Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 14:28
Static task
static1
Behavioral task
behavioral1
Sample
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe
Resource
win7-20241010-en
General
-
Target
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe
-
Size
456KB
-
MD5
7c3a20d643b7797d5ab2d655627224f0
-
SHA1
674cb1d4fc82d94e6c4fbc5cd451f264b4904689
-
SHA256
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3c
-
SHA512
5674523a6cfde5042cab35d9f0faa90c0a17aa3b701cbdc25709487cb95b45a0c44818d29726eec73731d7a8f293a5460de1b3c1127c2d41d64ad984b6c623c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR5:q7Tc2NYHUrAwfMp3CDR5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
Processes:
resource yara_rule behavioral2/memory/4836-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/344-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-838-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-1153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-1701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hntnhb.exerxlflfx.exennbtnn.exehbbttt.exelxxlfrl.exefflrlfx.exejdpvv.exe9frlfrl.exepdjdv.exe3frlrxf.exevdjjd.exerfffrlr.exedppjv.exe1xxrlff.exellxrfxl.exehbtnhb.exerlfxlxr.exevpdvv.exevppdp.exepppdv.exelrlflfl.exe1ffrrll.exe7pvpj.exellfxlff.exejvdvp.exettnhhb.exepjpdv.exe7thhtn.exejdjjd.exe1btnbb.exevppjd.exetnnhtt.exe1vvpj.exerxfrffx.exehntnbb.exejvjdj.exefrxrllf.exelxfxrrl.exehhhhbb.exevpjdv.exe1flfrfx.exevvvvd.exedppjv.exerllfflf.exebbnbtt.exevvddj.exelrlflrr.exentnbnh.exejjjdp.exeppvpj.exexfxrxlf.exethhtnh.exepjdpd.exe9vdpd.exerlxrrlr.exe1tnhbh.exevvvvj.exe5vdvj.exerrlxlfr.exe3hbttt.exejdjpd.exejdjdv.exe5xrlfff.exefxflflf.exepid process 364 hntnhb.exe 1532 rxlflfx.exe 4976 nnbtnn.exe 3516 hbbttt.exe 344 lxxlfrl.exe 3780 fflrlfx.exe 2808 jdpvv.exe 1884 9frlfrl.exe 4928 pdjdv.exe 4944 3frlrxf.exe 2284 vdjjd.exe 4328 rfffrlr.exe 1864 dppjv.exe 2332 1xxrlff.exe 4688 llxrfxl.exe 4996 hbtnhb.exe 5024 rlfxlxr.exe 3612 vpdvv.exe 3760 vppdp.exe 1252 pppdv.exe 2864 lrlflfl.exe 3208 1ffrrll.exe 4460 7pvpj.exe 3696 llfxlff.exe 2868 jvdvp.exe 1456 ttnhhb.exe 2428 pjpdv.exe 2628 7thhtn.exe 2308 jdjjd.exe 2988 1btnbb.exe 4320 vppjd.exe 3508 tnnhtt.exe 4372 1vvpj.exe 4868 rxfrffx.exe 3504 hntnbb.exe 4952 jvjdj.exe 3680 frxrllf.exe 2440 lxfxrrl.exe 2316 hhhhbb.exe 4440 vpjdv.exe 1356 1flfrfx.exe 3728 vvvvd.exe 4296 dppjv.exe 3644 rllfflf.exe 3164 bbnbtt.exe 5080 vvddj.exe 4596 lrlflrr.exe 3316 ntnbnh.exe 700 jjjdp.exe 3004 ppvpj.exe 2808 xfxrxlf.exe 3988 thhtnh.exe 2292 pjdpd.exe 3656 9vdpd.exe 2320 rlxrrlr.exe 4484 1tnhbh.exe 1312 vvvvj.exe 2900 5vdvj.exe 2144 rrlxlfr.exe 2312 3hbttt.exe 4516 jdjpd.exe 4344 jdjdv.exe 4688 5xrlfff.exe 3916 fxflflf.exe -
Processes:
resource yara_rule behavioral2/memory/4836-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/344-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-755-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bttbnb.exethnhbb.exenhnhtn.exeppddv.exehhthtn.exetnbttn.exebthnbt.exelxlfxxf.exenbbbbb.exexflxrlf.exelffxlfr.exexlfxlfx.exefffrfxl.exebtbbtn.exe9tbtnn.exe3hhtht.exexxlffxx.exedjjdj.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exehntnhb.exerxlflfx.exennbtnn.exehbbttt.exelxxlfrl.exefflrlfx.exejdpvv.exe9frlfrl.exepdjdv.exe3frlrxf.exevdjjd.exerfffrlr.exedppjv.exe1xxrlff.exellxrfxl.exehbtnhb.exerlfxlxr.exevpdvv.exevppdp.exepppdv.exelrlflfl.exedescription pid process target process PID 4836 wrote to memory of 364 4836 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe hntnhb.exe PID 4836 wrote to memory of 364 4836 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe hntnhb.exe PID 4836 wrote to memory of 364 4836 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe hntnhb.exe PID 364 wrote to memory of 1532 364 hntnhb.exe rxlflfx.exe PID 364 wrote to memory of 1532 364 hntnhb.exe rxlflfx.exe PID 364 wrote to memory of 1532 364 hntnhb.exe rxlflfx.exe PID 1532 wrote to memory of 4976 1532 rxlflfx.exe nnbtnn.exe PID 1532 wrote to memory of 4976 1532 rxlflfx.exe nnbtnn.exe PID 1532 wrote to memory of 4976 1532 rxlflfx.exe nnbtnn.exe PID 4976 wrote to memory of 3516 4976 nnbtnn.exe hbbttt.exe PID 4976 wrote to memory of 3516 4976 nnbtnn.exe hbbttt.exe PID 4976 wrote to memory of 3516 4976 nnbtnn.exe hbbttt.exe PID 3516 wrote to memory of 344 3516 hbbttt.exe lxxlfrl.exe PID 3516 wrote to memory of 344 3516 hbbttt.exe lxxlfrl.exe PID 3516 wrote to memory of 344 3516 hbbttt.exe lxxlfrl.exe PID 344 wrote to memory of 3780 344 lxxlfrl.exe fflrlfx.exe PID 344 wrote to memory of 3780 344 lxxlfrl.exe fflrlfx.exe PID 344 wrote to memory of 3780 344 lxxlfrl.exe fflrlfx.exe PID 3780 wrote to memory of 2808 3780 fflrlfx.exe jdpvv.exe PID 3780 wrote to memory of 2808 3780 fflrlfx.exe jdpvv.exe PID 3780 wrote to memory of 2808 3780 fflrlfx.exe jdpvv.exe PID 2808 wrote to memory of 1884 2808 jdpvv.exe 9frlfrl.exe PID 2808 wrote to memory of 1884 2808 jdpvv.exe 9frlfrl.exe PID 2808 wrote to memory of 1884 2808 jdpvv.exe 9frlfrl.exe PID 1884 wrote to memory of 4928 1884 9frlfrl.exe pdjdv.exe PID 1884 wrote to memory of 4928 1884 9frlfrl.exe pdjdv.exe PID 1884 wrote to memory of 4928 1884 9frlfrl.exe pdjdv.exe PID 4928 wrote to memory of 4944 4928 pdjdv.exe 3frlrxf.exe PID 4928 wrote to memory of 4944 4928 pdjdv.exe 3frlrxf.exe PID 4928 wrote to memory of 4944 4928 pdjdv.exe 3frlrxf.exe PID 4944 wrote to memory of 2284 4944 3frlrxf.exe vdjjd.exe PID 4944 wrote to memory of 2284 4944 3frlrxf.exe vdjjd.exe PID 4944 wrote to memory of 2284 4944 3frlrxf.exe vdjjd.exe PID 2284 wrote to memory of 4328 2284 vdjjd.exe rfffrlr.exe PID 2284 wrote to memory of 4328 2284 vdjjd.exe rfffrlr.exe PID 2284 wrote to memory of 4328 2284 vdjjd.exe rfffrlr.exe PID 4328 wrote to memory of 1864 4328 rfffrlr.exe dppjv.exe PID 4328 wrote to memory of 1864 4328 rfffrlr.exe dppjv.exe PID 4328 wrote to memory of 1864 4328 rfffrlr.exe dppjv.exe PID 1864 wrote to memory of 2332 1864 dppjv.exe 1xxrlff.exe PID 1864 wrote to memory of 2332 1864 dppjv.exe 1xxrlff.exe PID 1864 wrote to memory of 2332 1864 dppjv.exe 1xxrlff.exe PID 2332 wrote to memory of 4688 2332 1xxrlff.exe llxrfxl.exe PID 2332 wrote to memory of 4688 2332 1xxrlff.exe llxrfxl.exe PID 2332 wrote to memory of 4688 2332 1xxrlff.exe llxrfxl.exe PID 4688 wrote to memory of 4996 4688 llxrfxl.exe hbtnhb.exe PID 4688 wrote to memory of 4996 4688 llxrfxl.exe hbtnhb.exe PID 4688 wrote to memory of 4996 4688 llxrfxl.exe hbtnhb.exe PID 4996 wrote to memory of 5024 4996 hbtnhb.exe rlfxlxr.exe PID 4996 wrote to memory of 5024 4996 hbtnhb.exe rlfxlxr.exe PID 4996 wrote to memory of 5024 4996 hbtnhb.exe rlfxlxr.exe PID 5024 wrote to memory of 3612 5024 rlfxlxr.exe vpdvv.exe PID 5024 wrote to memory of 3612 5024 rlfxlxr.exe vpdvv.exe PID 5024 wrote to memory of 3612 5024 rlfxlxr.exe vpdvv.exe PID 3612 wrote to memory of 3760 3612 vpdvv.exe vppdp.exe PID 3612 wrote to memory of 3760 3612 vpdvv.exe vppdp.exe PID 3612 wrote to memory of 3760 3612 vpdvv.exe vppdp.exe PID 3760 wrote to memory of 1252 3760 vppdp.exe pppdv.exe PID 3760 wrote to memory of 1252 3760 vppdp.exe pppdv.exe PID 3760 wrote to memory of 1252 3760 vppdp.exe pppdv.exe PID 1252 wrote to memory of 2864 1252 pppdv.exe lrlflfl.exe PID 1252 wrote to memory of 2864 1252 pppdv.exe lrlflfl.exe PID 1252 wrote to memory of 2864 1252 pppdv.exe lrlflfl.exe PID 2864 wrote to memory of 3208 2864 lrlflfl.exe 1ffrrll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe"C:\Users\Admin\AppData\Local\Temp\d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\hntnhb.exec:\hntnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\rxlflfx.exec:\rxlflfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\nnbtnn.exec:\nnbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\hbbttt.exec:\hbbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\lxxlfrl.exec:\lxxlfrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\fflrlfx.exec:\fflrlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\jdpvv.exec:\jdpvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\9frlfrl.exec:\9frlfrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\pdjdv.exec:\pdjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\3frlrxf.exec:\3frlrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\vdjjd.exec:\vdjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\rfffrlr.exec:\rfffrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\dppjv.exec:\dppjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\1xxrlff.exec:\1xxrlff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\llxrfxl.exec:\llxrfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\hbtnhb.exec:\hbtnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rlfxlxr.exec:\rlfxlxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\vpdvv.exec:\vpdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\vppdp.exec:\vppdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\pppdv.exec:\pppdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\lrlflfl.exec:\lrlflfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\1ffrrll.exec:\1ffrrll.exe23⤵
- Executes dropped EXE
PID:3208 -
\??\c:\7pvpj.exec:\7pvpj.exe24⤵
- Executes dropped EXE
PID:4460 -
\??\c:\llfxlff.exec:\llfxlff.exe25⤵
- Executes dropped EXE
PID:3696 -
\??\c:\jvdvp.exec:\jvdvp.exe26⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ttnhhb.exec:\ttnhhb.exe27⤵
- Executes dropped EXE
PID:1456 -
\??\c:\pjpdv.exec:\pjpdv.exe28⤵
- Executes dropped EXE
PID:2428 -
\??\c:\7thhtn.exec:\7thhtn.exe29⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jdjjd.exec:\jdjjd.exe30⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1btnbb.exec:\1btnbb.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vppjd.exec:\vppjd.exe32⤵
- Executes dropped EXE
PID:4320 -
\??\c:\tnnhtt.exec:\tnnhtt.exe33⤵
- Executes dropped EXE
PID:3508 -
\??\c:\1vvpj.exec:\1vvpj.exe34⤵
- Executes dropped EXE
PID:4372 -
\??\c:\rxfrffx.exec:\rxfrffx.exe35⤵
- Executes dropped EXE
PID:4868 -
\??\c:\hntnbb.exec:\hntnbb.exe36⤵
- Executes dropped EXE
PID:3504 -
\??\c:\jvjdj.exec:\jvjdj.exe37⤵
- Executes dropped EXE
PID:4952 -
\??\c:\frxrllf.exec:\frxrllf.exe38⤵
- Executes dropped EXE
PID:3680 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe39⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hhhhbb.exec:\hhhhbb.exe40⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vpjdv.exec:\vpjdv.exe41⤵
- Executes dropped EXE
PID:4440 -
\??\c:\1flfrfx.exec:\1flfrfx.exe42⤵
- Executes dropped EXE
PID:1356 -
\??\c:\vvvvd.exec:\vvvvd.exe43⤵
- Executes dropped EXE
PID:3728 -
\??\c:\dppjv.exec:\dppjv.exe44⤵
- Executes dropped EXE
PID:4296 -
\??\c:\rllfflf.exec:\rllfflf.exe45⤵
- Executes dropped EXE
PID:3644 -
\??\c:\bbnbtt.exec:\bbnbtt.exe46⤵
- Executes dropped EXE
PID:3164 -
\??\c:\vvddj.exec:\vvddj.exe47⤵
- Executes dropped EXE
PID:5080 -
\??\c:\lrlflrr.exec:\lrlflrr.exe48⤵
- Executes dropped EXE
PID:4596 -
\??\c:\ntnbnh.exec:\ntnbnh.exe49⤵
- Executes dropped EXE
PID:3316 -
\??\c:\jjjdp.exec:\jjjdp.exe50⤵
- Executes dropped EXE
PID:700 -
\??\c:\ppvpj.exec:\ppvpj.exe51⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xfxrxlf.exec:\xfxrxlf.exe52⤵
- Executes dropped EXE
PID:2808 -
\??\c:\thhtnh.exec:\thhtnh.exe53⤵
- Executes dropped EXE
PID:3988 -
\??\c:\pjdpd.exec:\pjdpd.exe54⤵
- Executes dropped EXE
PID:2292 -
\??\c:\9vdpd.exec:\9vdpd.exe55⤵
- Executes dropped EXE
PID:3656 -
\??\c:\rlxrrlr.exec:\rlxrrlr.exe56⤵
- Executes dropped EXE
PID:2320 -
\??\c:\1tnhbh.exec:\1tnhbh.exe57⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vvvvj.exec:\vvvvj.exe58⤵
- Executes dropped EXE
PID:1312 -
\??\c:\5vdvj.exec:\5vdvj.exe59⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rrlxlfr.exec:\rrlxlfr.exe60⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3hbttt.exec:\3hbttt.exe61⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jdjpd.exec:\jdjpd.exe62⤵
- Executes dropped EXE
PID:4516 -
\??\c:\jdjdv.exec:\jdjdv.exe63⤵
- Executes dropped EXE
PID:4344 -
\??\c:\5xrlfff.exec:\5xrlfff.exe64⤵
- Executes dropped EXE
PID:4688 -
\??\c:\fxflflf.exec:\fxflflf.exe65⤵
- Executes dropped EXE
PID:3916 -
\??\c:\tbbnbt.exec:\tbbnbt.exe66⤵PID:5044
-
\??\c:\vjjjd.exec:\vjjjd.exe67⤵PID:4092
-
\??\c:\7rxlfxx.exec:\7rxlfxx.exe68⤵PID:3176
-
\??\c:\bttnht.exec:\bttnht.exe69⤵PID:372
-
\??\c:\btthhb.exec:\btthhb.exe70⤵PID:780
-
\??\c:\pvdvj.exec:\pvdvj.exe71⤵PID:972
-
\??\c:\xllxrll.exec:\xllxrll.exe72⤵PID:5112
-
\??\c:\tttntn.exec:\tttntn.exe73⤵PID:3208
-
\??\c:\ntbthb.exec:\ntbthb.exe74⤵PID:2620
-
\??\c:\jvvjj.exec:\jvvjj.exe75⤵PID:4636
-
\??\c:\llxrfff.exec:\llxrfff.exe76⤵PID:2824
-
\??\c:\9flffff.exec:\9flffff.exe77⤵PID:4804
-
\??\c:\thbtnn.exec:\thbtnn.exe78⤵PID:2868
-
\??\c:\dpvpd.exec:\dpvpd.exe79⤵PID:2872
-
\??\c:\5ddpj.exec:\5ddpj.exe80⤵PID:3056
-
\??\c:\frfxffx.exec:\frfxffx.exe81⤵PID:448
-
\??\c:\tnhbht.exec:\tnhbht.exe82⤵PID:2628
-
\??\c:\vpvpp.exec:\vpvpp.exe83⤵PID:4700
-
\??\c:\5fxxxxf.exec:\5fxxxxf.exe84⤵PID:684
-
\??\c:\bthnbt.exec:\bthnbt.exe85⤵
- System Location Discovery: System Language Discovery
PID:4668 -
\??\c:\9dvpv.exec:\9dvpv.exe86⤵PID:452
-
\??\c:\jddpd.exec:\jddpd.exe87⤵PID:5040
-
\??\c:\xlxrrxr.exec:\xlxrrxr.exe88⤵PID:2072
-
\??\c:\httntn.exec:\httntn.exe89⤵PID:224
-
\??\c:\jdpjd.exec:\jdpjd.exe90⤵PID:3972
-
\??\c:\vpdpj.exec:\vpdpj.exe91⤵PID:4260
-
\??\c:\rxllffx.exec:\rxllffx.exe92⤵PID:3240
-
\??\c:\btbtnn.exec:\btbtnn.exe93⤵PID:1500
-
\??\c:\dvpjv.exec:\dvpjv.exe94⤵PID:1304
-
\??\c:\dvvdp.exec:\dvvdp.exe95⤵PID:4888
-
\??\c:\frlxxrf.exec:\frlxxrf.exe96⤵PID:1784
-
\??\c:\tttnhb.exec:\tttnhb.exe97⤵PID:2660
-
\??\c:\vvjdp.exec:\vvjdp.exe98⤵PID:4580
-
\??\c:\xrxrlxr.exec:\xrxrlxr.exe99⤵PID:4588
-
\??\c:\bbbnbn.exec:\bbbnbn.exe100⤵PID:2884
-
\??\c:\5nhbnn.exec:\5nhbnn.exe101⤵PID:3516
-
\??\c:\djvpd.exec:\djvpd.exe102⤵PID:344
-
\??\c:\lflxfrf.exec:\lflxfrf.exe103⤵PID:4112
-
\??\c:\nnthht.exec:\nnthht.exe104⤵PID:4600
-
\??\c:\9tnhtt.exec:\9tnhtt.exe105⤵PID:1944
-
\??\c:\pddjd.exec:\pddjd.exe106⤵PID:3172
-
\??\c:\lxxrffx.exec:\lxxrffx.exe107⤵PID:2808
-
\??\c:\nhtbbh.exec:\nhtbbh.exe108⤵PID:4084
-
\??\c:\7nhtnn.exec:\7nhtnn.exe109⤵PID:1780
-
\??\c:\jpvvj.exec:\jpvvj.exe110⤵PID:3868
-
\??\c:\fxxrffx.exec:\fxxrffx.exe111⤵PID:3540
-
\??\c:\7rfxrrr.exec:\7rfxrrr.exe112⤵PID:2284
-
\??\c:\1vvjv.exec:\1vvjv.exe113⤵PID:2020
-
\??\c:\pdjjv.exec:\pdjjv.exe114⤵PID:2928
-
\??\c:\lrrlxxf.exec:\lrrlxxf.exe115⤵PID:4488
-
\??\c:\tnnhbb.exec:\tnnhbb.exe116⤵PID:2936
-
\??\c:\pvdpd.exec:\pvdpd.exe117⤵PID:2548
-
\??\c:\xrrfrrl.exec:\xrrfrrl.exe118⤵PID:4300
-
\??\c:\bhbthb.exec:\bhbthb.exe119⤵PID:1248
-
\??\c:\7jvpj.exec:\7jvpj.exe120⤵PID:2040
-
\??\c:\7jdpd.exec:\7jdpd.exe121⤵PID:3916
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe122⤵PID:5044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-