Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 23:37
Static task
static1
Behavioral task
behavioral1
Sample
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe
Resource
win7-20240903-en
General
-
Target
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe
-
Size
453KB
-
MD5
afefe191cfec1baabd209d2703abb81a
-
SHA1
5858b3c6b969b349839f60e270d866c8b22d53f9
-
SHA256
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87
-
SHA512
7dd47d17caa2f9d66150b49d02fddd182bb71207c5b9dbc08d7372b02dd26de526430aefd61555d45a6f526e9f96c4a58e4554b9fdaac83ad41bb65f979a7424
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1612-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/656-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-753-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-757-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5vjdj.exexlrllll.exe3xffflr.exenbhhbn.exexxxxflx.exehtbtnn.exefllrfff.exeddjdd.exexxffffl.exevjpjv.exexlrlrxf.exebbtnnn.exevvdvv.exellrxxlf.exettttnh.exedppjd.exellrrllf.exexrllfrr.exejdpvd.exelllfflf.exebthttn.exenhnttt.exe5dvvj.exetbnnbt.exedppdv.exe9lfflrr.exehhhtbh.exejpjdd.exeppdpv.exexrxrrxx.exehbhbtb.exevpvjv.exefrlrllr.exe3btntn.exe9tnnhh.exe5jdpj.exelfffxll.exenntntt.exe3hnnbb.exefxxrffr.exehtnthn.exepjpdd.exexxxxxll.exetnnnnh.exeflfffll.exepdddv.exefrxxrrl.exethhhhh.exejdvjd.exeflrfxfl.exentnnhh.exenthhhh.exe1jjdd.exefrxrrrr.exetthbhh.exehbbttb.exedpvvp.exe1ffxflf.exefrlflxf.exe3nthth.exe1vdvp.exejpvpp.exe5xxxrfx.exennnnnn.exepid process 2740 5vjdj.exe 3212 xlrllll.exe 2608 3xffflr.exe 2172 nbhhbn.exe 3236 xxxxflx.exe 4528 htbtnn.exe 2108 fllrfff.exe 3472 ddjdd.exe 1312 xxffffl.exe 516 vjpjv.exe 2052 xlrlrxf.exe 4724 bbtnnn.exe 972 vvdvv.exe 2964 llrxxlf.exe 2676 ttttnh.exe 656 dppjd.exe 5004 llrrllf.exe 2500 xrllfrr.exe 632 jdpvd.exe 1876 lllfflf.exe 2540 bthttn.exe 2772 nhnttt.exe 4452 5dvvj.exe 4204 tbnnbt.exe 3864 dppdv.exe 724 9lfflrr.exe 2792 hhhtbh.exe 4208 jpjdd.exe 3916 ppdpv.exe 4992 xrxrrxx.exe 3292 hbhbtb.exe 3852 vpvjv.exe 1908 frlrllr.exe 988 3btntn.exe 812 9tnnhh.exe 5008 5jdpj.exe 3664 lfffxll.exe 4832 nntntt.exe 1048 3hnnbb.exe 4856 fxxrffr.exe 3984 htnthn.exe 4032 pjpdd.exe 4360 xxxxxll.exe 3100 tnnnnh.exe 2852 flfffll.exe 1924 pdddv.exe 4024 frxxrrl.exe 2036 thhhhh.exe 2244 jdvjd.exe 3232 flrfxfl.exe 3300 ntnnhh.exe 3624 nthhhh.exe 5044 1jjdd.exe 2596 frxrrrr.exe 2320 tthbhh.exe 456 hbbttb.exe 4600 dpvvp.exe 3284 1ffxflf.exe 3652 frlflxf.exe 4292 3nthth.exe 3548 1vdvp.exe 2052 jpvpp.exe 3928 5xxxrfx.exe 3436 nnnnnn.exe -
Processes:
resource yara_rule behavioral2/memory/1612-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/656-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-506-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
vdjdd.exebhthnt.exebhnhbb.exevjppv.exepvddj.exe3lxxrrl.exe1btbtn.exenhnhbh.exetnnnnn.exe3vppv.exepjpdd.exedjjvd.exedvddv.exejjjjv.exe3vddj.exerxxxxrr.exevdjdj.exerrrlllf.exejdjjj.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe5vjdj.exexlrllll.exe3xffflr.exenbhhbn.exexxxxflx.exehtbtnn.exefllrfff.exeddjdd.exexxffffl.exevjpjv.exexlrlrxf.exebbtnnn.exevvdvv.exellrxxlf.exettttnh.exedppjd.exellrrllf.exexrllfrr.exejdpvd.exelllfflf.exebthttn.exedescription pid process target process PID 1612 wrote to memory of 2740 1612 4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe 5vjdj.exe PID 1612 wrote to memory of 2740 1612 4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe 5vjdj.exe PID 1612 wrote to memory of 2740 1612 4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe 5vjdj.exe PID 2740 wrote to memory of 3212 2740 5vjdj.exe xlrllll.exe PID 2740 wrote to memory of 3212 2740 5vjdj.exe xlrllll.exe PID 2740 wrote to memory of 3212 2740 5vjdj.exe xlrllll.exe PID 3212 wrote to memory of 2608 3212 xlrllll.exe 3xffflr.exe PID 3212 wrote to memory of 2608 3212 xlrllll.exe 3xffflr.exe PID 3212 wrote to memory of 2608 3212 xlrllll.exe 3xffflr.exe PID 2608 wrote to memory of 2172 2608 3xffflr.exe nbhhbn.exe PID 2608 wrote to memory of 2172 2608 3xffflr.exe nbhhbn.exe PID 2608 wrote to memory of 2172 2608 3xffflr.exe nbhhbn.exe PID 2172 wrote to memory of 3236 2172 nbhhbn.exe xxxxflx.exe PID 2172 wrote to memory of 3236 2172 nbhhbn.exe xxxxflx.exe PID 2172 wrote to memory of 3236 2172 nbhhbn.exe xxxxflx.exe PID 3236 wrote to memory of 4528 3236 xxxxflx.exe htbtnn.exe PID 3236 wrote to memory of 4528 3236 xxxxflx.exe htbtnn.exe PID 3236 wrote to memory of 4528 3236 xxxxflx.exe htbtnn.exe PID 4528 wrote to memory of 2108 4528 htbtnn.exe fllrfff.exe PID 4528 wrote to memory of 2108 4528 htbtnn.exe fllrfff.exe PID 4528 wrote to memory of 2108 4528 htbtnn.exe fllrfff.exe PID 2108 wrote to memory of 3472 2108 fllrfff.exe ddjdd.exe PID 2108 wrote to memory of 3472 2108 fllrfff.exe ddjdd.exe PID 2108 wrote to memory of 3472 2108 fllrfff.exe ddjdd.exe PID 3472 wrote to memory of 1312 3472 ddjdd.exe xxffffl.exe PID 3472 wrote to memory of 1312 3472 ddjdd.exe xxffffl.exe PID 3472 wrote to memory of 1312 3472 ddjdd.exe xxffffl.exe PID 1312 wrote to memory of 516 1312 xxffffl.exe vjpjv.exe PID 1312 wrote to memory of 516 1312 xxffffl.exe vjpjv.exe PID 1312 wrote to memory of 516 1312 xxffffl.exe vjpjv.exe PID 516 wrote to memory of 2052 516 vjpjv.exe xlrlrxf.exe PID 516 wrote to memory of 2052 516 vjpjv.exe xlrlrxf.exe PID 516 wrote to memory of 2052 516 vjpjv.exe xlrlrxf.exe PID 2052 wrote to memory of 4724 2052 xlrlrxf.exe bbtnnn.exe PID 2052 wrote to memory of 4724 2052 xlrlrxf.exe bbtnnn.exe PID 2052 wrote to memory of 4724 2052 xlrlrxf.exe bbtnnn.exe PID 4724 wrote to memory of 972 4724 bbtnnn.exe vvdvv.exe PID 4724 wrote to memory of 972 4724 bbtnnn.exe vvdvv.exe PID 4724 wrote to memory of 972 4724 bbtnnn.exe vvdvv.exe PID 972 wrote to memory of 2964 972 vvdvv.exe llrxxlf.exe PID 972 wrote to memory of 2964 972 vvdvv.exe llrxxlf.exe PID 972 wrote to memory of 2964 972 vvdvv.exe llrxxlf.exe PID 2964 wrote to memory of 2676 2964 llrxxlf.exe ttttnh.exe PID 2964 wrote to memory of 2676 2964 llrxxlf.exe ttttnh.exe PID 2964 wrote to memory of 2676 2964 llrxxlf.exe ttttnh.exe PID 2676 wrote to memory of 656 2676 ttttnh.exe dppjd.exe PID 2676 wrote to memory of 656 2676 ttttnh.exe dppjd.exe PID 2676 wrote to memory of 656 2676 ttttnh.exe dppjd.exe PID 656 wrote to memory of 5004 656 dppjd.exe llrrllf.exe PID 656 wrote to memory of 5004 656 dppjd.exe llrrllf.exe PID 656 wrote to memory of 5004 656 dppjd.exe llrrllf.exe PID 5004 wrote to memory of 2500 5004 llrrllf.exe xrllfrr.exe PID 5004 wrote to memory of 2500 5004 llrrllf.exe xrllfrr.exe PID 5004 wrote to memory of 2500 5004 llrrllf.exe xrllfrr.exe PID 2500 wrote to memory of 632 2500 xrllfrr.exe jdpvd.exe PID 2500 wrote to memory of 632 2500 xrllfrr.exe jdpvd.exe PID 2500 wrote to memory of 632 2500 xrllfrr.exe jdpvd.exe PID 632 wrote to memory of 1876 632 jdpvd.exe lllfflf.exe PID 632 wrote to memory of 1876 632 jdpvd.exe lllfflf.exe PID 632 wrote to memory of 1876 632 jdpvd.exe lllfflf.exe PID 1876 wrote to memory of 2540 1876 lllfflf.exe dddjd.exe PID 1876 wrote to memory of 2540 1876 lllfflf.exe dddjd.exe PID 1876 wrote to memory of 2540 1876 lllfflf.exe dddjd.exe PID 2540 wrote to memory of 2772 2540 bthttn.exe 3rlfffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe"C:\Users\Admin\AppData\Local\Temp\4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\5vjdj.exec:\5vjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xlrllll.exec:\xlrllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\3xffflr.exec:\3xffflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nbhhbn.exec:\nbhhbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\xxxxflx.exec:\xxxxflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\htbtnn.exec:\htbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\fllrfff.exec:\fllrfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ddjdd.exec:\ddjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\xxffffl.exec:\xxffffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\vjpjv.exec:\vjpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\xlrlrxf.exec:\xlrlrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\bbtnnn.exec:\bbtnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\vvdvv.exec:\vvdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\llrxxlf.exec:\llrxxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ttttnh.exec:\ttttnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\dppjd.exec:\dppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\llrrllf.exec:\llrrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\xrllfrr.exec:\xrllfrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jdpvd.exec:\jdpvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\lllfflf.exec:\lllfflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\bthttn.exec:\bthttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nhnttt.exec:\nhnttt.exe23⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5dvvj.exec:\5dvvj.exe24⤵
- Executes dropped EXE
PID:4452 -
\??\c:\tbnnbt.exec:\tbnnbt.exe25⤵
- Executes dropped EXE
PID:4204 -
\??\c:\dppdv.exec:\dppdv.exe26⤵
- Executes dropped EXE
PID:3864 -
\??\c:\9lfflrr.exec:\9lfflrr.exe27⤵
- Executes dropped EXE
PID:724 -
\??\c:\hhhtbh.exec:\hhhtbh.exe28⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jpjdd.exec:\jpjdd.exe29⤵
- Executes dropped EXE
PID:4208 -
\??\c:\ppdpv.exec:\ppdpv.exe30⤵
- Executes dropped EXE
PID:3916 -
\??\c:\xrxrrxx.exec:\xrxrrxx.exe31⤵
- Executes dropped EXE
PID:4992 -
\??\c:\hbhbtb.exec:\hbhbtb.exe32⤵
- Executes dropped EXE
PID:3292 -
\??\c:\vpvjv.exec:\vpvjv.exe33⤵
- Executes dropped EXE
PID:3852 -
\??\c:\frlrllr.exec:\frlrllr.exe34⤵
- Executes dropped EXE
PID:1908 -
\??\c:\3btntn.exec:\3btntn.exe35⤵
- Executes dropped EXE
PID:988 -
\??\c:\9tnnhh.exec:\9tnnhh.exe36⤵
- Executes dropped EXE
PID:812 -
\??\c:\5jdpj.exec:\5jdpj.exe37⤵
- Executes dropped EXE
PID:5008 -
\??\c:\lfffxll.exec:\lfffxll.exe38⤵
- Executes dropped EXE
PID:3664 -
\??\c:\nntntt.exec:\nntntt.exe39⤵
- Executes dropped EXE
PID:4832 -
\??\c:\3hnnbb.exec:\3hnnbb.exe40⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vjvdj.exec:\vjvdj.exe41⤵PID:4420
-
\??\c:\fxxrffr.exec:\fxxrffr.exe42⤵
- Executes dropped EXE
PID:4856 -
\??\c:\htnthn.exec:\htnthn.exe43⤵
- Executes dropped EXE
PID:3984 -
\??\c:\pjpdd.exec:\pjpdd.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4032 -
\??\c:\xxxxxll.exec:\xxxxxll.exe45⤵
- Executes dropped EXE
PID:4360 -
\??\c:\tnnnnh.exec:\tnnnnh.exe46⤵
- Executes dropped EXE
PID:3100 -
\??\c:\flfffll.exec:\flfffll.exe47⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pdddv.exec:\pdddv.exe48⤵
- Executes dropped EXE
PID:1924 -
\??\c:\frxxrrl.exec:\frxxrrl.exe49⤵
- Executes dropped EXE
PID:4024 -
\??\c:\thhhhh.exec:\thhhhh.exe50⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jdvjd.exec:\jdvjd.exe51⤵
- Executes dropped EXE
PID:2244 -
\??\c:\flrfxfl.exec:\flrfxfl.exe52⤵
- Executes dropped EXE
PID:3232 -
\??\c:\ntnnhh.exec:\ntnnhh.exe53⤵
- Executes dropped EXE
PID:3300 -
\??\c:\nthhhh.exec:\nthhhh.exe54⤵
- Executes dropped EXE
PID:3624 -
\??\c:\1jjdd.exec:\1jjdd.exe55⤵
- Executes dropped EXE
PID:5044 -
\??\c:\frxrrrr.exec:\frxrrrr.exe56⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tthbhh.exec:\tthbhh.exe57⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hbbttb.exec:\hbbttb.exe58⤵
- Executes dropped EXE
PID:456 -
\??\c:\dpvvp.exec:\dpvvp.exe59⤵
- Executes dropped EXE
PID:4600 -
\??\c:\1ffxflf.exec:\1ffxflf.exe60⤵
- Executes dropped EXE
PID:3284 -
\??\c:\frlflxf.exec:\frlflxf.exe61⤵
- Executes dropped EXE
PID:3652 -
\??\c:\3nthth.exec:\3nthth.exe62⤵
- Executes dropped EXE
PID:4292 -
\??\c:\1vdvp.exec:\1vdvp.exe63⤵
- Executes dropped EXE
PID:3548 -
\??\c:\jpvpp.exec:\jpvpp.exe64⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5xxxrfx.exec:\5xxxrfx.exe65⤵
- Executes dropped EXE
PID:3928 -
\??\c:\nnnnnn.exec:\nnnnnn.exe66⤵
- Executes dropped EXE
PID:3436 -
\??\c:\djvvd.exec:\djvvd.exe67⤵PID:1816
-
\??\c:\ffrlllr.exec:\ffrlllr.exe68⤵PID:1284
-
\??\c:\7rrrlff.exec:\7rrrlff.exe69⤵PID:2692
-
\??\c:\bhthnt.exec:\bhthnt.exe70⤵
- System Location Discovery: System Language Discovery
PID:2420 -
\??\c:\vdjvd.exec:\vdjvd.exe71⤵PID:2444
-
\??\c:\5vppp.exec:\5vppp.exe72⤵PID:3076
-
\??\c:\fxfxfxr.exec:\fxfxfxr.exe73⤵PID:1696
-
\??\c:\ntbbbb.exec:\ntbbbb.exe74⤵PID:4416
-
\??\c:\hthbhh.exec:\hthbhh.exe75⤵PID:2744
-
\??\c:\dddjd.exec:\dddjd.exe76⤵PID:2540
-
\??\c:\3rlfffx.exec:\3rlfffx.exe77⤵PID:2772
-
\??\c:\hhttht.exec:\hhttht.exe78⤵PID:768
-
\??\c:\pdjdd.exec:\pdjdd.exe79⤵PID:5112
-
\??\c:\pdpdp.exec:\pdpdp.exe80⤵PID:4220
-
\??\c:\xrxlrrl.exec:\xrxlrrl.exe81⤵PID:2180
-
\??\c:\9bttnn.exec:\9bttnn.exe82⤵PID:2600
-
\??\c:\nhttnt.exec:\nhttnt.exe83⤵PID:1424
-
\??\c:\9dvpp.exec:\9dvpp.exe84⤵PID:3508
-
\??\c:\3lxxrrl.exec:\3lxxrrl.exe85⤵
- System Location Discovery: System Language Discovery
PID:1524 -
\??\c:\fllfxff.exec:\fllfxff.exe86⤵PID:2388
-
\??\c:\bbnhnh.exec:\bbnhnh.exe87⤵PID:2572
-
\??\c:\3jjdv.exec:\3jjdv.exe88⤵PID:4208
-
\??\c:\ffrrflx.exec:\ffrrflx.exe89⤵PID:3940
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe90⤵PID:3964
-
\??\c:\hbhntn.exec:\hbhntn.exe91⤵PID:3476
-
\??\c:\vdjpp.exec:\vdjpp.exe92⤵PID:2880
-
\??\c:\hbthnb.exec:\hbthnb.exe93⤵PID:4296
-
\??\c:\7vjjd.exec:\7vjjd.exe94⤵PID:3484
-
\??\c:\flrllll.exec:\flrllll.exe95⤵PID:1724
-
\??\c:\9bnhtt.exec:\9bnhtt.exe96⤵PID:812
-
\??\c:\jjvvv.exec:\jjvvv.exe97⤵PID:1404
-
\??\c:\lflfrlf.exec:\lflfrlf.exe98⤵PID:4492
-
\??\c:\hbbtnb.exec:\hbbtnb.exe99⤵PID:464
-
\??\c:\vvppd.exec:\vvppd.exe100⤵PID:1616
-
\??\c:\xxrlfll.exec:\xxrlfll.exe101⤵PID:2824
-
\??\c:\bbbbbh.exec:\bbbbbh.exe102⤵PID:1612
-
\??\c:\3xffxfx.exec:\3xffxfx.exe103⤵PID:1880
-
\??\c:\nbnhbb.exec:\nbnhbb.exe104⤵PID:1952
-
\??\c:\djddd.exec:\djddd.exe105⤵PID:1684
-
\??\c:\lxxxxxl.exec:\lxxxxxl.exe106⤵PID:2664
-
\??\c:\nnnhnt.exec:\nnnhnt.exe107⤵PID:3100
-
\??\c:\hhbbnt.exec:\hhbbnt.exe108⤵PID:5000
-
\??\c:\9vdvp.exec:\9vdvp.exe109⤵PID:3256
-
\??\c:\3ffflxl.exec:\3ffflxl.exe110⤵PID:1828
-
\??\c:\djvpv.exec:\djvpv.exe111⤵PID:4024
-
\??\c:\hthttt.exec:\hthttt.exe112⤵PID:4948
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe113⤵PID:4468
-
\??\c:\tntnbn.exec:\tntnbn.exe114⤵PID:4868
-
\??\c:\vvvpp.exec:\vvvpp.exe115⤵PID:1900
-
\??\c:\tbttnh.exec:\tbttnh.exe116⤵PID:4928
-
\??\c:\vjjjj.exec:\vjjjj.exe117⤵PID:5044
-
\??\c:\lrxrllf.exec:\lrxrllf.exe118⤵PID:2108
-
\??\c:\jjpvp.exec:\jjpvp.exe119⤵PID:1988
-
\??\c:\xfxfxlf.exec:\xfxfxlf.exe120⤵PID:456
-
\??\c:\rllfxxx.exec:\rllfxxx.exe121⤵PID:1312
-
\??\c:\thnnnt.exec:\thnnnt.exe122⤵PID:2028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-