Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 12:45
Behavioral task
behavioral1
Sample
4ef67c4f99e61d8455a77fc970f54bee71d3a0ee54f75b5734d74b7b21439cefN.exe
Resource
win7-20240903-en
General
-
Target
4ef67c4f99e61d8455a77fc970f54bee71d3a0ee54f75b5734d74b7b21439cefN.exe
-
Size
381KB
-
MD5
50fc5cba7c40032cafa489070c5d6450
-
SHA1
6bbc84b18aede23b5e17e78d651749638b74af89
-
SHA256
4ef67c4f99e61d8455a77fc970f54bee71d3a0ee54f75b5734d74b7b21439cef
-
SHA512
868afe13c736a3a0cdc6f241f759cf1dfcd252faed7d454b999a3480409a3e2019cb7798144c31e9d5b16ce67d1e2eafd63cc8e864a930632aef8e076a01b7d4
-
SSDEEP
6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7h:/4wFHoSA4KofHfHTXQLzgvnzHPowYbvY
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1772-7-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1860-13-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1192-20-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4760-27-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4120-34-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2988-33-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1472-46-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1472-43-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4120-42-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3956-55-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3428-63-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2604-68-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4856-76-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4396-81-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4500-90-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3432-97-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4648-95-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3432-105-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3224-116-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3224-113-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4816-110-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3176-127-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5008-134-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/452-140-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1768-144-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4548-153-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1416-151-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4148-162-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1416-160-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2148-176-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5096-174-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4148-167-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/608-181-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2148-180-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/608-187-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4508-195-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2100-200-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2064-207-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1928-214-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/976-216-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/976-222-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1012-223-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1012-230-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4392-234-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5072-233-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4392-239-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/640-243-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3236-248-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/320-254-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4888-258-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3632-264-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4252-269-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1668-273-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1060-279-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3828-283-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1664-289-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5000-288-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1664-293-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3460-294-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4608-298-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3460-299-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2568-1102-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/932-1656-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/208-2026-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1860 hnhthn.exe 1192 lrrrffr.exe 4760 ffxrlff.exe 2988 dppdp.exe 4120 nbbthb.exe 1472 djjjv.exe 3956 rfxrxxr.exe 3428 pjdvp.exe 2604 vpdpj.exe 4856 fxrrrrr.exe 4396 tttnhn.exe 4500 vpdvp.exe 4648 htthnn.exe 3432 xrfflfx.exe 4816 btnnhb.exe 3224 rxxxrrl.exe 3176 bbbtbb.exe 5008 pjpjj.exe 452 hbhbhh.exe 1768 fflfrrl.exe 4548 vpppj.exe 1416 frrlffx.exe 4148 btnnnh.exe 5096 jdvpj.exe 2148 9fxrllf.exe 608 xflxrrf.exe 4508 nbhbhh.exe 2100 jjpjp.exe 2064 vdjdv.exe 1928 vjpdp.exe 976 bnnhbh.exe 1012 3flxrrl.exe 5072 5tbtnh.exe 4392 vvjdv.exe 640 vpppp.exe 3236 jjvdv.exe 320 xxxrlrr.exe 4888 xxrrlxr.exe 3632 hhtnbb.exe 4252 jvvvv.exe 1668 bntnhh.exe 1060 ppjdv.exe 3828 lflfffx.exe 5000 djdpp.exe 1664 dvvdv.exe 3460 fxxfrrl.exe 4608 vjjvd.exe 4372 rlfrlfx.exe 3912 tbhbbt.exe 3756 jppjv.exe 4828 ffflxxr.exe 4276 bhhtnn.exe 3428 dvdvv.exe 2656 pdpjd.exe 2152 5lfrlxr.exe 1088 ntbtnn.exe 3140 jpvpv.exe 1660 lrxlrlr.exe 2696 rrfxrrl.exe 3432 vdvpj.exe 4896 lxfxxxr.exe 4100 frrlxrl.exe 5036 bhhtnh.exe 4624 jpddp.exe -
Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
resource yara_rule behavioral2/files/0x00080000000234ac-3.dat molebox behavioral2/files/0x00070000000234b3-14.dat molebox behavioral2/files/0x00070000000234b4-15.dat molebox behavioral2/files/0x00070000000234b5-25.dat molebox behavioral2/files/0x00070000000234b6-35.dat molebox behavioral2/files/0x00070000000234b7-39.dat molebox behavioral2/files/0x00070000000234b8-47.dat molebox behavioral2/files/0x00070000000234b9-52.dat molebox behavioral2/files/0x00070000000234ba-59.dat molebox behavioral2/files/0x00070000000234bb-66.dat molebox behavioral2/files/0x00080000000234b0-73.dat molebox behavioral2/files/0x00070000000234bc-82.dat molebox behavioral2/files/0x00070000000234bd-88.dat molebox behavioral2/files/0x00070000000234bf-96.dat molebox behavioral2/files/0x00070000000234c0-103.dat molebox behavioral2/files/0x00070000000234c1-111.dat molebox behavioral2/files/0x00070000000234c2-117.dat molebox behavioral2/files/0x00070000000234c3-122.dat molebox behavioral2/files/0x00070000000234c4-129.dat molebox behavioral2/files/0x00070000000234c5-139.dat molebox behavioral2/files/0x00070000000234c6-145.dat molebox behavioral2/files/0x00070000000234c7-154.dat molebox behavioral2/files/0x00070000000234c8-157.dat molebox behavioral2/files/0x00070000000234c9-164.dat molebox behavioral2/files/0x00070000000234ca-171.dat molebox behavioral2/files/0x00070000000234cb-178.dat molebox behavioral2/files/0x00070000000234cc-188.dat molebox behavioral2/files/0x00070000000234cd-192.dat molebox behavioral2/files/0x00070000000234ce-201.dat molebox behavioral2/files/0x00070000000234cf-208.dat molebox behavioral2/files/0x00070000000234d0-215.dat molebox behavioral2/files/0x00070000000234d1-220.dat molebox -
resource yara_rule behavioral2/memory/1772-0-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00080000000234ac-3.dat upx behavioral2/memory/1860-5-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1772-7-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1860-13-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234b3-14.dat upx behavioral2/memory/1192-12-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234b4-15.dat upx behavioral2/memory/4760-19-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1192-20-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234b5-25.dat upx behavioral2/memory/2988-26-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4760-27-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234b6-35.dat upx behavioral2/memory/4120-34-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2988-33-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234b7-39.dat upx behavioral2/files/0x00070000000234b8-47.dat upx behavioral2/memory/3956-49-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1472-46-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1472-43-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4120-42-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3428-53-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234b9-52.dat upx behavioral2/memory/3956-55-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234ba-59.dat upx behavioral2/memory/3428-63-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2604-60-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234bb-66.dat upx behavioral2/memory/4856-69-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2604-68-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4856-76-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00080000000234b0-73.dat upx behavioral2/memory/4396-77-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4396-81-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234bc-82.dat upx behavioral2/memory/4500-83-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234bd-88.dat upx behavioral2/memory/4500-90-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4648-92-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234bf-96.dat upx behavioral2/memory/3432-97-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4648-95-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4816-102-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234c0-103.dat upx behavioral2/memory/3432-105-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234c1-111.dat upx behavioral2/files/0x00070000000234c2-117.dat upx behavioral2/memory/3224-116-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3176-119-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3224-113-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4816-110-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234c3-122.dat upx behavioral2/memory/5008-124-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3176-127-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234c4-129.dat upx behavioral2/memory/452-131-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5008-134-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/452-140-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234c5-139.dat upx behavioral2/memory/1768-137-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000234c6-145.dat upx behavioral2/memory/1768-144-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4548-147-0x0000000000400000-0x0000000000460000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1772 wrote to memory of 1860 1772 4ef67c4f99e61d8455a77fc970f54bee71d3a0ee54f75b5734d74b7b21439cefN.exe 84 PID 1772 wrote to memory of 1860 1772 4ef67c4f99e61d8455a77fc970f54bee71d3a0ee54f75b5734d74b7b21439cefN.exe 84 PID 1772 wrote to memory of 1860 1772 4ef67c4f99e61d8455a77fc970f54bee71d3a0ee54f75b5734d74b7b21439cefN.exe 84 PID 1860 wrote to memory of 1192 1860 hnhthn.exe 85 PID 1860 wrote to memory of 1192 1860 hnhthn.exe 85 PID 1860 wrote to memory of 1192 1860 hnhthn.exe 85 PID 1192 wrote to memory of 4760 1192 lrrrffr.exe 86 PID 1192 wrote to memory of 4760 1192 lrrrffr.exe 86 PID 1192 wrote to memory of 4760 1192 lrrrffr.exe 86 PID 4760 wrote to memory of 2988 4760 ffxrlff.exe 87 PID 4760 wrote to memory of 2988 4760 ffxrlff.exe 87 PID 4760 wrote to memory of 2988 4760 ffxrlff.exe 87 PID 2988 wrote to memory of 4120 2988 dppdp.exe 88 PID 2988 wrote to memory of 4120 2988 dppdp.exe 88 PID 2988 wrote to memory of 4120 2988 dppdp.exe 88 PID 4120 wrote to memory of 1472 4120 nbbthb.exe 89 PID 4120 wrote to memory of 1472 4120 nbbthb.exe 89 PID 4120 wrote to memory of 1472 4120 nbbthb.exe 89 PID 1472 wrote to memory of 3956 1472 djjjv.exe 90 PID 1472 wrote to memory of 3956 1472 djjjv.exe 90 PID 1472 wrote to memory of 3956 1472 djjjv.exe 90 PID 3956 wrote to memory of 3428 3956 rfxrxxr.exe 91 PID 3956 wrote to memory of 3428 3956 rfxrxxr.exe 91 PID 3956 wrote to memory of 3428 3956 rfxrxxr.exe 91 PID 3428 wrote to memory of 2604 3428 pjdvp.exe 92 PID 3428 wrote to memory of 2604 3428 pjdvp.exe 92 PID 3428 wrote to memory of 2604 3428 pjdvp.exe 92 PID 2604 wrote to memory of 4856 2604 vpdpj.exe 93 PID 2604 wrote to memory of 4856 2604 vpdpj.exe 93 PID 2604 wrote to memory of 4856 2604 vpdpj.exe 93 PID 4856 wrote to memory of 4396 4856 fxrrrrr.exe 94 PID 4856 wrote to memory of 4396 4856 fxrrrrr.exe 94 PID 4856 wrote to memory of 4396 4856 fxrrrrr.exe 94 PID 4396 wrote to memory of 4500 4396 tttnhn.exe 95 PID 4396 wrote to memory of 4500 4396 tttnhn.exe 95 PID 4396 wrote to memory of 4500 4396 tttnhn.exe 95 PID 4500 wrote to memory of 4648 4500 vpdvp.exe 96 PID 4500 wrote to memory of 4648 4500 vpdvp.exe 96 PID 4500 wrote to memory of 4648 4500 vpdvp.exe 96 PID 4648 wrote to memory of 3432 4648 htthnn.exe 97 PID 4648 wrote to memory of 3432 4648 htthnn.exe 97 PID 4648 wrote to memory of 3432 4648 htthnn.exe 97 PID 3432 wrote to memory of 4816 3432 xrfflfx.exe 98 PID 3432 wrote to memory of 4816 3432 xrfflfx.exe 98 PID 3432 wrote to memory of 4816 3432 xrfflfx.exe 98 PID 4816 wrote to memory of 3224 4816 btnnhb.exe 99 PID 4816 wrote to memory of 3224 4816 btnnhb.exe 99 PID 4816 wrote to memory of 3224 4816 btnnhb.exe 99 PID 3224 wrote to memory of 3176 3224 rxxxrrl.exe 100 PID 3224 wrote to memory of 3176 3224 rxxxrrl.exe 100 PID 3224 wrote to memory of 3176 3224 rxxxrrl.exe 100 PID 3176 wrote to memory of 5008 3176 bbbtbb.exe 101 PID 3176 wrote to memory of 5008 3176 bbbtbb.exe 101 PID 3176 wrote to memory of 5008 3176 bbbtbb.exe 101 PID 5008 wrote to memory of 452 5008 pjpjj.exe 102 PID 5008 wrote to memory of 452 5008 pjpjj.exe 102 PID 5008 wrote to memory of 452 5008 pjpjj.exe 102 PID 452 wrote to memory of 1768 452 hbhbhh.exe 103 PID 452 wrote to memory of 1768 452 hbhbhh.exe 103 PID 452 wrote to memory of 1768 452 hbhbhh.exe 103 PID 1768 wrote to memory of 4548 1768 fflfrrl.exe 104 PID 1768 wrote to memory of 4548 1768 fflfrrl.exe 104 PID 1768 wrote to memory of 4548 1768 fflfrrl.exe 104 PID 4548 wrote to memory of 1416 4548 vpppj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ef67c4f99e61d8455a77fc970f54bee71d3a0ee54f75b5734d74b7b21439cefN.exe"C:\Users\Admin\AppData\Local\Temp\4ef67c4f99e61d8455a77fc970f54bee71d3a0ee54f75b5734d74b7b21439cefN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\hnhthn.exec:\hnhthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\lrrrffr.exec:\lrrrffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\ffxrlff.exec:\ffxrlff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\dppdp.exec:\dppdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nbbthb.exec:\nbbthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\djjjv.exec:\djjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\rfxrxxr.exec:\rfxrxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\pjdvp.exec:\pjdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\vpdpj.exec:\vpdpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\tttnhn.exec:\tttnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\vpdvp.exec:\vpdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\htthnn.exec:\htthnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\xrfflfx.exec:\xrfflfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\btnnhb.exec:\btnnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\bbbtbb.exec:\bbbtbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\pjpjj.exec:\pjpjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\hbhbhh.exec:\hbhbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\fflfrrl.exec:\fflfrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\vpppj.exec:\vpppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\frrlffx.exec:\frrlffx.exe23⤵
- Executes dropped EXE
PID:1416 -
\??\c:\btnnnh.exec:\btnnnh.exe24⤵
- Executes dropped EXE
PID:4148 -
\??\c:\jdvpj.exec:\jdvpj.exe25⤵
- Executes dropped EXE
PID:5096 -
\??\c:\9fxrllf.exec:\9fxrllf.exe26⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xflxrrf.exec:\xflxrrf.exe27⤵
- Executes dropped EXE
PID:608 -
\??\c:\nbhbhh.exec:\nbhbhh.exe28⤵
- Executes dropped EXE
PID:4508 -
\??\c:\jjpjp.exec:\jjpjp.exe29⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vdjdv.exec:\vdjdv.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vjpdp.exec:\vjpdp.exe31⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bnnhbh.exec:\bnnhbh.exe32⤵
- Executes dropped EXE
PID:976 -
\??\c:\3flxrrl.exec:\3flxrrl.exe33⤵
- Executes dropped EXE
PID:1012 -
\??\c:\5tbtnh.exec:\5tbtnh.exe34⤵
- Executes dropped EXE
PID:5072 -
\??\c:\vvjdv.exec:\vvjdv.exe35⤵
- Executes dropped EXE
PID:4392 -
\??\c:\vpppp.exec:\vpppp.exe36⤵
- Executes dropped EXE
PID:640 -
\??\c:\jjvdv.exec:\jjvdv.exe37⤵
- Executes dropped EXE
PID:3236 -
\??\c:\xxxrlrr.exec:\xxxrlrr.exe38⤵
- Executes dropped EXE
PID:320 -
\??\c:\xxrrlxr.exec:\xxrrlxr.exe39⤵
- Executes dropped EXE
PID:4888 -
\??\c:\hhtnbb.exec:\hhtnbb.exe40⤵
- Executes dropped EXE
PID:3632 -
\??\c:\jvvvv.exec:\jvvvv.exe41⤵
- Executes dropped EXE
PID:4252 -
\??\c:\bntnhh.exec:\bntnhh.exe42⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ppjdv.exec:\ppjdv.exe43⤵
- Executes dropped EXE
PID:1060 -
\??\c:\lflfffx.exec:\lflfffx.exe44⤵
- Executes dropped EXE
PID:3828 -
\??\c:\djdpp.exec:\djdpp.exe45⤵
- Executes dropped EXE
PID:5000 -
\??\c:\dvvdv.exec:\dvvdv.exe46⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fxxfrrl.exec:\fxxfrrl.exe47⤵
- Executes dropped EXE
PID:3460 -
\??\c:\vjjvd.exec:\vjjvd.exe48⤵
- Executes dropped EXE
PID:4608 -
\??\c:\rlfrlfx.exec:\rlfrlfx.exe49⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tbhbbt.exec:\tbhbbt.exe50⤵
- Executes dropped EXE
PID:3912 -
\??\c:\jppjv.exec:\jppjv.exe51⤵
- Executes dropped EXE
PID:3756 -
\??\c:\ffflxxr.exec:\ffflxxr.exe52⤵
- Executes dropped EXE
PID:4828 -
\??\c:\bhhtnn.exec:\bhhtnn.exe53⤵
- Executes dropped EXE
PID:4276 -
\??\c:\dvdvv.exec:\dvdvv.exe54⤵
- Executes dropped EXE
PID:3428 -
\??\c:\pdpjd.exec:\pdpjd.exe55⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5lfrlxr.exec:\5lfrlxr.exe56⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ntbtnn.exec:\ntbtnn.exe57⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jpvpv.exec:\jpvpv.exe58⤵
- Executes dropped EXE
PID:3140 -
\??\c:\lrxlrlr.exec:\lrxlrlr.exe59⤵
- Executes dropped EXE
PID:1660 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe60⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vdvpj.exec:\vdvpj.exe61⤵
- Executes dropped EXE
PID:3432 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe62⤵
- Executes dropped EXE
PID:4896 -
\??\c:\frrlxrl.exec:\frrlxrl.exe63⤵
- Executes dropped EXE
PID:4100 -
\??\c:\bhhtnh.exec:\bhhtnh.exe64⤵
- Executes dropped EXE
PID:5036 -
\??\c:\jpddp.exec:\jpddp.exe65⤵
- Executes dropped EXE
PID:4624 -
\??\c:\9lrllfl.exec:\9lrllfl.exe66⤵PID:1296
-
\??\c:\rrrlxxl.exec:\rrrlxxl.exe67⤵PID:528
-
\??\c:\tbhbtn.exec:\tbhbtn.exe68⤵PID:3652
-
\??\c:\dvjdd.exec:\dvjdd.exe69⤵PID:4752
-
\??\c:\dpdvv.exec:\dpdvv.exe70⤵PID:3228
-
\??\c:\fxxlflf.exec:\fxxlflf.exe71⤵PID:1616
-
\??\c:\lxffxxx.exec:\lxffxxx.exe72⤵PID:1580
-
\??\c:\hbnhnn.exec:\hbnhnn.exe73⤵PID:3640
-
\??\c:\vjjjv.exec:\vjjjv.exe74⤵PID:1460
-
\??\c:\jjppp.exec:\jjppp.exe75⤵PID:2188
-
\??\c:\lrffrrl.exec:\lrffrrl.exe76⤵PID:4464
-
\??\c:\nnnnth.exec:\nnnnth.exe77⤵PID:2028
-
\??\c:\pddvp.exec:\pddvp.exe78⤵PID:2252
-
\??\c:\1ppdv.exec:\1ppdv.exe79⤵PID:3812
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe80⤵PID:1196
-
\??\c:\thntbb.exec:\thntbb.exe81⤵PID:4736
-
\??\c:\bbbtbb.exec:\bbbtbb.exe82⤵PID:2500
-
\??\c:\ddpjj.exec:\ddpjj.exe83⤵PID:4312
-
\??\c:\rflfxrl.exec:\rflfxrl.exe84⤵PID:2980
-
\??\c:\btbtnt.exec:\btbtnt.exe85⤵PID:1360
-
\??\c:\httbnt.exec:\httbnt.exe86⤵PID:2848
-
\??\c:\pdjdv.exec:\pdjdv.exe87⤵PID:2196
-
\??\c:\lfrrlrr.exec:\lfrrlrr.exe88⤵PID:4884
-
\??\c:\lfffxxr.exec:\lfffxxr.exe89⤵PID:3096
-
\??\c:\httnhn.exec:\httnhn.exe90⤵PID:4236
-
\??\c:\pvjdv.exec:\pvjdv.exe91⤵PID:968
-
\??\c:\xrfrxlr.exec:\xrfrxlr.exe92⤵PID:2216
-
\??\c:\ntntnh.exec:\ntntnh.exe93⤵PID:4440
-
\??\c:\3htnhh.exec:\3htnhh.exe94⤵PID:2340
-
\??\c:\vppjd.exec:\vppjd.exe95⤵PID:1500
-
\??\c:\ppvvj.exec:\ppvvj.exe96⤵PID:1448
-
\??\c:\frrlxfl.exec:\frrlxfl.exe97⤵PID:2888
-
\??\c:\thbbnh.exec:\thbbnh.exe98⤵PID:3976
-
\??\c:\dpvpj.exec:\dpvpj.exe99⤵PID:3020
-
\??\c:\xrlfrxx.exec:\xrlfrxx.exe100⤵PID:3148
-
\??\c:\hhtnhh.exec:\hhtnhh.exe101⤵PID:3952
-
\??\c:\tbtnnb.exec:\tbtnnb.exe102⤵PID:3488
-
\??\c:\dpvpd.exec:\dpvpd.exe103⤵PID:432
-
\??\c:\pjvjp.exec:\pjvjp.exe104⤵PID:2920
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe105⤵PID:3824
-
\??\c:\tntnnh.exec:\tntnnh.exe106⤵PID:3356
-
\??\c:\dvddd.exec:\dvddd.exe107⤵PID:2488
-
\??\c:\xrlfxfx.exec:\xrlfxfx.exe108⤵PID:4500
-
\??\c:\rfxfxxr.exec:\rfxfxxr.exe109⤵PID:3316
-
\??\c:\nhbhbb.exec:\nhbhbb.exe110⤵PID:4892
-
\??\c:\ntbtnn.exec:\ntbtnn.exe111⤵PID:440
-
\??\c:\jjjpd.exec:\jjjpd.exe112⤵PID:5080
-
\??\c:\7rllrrl.exec:\7rllrrl.exe113⤵PID:4000
-
\??\c:\hnttnn.exec:\hnttnn.exe114⤵PID:2160
-
\??\c:\bnhbtn.exec:\bnhbtn.exe115⤵PID:2052
-
\??\c:\vddpv.exec:\vddpv.exe116⤵PID:452
-
\??\c:\frrllll.exec:\frrllll.exe117⤵PID:428
-
\??\c:\bbhhhb.exec:\bbhhhb.exe118⤵PID:4436
-
\??\c:\bnhtnh.exec:\bnhtnh.exe119⤵PID:4188
-
\??\c:\jjdvd.exec:\jjdvd.exe120⤵
- System Location Discovery: System Language Discovery
PID:3084 -
\??\c:\3rrlflf.exec:\3rrlflf.exe121⤵PID:1504
-
\??\c:\bbbhbh.exec:\bbbhbh.exe122⤵PID:2092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-