Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\h879iieoae.exe

"C:\Users\user\Desktop\h879iieoae.exe"

C:\Windows\SysWOW64\Nejhbi32.exe

C:\Windows\system32\Nejhbi32.exe

C:\Windows\SysWOW64\Ogjdllpi.exe

C:\Windows\system32\Ogjdllpi.exe

C:\Windows\SysWOW64\Opbieagi.exe

C:\Windows\system32\Opbieagi.exe

C:\Windows\SysWOW64\Oglabl32.exe

C:\Windows\system32\Oglabl32.exe

C:\Windows\SysWOW64\Olijjb32.exe

C:\Windows\system32\Olijjb32.exe

C:\Windows\SysWOW64\Oeanchcn.exe

C:\Windows\system32\Oeanchcn.exe

C:\Windows\SysWOW64\Oceoll32.exe

C:\Windows\system32\Oceoll32.exe

C:\Windows\SysWOW64\Onkcje32.exe

C:\Windows\system32\Onkcje32.exe

C:\Windows\SysWOW64\Odekfoij.exe

C:\Windows\system32\Odekfoij.exe

C:\Windows\SysWOW64\Ojacofgb.exe

C:\Windows\system32\Ojacofgb.exe

C:\Windows\SysWOW64\Ppllkpoo.exe

C:\Windows\system32\Ppllkpoo.exe

C:\Windows\SysWOW64\Plbmqa32.exe

C:\Windows\system32\Plbmqa32.exe

C:\Windows\SysWOW64\Plgflqpn.exe

C:\Windows\system32\Plgflqpn.exe

C:\Windows\SysWOW64\Pqeoao32.exe

C:\Windows\system32\Pqeoao32.exe

C:\Windows\SysWOW64\Qgcpihjl.exe

C:\Windows\system32\Qgcpihjl.exe

C:\Windows\SysWOW64\Ajkolbad.exe

C:\Windows\system32\Ajkolbad.exe

C:\Windows\SysWOW64\Bmlhnnne.exe

C:\Windows\system32\Bmlhnnne.exe

C:\Windows\SysWOW64\Bgamkfnl.exe

C:\Windows\system32\Bgamkfnl.exe

C:\Windows\SysWOW64\Bqjacldl.exe

C:\Windows\system32\Bqjacldl.exe

C:\Windows\SysWOW64\Bnnampcf.exe

C:\Windows\system32\Bnnampcf.exe

C:\Windows\SysWOW64\Bnpnbp32.exe

C:\Windows\system32\Bnpnbp32.exe

C:\Windows\SysWOW64\Bgibkegc.exe

C:\Windows\system32\Bgibkegc.exe

C:\Windows\SysWOW64\Baagdk32.exe

C:\Windows\system32\Baagdk32.exe

C:\Windows\SysWOW64\Cfnpmb32.exe

C:\Windows\system32\Cfnpmb32.exe

C:\Windows\SysWOW64\Ccapffke.exe

C:\Windows\system32\Ccapffke.exe

C:\Windows\SysWOW64\Ceampi32.exe

C:\Windows\system32\Ceampi32.exe

C:\Windows\SysWOW64\Cnjaioih.exe

C:\Windows\system32\Cnjaioih.exe

C:\Windows\SysWOW64\Camgpi32.exe

C:\Windows\system32\Camgpi32.exe

C:\Windows\SysWOW64\Dmfdkj32.exe

C:\Windows\system32\Dmfdkj32.exe

C:\Windows\SysWOW64\Dnhmjm32.exe

C:\Windows\system32\Dnhmjm32.exe

C:\Windows\SysWOW64\Dfcboo32.exe

C:\Windows\system32\Dfcboo32.exe

C:\Windows\SysWOW64\Edgbhcim.exe

C:\Windows\system32\Edgbhcim.exe

C:\Windows\SysWOW64\Emogai32.exe

C:\Windows\system32\Emogai32.exe

C:\Windows\SysWOW64\Efgkjnfn.exe

C:\Windows\system32\Efgkjnfn.exe

C:\Windows\SysWOW64\Eoappk32.exe

C:\Windows\system32\Eoappk32.exe

C:\Windows\SysWOW64\Fkogfkdj.exe

C:\Windows\system32\Fkogfkdj.exe

C:\Windows\SysWOW64\Fhedeo32.exe

C:\Windows\system32\Fhedeo32.exe

C:\Windows\SysWOW64\Feidnc32.exe

C:\Windows\system32\Feidnc32.exe

C:\Windows\SysWOW64\Foaigifk.exe

C:\Windows\system32\Foaigifk.exe

There are 30 hidden processes, click here to show them.

URLs

Name

Malicious

http://tat-neftbank.ru/kkq.phphttp://tat-neftbank.ru/wcmd.htmSoftware

unknown

Details

Name:	http://tat-neftbank.ru/kkq.phphttp://tat-neftbank.ru/wcmd.htmSoftware
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\h879iieoae.exe
Source:	h879iieoae.exe, 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Nejhbi32.exe, 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Ogjdllpi.exe, 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Opbieagi.exe, 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Oglabl32.exe, 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Olijjb32.exe, 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Oeanchcn.exe, 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Oceoll32.exe, 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Onkcje32.exe, 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Odekfoij.exe, 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Ojacofgb.exe, 0000000A.00000002.1986379697.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Ppllkpoo.exe, 0000000B.00000002.1988867655.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Plbmqa32.exe, 0000000C.00000002.1990903099.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Plgflqpn.exe, 0000000D.00000002.1993494029.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Pqeoao32.exe, 0000000E.00000002.1998469389.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Qgcpihjl.exe, 0000000F.00000002.2000063573.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Ajkolbad.exe, 00000010.00000002.2000741077.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Bmlhnnne.exe, 00000011.00000002.2001790871.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Bgamkfnl.exe, 00000012.00000002.2002333377.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Bqjacldl.exe, 00000013.00000002.2003694218.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Bnnampcf.exe, 00000014.00000002.2004277931.000000000042A000.00000004.00000001.01000000.00000017.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://oracle.com/contracts.

unknown

http://tat-neftbank.ru/wcmd.htm

unknown

Details

Name:	http://tat-neftbank.ru/wcmd.htm
TargetID:	-1
From Memory:	true
Source:	h879iieoae.exe, h879iieoae.exe, 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Nejhbi32.exe, Nejhbi32.exe, 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Ogjdllpi.exe, Ogjdllpi.exe, 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Opbieagi.exe, Opbieagi.exe, 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Oglabl32.exe, Oglabl32.exe, 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Olijjb32.exe, Olijjb32.exe, 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Oeanchcn.exe, Oeanchcn.exe, 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Oceoll32.exe, Oceoll32.exe, 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Onkcje32.exe, Onkcje32.exe, 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Odekfoij.exe, Odekfoij.exe, 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Ojacofgb.exe

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://tat-neftbank.ru/kkq.php

unknown

Details

Name:	http://tat-neftbank.ru/kkq.php
TargetID:	-1
From Memory:	true
Source:	h879iieoae.exe, h879iieoae.exe, 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Nejhbi32.exe, Nejhbi32.exe, 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Ogjdllpi.exe, Ogjdllpi.exe, 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Opbieagi.exe, Opbieagi.exe, 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Oglabl32.exe, Oglabl32.exe, 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Olijjb32.exe, Olijjb32.exe, 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Oeanchcn.exe, Oeanchcn.exe, 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Oceoll32.exe, Oceoll32.exe, 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Onkcje32.exe, Onkcje32.exe, 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Odekfoij.exe, Odekfoij.exe, 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Ojacofgb.exe

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.oracle.com/education/oln.

unknown

Details

Name:	http://www.oracle.com/education/oln.
TargetID:	-1
From Memory:	true
Source:	h879iieoae.exe, Fhedeo32.exe.36.dr, Odekfoij.exe.8.dr, Efgkjnfn.exe.33.dr, Bgibkegc.exe.21.dr, Feidnc32.exe.37.dr, Bgamkfnl.exe.17.dr, Cnjaioih.exe.26.dr, Oeanchcn.exe.5.dr, Dfcboo32.exe.30.dr, Ggmnlk32.exe.39.dr, Baagdk32.exe.22.dr, Bnnampcf.exe.19.dr, Eoappk32.exe.34.dr, Olijjb32.exe.4.dr, Oceoll32.exe.6.dr, Ajkolbad.exe.15.dr, Pqeoao32.exe.13.dr, Cfnpmb32.exe.23.dr, Dnhmjm32.exe.29.dr, Foaigifk.exe.38.dr

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://oracle.com/contracts

unknown

Details

Name:	http://oracle.com/contracts
TargetID:	-1
From Memory:	true
Source:	h879iieoae.exe, Fhedeo32.exe.36.dr, Odekfoij.exe.8.dr, Efgkjnfn.exe.33.dr, Bgibkegc.exe.21.dr, Feidnc32.exe.37.dr, Bgamkfnl.exe.17.dr, Cnjaioih.exe.26.dr, Oeanchcn.exe.5.dr, Dfcboo32.exe.30.dr, Ggmnlk32.exe.39.dr, Baagdk32.exe.22.dr, Bnnampcf.exe.19.dr, Eoappk32.exe.34.dr, Olijjb32.exe.4.dr, Oceoll32.exe.6.dr, Ajkolbad.exe.15.dr, Pqeoao32.exe.13.dr, Cfnpmb32.exe.23.dr, Dnhmjm32.exe.29.dr, Foaigifk.exe.38.dr

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

Web Event Logger