Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 14:04
Static task
static1
Behavioral task
behavioral1
Sample
3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exe
Resource
win7-20240903-en
General
-
Target
3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exe
-
Size
453KB
-
MD5
542c948758cf875109247f384721b7c0
-
SHA1
d117411c1089314e74f126272acf398a7c45401b
-
SHA256
3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7
-
SHA512
4a3168a14eb2bb2b540935ef10b0261a1a75c5f981a39a531675c2506deac53a571fa1bcb0909b46c6c4a9fa594fdb38bcc481f6afc04f13ee3d10231c873126
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2036-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-827-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-887-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-906-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-1480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrxrrrl.exetntntt.exe1httnh.exevvvvv.exefflfrlf.exebtnhhh.exedvjdj.exedddvv.exehbnhhh.exetthhhn.exepvjdd.exexfrrlrl.exe7lrlfff.exebthbtt.exevdddd.exedvjvp.exellfxrlf.exejpjjd.exe1xrlxrl.exelrffrxl.exebhbhth.exe7ddjd.exe9xlffff.exebbtbnb.exepdpvp.exedvjdv.exefxrfxrl.exetthttn.exedpjdp.exexlxrlll.exenhhhht.exevdjdp.exepjjdp.exexrlfrrf.exebntnhh.exevpvpp.exe7rlfxlf.exebbtnbt.exe3nhhbb.exepdvpj.exe9ffrffx.exe1hbbtt.exennhbtn.exe9vvpp.exe7vvpd.exelllxrlf.exenhhhhn.exetnnbth.exejpvvd.exexxfxlff.exerlfxxrr.exehtbtbt.exevppdj.exejpvvd.exelrrxxxr.exebbnnnh.exennthtn.exejvppp.exerfflllx.exerllfrrr.exebtnhtn.exe3htntt.exevjjvp.exexxlrxrx.exepid Process 3972 rrxrrrl.exe 964 tntntt.exe 4952 1httnh.exe 3328 vvvvv.exe 208 fflfrlf.exe 4820 btnhhh.exe 2316 dvjdj.exe 3976 dddvv.exe 3836 hbnhhh.exe 532 tthhhn.exe 4148 pvjdd.exe 4664 xfrrlrl.exe 2804 7lrlfff.exe 1424 bthbtt.exe 2632 vdddd.exe 4028 dvjvp.exe 1416 llfxrlf.exe 3936 jpjjd.exe 1948 1xrlxrl.exe 2800 lrffrxl.exe 736 bhbhth.exe 2572 7ddjd.exe 1884 9xlffff.exe 1692 bbtbnb.exe 4540 pdpvp.exe 1072 dvjdv.exe 3764 fxrfxrl.exe 4488 tthttn.exe 4320 dpjdp.exe 4580 xlxrlll.exe 4880 nhhhht.exe 4652 vdjdp.exe 3200 pjjdp.exe 716 xrlfrrf.exe 1920 bntnhh.exe 1932 vpvpp.exe 1880 7rlfxlf.exe 1904 bbtnbt.exe 688 3nhhbb.exe 3124 pdvpj.exe 4112 9ffrffx.exe 1436 1hbbtt.exe 368 nnhbtn.exe 4396 9vvpp.exe 872 7vvpd.exe 4992 lllxrlf.exe 1712 nhhhhn.exe 1888 tnnbth.exe 4420 jpvvd.exe 1900 xxfxlff.exe 2036 rlfxxrr.exe 3972 htbtbt.exe 4244 vppdj.exe 2152 jpvvd.exe 4176 lrrxxxr.exe 224 bbnnnh.exe 3296 nnthtn.exe 2308 jvppp.exe 4820 rfflllx.exe 1456 rllfrrr.exe 3128 btnhtn.exe 3664 3htntt.exe 4672 vjjvp.exe 2524 xxlrxrx.exe -
Processes:
resource yara_rule behavioral2/memory/2036-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-723-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fxxfxlf.exejvdjd.exejpvvj.exe1tnhhh.exerrxxllf.exejvjvv.exedjvjp.exexxlflfx.exe5hnbtn.exehnbbnt.exehhbbhh.exefxfxflr.exehnhbnh.exejpvpj.exe1rxrxrl.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exerrxrrrl.exetntntt.exe1httnh.exevvvvv.exefflfrlf.exebtnhhh.exedvjdj.exedddvv.exehbnhhh.exetthhhn.exepvjdd.exexfrrlrl.exe7lrlfff.exebthbtt.exevdddd.exedvjvp.exellfxrlf.exejpjjd.exe1xrlxrl.exelrffrxl.exebhbhth.exedescription pid Process procid_target PID 2036 wrote to memory of 3972 2036 3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exe 134 PID 2036 wrote to memory of 3972 2036 3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exe 134 PID 2036 wrote to memory of 3972 2036 3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exe 134 PID 3972 wrote to memory of 964 3972 rrxrrrl.exe 84 PID 3972 wrote to memory of 964 3972 rrxrrrl.exe 84 PID 3972 wrote to memory of 964 3972 rrxrrrl.exe 84 PID 964 wrote to memory of 4952 964 tntntt.exe 85 PID 964 wrote to memory of 4952 964 tntntt.exe 85 PID 964 wrote to memory of 4952 964 tntntt.exe 85 PID 4952 wrote to memory of 3328 4952 1httnh.exe 86 PID 4952 wrote to memory of 3328 4952 1httnh.exe 86 PID 4952 wrote to memory of 3328 4952 1httnh.exe 86 PID 3328 wrote to memory of 208 3328 vvvvv.exe 87 PID 3328 wrote to memory of 208 3328 vvvvv.exe 87 PID 3328 wrote to memory of 208 3328 vvvvv.exe 87 PID 208 wrote to memory of 4820 208 fflfrlf.exe 141 PID 208 wrote to memory of 4820 208 fflfrlf.exe 141 PID 208 wrote to memory of 4820 208 fflfrlf.exe 141 PID 4820 wrote to memory of 2316 4820 btnhhh.exe 89 PID 4820 wrote to memory of 2316 4820 btnhhh.exe 89 PID 4820 wrote to memory of 2316 4820 btnhhh.exe 89 PID 2316 wrote to memory of 3976 2316 dvjdj.exe 90 PID 2316 wrote to memory of 3976 2316 dvjdj.exe 90 PID 2316 wrote to memory of 3976 2316 dvjdj.exe 90 PID 3976 wrote to memory of 3836 3976 dddvv.exe 91 PID 3976 wrote to memory of 3836 3976 dddvv.exe 91 PID 3976 wrote to memory of 3836 3976 dddvv.exe 91 PID 3836 wrote to memory of 532 3836 hbnhhh.exe 92 PID 3836 wrote to memory of 532 3836 hbnhhh.exe 92 PID 3836 wrote to memory of 532 3836 hbnhhh.exe 92 PID 532 wrote to memory of 4148 532 tthhhn.exe 93 PID 532 wrote to memory of 4148 532 tthhhn.exe 93 PID 532 wrote to memory of 4148 532 tthhhn.exe 93 PID 4148 wrote to memory of 4664 4148 pvjdd.exe 94 PID 4148 wrote to memory of 4664 4148 pvjdd.exe 94 PID 4148 wrote to memory of 4664 4148 pvjdd.exe 94 PID 4664 wrote to memory of 2804 4664 xfrrlrl.exe 95 PID 4664 wrote to memory of 2804 4664 xfrrlrl.exe 95 PID 4664 wrote to memory of 2804 4664 xfrrlrl.exe 95 PID 2804 wrote to memory of 1424 2804 7lrlfff.exe 96 PID 2804 wrote to memory of 1424 2804 7lrlfff.exe 96 PID 2804 wrote to memory of 1424 2804 7lrlfff.exe 96 PID 1424 wrote to memory of 2632 1424 bthbtt.exe 153 PID 1424 wrote to memory of 2632 1424 bthbtt.exe 153 PID 1424 wrote to memory of 2632 1424 bthbtt.exe 153 PID 2632 wrote to memory of 4028 2632 vdddd.exe 98 PID 2632 wrote to memory of 4028 2632 vdddd.exe 98 PID 2632 wrote to memory of 4028 2632 vdddd.exe 98 PID 4028 wrote to memory of 1416 4028 dvjvp.exe 99 PID 4028 wrote to memory of 1416 4028 dvjvp.exe 99 PID 4028 wrote to memory of 1416 4028 dvjvp.exe 99 PID 1416 wrote to memory of 3936 1416 llfxrlf.exe 100 PID 1416 wrote to memory of 3936 1416 llfxrlf.exe 100 PID 1416 wrote to memory of 3936 1416 llfxrlf.exe 100 PID 3936 wrote to memory of 1948 3936 jpjjd.exe 101 PID 3936 wrote to memory of 1948 3936 jpjjd.exe 101 PID 3936 wrote to memory of 1948 3936 jpjjd.exe 101 PID 1948 wrote to memory of 2800 1948 1xrlxrl.exe 102 PID 1948 wrote to memory of 2800 1948 1xrlxrl.exe 102 PID 1948 wrote to memory of 2800 1948 1xrlxrl.exe 102 PID 2800 wrote to memory of 736 2800 lrffrxl.exe 103 PID 2800 wrote to memory of 736 2800 lrffrxl.exe 103 PID 2800 wrote to memory of 736 2800 lrffrxl.exe 103 PID 736 wrote to memory of 2572 736 bhbhth.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exe"C:\Users\Admin\AppData\Local\Temp\3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\tntntt.exec:\tntntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\1httnh.exec:\1httnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\vvvvv.exec:\vvvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\fflfrlf.exec:\fflfrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\btnhhh.exec:\btnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\dvjdj.exec:\dvjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\dddvv.exec:\dddvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\hbnhhh.exec:\hbnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\tthhhn.exec:\tthhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\pvjdd.exec:\pvjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\xfrrlrl.exec:\xfrrlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\7lrlfff.exec:\7lrlfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bthbtt.exec:\bthbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\vdddd.exec:\vdddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\dvjvp.exec:\dvjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\llfxrlf.exec:\llfxrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\jpjjd.exec:\jpjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\1xrlxrl.exec:\1xrlxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\lrffrxl.exec:\lrffrxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bhbhth.exec:\bhbhth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\7ddjd.exec:\7ddjd.exe23⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9xlffff.exec:\9xlffff.exe24⤵
- Executes dropped EXE
PID:1884 -
\??\c:\bbtbnb.exec:\bbtbnb.exe25⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pdpvp.exec:\pdpvp.exe26⤵
- Executes dropped EXE
PID:4540 -
\??\c:\dvjdv.exec:\dvjdv.exe27⤵
- Executes dropped EXE
PID:1072 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe28⤵
- Executes dropped EXE
PID:3764 -
\??\c:\tthttn.exec:\tthttn.exe29⤵
- Executes dropped EXE
PID:4488 -
\??\c:\dpjdp.exec:\dpjdp.exe30⤵
- Executes dropped EXE
PID:4320 -
\??\c:\xlxrlll.exec:\xlxrlll.exe31⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nhhhht.exec:\nhhhht.exe32⤵
- Executes dropped EXE
PID:4880 -
\??\c:\vdjdp.exec:\vdjdp.exe33⤵
- Executes dropped EXE
PID:4652 -
\??\c:\pjjdp.exec:\pjjdp.exe34⤵
- Executes dropped EXE
PID:3200 -
\??\c:\xrlfrrf.exec:\xrlfrrf.exe35⤵
- Executes dropped EXE
PID:716 -
\??\c:\bntnhh.exec:\bntnhh.exe36⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vpvpp.exec:\vpvpp.exe37⤵
- Executes dropped EXE
PID:1932 -
\??\c:\7rlfxlf.exec:\7rlfxlf.exe38⤵
- Executes dropped EXE
PID:1880 -
\??\c:\bbtnbt.exec:\bbtnbt.exe39⤵
- Executes dropped EXE
PID:1904 -
\??\c:\3nhhbb.exec:\3nhhbb.exe40⤵
- Executes dropped EXE
PID:688 -
\??\c:\pdvpj.exec:\pdvpj.exe41⤵
- Executes dropped EXE
PID:3124 -
\??\c:\9ffrffx.exec:\9ffrffx.exe42⤵
- Executes dropped EXE
PID:4112 -
\??\c:\1hbbtt.exec:\1hbbtt.exe43⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nnhbtn.exec:\nnhbtn.exe44⤵
- Executes dropped EXE
PID:368 -
\??\c:\9vvpp.exec:\9vvpp.exe45⤵
- Executes dropped EXE
PID:4396 -
\??\c:\7vvpd.exec:\7vvpd.exe46⤵
- Executes dropped EXE
PID:872 -
\??\c:\lllxrlf.exec:\lllxrlf.exe47⤵
- Executes dropped EXE
PID:4992 -
\??\c:\nhhhhn.exec:\nhhhhn.exe48⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tnnbth.exec:\tnnbth.exe49⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jpvvd.exec:\jpvvd.exe50⤵
- Executes dropped EXE
PID:4420 -
\??\c:\xxfxlff.exec:\xxfxlff.exe51⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rlfxxrr.exec:\rlfxxrr.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\htbtbt.exec:\htbtbt.exe53⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vppdj.exec:\vppdj.exe54⤵
- Executes dropped EXE
PID:4244 -
\??\c:\jpvvd.exec:\jpvvd.exe55⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lrrxxxr.exec:\lrrxxxr.exe56⤵
- Executes dropped EXE
PID:4176 -
\??\c:\bbnnnh.exec:\bbnnnh.exe57⤵
- Executes dropped EXE
PID:224 -
\??\c:\nnthtn.exec:\nnthtn.exe58⤵
- Executes dropped EXE
PID:3296 -
\??\c:\jvppp.exec:\jvppp.exe59⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rfflllx.exec:\rfflllx.exe60⤵
- Executes dropped EXE
PID:4820 -
\??\c:\rllfrrr.exec:\rllfrrr.exe61⤵
- Executes dropped EXE
PID:1456 -
\??\c:\btnhtn.exec:\btnhtn.exe62⤵
- Executes dropped EXE
PID:3128 -
\??\c:\3htntt.exec:\3htntt.exe63⤵
- Executes dropped EXE
PID:3664 -
\??\c:\vjjvp.exec:\vjjvp.exe64⤵
- Executes dropped EXE
PID:4672 -
\??\c:\xxlrxrx.exec:\xxlrxrx.exe65⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ththtn.exec:\ththtn.exe66⤵PID:532
-
\??\c:\hhhbnh.exec:\hhhbnh.exe67⤵PID:5020
-
\??\c:\vppjj.exec:\vppjj.exe68⤵PID:4032
-
\??\c:\llxflfx.exec:\llxflfx.exe69⤵PID:2792
-
\??\c:\9rfxlxr.exec:\9rfxlxr.exe70⤵PID:5028
-
\??\c:\bthntt.exec:\bthntt.exe71⤵PID:1156
-
\??\c:\pvjpv.exec:\pvjpv.exe72⤵PID:2632
-
\??\c:\fxxlfxl.exec:\fxxlfxl.exe73⤵PID:4896
-
\??\c:\bthbth.exec:\bthbth.exe74⤵PID:4048
-
\??\c:\tnthbt.exec:\tnthbt.exe75⤵PID:1408
-
\??\c:\jvdpd.exec:\jvdpd.exe76⤵PID:3592
-
\??\c:\jdppd.exec:\jdppd.exe77⤵PID:5016
-
\??\c:\xlflrxl.exec:\xlflrxl.exe78⤵PID:512
-
\??\c:\btbnhb.exec:\btbnhb.exe79⤵PID:2060
-
\??\c:\7jdpp.exec:\7jdpp.exe80⤵PID:1872
-
\??\c:\pjddp.exec:\pjddp.exe81⤵PID:2756
-
\??\c:\rllfxrl.exec:\rllfxrl.exe82⤵PID:2536
-
\??\c:\vpdjp.exec:\vpdjp.exe83⤵PID:4076
-
\??\c:\llfllxf.exec:\llfllxf.exe84⤵PID:2888
-
\??\c:\hnbbnt.exec:\hnbbnt.exe85⤵
- System Location Discovery: System Language Discovery
PID:2028 -
\??\c:\djjjd.exec:\djjjd.exe86⤵PID:1072
-
\??\c:\9lrlfff.exec:\9lrlfff.exe87⤵PID:3764
-
\??\c:\xllfxxr.exec:\xllfxxr.exe88⤵PID:5044
-
\??\c:\5tbthb.exec:\5tbthb.exe89⤵PID:4128
-
\??\c:\7vdvv.exec:\7vdvv.exe90⤵PID:1488
-
\??\c:\xfrlfff.exec:\xfrlfff.exe91⤵PID:4536
-
\??\c:\tntnnb.exec:\tntnnb.exe92⤵PID:116
-
\??\c:\jpjvp.exec:\jpjvp.exe93⤵PID:1688
-
\??\c:\xxfxxrr.exec:\xxfxxrr.exe94⤵PID:4732
-
\??\c:\bnnhbb.exec:\bnnhbb.exe95⤵PID:1916
-
\??\c:\rxfrfrf.exec:\rxfrfrf.exe96⤵PID:2416
-
\??\c:\hnhtnt.exec:\hnhtnt.exe97⤵PID:4856
-
\??\c:\vdpdj.exec:\vdpdj.exe98⤵PID:4704
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe99⤵PID:3492
-
\??\c:\9nnhbn.exec:\9nnhbn.exe100⤵PID:3900
-
\??\c:\jpvjd.exec:\jpvjd.exe101⤵PID:644
-
\??\c:\xlxlxlx.exec:\xlxlxlx.exe102⤵PID:3136
-
\??\c:\htbtbt.exec:\htbtbt.exe103⤵PID:3624
-
\??\c:\jjpdv.exec:\jjpdv.exe104⤵PID:3120
-
\??\c:\rlxllff.exec:\rlxllff.exe105⤵PID:1292
-
\??\c:\nhbtnt.exec:\nhbtnt.exe106⤵PID:3476
-
\??\c:\bhttnh.exec:\bhttnh.exe107⤵PID:3720
-
\??\c:\7pjvj.exec:\7pjvj.exe108⤵PID:1440
-
\??\c:\rrrrlff.exec:\rrrrlff.exe109⤵PID:3548
-
\??\c:\3btnht.exec:\3btnht.exe110⤵PID:4440
-
\??\c:\rfxfxrl.exec:\rfxfxrl.exe111⤵PID:4988
-
\??\c:\fxrfxxx.exec:\fxrfxxx.exe112⤵PID:2064
-
\??\c:\bthhhh.exec:\bthhhh.exe113⤵PID:4624
-
\??\c:\vppjv.exec:\vppjv.exe114⤵PID:1592
-
\??\c:\lrflllf.exec:\lrflllf.exe115⤵PID:3680
-
\??\c:\xrrxrff.exec:\xrrxrff.exe116⤵PID:5048
-
\??\c:\thnthh.exec:\thnthh.exe117⤵PID:4056
-
\??\c:\1vdpv.exec:\1vdpv.exe118⤵PID:1456
-
\??\c:\vjjjj.exec:\vjjjj.exe119⤵PID:3836
-
\??\c:\llrlfff.exec:\llrlfff.exe120⤵PID:1164
-
\??\c:\3hbbtt.exec:\3hbbtt.exe121⤵PID:1232
-
\??\c:\jpppj.exec:\jpppj.exe122⤵PID:3004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-