Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 07:07
Static task
static1
Behavioral task
behavioral1
Sample
1a29fcce26a658845ea38f24b7d67c40743e42bcc9451c490e9eb7ca98ffae15.exe
Resource
win7-20240903-en
General
-
Target
1a29fcce26a658845ea38f24b7d67c40743e42bcc9451c490e9eb7ca98ffae15.exe
-
Size
455KB
-
MD5
fc482c2a3abef95ea8d8110e693da394
-
SHA1
eca12f365a03c39dda4c216e7def8c336a59caa2
-
SHA256
1a29fcce26a658845ea38f24b7d67c40743e42bcc9451c490e9eb7ca98ffae15
-
SHA512
9df98d78ae2557df59a15ab440383057a5eeff06f8747665ea480c9da354d2ac661660cf5ac36b0b058608d4e9dde30a71ea0325f2aa6ee409a004bd0fc2da93
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRK:q7Tc2NYHUrAwfMp3CDRK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1200-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/680-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-1088-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-1143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-1165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-1559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-1596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djjjj.exejvdvv.exerxfrlfx.exe3bthbt.exeddddd.exellrrrll.exelxxxffx.exetbbhbb.exepdjjd.exerrfffll.exeffllxxx.exebtbbnb.exevdjjj.exerxfxxff.exethnhhh.exe3ddvp.exejpvpp.exe5lrflfx.exebtbnnn.exevdvjd.exejppjj.exefrrrrfr.exenbbttb.exepjppp.exepjvdd.exe1rlrlll.exehbnttb.exedpjjd.exepvddj.exexflxfxx.exehnnnnn.exenhttbh.exepppvv.exerlllfff.exelllfrxx.exebnnnnn.exejdjjd.exe9xxxrrl.exerlrrffx.exetbbtbt.exepdddv.exe1xrlflf.exerrrrllx.exetnthnt.exepjjdd.exelxxlrrr.exefrrrrxr.exehbnhhh.exe9ppjv.exeddjjv.exerfllfff.exennntnt.exejdpjp.exevddvv.exerflxlxf.exehhnntt.exeddddv.exepjvpj.exefxrlfxr.exebbnbtt.exeppvvp.exeddvjd.exefxxxrrr.exenbhhbb.exepid process 3128 djjjj.exe 1576 jvdvv.exe 2900 rxfrlfx.exe 3696 3bthbt.exe 2096 ddddd.exe 4804 llrrrll.exe 3292 lxxxffx.exe 244 tbbhbb.exe 628 pdjjd.exe 3252 rrfffll.exe 4776 ffllxxx.exe 1880 btbbnb.exe 1068 vdjjj.exe 4488 rxfxxff.exe 1884 thnhhh.exe 2320 3ddvp.exe 2928 jpvpp.exe 2800 5lrflfx.exe 1428 btbnnn.exe 3796 vdvjd.exe 740 jppjj.exe 4908 frrrrfr.exe 2428 nbbttb.exe 3516 pjppp.exe 4676 pjvdd.exe 3208 1rlrlll.exe 4120 hbnttb.exe 3176 dpjjd.exe 3496 pvddj.exe 936 xflxfxx.exe 4928 hnnnnn.exe 3392 nhttbh.exe 4808 pppvv.exe 4904 rlllfff.exe 4128 lllfrxx.exe 3972 bnnnnn.exe 2932 jdjjd.exe 4548 9xxxrrl.exe 1492 rlrrffx.exe 1476 tbbtbt.exe 3624 pdddv.exe 3604 1xrlflf.exe 64 rrrrllx.exe 2092 tnthnt.exe 4868 pjjdd.exe 4424 lxxlrrr.exe 3260 frrrrxr.exe 4848 hbnhhh.exe 220 9ppjv.exe 3120 ddjjv.exe 3476 rfllfff.exe 2900 nnntnt.exe 3696 jdpjp.exe 3012 vddvv.exe 2168 rflxlxf.exe 5100 hhnntt.exe 3292 ddddv.exe 1368 pjvpj.exe 1504 fxrlfxr.exe 2552 bbnbtt.exe 5056 ppvvp.exe 3888 ddvjd.exe 4752 fxxxrrr.exe 4444 nbhhbb.exe -
Processes:
resource yara_rule behavioral2/memory/3128-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/680-668-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
9dddd.exe5rlrrrl.exepdddv.exefxlfxfx.exetnntnn.exejpvdj.exepvvvp.exerxrlffx.exe9flffff.exelxlfxfx.exefflffff.exerlllfff.exe5pjjj.exe7vjdj.exeddddv.exebhbbbt.exepvjjp.exefllllll.exethhnnn.exeflfxxll.exethnnhn.exelfrfffl.exerffxrrx.exejjppp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1a29fcce26a658845ea38f24b7d67c40743e42bcc9451c490e9eb7ca98ffae15.exedjjjj.exejvdvv.exerxfrlfx.exe3bthbt.exeddddd.exellrrrll.exelxxxffx.exetbbhbb.exepdjjd.exerrfffll.exeffllxxx.exebtbbnb.exevdjjj.exerxfxxff.exethnhhh.exe3ddvp.exejpvpp.exe5lrflfx.exebtbnnn.exevdvjd.exejppjj.exedescription pid process target process PID 1200 wrote to memory of 3128 1200 1a29fcce26a658845ea38f24b7d67c40743e42bcc9451c490e9eb7ca98ffae15.exe djjjj.exe PID 1200 wrote to memory of 3128 1200 1a29fcce26a658845ea38f24b7d67c40743e42bcc9451c490e9eb7ca98ffae15.exe djjjj.exe PID 1200 wrote to memory of 3128 1200 1a29fcce26a658845ea38f24b7d67c40743e42bcc9451c490e9eb7ca98ffae15.exe djjjj.exe PID 3128 wrote to memory of 1576 3128 djjjj.exe jvdvv.exe PID 3128 wrote to memory of 1576 3128 djjjj.exe jvdvv.exe PID 3128 wrote to memory of 1576 3128 djjjj.exe jvdvv.exe PID 1576 wrote to memory of 2900 1576 jvdvv.exe rxfrlfx.exe PID 1576 wrote to memory of 2900 1576 jvdvv.exe rxfrlfx.exe PID 1576 wrote to memory of 2900 1576 jvdvv.exe rxfrlfx.exe PID 2900 wrote to memory of 3696 2900 rxfrlfx.exe 3bthbt.exe PID 2900 wrote to memory of 3696 2900 rxfrlfx.exe 3bthbt.exe PID 2900 wrote to memory of 3696 2900 rxfrlfx.exe 3bthbt.exe PID 3696 wrote to memory of 2096 3696 3bthbt.exe ddddd.exe PID 3696 wrote to memory of 2096 3696 3bthbt.exe ddddd.exe PID 3696 wrote to memory of 2096 3696 3bthbt.exe ddddd.exe PID 2096 wrote to memory of 4804 2096 ddddd.exe llrrrll.exe PID 2096 wrote to memory of 4804 2096 ddddd.exe llrrrll.exe PID 2096 wrote to memory of 4804 2096 ddddd.exe llrrrll.exe PID 4804 wrote to memory of 3292 4804 llrrrll.exe lxxxffx.exe PID 4804 wrote to memory of 3292 4804 llrrrll.exe lxxxffx.exe PID 4804 wrote to memory of 3292 4804 llrrrll.exe lxxxffx.exe PID 3292 wrote to memory of 244 3292 lxxxffx.exe tbbhbb.exe PID 3292 wrote to memory of 244 3292 lxxxffx.exe tbbhbb.exe PID 3292 wrote to memory of 244 3292 lxxxffx.exe tbbhbb.exe PID 244 wrote to memory of 628 244 tbbhbb.exe pdjjd.exe PID 244 wrote to memory of 628 244 tbbhbb.exe pdjjd.exe PID 244 wrote to memory of 628 244 tbbhbb.exe pdjjd.exe PID 628 wrote to memory of 3252 628 pdjjd.exe rrfffll.exe PID 628 wrote to memory of 3252 628 pdjjd.exe rrfffll.exe PID 628 wrote to memory of 3252 628 pdjjd.exe rrfffll.exe PID 3252 wrote to memory of 4776 3252 rrfffll.exe ffllxxx.exe PID 3252 wrote to memory of 4776 3252 rrfffll.exe ffllxxx.exe PID 3252 wrote to memory of 4776 3252 rrfffll.exe ffllxxx.exe PID 4776 wrote to memory of 1880 4776 ffllxxx.exe btbbnb.exe PID 4776 wrote to memory of 1880 4776 ffllxxx.exe btbbnb.exe PID 4776 wrote to memory of 1880 4776 ffllxxx.exe btbbnb.exe PID 1880 wrote to memory of 1068 1880 btbbnb.exe vdjjj.exe PID 1880 wrote to memory of 1068 1880 btbbnb.exe vdjjj.exe PID 1880 wrote to memory of 1068 1880 btbbnb.exe vdjjj.exe PID 1068 wrote to memory of 4488 1068 vdjjj.exe rxfxxff.exe PID 1068 wrote to memory of 4488 1068 vdjjj.exe rxfxxff.exe PID 1068 wrote to memory of 4488 1068 vdjjj.exe rxfxxff.exe PID 4488 wrote to memory of 1884 4488 rxfxxff.exe thnhhh.exe PID 4488 wrote to memory of 1884 4488 rxfxxff.exe thnhhh.exe PID 4488 wrote to memory of 1884 4488 rxfxxff.exe thnhhh.exe PID 1884 wrote to memory of 2320 1884 thnhhh.exe 3ddvp.exe PID 1884 wrote to memory of 2320 1884 thnhhh.exe 3ddvp.exe PID 1884 wrote to memory of 2320 1884 thnhhh.exe 3ddvp.exe PID 2320 wrote to memory of 2928 2320 3ddvp.exe jpvpp.exe PID 2320 wrote to memory of 2928 2320 3ddvp.exe jpvpp.exe PID 2320 wrote to memory of 2928 2320 3ddvp.exe jpvpp.exe PID 2928 wrote to memory of 2800 2928 jpvpp.exe dvpjd.exe PID 2928 wrote to memory of 2800 2928 jpvpp.exe dvpjd.exe PID 2928 wrote to memory of 2800 2928 jpvpp.exe dvpjd.exe PID 2800 wrote to memory of 1428 2800 5lrflfx.exe btbnnn.exe PID 2800 wrote to memory of 1428 2800 5lrflfx.exe btbnnn.exe PID 2800 wrote to memory of 1428 2800 5lrflfx.exe btbnnn.exe PID 1428 wrote to memory of 3796 1428 btbnnn.exe vdvjd.exe PID 1428 wrote to memory of 3796 1428 btbnnn.exe vdvjd.exe PID 1428 wrote to memory of 3796 1428 btbnnn.exe vdvjd.exe PID 3796 wrote to memory of 740 3796 vdvjd.exe jppjj.exe PID 3796 wrote to memory of 740 3796 vdvjd.exe jppjj.exe PID 3796 wrote to memory of 740 3796 vdvjd.exe jppjj.exe PID 740 wrote to memory of 4908 740 jppjj.exe frrrrfr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a29fcce26a658845ea38f24b7d67c40743e42bcc9451c490e9eb7ca98ffae15.exe"C:\Users\Admin\AppData\Local\Temp\1a29fcce26a658845ea38f24b7d67c40743e42bcc9451c490e9eb7ca98ffae15.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\djjjj.exec:\djjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\jvdvv.exec:\jvdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\rxfrlfx.exec:\rxfrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\3bthbt.exec:\3bthbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\ddddd.exec:\ddddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\llrrrll.exec:\llrrrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\lxxxffx.exec:\lxxxffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\tbbhbb.exec:\tbbhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\pdjjd.exec:\pdjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\rrfffll.exec:\rrfffll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\ffllxxx.exec:\ffllxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\btbbnb.exec:\btbbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\vdjjj.exec:\vdjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\rxfxxff.exec:\rxfxxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\thnhhh.exec:\thnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\3ddvp.exec:\3ddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jpvpp.exec:\jpvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\5lrflfx.exec:\5lrflfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\btbnnn.exec:\btbnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\vdvjd.exec:\vdvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\jppjj.exec:\jppjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\frrrrfr.exec:\frrrrfr.exe23⤵
- Executes dropped EXE
PID:4908 -
\??\c:\nbbttb.exec:\nbbttb.exe24⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pjppp.exec:\pjppp.exe25⤵
- Executes dropped EXE
PID:3516 -
\??\c:\pjvdd.exec:\pjvdd.exe26⤵
- Executes dropped EXE
PID:4676 -
\??\c:\1rlrlll.exec:\1rlrlll.exe27⤵
- Executes dropped EXE
PID:3208 -
\??\c:\hbnttb.exec:\hbnttb.exe28⤵
- Executes dropped EXE
PID:4120 -
\??\c:\dpjjd.exec:\dpjjd.exe29⤵
- Executes dropped EXE
PID:3176 -
\??\c:\pvddj.exec:\pvddj.exe30⤵
- Executes dropped EXE
PID:3496 -
\??\c:\xflxfxx.exec:\xflxfxx.exe31⤵
- Executes dropped EXE
PID:936 -
\??\c:\hnnnnn.exec:\hnnnnn.exe32⤵
- Executes dropped EXE
PID:4928 -
\??\c:\nhttbh.exec:\nhttbh.exe33⤵
- Executes dropped EXE
PID:3392 -
\??\c:\pppvv.exec:\pppvv.exe34⤵
- Executes dropped EXE
PID:4808 -
\??\c:\rlllfff.exec:\rlllfff.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4904 -
\??\c:\lllfrxx.exec:\lllfrxx.exe36⤵
- Executes dropped EXE
PID:4128 -
\??\c:\bnnnnn.exec:\bnnnnn.exe37⤵
- Executes dropped EXE
PID:3972 -
\??\c:\jdjjd.exec:\jdjjd.exe38⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9xxxrrl.exec:\9xxxrrl.exe39⤵
- Executes dropped EXE
PID:4548 -
\??\c:\rlrrffx.exec:\rlrrffx.exe40⤵
- Executes dropped EXE
PID:1492 -
\??\c:\tbbtbt.exec:\tbbtbt.exe41⤵
- Executes dropped EXE
PID:1476 -
\??\c:\pdddv.exec:\pdddv.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3624 -
\??\c:\1xrlflf.exec:\1xrlflf.exe43⤵
- Executes dropped EXE
PID:3604 -
\??\c:\rrrrllx.exec:\rrrrllx.exe44⤵
- Executes dropped EXE
PID:64 -
\??\c:\tnthnt.exec:\tnthnt.exe45⤵
- Executes dropped EXE
PID:2092 -
\??\c:\pjjdd.exec:\pjjdd.exe46⤵
- Executes dropped EXE
PID:4868 -
\??\c:\lxxlrrr.exec:\lxxlrrr.exe47⤵
- Executes dropped EXE
PID:4424 -
\??\c:\frrrrxr.exec:\frrrrxr.exe48⤵
- Executes dropped EXE
PID:3260 -
\??\c:\hbnhhh.exec:\hbnhhh.exe49⤵
- Executes dropped EXE
PID:4848 -
\??\c:\9ppjv.exec:\9ppjv.exe50⤵
- Executes dropped EXE
PID:220 -
\??\c:\ddjjv.exec:\ddjjv.exe51⤵
- Executes dropped EXE
PID:3120 -
\??\c:\rfllfff.exec:\rfllfff.exe52⤵
- Executes dropped EXE
PID:3476 -
\??\c:\nnntnt.exec:\nnntnt.exe53⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jdpjp.exec:\jdpjp.exe54⤵
- Executes dropped EXE
PID:3696 -
\??\c:\vddvv.exec:\vddvv.exe55⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rflxlxf.exec:\rflxlxf.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hhnntt.exec:\hhnntt.exe57⤵
- Executes dropped EXE
PID:5100 -
\??\c:\ddddv.exec:\ddddv.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3292 -
\??\c:\pjvpj.exec:\pjvpj.exe59⤵
- Executes dropped EXE
PID:1368 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe60⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bbnbtt.exec:\bbnbtt.exe61⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ppvvp.exec:\ppvvp.exe62⤵
- Executes dropped EXE
PID:5056 -
\??\c:\ddvjd.exec:\ddvjd.exe63⤵
- Executes dropped EXE
PID:3888 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe64⤵
- Executes dropped EXE
PID:4752 -
\??\c:\nbhhbb.exec:\nbhhbb.exe65⤵
- Executes dropped EXE
PID:4444 -
\??\c:\vjddv.exec:\vjddv.exe66⤵PID:3584
-
\??\c:\ffllxxr.exec:\ffllxxr.exe67⤵PID:1900
-
\??\c:\9xffffl.exec:\9xffffl.exe68⤵PID:1852
-
\??\c:\thtnhh.exec:\thtnhh.exe69⤵PID:2144
-
\??\c:\dvpjd.exec:\dvpjd.exe70⤵PID:2800
-
\??\c:\rlrrlll.exec:\rlrrlll.exe71⤵PID:2692
-
\??\c:\rrrllrr.exec:\rrrllrr.exe72⤵PID:4872
-
\??\c:\bnnhhh.exec:\bnnhhh.exe73⤵PID:4484
-
\??\c:\lrrlfff.exec:\lrrlfff.exe74⤵PID:556
-
\??\c:\lfrrllf.exec:\lfrrllf.exe75⤵PID:2660
-
\??\c:\hhtntt.exec:\hhtntt.exe76⤵PID:4560
-
\??\c:\djddv.exec:\djddv.exe77⤵PID:2152
-
\??\c:\rlllxlf.exec:\rlllxlf.exe78⤵PID:2084
-
\??\c:\vvvdv.exec:\vvvdv.exe79⤵PID:1920
-
\??\c:\xxxrllf.exec:\xxxrllf.exe80⤵PID:1872
-
\??\c:\9nhbtb.exec:\9nhbtb.exe81⤵PID:4928
-
\??\c:\1ppjj.exec:\1ppjj.exe82⤵PID:1964
-
\??\c:\htttnn.exec:\htttnn.exe83⤵PID:5016
-
\??\c:\bttnhh.exec:\bttnhh.exe84⤵PID:1124
-
\??\c:\rflfxfx.exec:\rflfxfx.exe85⤵PID:2296
-
\??\c:\bnhhhn.exec:\bnhhhn.exe86⤵PID:4764
-
\??\c:\pvpjd.exec:\pvpjd.exe87⤵PID:1128
-
\??\c:\htthhh.exec:\htthhh.exe88⤵PID:4832
-
\??\c:\5hbtnn.exec:\5hbtnn.exe89⤵PID:2012
-
\??\c:\jjdpv.exec:\jjdpv.exe90⤵PID:2400
-
\??\c:\xfxrllf.exec:\xfxrllf.exe91⤵PID:4268
-
\??\c:\tnnbtt.exec:\tnnbtt.exe92⤵PID:2092
-
\??\c:\nntntn.exec:\nntntn.exe93⤵PID:4424
-
\??\c:\vpvvp.exec:\vpvvp.exe94⤵PID:1464
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe95⤵PID:432
-
\??\c:\bhbttn.exec:\bhbttn.exe96⤵PID:2068
-
\??\c:\pjvdv.exec:\pjvdv.exe97⤵PID:3088
-
\??\c:\xfrrxxr.exec:\xfrrxxr.exe98⤵PID:4240
-
\??\c:\1hnhbh.exec:\1hnhbh.exe99⤵PID:3236
-
\??\c:\djjdv.exec:\djjdv.exe100⤵PID:1788
-
\??\c:\jjddv.exec:\jjddv.exe101⤵PID:3028
-
\??\c:\llllflf.exec:\llllflf.exe102⤵PID:2996
-
\??\c:\pvpjd.exec:\pvpjd.exe103⤵PID:3740
-
\??\c:\xfllrlx.exec:\xfllrlx.exe104⤵PID:3988
-
\??\c:\tnnhhh.exec:\tnnhhh.exe105⤵PID:3588
-
\??\c:\xfrlffx.exec:\xfrlffx.exe106⤵PID:4748
-
\??\c:\hbbtnt.exec:\hbbtnt.exe107⤵PID:4384
-
\??\c:\dddvp.exec:\dddvp.exe108⤵PID:2740
-
\??\c:\nhhbtn.exec:\nhhbtn.exe109⤵PID:4348
-
\??\c:\pvvvp.exec:\pvvvp.exe110⤵PID:2504
-
\??\c:\vpvpj.exec:\vpvpj.exe111⤵PID:4752
-
\??\c:\5llffff.exec:\5llffff.exe112⤵PID:4444
-
\??\c:\pjpjd.exec:\pjpjd.exe113⤵PID:1876
-
\??\c:\nntbhn.exec:\nntbhn.exe114⤵PID:4300
-
\??\c:\7xfxffl.exec:\7xfxffl.exe115⤵PID:3248
-
\??\c:\bttnbt.exec:\bttnbt.exe116⤵PID:4248
-
\??\c:\lffxrrx.exec:\lffxrrx.exe117⤵PID:2412
-
\??\c:\tnhthh.exec:\tnhthh.exe118⤵PID:4256
-
\??\c:\jjjdv.exec:\jjjdv.exe119⤵PID:928
-
\??\c:\htnhbb.exec:\htnhbb.exe120⤵PID:1944
-
\??\c:\pjpjv.exec:\pjpjv.exe121⤵PID:1600
-
\??\c:\xxxlfxr.exec:\xxxlfxr.exe122⤵PID:224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-