Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe
Resource
win7-20240903-en
General
-
Target
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe
-
Size
453KB
-
MD5
1ed920f9954d0971060e9a75577cd7ac
-
SHA1
16f3876f008c05239a2ea00423cda1762a2959ac
-
SHA256
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720
-
SHA512
66ac63cab28eeddc2b79905b29fc94fff96ca64956406ee7e3e8aa71ba9bf00420627f45bf904a8bedf43b31091af88bd20a40267f363ad97214333224cd69c8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
Processes:
resource yara_rule behavioral2/memory/1656-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/984-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-928-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-971-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-1068-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-1465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3fxlffx.exenhnhhb.exe5jvpj.exe9ppjv.exefllxrlx.exevddvj.exethbthh.exe7rrlxrl.exejddvp.exenhbthb.exe5bbnbt.exerflrllf.exe9dddp.exe3frlrll.exebthtbh.exerlrrxxf.exe1rlfrrl.exepjdvp.exehhtbtt.exedpdpj.exetnnhhh.exelffxrrl.exehhtnhh.exexrxxlfx.exepvvjv.exenbhbbt.exevvjdj.exebnnbnh.exevvjvp.exelflfrrl.exetnhbtt.exedjddp.exevddvj.exexfffffx.exe1bbtnn.exebthbnn.exe3pjvj.exelfllrlx.exevjdpp.exexxlffff.exerrxlfxl.exehthhnh.exeddjdd.exerlllxrx.exehtbtnn.exenbhbtt.exejppdp.exeflrlfff.exehhnnhh.exevdvdp.exerllfrrl.exebnnhtn.exedpdvv.exepvjdv.exerflxrrl.exe3bhntt.exedvjjp.exedpvpj.exerrxrlxr.exebhbbtt.exevvvpj.exedpvvv.exelrlxfrl.exehtbnnn.exepid process 2852 3fxlffx.exe 2168 nhnhhb.exe 2364 5jvpj.exe 1036 9ppjv.exe 972 fllxrlx.exe 4944 vddvj.exe 3768 thbthh.exe 4948 7rrlxrl.exe 1664 jddvp.exe 4216 nhbthb.exe 984 5bbnbt.exe 4744 rflrllf.exe 4676 9dddp.exe 2552 3frlrll.exe 2840 bthtbh.exe 3512 rlrrxxf.exe 4832 1rlfrrl.exe 3704 pjdvp.exe 244 hhtbtt.exe 5044 dpdpj.exe 3036 tnnhhh.exe 2708 lffxrrl.exe 2164 hhtnhh.exe 3092 xrxxlfx.exe 3076 pvvjv.exe 1532 nbhbbt.exe 4176 vvjdj.exe 1896 bnnbnh.exe 908 vvjvp.exe 2388 lflfrrl.exe 1964 tnhbtt.exe 4552 djddp.exe 4268 vddvj.exe 2300 xfffffx.exe 2640 1bbtnn.exe 2508 bthbnn.exe 2956 3pjvj.exe 4732 lfllrlx.exe 1192 vjdpp.exe 2716 xxlffff.exe 2336 rrxlfxl.exe 4548 hthhnh.exe 1156 ddjdd.exe 1812 rlllxrx.exe 4628 htbtnn.exe 4708 nbhbtt.exe 3584 jppdp.exe 1040 flrlfff.exe 4840 hhnnhh.exe 3392 vdvdp.exe 1656 rllfrrl.exe 1972 bnnhtn.exe 3676 dpdvv.exe 3396 pvjdv.exe 2364 rflxrrl.exe 3608 3bhntt.exe 1036 dvjjp.exe 3112 dpvpj.exe 4748 rrxrlxr.exe 4408 bhbbtt.exe 2772 vvvpj.exe 4760 dpvvv.exe 4872 lrlxfrl.exe 2700 htbnnn.exe -
Processes:
resource yara_rule behavioral2/memory/1656-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/984-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-1068-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
xlxxrrr.exenhnhhb.exebntnnn.exedvpjv.exepddvp.exefrrllrl.exe1bnhbt.exerxxrrlf.exepjppd.exebnhhbb.exepvdvj.exevjdpp.exehtbtnn.exebthhnn.exelxlfrrr.exepvdvp.exebtnnhh.exepvvjv.exe3tnnbb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe3fxlffx.exenhnhhb.exe5jvpj.exe9ppjv.exefllxrlx.exevddvj.exethbthh.exe7rrlxrl.exejddvp.exenhbthb.exe5bbnbt.exerflrllf.exe9dddp.exe3frlrll.exebthtbh.exerlrrxxf.exe1rlfrrl.exepjdvp.exehhtbtt.exedpdpj.exetnnhhh.exedescription pid process target process PID 1656 wrote to memory of 2852 1656 98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe 3fxlffx.exe PID 1656 wrote to memory of 2852 1656 98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe 3fxlffx.exe PID 1656 wrote to memory of 2852 1656 98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe 3fxlffx.exe PID 2852 wrote to memory of 2168 2852 3fxlffx.exe nhnhhb.exe PID 2852 wrote to memory of 2168 2852 3fxlffx.exe nhnhhb.exe PID 2852 wrote to memory of 2168 2852 3fxlffx.exe nhnhhb.exe PID 2168 wrote to memory of 2364 2168 nhnhhb.exe 5jvpj.exe PID 2168 wrote to memory of 2364 2168 nhnhhb.exe 5jvpj.exe PID 2168 wrote to memory of 2364 2168 nhnhhb.exe 5jvpj.exe PID 2364 wrote to memory of 1036 2364 5jvpj.exe 9ppjv.exe PID 2364 wrote to memory of 1036 2364 5jvpj.exe 9ppjv.exe PID 2364 wrote to memory of 1036 2364 5jvpj.exe 9ppjv.exe PID 1036 wrote to memory of 972 1036 9ppjv.exe fllxrlx.exe PID 1036 wrote to memory of 972 1036 9ppjv.exe fllxrlx.exe PID 1036 wrote to memory of 972 1036 9ppjv.exe fllxrlx.exe PID 972 wrote to memory of 4944 972 fllxrlx.exe vddvj.exe PID 972 wrote to memory of 4944 972 fllxrlx.exe vddvj.exe PID 972 wrote to memory of 4944 972 fllxrlx.exe vddvj.exe PID 4944 wrote to memory of 3768 4944 vddvj.exe thbthh.exe PID 4944 wrote to memory of 3768 4944 vddvj.exe thbthh.exe PID 4944 wrote to memory of 3768 4944 vddvj.exe thbthh.exe PID 3768 wrote to memory of 4948 3768 thbthh.exe 7rrlxrl.exe PID 3768 wrote to memory of 4948 3768 thbthh.exe 7rrlxrl.exe PID 3768 wrote to memory of 4948 3768 thbthh.exe 7rrlxrl.exe PID 4948 wrote to memory of 1664 4948 7rrlxrl.exe jddvp.exe PID 4948 wrote to memory of 1664 4948 7rrlxrl.exe jddvp.exe PID 4948 wrote to memory of 1664 4948 7rrlxrl.exe jddvp.exe PID 1664 wrote to memory of 4216 1664 jddvp.exe nhbthb.exe PID 1664 wrote to memory of 4216 1664 jddvp.exe nhbthb.exe PID 1664 wrote to memory of 4216 1664 jddvp.exe nhbthb.exe PID 4216 wrote to memory of 984 4216 nhbthb.exe 5bbnbt.exe PID 4216 wrote to memory of 984 4216 nhbthb.exe 5bbnbt.exe PID 4216 wrote to memory of 984 4216 nhbthb.exe 5bbnbt.exe PID 984 wrote to memory of 4744 984 5bbnbt.exe rflrllf.exe PID 984 wrote to memory of 4744 984 5bbnbt.exe rflrllf.exe PID 984 wrote to memory of 4744 984 5bbnbt.exe rflrllf.exe PID 4744 wrote to memory of 4676 4744 rflrllf.exe 9dddp.exe PID 4744 wrote to memory of 4676 4744 rflrllf.exe 9dddp.exe PID 4744 wrote to memory of 4676 4744 rflrllf.exe 9dddp.exe PID 4676 wrote to memory of 2552 4676 9dddp.exe 3frlrll.exe PID 4676 wrote to memory of 2552 4676 9dddp.exe 3frlrll.exe PID 4676 wrote to memory of 2552 4676 9dddp.exe 3frlrll.exe PID 2552 wrote to memory of 2840 2552 3frlrll.exe bthtbh.exe PID 2552 wrote to memory of 2840 2552 3frlrll.exe bthtbh.exe PID 2552 wrote to memory of 2840 2552 3frlrll.exe bthtbh.exe PID 2840 wrote to memory of 3512 2840 bthtbh.exe rlrrxxf.exe PID 2840 wrote to memory of 3512 2840 bthtbh.exe rlrrxxf.exe PID 2840 wrote to memory of 3512 2840 bthtbh.exe rlrrxxf.exe PID 3512 wrote to memory of 4832 3512 rlrrxxf.exe 1rlfrrl.exe PID 3512 wrote to memory of 4832 3512 rlrrxxf.exe 1rlfrrl.exe PID 3512 wrote to memory of 4832 3512 rlrrxxf.exe 1rlfrrl.exe PID 4832 wrote to memory of 3704 4832 1rlfrrl.exe pjdvp.exe PID 4832 wrote to memory of 3704 4832 1rlfrrl.exe pjdvp.exe PID 4832 wrote to memory of 3704 4832 1rlfrrl.exe pjdvp.exe PID 3704 wrote to memory of 244 3704 pjdvp.exe hhtbtt.exe PID 3704 wrote to memory of 244 3704 pjdvp.exe hhtbtt.exe PID 3704 wrote to memory of 244 3704 pjdvp.exe hhtbtt.exe PID 244 wrote to memory of 5044 244 hhtbtt.exe dpdpj.exe PID 244 wrote to memory of 5044 244 hhtbtt.exe dpdpj.exe PID 244 wrote to memory of 5044 244 hhtbtt.exe dpdpj.exe PID 5044 wrote to memory of 3036 5044 dpdpj.exe tnnhhh.exe PID 5044 wrote to memory of 3036 5044 dpdpj.exe tnnhhh.exe PID 5044 wrote to memory of 3036 5044 dpdpj.exe tnnhhh.exe PID 3036 wrote to memory of 2708 3036 tnnhhh.exe lffxrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe"C:\Users\Admin\AppData\Local\Temp\98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\3fxlffx.exec:\3fxlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nhnhhb.exec:\nhnhhb.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\5jvpj.exec:\5jvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\9ppjv.exec:\9ppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\fllxrlx.exec:\fllxrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\vddvj.exec:\vddvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\thbthh.exec:\thbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\7rrlxrl.exec:\7rrlxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\jddvp.exec:\jddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\nhbthb.exec:\nhbthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\5bbnbt.exec:\5bbnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\rflrllf.exec:\rflrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\9dddp.exec:\9dddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\3frlrll.exec:\3frlrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bthtbh.exec:\bthtbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\1rlfrrl.exec:\1rlfrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\pjdvp.exec:\pjdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\hhtbtt.exec:\hhtbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\dpdpj.exec:\dpdpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\tnnhhh.exec:\tnnhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lffxrrl.exec:\lffxrrl.exe23⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hhtnhh.exec:\hhtnhh.exe24⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xrxxlfx.exec:\xrxxlfx.exe25⤵
- Executes dropped EXE
PID:3092 -
\??\c:\pvvjv.exec:\pvvjv.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3076 -
\??\c:\nbhbbt.exec:\nbhbbt.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vvjdj.exec:\vvjdj.exe28⤵
- Executes dropped EXE
PID:4176 -
\??\c:\bnnbnh.exec:\bnnbnh.exe29⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vvjvp.exec:\vvjvp.exe30⤵
- Executes dropped EXE
PID:908 -
\??\c:\lflfrrl.exec:\lflfrrl.exe31⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tnhbtt.exec:\tnhbtt.exe32⤵
- Executes dropped EXE
PID:1964 -
\??\c:\djddp.exec:\djddp.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\vddvj.exec:\vddvj.exe34⤵
- Executes dropped EXE
PID:4268 -
\??\c:\xfffffx.exec:\xfffffx.exe35⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1bbtnn.exec:\1bbtnn.exe36⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bthbnn.exec:\bthbnn.exe37⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3pjvj.exec:\3pjvj.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lfllrlx.exec:\lfllrlx.exe39⤵
- Executes dropped EXE
PID:4732 -
\??\c:\vjdpp.exec:\vjdpp.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1192 -
\??\c:\xxlffff.exec:\xxlffff.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rrxlfxl.exec:\rrxlfxl.exe42⤵
- Executes dropped EXE
PID:2336 -
\??\c:\hthhnh.exec:\hthhnh.exe43⤵
- Executes dropped EXE
PID:4548 -
\??\c:\ddjdd.exec:\ddjdd.exe44⤵
- Executes dropped EXE
PID:1156 -
\??\c:\rlllxrx.exec:\rlllxrx.exe45⤵
- Executes dropped EXE
PID:1812 -
\??\c:\htbtnn.exec:\htbtnn.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4628 -
\??\c:\nbhbtt.exec:\nbhbtt.exe47⤵
- Executes dropped EXE
PID:4708 -
\??\c:\jppdp.exec:\jppdp.exe48⤵
- Executes dropped EXE
PID:3584 -
\??\c:\flrlfff.exec:\flrlfff.exe49⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hhnnhh.exec:\hhnnhh.exe50⤵
- Executes dropped EXE
PID:4840 -
\??\c:\vdvdp.exec:\vdvdp.exe51⤵
- Executes dropped EXE
PID:3392 -
\??\c:\rllfrrl.exec:\rllfrrl.exe52⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bnnhtn.exec:\bnnhtn.exe53⤵
- Executes dropped EXE
PID:1972 -
\??\c:\dpdvv.exec:\dpdvv.exe54⤵
- Executes dropped EXE
PID:3676 -
\??\c:\pvjdv.exec:\pvjdv.exe55⤵
- Executes dropped EXE
PID:3396 -
\??\c:\rflxrrl.exec:\rflxrrl.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3bhntt.exec:\3bhntt.exe57⤵
- Executes dropped EXE
PID:3608 -
\??\c:\dvjjp.exec:\dvjjp.exe58⤵
- Executes dropped EXE
PID:1036 -
\??\c:\dpvpj.exec:\dpvpj.exe59⤵
- Executes dropped EXE
PID:3112 -
\??\c:\rrxrlxr.exec:\rrxrlxr.exe60⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bhbbtt.exec:\bhbbtt.exe61⤵
- Executes dropped EXE
PID:4408 -
\??\c:\vvvpj.exec:\vvvpj.exe62⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dpvvv.exec:\dpvvv.exe63⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lrlxfrl.exec:\lrlxfrl.exe64⤵
- Executes dropped EXE
PID:4872 -
\??\c:\htbnnn.exec:\htbnnn.exe65⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jvvjd.exec:\jvvjd.exe66⤵PID:1440
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe67⤵PID:1276
-
\??\c:\htnnhn.exec:\htnnhn.exe68⤵PID:1272
-
\??\c:\jjdvj.exec:\jjdvj.exe69⤵PID:4960
-
\??\c:\xrfrlfx.exec:\xrfrlfx.exe70⤵PID:2760
-
\??\c:\9nhhbh.exec:\9nhhbh.exe71⤵PID:444
-
\??\c:\3ntnnn.exec:\3ntnnn.exe72⤵PID:2160
-
\??\c:\9pvvp.exec:\9pvvp.exe73⤵PID:116
-
\??\c:\llllfxr.exec:\llllfxr.exe74⤵PID:3424
-
\??\c:\hbhbtt.exec:\hbhbtt.exe75⤵PID:2800
-
\??\c:\1vvpd.exec:\1vvpd.exe76⤵PID:4900
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe77⤵
- System Location Discovery: System Language Discovery
PID:2136 -
\??\c:\lrffxxr.exec:\lrffxxr.exe78⤵PID:3240
-
\??\c:\htbtnb.exec:\htbtnb.exe79⤵PID:2708
-
\??\c:\vjpjj.exec:\vjpjj.exe80⤵PID:4240
-
\??\c:\jjjdd.exec:\jjjdd.exe81⤵PID:2628
-
\??\c:\lrffxxl.exec:\lrffxxl.exe82⤵PID:4888
-
\??\c:\bttnhb.exec:\bttnhb.exe83⤵PID:3076
-
\??\c:\vjjvj.exec:\vjjvj.exe84⤵PID:2680
-
\??\c:\frxxrxr.exec:\frxxrxr.exe85⤵PID:3964
-
\??\c:\hhbthb.exec:\hhbthb.exe86⤵PID:3592
-
\??\c:\jdvpj.exec:\jdvpj.exe87⤵PID:3548
-
\??\c:\rllfrlf.exec:\rllfrlf.exe88⤵PID:3640
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe89⤵PID:404
-
\??\c:\htbbtn.exec:\htbbtn.exe90⤵PID:2724
-
\??\c:\vdpjd.exec:\vdpjd.exe91⤵PID:4692
-
\??\c:\7jvvj.exec:\7jvvj.exe92⤵PID:2696
-
\??\c:\xxfxllx.exec:\xxfxllx.exe93⤵PID:4268
-
\??\c:\hntnhb.exec:\hntnhb.exe94⤵PID:2632
-
\??\c:\3ddpd.exec:\3ddpd.exe95⤵PID:2640
-
\??\c:\5xxrrfx.exec:\5xxrrfx.exe96⤵PID:5056
-
\??\c:\hhnhbb.exec:\hhnhbb.exe97⤵PID:2956
-
\??\c:\nhnnnn.exec:\nhnnnn.exe98⤵PID:2240
-
\??\c:\djjdj.exec:\djjdj.exe99⤵PID:1400
-
\??\c:\xrrlffx.exec:\xrrlffx.exe100⤵PID:4080
-
\??\c:\ffrxrlf.exec:\ffrxrlf.exe101⤵PID:1456
-
\??\c:\tbhtnn.exec:\tbhtnn.exe102⤵PID:1556
-
\??\c:\9ppjv.exec:\9ppjv.exe103⤵PID:2076
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe104⤵PID:3600
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe105⤵
- System Location Discovery: System Language Discovery
PID:464 -
\??\c:\nbhbbt.exec:\nbhbbt.exe106⤵PID:1196
-
\??\c:\ppdpp.exec:\ppdpp.exe107⤵PID:1828
-
\??\c:\rxlfflf.exec:\rxlfflf.exe108⤵PID:3524
-
\??\c:\rrxffff.exec:\rrxffff.exe109⤵PID:3056
-
\??\c:\bbhttn.exec:\bbhttn.exe110⤵PID:4456
-
\??\c:\1djdp.exec:\1djdp.exe111⤵PID:3392
-
\??\c:\7ffxllf.exec:\7ffxllf.exe112⤵PID:1032
-
\??\c:\frlrfxf.exec:\frlrfxf.exe113⤵PID:1268
-
\??\c:\tbhbtt.exec:\tbhbtt.exe114⤵PID:5012
-
\??\c:\pvdvp.exec:\pvdvp.exe115⤵
- System Location Discovery: System Language Discovery
PID:3388 -
\??\c:\jjpdv.exec:\jjpdv.exe116⤵PID:3504
-
\??\c:\nnthtn.exec:\nnthtn.exe117⤵PID:3608
-
\??\c:\nbnbtn.exec:\nbnbtn.exe118⤵PID:2208
-
\??\c:\vjdvp.exec:\vjdvp.exe119⤵PID:1036
-
\??\c:\llxllxr.exec:\llxllxr.exe120⤵PID:3544
-
\??\c:\llrrrrr.exec:\llrrrrr.exe121⤵PID:5008
-
\??\c:\vjdvp.exec:\vjdvp.exe122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-