windows\system32\Mcifdj32.exe153⤵
-
C:\Windows\SysWOW64\Mamgmofp.exeC:\Windows\system32\Mamgmofp.exe154⤵
-
C:\Windows\SysWOW64\Mfjoeeeh.exeC:\Windows\system32\Mfjoeeeh.exe155⤵
-
C:\Windows\SysWOW64\Mfllkece.exeC:\Windows\system32\Mfllkece.exe156⤵
-
C:\Windows\SysWOW64\Mfoiqe32.exeC:\Windows\system32\Mfoiqe32.exe157⤵
-
C:\Windows\SysWOW64\Mpgmijgc.exeC:\Windows\system32\Mpgmijgc.exe158⤵
-
C:\Windows\SysWOW64\Nmkncofl.exeC:\Windows\system32\Nmkncofl.exe159⤵
-
C:\Windows\SysWOW64\Nplfdj32.exeC:\Windows\system32\Nplfdj32.exe160⤵
-
C:\Windows\SysWOW64\Nhgkil32.exeC:\Windows\system32\Nhgkil32.exe161⤵
-
C:\Windows\SysWOW64\Neklbppb.exeC:\Windows\system32\Neklbppb.exe162⤵
-
C:\Windows\SysWOW64\Nhiholof.exeC:\Windows\system32\Nhiholof.exe163⤵
-
C:\Windows\SysWOW64\Nocpkf32.exeC:\Windows\system32\Nocpkf32.exe164⤵
-
C:\Windows\SysWOW64\Ndpicm32.exeC:\Windows\system32\Ndpicm32.exe165⤵
-
C:\Windows\SysWOW64\Npgihn32.exeC:\Windows\system32\Npgihn32.exe166⤵
-
C:\Windows\SysWOW64\Oklnff32.exeC:\Windows\system32\Oklnff32.exe167⤵
-
C:\Windows\SysWOW64\Okojkf32.exeC:\Windows\system32\Okojkf32.exe168⤵
-
C:\Windows\SysWOW64\Odgodl32.exeC:\Windows\system32\Odgodl32.exe169⤵
-
C:\Windows\SysWOW64\Ooclji32.exeC:\Windows\system32\Ooclji32.exe170⤵
-
C:\Windows\SysWOW64\Pkjmoj32.exeC:\Windows\system32\Pkjmoj32.exe171⤵
-
C:\Windows\SysWOW64\Peanbblf.exeC:\Windows\system32\Peanbblf.exe172⤵
-
C:\Windows\SysWOW64\Pnmcfeia.exeC:\Windows\system32\Pnmcfeia.exe173⤵
-
C:\Windows\SysWOW64\Pdihiook.exeC:\Windows\system32\Pdihiook.exe174⤵
-
C:\Windows\SysWOW64\Pmdmmalf.exeC:\Windows\system32\Pmdmmalf.exe175⤵
-
C:\Windows\SysWOW64\Qndigd32.exeC:\Windows\system32\Qndigd32.exe176⤵
-
C:\Windows\SysWOW64\Qjkjle32.exeC:\Windows\system32\Qjkjle32.exe177⤵
-
C:\Windows\SysWOW64\Aipfmane.exeC:\Windows\system32\Aipfmane.exe178⤵
-
C:\Windows\SysWOW64\Acekjjmk.exeC:\Windows\system32\Acekjjmk.exe179⤵
-
C:\Windows\SysWOW64\Anolkh32.exeC:\Windows\system32\Anolkh32.exe180⤵
-
C:\Windows\SysWOW64\Aoohekal.exeC:\Windows\system32\Aoohekal.exe181⤵
-
C:\Windows\SysWOW64\Aigmnqgm.exeC:\Windows\system32\Aigmnqgm.exe182⤵
-
C:\Windows\SysWOW64\Aababceh.exeC:\Windows\system32\Aababceh.exe183⤵
-
C:\Windows\SysWOW64\Bnfblgca.exeC:\Windows\system32\Bnfblgca.exe184⤵
-
C:\Windows\SysWOW64\Bnhoag32.exeC:\Windows\system32\Bnhoag32.exe185⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bibpad32.exeC:\Windows\system32\Bibpad32.exe186⤵
-
C:\Windows\SysWOW64\Bplhnoej.exeC:\Windows\system32\Bplhnoej.exe187⤵
-
C:\Windows\SysWOW64\Bffpki32.exeC:\Windows\system32\Bffpki32.exe188⤵
-
C:\Windows\SysWOW64\Bidlgdlk.exeC:\Windows\system32\Bidlgdlk.exe189⤵
-
C:\Windows\SysWOW64\Bleeioil.exeC:\Windows\system32\Bleeioil.exe190⤵
-
C:\Windows\SysWOW64\Cbajkiof.exeC:\Windows\system32\Cbajkiof.exe191⤵
-
C:\Windows\SysWOW64\Cikbhc32.exeC:\Windows\system32\Cikbhc32.exe192⤵
-
C:\Windows\SysWOW64\Cbdgqimc.exeC:\Windows\system32\Cbdgqimc.exe193⤵
-
C:\Windows\SysWOW64\Cojhejbh.exeC:\Windows\system32\Cojhejbh.exe194⤵
-
C:\Windows\SysWOW64\Cffljlpc.exeC:\Windows\system32\Cffljlpc.exe195⤵
-
C:\Windows\SysWOW64\Dpqnhadq.exeC:\Windows\system32\Dpqnhadq.exe196⤵
-
C:\Windows\SysWOW64\Dgjfek32.exeC:\Windows\system32\Dgjfek32.exe197⤵
-
C:\Windows\SysWOW64\Dbafjlaa.exeC:\Windows\system32\Dbafjlaa.exe198⤵
-
C:\Windows\SysWOW64\Dikogf32.exeC:\Windows\system32\Dikogf32.exe199⤵
-
C:\Windows\SysWOW64\Dgoopkgh.exeC:\Windows\system32\Dgoopkgh.exe200⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fffefjmi.exeC:\Windows\system32\Fffefjmi.exe201⤵
-
C:\Windows\SysWOW64\Fbmfkkbm.exeC:\Windows\system32\Fbmfkkbm.exe202⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fkejcq32.exeC:\Windows\system32\Fkejcq32.exe203⤵
-
C:\Windows\SysWOW64\Fdnolfon.exeC:\Windows\system32\Fdnolfon.exe204⤵
-
C:\Windows\SysWOW64\Fmegncpp.exeC:\Windows\system32\Fmegncpp.exe205⤵
-
C:\Windows\SysWOW64\Fdpkbf32.exeC:\Windows\system32\Fdpkbf32.exe206⤵
-
C:\Windows\SysWOW64\Fofpoo32.exeC:\Windows\system32\Fofpoo32.exe207⤵
-
C:\Windows\SysWOW64\Fbdlkj32.exeC:\Windows\system32\Fbdlkj32.exe208⤵
-
C:\Windows\SysWOW64\Gnkmqkbi.exeC:\Windows\system32\Gnkmqkbi.exe209⤵
-
C:\Windows\SysWOW64\Gnmifk32.exeC:\Windows\system32\Gnmifk32.exe210⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gqlebf32.exeC:\Windows\system32\Gqlebf32.exe211⤵
-
C:\Windows\SysWOW64\Gmbfggdo.exeC:\Windows\system32\Gmbfggdo.exe212⤵
-
C:\Windows\SysWOW64\Gmecmg32.exeC:\Windows\system32\Gmecmg32.exe213⤵
-
C:\Windows\SysWOW64\Gljpncgc.exeC:\Windows\system32\Gljpncgc.exe214⤵
-
C:\Windows\SysWOW64\Hmjlhfof.exeC:\Windows\system32\Hmjlhfof.exe215⤵
-
C:\Windows\SysWOW64\Hpjeialg.exeC:\Windows\system32\Hpjeialg.exe216⤵
-
C:\Windows\SysWOW64\Halbai32.exeC:\Windows\system32\Halbai32.exe217⤵
-
C:\Windows\SysWOW64\Hbknkl32.exeC:\Windows\system32\Hbknkl32.exe218⤵
-
C:\Windows\SysWOW64\Hapklimq.exeC:\Windows\system32\Hapklimq.exe219⤵
-
C:\Windows\SysWOW64\Hndlem32.exeC:\Windows\system32\Hndlem32.exe220⤵
-
C:\Windows\SysWOW64\Ifoqjo32.exeC:\Windows\system32\Ifoqjo32.exe221⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Iplnnd32.exeC:\Windows\system32\Iplnnd32.exe222⤵
-
C:\Windows\SysWOW64\Ifffkncm.exeC:\Windows\system32\Ifffkncm.exe223⤵
-
C:\Windows\SysWOW64\Ilcoce32.exeC:\Windows\system32\Ilcoce32.exe224⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jhjphfgi.exeC:\Windows\system32\Jhjphfgi.exe225⤵
-
C:\Windows\SysWOW64\Jofejpmc.exeC:\Windows\system32\Jofejpmc.exe226⤵
-
C:\Windows\SysWOW64\Jhoice32.exeC:\Windows\system32\Jhoice32.exe227⤵
-
C:\Windows\SysWOW64\Jkmeoa32.exeC:\Windows\system32\Jkmeoa32.exe228⤵
-
C:\Windows\SysWOW64\Jkpbdq32.exeC:\Windows\system32\Jkpbdq32.exe229⤵
-
C:\Windows\SysWOW64\Jckgicnp.exeC:\Windows\system32\Jckgicnp.exe230⤵
-
C:\Windows\SysWOW64\Jnpkflne.exeC:\Windows\system32\Jnpkflne.exe231⤵
-
C:\Windows\SysWOW64\Klehgh32.exeC:\Windows\system32\Klehgh32.exe232⤵
-
C:\Windows\SysWOW64\Kfnmpn32.exeC:\Windows\system32\Kfnmpn32.exe233⤵
-
C:\Windows\SysWOW64\Kbdmeoob.exeC:\Windows\system32\Kbdmeoob.exe234⤵
-
C:\Windows\SysWOW64\Kcdjoaee.exeC:\Windows\system32\Kcdjoaee.exe235⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kdhcli32.exeC:\Windows\system32\Kdhcli32.exe236⤵
-
C:\Windows\SysWOW64\Kgfoie32.exeC:\Windows\system32\Kgfoie32.exe237⤵
-
C:\Windows\SysWOW64\Ldjpbign.exeC:\Windows\system32\Ldjpbign.exe238⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ldllgiek.exeC:\Windows\system32\Ldllgiek.exe239⤵
-
C:\Windows\SysWOW64\Lngnfnji.exeC:\Windows\system32\Lngnfnji.exe240⤵
-
C:\Windows\SysWOW64\Lmljgj32.exeC:\Windows\system32\Lmljgj32.exe241⤵