Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 03:17
Static task
static1
Behavioral task
behavioral1
Sample
b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe
Resource
win7-20240903-en
General
-
Target
b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe
-
Size
456KB
-
MD5
dc96d6a7edaefc3e2a9326960717e0a5
-
SHA1
c4dc229899816846fea37cb43050c58986d68e56
-
SHA256
b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5
-
SHA512
f22ade96126e35d2a11caaaf380670d23b5c0e3b3eea74acf89d9dd245ce31e8c463bd095278c58599198a8a08cc5c2127a629c9992c56e6d2fb43da780371fa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRwB:q7Tc2NYHUrAwfMp3CDRwB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4860-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-882-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-1257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-1568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xffflrf.exelfllxrf.exevvvjd.exe3pjdp.exefflrxrx.exerfrrrrx.exefflffrr.exehtbbhb.exedjdvv.exelrrxrxl.exehtnnnt.exe3bhhhn.exe9jdvv.exettthbn.exelxxfxrl.exe3nhbbh.exejpjpp.exefffrxrx.exedvvpj.exeflflrxf.exebnhbnh.exelfxflrx.exexxfxxrr.exepppjd.exeppvdj.exefxxrxrl.exetnnbnt.exexlxffxl.exehbhtht.exevvvvp.exerffflfx.exe5flrfxf.exedpvjj.exexllxrlx.exefxrllff.exebttnnh.exevpjvj.exefllxrlx.exexflllxx.exebnbthb.exepdpdj.exexfxfrrf.exetttnbt.exevjpdv.exe1pvjp.exe3rllfxr.exenhhhnn.exehttbbh.exevjvdp.exe7lxlxfx.exehhtnhh.exe3bbnhn.exepvdvv.exe3ffrllx.exenhhbhh.exe1nbnbb.exevddvj.exexlrfxrf.exebnbntt.exethbthb.exejdjjv.exerfxxlfx.exehbbttb.exebhbbbn.exepid process 4272 xffflrf.exe 1460 lfllxrf.exe 4640 vvvjd.exe 4796 3pjdp.exe 2516 fflrxrx.exe 4612 rfrrrrx.exe 2036 fflffrr.exe 3716 htbbhb.exe 640 djdvv.exe 728 lrrxrxl.exe 392 htnnnt.exe 3360 3bhhhn.exe 2340 9jdvv.exe 3448 ttthbn.exe 3528 lxxfxrl.exe 3900 3nhbbh.exe 4732 jpjpp.exe 1960 fffrxrx.exe 2684 dvvpj.exe 2680 flflrxf.exe 3668 bnhbnh.exe 4236 lfxflrx.exe 2780 xxfxxrr.exe 3460 pppjd.exe 3536 ppvdj.exe 3828 fxxrxrl.exe 3100 tnnbnt.exe 4416 xlxffxl.exe 4572 hbhtht.exe 5072 vvvvp.exe 3156 rffflfx.exe 4476 5flrfxf.exe 1336 dpvjj.exe 1604 xllxrlx.exe 2660 fxrllff.exe 448 bttnnh.exe 3768 vpjvj.exe 4648 fllxrlx.exe 3128 xflllxx.exe 1060 bnbthb.exe 3720 pdpdj.exe 1272 xfxfrrf.exe 2300 tttnbt.exe 1712 vjpdv.exe 4580 1pvjp.exe 1472 3rllfxr.exe 4644 nhhhnn.exe 2312 httbbh.exe 1156 vjvdp.exe 1796 7lxlxfx.exe 4568 hhtnhh.exe 2536 3bbnhn.exe 4488 pvdvv.exe 2840 3ffrllx.exe 2292 nhhbhh.exe 3808 1nbnbb.exe 1460 vddvj.exe 3192 xlrfxrf.exe 4024 bnbntt.exe 1344 thbthb.exe 4948 jdjjv.exe 4612 rfxxlfx.exe 4192 hbbttb.exe 4620 bhbbbn.exe -
Processes:
resource yara_rule behavioral2/memory/4860-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-770-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hhtnhh.exedjvvd.exennbtnn.exevvdjj.exenhttnb.exennhnnt.exebnhbnh.exepvdvv.exelxrflxf.exelrrfxrl.exeddvjj.exennhhht.exe9nbbnn.exe7rlfrxx.exefflrfxf.exennbtnt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exexffflrf.exelfllxrf.exevvvjd.exe3pjdp.exefflrxrx.exerfrrrrx.exefflffrr.exehtbbhb.exedjdvv.exelrrxrxl.exehtnnnt.exe3bhhhn.exe9jdvv.exettthbn.exelxxfxrl.exe3nhbbh.exejpjpp.exefffrxrx.exedvvpj.exeflflrxf.exebnhbnh.exedescription pid process target process PID 4860 wrote to memory of 4272 4860 b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe xffflrf.exe PID 4860 wrote to memory of 4272 4860 b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe xffflrf.exe PID 4860 wrote to memory of 4272 4860 b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe xffflrf.exe PID 4272 wrote to memory of 1460 4272 xffflrf.exe lfllxrf.exe PID 4272 wrote to memory of 1460 4272 xffflrf.exe lfllxrf.exe PID 4272 wrote to memory of 1460 4272 xffflrf.exe lfllxrf.exe PID 1460 wrote to memory of 4640 1460 lfllxrf.exe vvvjd.exe PID 1460 wrote to memory of 4640 1460 lfllxrf.exe vvvjd.exe PID 1460 wrote to memory of 4640 1460 lfllxrf.exe vvvjd.exe PID 4640 wrote to memory of 4796 4640 vvvjd.exe 3pjdp.exe PID 4640 wrote to memory of 4796 4640 vvvjd.exe 3pjdp.exe PID 4640 wrote to memory of 4796 4640 vvvjd.exe 3pjdp.exe PID 4796 wrote to memory of 2516 4796 3pjdp.exe fflrxrx.exe PID 4796 wrote to memory of 2516 4796 3pjdp.exe fflrxrx.exe PID 4796 wrote to memory of 2516 4796 3pjdp.exe fflrxrx.exe PID 2516 wrote to memory of 4612 2516 fflrxrx.exe rfrrrrx.exe PID 2516 wrote to memory of 4612 2516 fflrxrx.exe rfrrrrx.exe PID 2516 wrote to memory of 4612 2516 fflrxrx.exe rfrrrrx.exe PID 4612 wrote to memory of 2036 4612 rfrrrrx.exe fflffrr.exe PID 4612 wrote to memory of 2036 4612 rfrrrrx.exe fflffrr.exe PID 4612 wrote to memory of 2036 4612 rfrrrrx.exe fflffrr.exe PID 2036 wrote to memory of 3716 2036 fflffrr.exe htbbhb.exe PID 2036 wrote to memory of 3716 2036 fflffrr.exe htbbhb.exe PID 2036 wrote to memory of 3716 2036 fflffrr.exe htbbhb.exe PID 3716 wrote to memory of 640 3716 htbbhb.exe djdvv.exe PID 3716 wrote to memory of 640 3716 htbbhb.exe djdvv.exe PID 3716 wrote to memory of 640 3716 htbbhb.exe djdvv.exe PID 640 wrote to memory of 728 640 djdvv.exe lrrxrxl.exe PID 640 wrote to memory of 728 640 djdvv.exe lrrxrxl.exe PID 640 wrote to memory of 728 640 djdvv.exe lrrxrxl.exe PID 728 wrote to memory of 392 728 lrrxrxl.exe htnnnt.exe PID 728 wrote to memory of 392 728 lrrxrxl.exe htnnnt.exe PID 728 wrote to memory of 392 728 lrrxrxl.exe htnnnt.exe PID 392 wrote to memory of 3360 392 htnnnt.exe 3bhhhn.exe PID 392 wrote to memory of 3360 392 htnnnt.exe 3bhhhn.exe PID 392 wrote to memory of 3360 392 htnnnt.exe 3bhhhn.exe PID 3360 wrote to memory of 2340 3360 3bhhhn.exe 9jdvv.exe PID 3360 wrote to memory of 2340 3360 3bhhhn.exe 9jdvv.exe PID 3360 wrote to memory of 2340 3360 3bhhhn.exe 9jdvv.exe PID 2340 wrote to memory of 3448 2340 9jdvv.exe ttthbn.exe PID 2340 wrote to memory of 3448 2340 9jdvv.exe ttthbn.exe PID 2340 wrote to memory of 3448 2340 9jdvv.exe ttthbn.exe PID 3448 wrote to memory of 3528 3448 ttthbn.exe lxxfxrl.exe PID 3448 wrote to memory of 3528 3448 ttthbn.exe lxxfxrl.exe PID 3448 wrote to memory of 3528 3448 ttthbn.exe lxxfxrl.exe PID 3528 wrote to memory of 3900 3528 lxxfxrl.exe 3nhbbh.exe PID 3528 wrote to memory of 3900 3528 lxxfxrl.exe 3nhbbh.exe PID 3528 wrote to memory of 3900 3528 lxxfxrl.exe 3nhbbh.exe PID 3900 wrote to memory of 4732 3900 3nhbbh.exe jpjpp.exe PID 3900 wrote to memory of 4732 3900 3nhbbh.exe jpjpp.exe PID 3900 wrote to memory of 4732 3900 3nhbbh.exe jpjpp.exe PID 4732 wrote to memory of 1960 4732 jpjpp.exe fffrxrx.exe PID 4732 wrote to memory of 1960 4732 jpjpp.exe fffrxrx.exe PID 4732 wrote to memory of 1960 4732 jpjpp.exe fffrxrx.exe PID 1960 wrote to memory of 2684 1960 fffrxrx.exe dvvpj.exe PID 1960 wrote to memory of 2684 1960 fffrxrx.exe dvvpj.exe PID 1960 wrote to memory of 2684 1960 fffrxrx.exe dvvpj.exe PID 2684 wrote to memory of 2680 2684 dvvpj.exe flflrxf.exe PID 2684 wrote to memory of 2680 2684 dvvpj.exe flflrxf.exe PID 2684 wrote to memory of 2680 2684 dvvpj.exe flflrxf.exe PID 2680 wrote to memory of 3668 2680 flflrxf.exe bnhbnh.exe PID 2680 wrote to memory of 3668 2680 flflrxf.exe bnhbnh.exe PID 2680 wrote to memory of 3668 2680 flflrxf.exe bnhbnh.exe PID 3668 wrote to memory of 4236 3668 bnhbnh.exe lfxflrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe"C:\Users\Admin\AppData\Local\Temp\b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\xffflrf.exec:\xffflrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\lfllxrf.exec:\lfllxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\vvvjd.exec:\vvvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\3pjdp.exec:\3pjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\fflrxrx.exec:\fflrxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\fflffrr.exec:\fflffrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\htbbhb.exec:\htbbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\djdvv.exec:\djdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\lrrxrxl.exec:\lrrxrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\htnnnt.exec:\htnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\3bhhhn.exec:\3bhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\9jdvv.exec:\9jdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\ttthbn.exec:\ttthbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\lxxfxrl.exec:\lxxfxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\3nhbbh.exec:\3nhbbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\jpjpp.exec:\jpjpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\fffrxrx.exec:\fffrxrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\dvvpj.exec:\dvvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\flflrxf.exec:\flflrxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bnhbnh.exec:\bnhbnh.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\lfxflrx.exec:\lfxflrx.exe23⤵
- Executes dropped EXE
PID:4236 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe24⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pppjd.exec:\pppjd.exe25⤵
- Executes dropped EXE
PID:3460 -
\??\c:\ppvdj.exec:\ppvdj.exe26⤵
- Executes dropped EXE
PID:3536 -
\??\c:\fxxrxrl.exec:\fxxrxrl.exe27⤵
- Executes dropped EXE
PID:3828 -
\??\c:\tnnbnt.exec:\tnnbnt.exe28⤵
- Executes dropped EXE
PID:3100 -
\??\c:\xlxffxl.exec:\xlxffxl.exe29⤵
- Executes dropped EXE
PID:4416 -
\??\c:\hbhtht.exec:\hbhtht.exe30⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vvvvp.exec:\vvvvp.exe31⤵
- Executes dropped EXE
PID:5072 -
\??\c:\rffflfx.exec:\rffflfx.exe32⤵
- Executes dropped EXE
PID:3156 -
\??\c:\5flrfxf.exec:\5flrfxf.exe33⤵
- Executes dropped EXE
PID:4476 -
\??\c:\dpvjj.exec:\dpvjj.exe34⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xllxrlx.exec:\xllxrlx.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\fxrllff.exec:\fxrllff.exe36⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bttnnh.exec:\bttnnh.exe37⤵
- Executes dropped EXE
PID:448 -
\??\c:\vpjvj.exec:\vpjvj.exe38⤵
- Executes dropped EXE
PID:3768 -
\??\c:\fllxrlx.exec:\fllxrlx.exe39⤵
- Executes dropped EXE
PID:4648 -
\??\c:\xflllxx.exec:\xflllxx.exe40⤵
- Executes dropped EXE
PID:3128 -
\??\c:\bnbthb.exec:\bnbthb.exe41⤵
- Executes dropped EXE
PID:1060 -
\??\c:\pdpdj.exec:\pdpdj.exe42⤵
- Executes dropped EXE
PID:3720 -
\??\c:\xfxfrrf.exec:\xfxfrrf.exe43⤵
- Executes dropped EXE
PID:1272 -
\??\c:\tttnbt.exec:\tttnbt.exe44⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vjpdv.exec:\vjpdv.exe45⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1pvjp.exec:\1pvjp.exe46⤵
- Executes dropped EXE
PID:4580 -
\??\c:\3rllfxr.exec:\3rllfxr.exe47⤵
- Executes dropped EXE
PID:1472 -
\??\c:\nhhhnn.exec:\nhhhnn.exe48⤵
- Executes dropped EXE
PID:4644 -
\??\c:\httbbh.exec:\httbbh.exe49⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vjvdp.exec:\vjvdp.exe50⤵
- Executes dropped EXE
PID:1156 -
\??\c:\7lxlxfx.exec:\7lxlxfx.exe51⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hhtnhh.exec:\hhtnhh.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4568 -
\??\c:\3bbnhn.exec:\3bbnhn.exe53⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pvdvv.exec:\pvdvv.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4488 -
\??\c:\3ffrllx.exec:\3ffrllx.exe55⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nhhbhh.exec:\nhhbhh.exe56⤵
- Executes dropped EXE
PID:2292 -
\??\c:\1nbnbb.exec:\1nbnbb.exe57⤵
- Executes dropped EXE
PID:3808 -
\??\c:\vddvj.exec:\vddvj.exe58⤵
- Executes dropped EXE
PID:1460 -
\??\c:\xlrfxrf.exec:\xlrfxrf.exe59⤵
- Executes dropped EXE
PID:3192 -
\??\c:\bnbntt.exec:\bnbntt.exe60⤵
- Executes dropped EXE
PID:4024 -
\??\c:\thbthb.exec:\thbthb.exe61⤵
- Executes dropped EXE
PID:1344 -
\??\c:\jdjjv.exec:\jdjjv.exe62⤵
- Executes dropped EXE
PID:4948 -
\??\c:\rfxxlfx.exec:\rfxxlfx.exe63⤵
- Executes dropped EXE
PID:4612 -
\??\c:\hbbttb.exec:\hbbttb.exe64⤵
- Executes dropped EXE
PID:4192 -
\??\c:\bhbbbn.exec:\bhbbbn.exe65⤵
- Executes dropped EXE
PID:4620 -
\??\c:\lfxrlfl.exec:\lfxrlfl.exe66⤵PID:760
-
\??\c:\hbttnh.exec:\hbttnh.exe67⤵PID:2664
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe68⤵PID:1280
-
\??\c:\lrxrxxr.exec:\lrxrxxr.exe69⤵PID:1276
-
\??\c:\nbbnnt.exec:\nbbnnt.exe70⤵PID:3116
-
\??\c:\3lxfxxx.exec:\3lxfxxx.exe71⤵PID:208
-
\??\c:\htnttn.exec:\htnttn.exe72⤵PID:2956
-
\??\c:\jdvvp.exec:\jdvvp.exe73⤵PID:2340
-
\??\c:\lfrrrll.exec:\lfrrrll.exe74⤵PID:3448
-
\??\c:\jppdv.exec:\jppdv.exe75⤵PID:1888
-
\??\c:\rlfffrr.exec:\rlfffrr.exe76⤵PID:4564
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe77⤵PID:2480
-
\??\c:\dvpvd.exec:\dvpvd.exe78⤵PID:3112
-
\??\c:\vdjjj.exec:\vdjjj.exe79⤵PID:112
-
\??\c:\lfrxxfr.exec:\lfrxxfr.exe80⤵PID:4800
-
\??\c:\htntnh.exec:\htntnh.exe81⤵PID:1528
-
\??\c:\vjpvv.exec:\vjpvv.exe82⤵PID:1500
-
\??\c:\lfrlrxl.exec:\lfrlrxl.exe83⤵PID:1876
-
\??\c:\tthnnn.exec:\tthnnn.exe84⤵PID:1672
-
\??\c:\bthbbt.exec:\bthbbt.exe85⤵PID:2636
-
\??\c:\pjdpd.exec:\pjdpd.exe86⤵PID:3484
-
\??\c:\rrxfxxr.exec:\rrxfxxr.exe87⤵PID:1400
-
\??\c:\bbbtnn.exec:\bbbtnn.exe88⤵PID:3168
-
\??\c:\pvjvd.exec:\pvjvd.exe89⤵PID:4208
-
\??\c:\bntttt.exec:\bntttt.exe90⤵PID:4684
-
\??\c:\frlfrlf.exec:\frlfrlf.exe91⤵PID:1312
-
\??\c:\hthnnn.exec:\hthnnn.exe92⤵PID:2564
-
\??\c:\xrrrxrf.exec:\xrrrxrf.exe93⤵PID:1948
-
\??\c:\ppjjd.exec:\ppjjd.exe94⤵PID:4932
-
\??\c:\1thhbn.exec:\1thhbn.exe95⤵PID:1244
-
\??\c:\3vpjj.exec:\3vpjj.exe96⤵PID:3172
-
\??\c:\xrrlllr.exec:\xrrlllr.exe97⤵PID:5088
-
\??\c:\thnhhn.exec:\thnhhn.exe98⤵PID:3096
-
\??\c:\hnttbb.exec:\hnttbb.exe99⤵PID:1912
-
\??\c:\rlfxfrl.exec:\rlfxfrl.exe100⤵PID:624
-
\??\c:\thnttb.exec:\thnttb.exe101⤵PID:3628
-
\??\c:\hbhbtb.exec:\hbhbtb.exe102⤵PID:4240
-
\??\c:\vpvdj.exec:\vpvdj.exe103⤵PID:4652
-
\??\c:\xfrlfff.exec:\xfrlfff.exe104⤵PID:4276
-
\??\c:\bnnhbn.exec:\bnnhbn.exe105⤵PID:4536
-
\??\c:\1ppvv.exec:\1ppvv.exe106⤵PID:1712
-
\??\c:\fxffllr.exec:\fxffllr.exe107⤵PID:4528
-
\??\c:\bnhnhn.exec:\bnhnhn.exe108⤵PID:4148
-
\??\c:\pvppd.exec:\pvppd.exe109⤵PID:4644
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe110⤵PID:2372
-
\??\c:\nhhbhb.exec:\nhhbhb.exe111⤵PID:2236
-
\??\c:\pvjdv.exec:\pvjdv.exe112⤵PID:1796
-
\??\c:\ppppp.exec:\ppppp.exe113⤵PID:4472
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe114⤵PID:4484
-
\??\c:\hbhtnn.exec:\hbhtnn.exe115⤵PID:440
-
\??\c:\dppvd.exec:\dppvd.exe116⤵PID:2840
-
\??\c:\flffrlr.exec:\flffrlr.exe117⤵PID:3144
-
\??\c:\hhtttn.exec:\hhtttn.exe118⤵PID:1756
-
\??\c:\7dvvd.exec:\7dvvd.exe119⤵PID:2428
-
\??\c:\rrfrlrr.exec:\rrfrlrr.exe120⤵PID:1600
-
\??\c:\tnnnnn.exec:\tnnnnn.exe121⤵PID:4796
-
\??\c:\dvjdv.exec:\dvjdv.exe122⤵PID:1788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-