Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 14:37
Static task
static1
Behavioral task
behavioral1
Sample
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe
Resource
win7-20240708-en
General
-
Target
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe
-
Size
384KB
-
MD5
0ada576629d2a2c79ab1cafcf823718c
-
SHA1
6dde40cdbd6857ffc06569bdf9b9c8b5978c6046
-
SHA256
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff
-
SHA512
9567227eb22f308cde4f42a5f6a271ea2ae314c4d6593fd436bd17a9039e9781041d68667eada4122431bff99364089c4efe0acfc4a662bc05d8476bdd763610
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFw41/t49:8cm7ImGddXmNt251UriZFwkS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/4396-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-1092-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-1144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-1499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbnnnn.exerlxrrlr.exelxlxlfr.exexlxlfxx.exedppjv.exelxfrffl.exepdvvd.exefxfrlfr.exerlrfrll.exepppjv.exe5hhhnh.exejdppv.exefxrlxrl.exe7tbnbt.exevdjjv.exerllxrlx.exethnnht.exevpdjv.exeflfxllf.exehbbttn.exelffrfxr.exebbnnnn.exepvdvd.exexrxlfxx.exe9lxlfrl.exe5nnhtt.exevjpjv.exettthbt.exenbbhbt.exefxlfrll.exevvjvj.exelfxxfrl.exebbnbnn.exelrfxfrl.exebhhbtn.exejdddv.exe7jdpp.exellrlrfr.exetthbnh.exevddvp.exelrxlxlf.exehnnbtn.exepjvpp.exepppdp.exefxxrlfr.exe7tbnbn.exenbbtnh.exe3pvpp.exelrllflx.exenntnhh.exe3vpjd.exelfrfrlf.exe1hhhbb.exehbbthb.exe5pvdd.exexrrfrll.exehnthht.exetbbthh.exeddpjd.exe3ttnbb.exe9nnhnn.exejpjvp.exe9rrlxlf.exelxrlffx.exepid process 1532 hbnnnn.exe 4852 rlxrrlr.exe 2864 lxlxlfr.exe 1516 xlxlfxx.exe 3676 dppjv.exe 3852 lxfrffl.exe 3280 pdvvd.exe 2184 fxfrlfr.exe 400 rlrfrll.exe 752 pppjv.exe 3208 5hhhnh.exe 4640 jdppv.exe 1860 fxrlxrl.exe 1952 7tbnbt.exe 3460 vdjjv.exe 3584 rllxrlx.exe 4100 thnnht.exe 4628 vpdjv.exe 4940 flfxllf.exe 2352 hbbttn.exe 4920 lffrfxr.exe 4656 bbnnnn.exe 3496 pvdvd.exe 1364 xrxlfxx.exe 4860 9lxlfrl.exe 464 5nnhtt.exe 1588 vjpjv.exe 2104 ttthbt.exe 3540 nbbhbt.exe 5016 fxlfrll.exe 4596 vvjvj.exe 3996 lfxxfrl.exe 2256 bbnbnn.exe 4324 lrfxfrl.exe 2240 bhhbtn.exe 2892 jdddv.exe 3252 7jdpp.exe 2948 llrlrfr.exe 2220 tthbnh.exe 4500 vddvp.exe 3516 lrxlxlf.exe 3832 hnnbtn.exe 3520 pjvpp.exe 4732 pppdp.exe 724 fxxrlfr.exe 3292 7tbnbn.exe 1356 nbbtnh.exe 3192 3pvpp.exe 4400 lrllflx.exe 4444 nntnhh.exe 3200 3vpjd.exe 860 lfrfrlf.exe 4364 1hhhbb.exe 3752 hbbthb.exe 3928 5pvdd.exe 3576 xrrfrll.exe 1572 hnthht.exe 2208 tbbthh.exe 2632 ddpjd.exe 3852 3ttnbb.exe 3100 9nnhnn.exe 5008 jpjvp.exe 4872 9rrlxlf.exe 2184 lxrlffx.exe -
Processes:
resource yara_rule behavioral2/memory/4396-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-908-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hbbnht.exebhnhtn.exebbbbbt.exepvjdv.exellxrxxl.exedjpdv.exe3llxfxl.exeppjjd.exejvvjp.exelxlxlfr.exevvjdd.exe1bhbtt.exepjpjv.exexxlrfxx.exehtbbtn.exe1xfxrrl.exefxxlxrl.exedjvvd.exevpvpd.exejvvvj.exe1rrlrlf.exe7ffxxxr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrlrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffxxxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exehbnnnn.exerlxrrlr.exelxlxlfr.exexlxlfxx.exedppjv.exelxfrffl.exepdvvd.exefxfrlfr.exerlrfrll.exepppjv.exe5hhhnh.exejdppv.exefxrlxrl.exe7tbnbt.exevdjjv.exerllxrlx.exethnnht.exevpdjv.exeflfxllf.exehbbttn.exelffrfxr.exedescription pid process target process PID 4396 wrote to memory of 1532 4396 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe hbnnnn.exe PID 4396 wrote to memory of 1532 4396 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe hbnnnn.exe PID 4396 wrote to memory of 1532 4396 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe hbnnnn.exe PID 1532 wrote to memory of 4852 1532 hbnnnn.exe rlxrrlr.exe PID 1532 wrote to memory of 4852 1532 hbnnnn.exe rlxrrlr.exe PID 1532 wrote to memory of 4852 1532 hbnnnn.exe rlxrrlr.exe PID 4852 wrote to memory of 2864 4852 rlxrrlr.exe lxlxlfr.exe PID 4852 wrote to memory of 2864 4852 rlxrrlr.exe lxlxlfr.exe PID 4852 wrote to memory of 2864 4852 rlxrrlr.exe lxlxlfr.exe PID 2864 wrote to memory of 1516 2864 lxlxlfr.exe xlxlfxx.exe PID 2864 wrote to memory of 1516 2864 lxlxlfr.exe xlxlfxx.exe PID 2864 wrote to memory of 1516 2864 lxlxlfr.exe xlxlfxx.exe PID 1516 wrote to memory of 3676 1516 xlxlfxx.exe dppjv.exe PID 1516 wrote to memory of 3676 1516 xlxlfxx.exe dppjv.exe PID 1516 wrote to memory of 3676 1516 xlxlfxx.exe dppjv.exe PID 3676 wrote to memory of 3852 3676 dppjv.exe lxfrffl.exe PID 3676 wrote to memory of 3852 3676 dppjv.exe lxfrffl.exe PID 3676 wrote to memory of 3852 3676 dppjv.exe lxfrffl.exe PID 3852 wrote to memory of 3280 3852 lxfrffl.exe pdvvd.exe PID 3852 wrote to memory of 3280 3852 lxfrffl.exe pdvvd.exe PID 3852 wrote to memory of 3280 3852 lxfrffl.exe pdvvd.exe PID 3280 wrote to memory of 2184 3280 pdvvd.exe fxfrlfr.exe PID 3280 wrote to memory of 2184 3280 pdvvd.exe fxfrlfr.exe PID 3280 wrote to memory of 2184 3280 pdvvd.exe fxfrlfr.exe PID 2184 wrote to memory of 400 2184 fxfrlfr.exe rlrfrll.exe PID 2184 wrote to memory of 400 2184 fxfrlfr.exe rlrfrll.exe PID 2184 wrote to memory of 400 2184 fxfrlfr.exe rlrfrll.exe PID 400 wrote to memory of 752 400 rlrfrll.exe pppjv.exe PID 400 wrote to memory of 752 400 rlrfrll.exe pppjv.exe PID 400 wrote to memory of 752 400 rlrfrll.exe pppjv.exe PID 752 wrote to memory of 3208 752 pppjv.exe 5hhhnh.exe PID 752 wrote to memory of 3208 752 pppjv.exe 5hhhnh.exe PID 752 wrote to memory of 3208 752 pppjv.exe 5hhhnh.exe PID 3208 wrote to memory of 4640 3208 5hhhnh.exe jdppv.exe PID 3208 wrote to memory of 4640 3208 5hhhnh.exe jdppv.exe PID 3208 wrote to memory of 4640 3208 5hhhnh.exe jdppv.exe PID 4640 wrote to memory of 1860 4640 jdppv.exe fxrlxrl.exe PID 4640 wrote to memory of 1860 4640 jdppv.exe fxrlxrl.exe PID 4640 wrote to memory of 1860 4640 jdppv.exe fxrlxrl.exe PID 1860 wrote to memory of 1952 1860 fxrlxrl.exe 7tbnbt.exe PID 1860 wrote to memory of 1952 1860 fxrlxrl.exe 7tbnbt.exe PID 1860 wrote to memory of 1952 1860 fxrlxrl.exe 7tbnbt.exe PID 1952 wrote to memory of 3460 1952 7tbnbt.exe vdjjv.exe PID 1952 wrote to memory of 3460 1952 7tbnbt.exe vdjjv.exe PID 1952 wrote to memory of 3460 1952 7tbnbt.exe vdjjv.exe PID 3460 wrote to memory of 3584 3460 vdjjv.exe rllxrlx.exe PID 3460 wrote to memory of 3584 3460 vdjjv.exe rllxrlx.exe PID 3460 wrote to memory of 3584 3460 vdjjv.exe rllxrlx.exe PID 3584 wrote to memory of 4100 3584 rllxrlx.exe thnnht.exe PID 3584 wrote to memory of 4100 3584 rllxrlx.exe thnnht.exe PID 3584 wrote to memory of 4100 3584 rllxrlx.exe thnnht.exe PID 4100 wrote to memory of 4628 4100 thnnht.exe vpdjv.exe PID 4100 wrote to memory of 4628 4100 thnnht.exe vpdjv.exe PID 4100 wrote to memory of 4628 4100 thnnht.exe vpdjv.exe PID 4628 wrote to memory of 4940 4628 vpdjv.exe flfxllf.exe PID 4628 wrote to memory of 4940 4628 vpdjv.exe flfxllf.exe PID 4628 wrote to memory of 4940 4628 vpdjv.exe flfxllf.exe PID 4940 wrote to memory of 2352 4940 flfxllf.exe hbbttn.exe PID 4940 wrote to memory of 2352 4940 flfxllf.exe hbbttn.exe PID 4940 wrote to memory of 2352 4940 flfxllf.exe hbbttn.exe PID 2352 wrote to memory of 4920 2352 hbbttn.exe lffrfxr.exe PID 2352 wrote to memory of 4920 2352 hbbttn.exe lffrfxr.exe PID 2352 wrote to memory of 4920 2352 hbbttn.exe lffrfxr.exe PID 4920 wrote to memory of 4656 4920 lffrfxr.exe bbnnnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe"C:\Users\Admin\AppData\Local\Temp\e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\hbnnnn.exec:\hbnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\rlxrrlr.exec:\rlxrrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\lxlxlfr.exec:\lxlxlfr.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\xlxlfxx.exec:\xlxlfxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\dppjv.exec:\dppjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\lxfrffl.exec:\lxfrffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\pdvvd.exec:\pdvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\fxfrlfr.exec:\fxfrlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\rlrfrll.exec:\rlrfrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\pppjv.exec:\pppjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\5hhhnh.exec:\5hhhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\jdppv.exec:\jdppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\7tbnbt.exec:\7tbnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\vdjjv.exec:\vdjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\rllxrlx.exec:\rllxrlx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\thnnht.exec:\thnnht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\vpdjv.exec:\vpdjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\flfxllf.exec:\flfxllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\hbbttn.exec:\hbbttn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\lffrfxr.exec:\lffrfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\bbnnnn.exec:\bbnnnn.exe23⤵
- Executes dropped EXE
PID:4656 -
\??\c:\pvdvd.exec:\pvdvd.exe24⤵
- Executes dropped EXE
PID:3496 -
\??\c:\xrxlfxx.exec:\xrxlfxx.exe25⤵
- Executes dropped EXE
PID:1364 -
\??\c:\9lxlfrl.exec:\9lxlfrl.exe26⤵
- Executes dropped EXE
PID:4860 -
\??\c:\5nnhtt.exec:\5nnhtt.exe27⤵
- Executes dropped EXE
PID:464 -
\??\c:\vjpjv.exec:\vjpjv.exe28⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ttthbt.exec:\ttthbt.exe29⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nbbhbt.exec:\nbbhbt.exe30⤵
- Executes dropped EXE
PID:3540 -
\??\c:\fxlfrll.exec:\fxlfrll.exe31⤵
- Executes dropped EXE
PID:5016 -
\??\c:\vvjvj.exec:\vvjvj.exe32⤵
- Executes dropped EXE
PID:4596 -
\??\c:\lfxxfrl.exec:\lfxxfrl.exe33⤵
- Executes dropped EXE
PID:3996 -
\??\c:\bbnbnn.exec:\bbnbnn.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lrfxfrl.exec:\lrfxfrl.exe35⤵
- Executes dropped EXE
PID:4324 -
\??\c:\bhhbtn.exec:\bhhbtn.exe36⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jdddv.exec:\jdddv.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7jdpp.exec:\7jdpp.exe38⤵
- Executes dropped EXE
PID:3252 -
\??\c:\llrlrfr.exec:\llrlrfr.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\tthbnh.exec:\tthbnh.exe40⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vddvp.exec:\vddvp.exe41⤵
- Executes dropped EXE
PID:4500 -
\??\c:\lrxlxlf.exec:\lrxlxlf.exe42⤵
- Executes dropped EXE
PID:3516 -
\??\c:\hnnbtn.exec:\hnnbtn.exe43⤵
- Executes dropped EXE
PID:3832 -
\??\c:\pjvpp.exec:\pjvpp.exe44⤵
- Executes dropped EXE
PID:3520 -
\??\c:\pppdp.exec:\pppdp.exe45⤵
- Executes dropped EXE
PID:4732 -
\??\c:\fxxrlfr.exec:\fxxrlfr.exe46⤵
- Executes dropped EXE
PID:724 -
\??\c:\7tbnbn.exec:\7tbnbn.exe47⤵
- Executes dropped EXE
PID:3292 -
\??\c:\nbbtnh.exec:\nbbtnh.exe48⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3pvpp.exec:\3pvpp.exe49⤵
- Executes dropped EXE
PID:3192 -
\??\c:\lrllflx.exec:\lrllflx.exe50⤵
- Executes dropped EXE
PID:4400 -
\??\c:\nntnhh.exec:\nntnhh.exe51⤵
- Executes dropped EXE
PID:4444 -
\??\c:\3vpjd.exec:\3vpjd.exe52⤵
- Executes dropped EXE
PID:3200 -
\??\c:\lfrfrlf.exec:\lfrfrlf.exe53⤵
- Executes dropped EXE
PID:860 -
\??\c:\1hhhbb.exec:\1hhhbb.exe54⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hbbthb.exec:\hbbthb.exe55⤵
- Executes dropped EXE
PID:3752 -
\??\c:\5pvdd.exec:\5pvdd.exe56⤵
- Executes dropped EXE
PID:3928 -
\??\c:\xrrfrll.exec:\xrrfrll.exe57⤵
- Executes dropped EXE
PID:3576 -
\??\c:\hnthht.exec:\hnthht.exe58⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tbbthh.exec:\tbbthh.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ddpjd.exec:\ddpjd.exe60⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3ttnbb.exec:\3ttnbb.exe61⤵
- Executes dropped EXE
PID:3852 -
\??\c:\9nnhnn.exec:\9nnhnn.exe62⤵
- Executes dropped EXE
PID:3100 -
\??\c:\jpjvp.exec:\jpjvp.exe63⤵
- Executes dropped EXE
PID:5008 -
\??\c:\9rrlxlf.exec:\9rrlxlf.exe64⤵
- Executes dropped EXE
PID:4872 -
\??\c:\lxrlffx.exec:\lxrlffx.exe65⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nhthhh.exec:\nhthhh.exe66⤵PID:4452
-
\??\c:\5pvjv.exec:\5pvjv.exe67⤵PID:4092
-
\??\c:\rllfxxx.exec:\rllfxxx.exe68⤵PID:752
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe69⤵PID:4044
-
\??\c:\hnhhbb.exec:\hnhhbb.exe70⤵PID:2676
-
\??\c:\dppjj.exec:\dppjj.exe71⤵PID:4712
-
\??\c:\vdvjv.exec:\vdvjv.exe72⤵PID:4028
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe73⤵PID:1480
-
\??\c:\hbhhbn.exec:\hbhhbn.exe74⤵PID:3464
-
\??\c:\jjppd.exec:\jjppd.exe75⤵PID:852
-
\??\c:\pjdvd.exec:\pjdvd.exe76⤵PID:2668
-
\??\c:\xxxlfxr.exec:\xxxlfxr.exe77⤵PID:4076
-
\??\c:\btbbtt.exec:\btbbtt.exe78⤵PID:4208
-
\??\c:\pddpj.exec:\pddpj.exe79⤵PID:4628
-
\??\c:\pdpjj.exec:\pdpjj.exe80⤵PID:4940
-
\??\c:\lrfxrxr.exec:\lrfxrxr.exe81⤵PID:4516
-
\??\c:\ntbbbt.exec:\ntbbbt.exe82⤵PID:1508
-
\??\c:\5bbnbt.exec:\5bbnbt.exe83⤵PID:4244
-
\??\c:\1pvpd.exec:\1pvpd.exe84⤵PID:3936
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe85⤵PID:4656
-
\??\c:\nbnhbb.exec:\nbnhbb.exe86⤵PID:2348
-
\??\c:\pvvpj.exec:\pvvpj.exe87⤵PID:2604
-
\??\c:\dpdvj.exec:\dpdvj.exe88⤵PID:4840
-
\??\c:\ffxxllx.exec:\ffxxllx.exe89⤵PID:4152
-
\??\c:\bbhbtt.exec:\bbhbtt.exe90⤵PID:2216
-
\??\c:\hbtnnh.exec:\hbtnnh.exe91⤵PID:2200
-
\??\c:\jvdpd.exec:\jvdpd.exe92⤵PID:1452
-
\??\c:\lrfrlrl.exec:\lrfrlrl.exe93⤵PID:5048
-
\??\c:\tntbnn.exec:\tntbnn.exe94⤵PID:5016
-
\??\c:\jjjvj.exec:\jjjvj.exe95⤵PID:1956
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe96⤵PID:884
-
\??\c:\3hhbhb.exec:\3hhbhb.exe97⤵PID:4416
-
\??\c:\bhbthh.exec:\bhbthh.exe98⤵PID:956
-
\??\c:\9vjdd.exec:\9vjdd.exe99⤵PID:4324
-
\??\c:\rlfrxrr.exec:\rlfrxrr.exe100⤵PID:2240
-
\??\c:\bbbtnn.exec:\bbbtnn.exe101⤵PID:4600
-
\??\c:\hnbnbb.exec:\hnbnbb.exe102⤵PID:1100
-
\??\c:\pppdp.exec:\pppdp.exe103⤵PID:3116
-
\??\c:\pjppd.exec:\pjppd.exe104⤵PID:3148
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe105⤵PID:4824
-
\??\c:\hhbtnn.exec:\hhbtnn.exe106⤵PID:5116
-
\??\c:\pdvpv.exec:\pdvpv.exe107⤵PID:2716
-
\??\c:\ppjjp.exec:\ppjjp.exe108⤵PID:3176
-
\??\c:\9xxlxrl.exec:\9xxlxrl.exe109⤵PID:4768
-
\??\c:\thhbtn.exec:\thhbtn.exe110⤵PID:5060
-
\??\c:\dvjdv.exec:\dvjdv.exe111⤵PID:2320
-
\??\c:\rxfrffr.exec:\rxfrffr.exe112⤵PID:2444
-
\??\c:\btnhbb.exec:\btnhbb.exe113⤵PID:3020
-
\??\c:\nbnhtt.exec:\nbnhtt.exe114⤵PID:4440
-
\??\c:\dpvpd.exec:\dpvpd.exe115⤵PID:1740
-
\??\c:\rxfxrrx.exec:\rxfxrrx.exe116⤵PID:3200
-
\??\c:\7bhbtt.exec:\7bhbtt.exe117⤵PID:2952
-
\??\c:\7vdvp.exec:\7vdvp.exe118⤵PID:2064
-
\??\c:\ddpvp.exec:\ddpvp.exe119⤵PID:1040
-
\??\c:\xfrrlll.exec:\xfrrlll.exe120⤵PID:1572
-
\??\c:\bttnhh.exec:\bttnhh.exe121⤵PID:4836
-
\??\c:\nhbtnn.exec:\nhbtnn.exe122⤵PID:1796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-