Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 21:12
Static task
static1
Behavioral task
behavioral1
Sample
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe
Resource
win7-20240903-en
General
-
Target
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe
-
Size
332KB
-
MD5
c627dddffa7434e42384fbb2b307622c
-
SHA1
526fd0d28ae693bd9813ebbed46a5bfe297efac1
-
SHA256
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0
-
SHA512
3eb5903d056bddfdaf2e1dc693137b1b17bdd7401f0df856da09403aeb19ded80cd3aaa145369e3f7bb0a193d608cd58d70508cfd7c2eabc2e902a32dab720f6
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhP:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/244-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-855-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjpjj.exejpjdv.exentbnnh.exevjppp.exellxxrxl.exepjdpj.exethbntb.exedvvvp.exelflllll.exepvvvv.exefrxxxrl.exebtbnhb.exexrxrrlf.exeppdvp.exenhtthh.exetntnbt.exelrxxrrr.exehhtntt.exedvddv.exexxfxxxr.exevppvp.exerxlfrfx.exedjvjd.exepppjd.exerrrrlrl.exexllrrxl.exenbbbbt.exenbhhtn.exebhtnhh.exexlrrlrl.exehbhhht.exefrxfxxl.exefrrllfl.exettbttn.exe9vdjj.exehbbbnn.exejvdvp.exeffxrflr.exennthhh.exejpdvp.exe7ntthn.exetnbttt.exepdppp.exelrlxfxl.exenbhnbh.exe3dpjp.exe5dvjp.exe1llfxll.exethnhbh.exefllrrfx.exehbhhhn.exedvddv.exe1vjdd.exellffllx.exe3hbhbh.exevjjdd.exeddjjv.exe7fxlflf.exehnbbbb.exe5dvpp.exepjpvv.exenbtttb.exerrrrrxx.exebttnnn.exepid process 4052 jjpjj.exe 4576 jpjdv.exe 4756 ntbnnh.exe 4472 vjppp.exe 5008 llxxrxl.exe 4952 pjdpj.exe 3820 thbntb.exe 4800 dvvvp.exe 3964 lflllll.exe 1524 pvvvv.exe 1096 frxxxrl.exe 3992 btbnhb.exe 1624 xrxrrlf.exe 1896 ppdvp.exe 3092 nhtthh.exe 364 tntnbt.exe 1628 lrxxrrr.exe 2868 hhtntt.exe 5028 dvddv.exe 2888 xxfxxxr.exe 4988 vppvp.exe 2876 rxlfrfx.exe 1008 djvjd.exe 2016 pppjd.exe 452 rrrrlrl.exe 4296 xllrrxl.exe 2908 nbbbbt.exe 3352 nbhhtn.exe 1124 bhtnhh.exe 4216 xlrrlrl.exe 740 hbhhht.exe 3808 frxfxxl.exe 2788 frrllfl.exe 1640 ttbttn.exe 1492 9vdjj.exe 2752 hbbbnn.exe 4340 jvdvp.exe 2408 ffxrflr.exe 2432 nnthhh.exe 4444 jpdvp.exe 3596 7ntthn.exe 228 tnbttt.exe 2928 pdppp.exe 4432 lrlxfxl.exe 3136 nbhnbh.exe 2904 3dpjp.exe 3612 5dvjp.exe 1692 1llfxll.exe 1352 thnhbh.exe 2592 fllrrfx.exe 852 hbhhhn.exe 1216 dvddv.exe 4956 1vjdd.exe 4624 llffllx.exe 4576 3hbhbh.exe 1128 vjjdd.exe 4848 ddjjv.exe 3436 7fxlflf.exe 1984 hnbbbb.exe 4996 5dvpp.exe 4800 pjpvv.exe 4816 nbtttb.exe 2020 rrrrrxx.exe 4488 bttnnn.exe -
Processes:
resource yara_rule behavioral2/memory/244-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-663-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
xllllll.exe7rxrflr.exejdjdd.exethbntb.exerxlfxxf.exehhtntn.exedvjdd.exe5rfxrll.exelxlfxxx.exe5jpjd.exelfxrrll.exeppvvv.exebnbbhh.exehtbthh.exe1hnhhb.exe5ttttt.exehhnttb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnttb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exejjpjj.exejpjdv.exentbnnh.exevjppp.exellxxrxl.exepjdpj.exethbntb.exedvvvp.exelflllll.exepvvvv.exefrxxxrl.exebtbnhb.exexrxrrlf.exeppdvp.exenhtthh.exetntnbt.exelrxxrrr.exehhtntt.exedvddv.exexxfxxxr.exevppvp.exedescription pid process target process PID 244 wrote to memory of 4052 244 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe jjpjj.exe PID 244 wrote to memory of 4052 244 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe jjpjj.exe PID 244 wrote to memory of 4052 244 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe jjpjj.exe PID 4052 wrote to memory of 4576 4052 jjpjj.exe jpjdv.exe PID 4052 wrote to memory of 4576 4052 jjpjj.exe jpjdv.exe PID 4052 wrote to memory of 4576 4052 jjpjj.exe jpjdv.exe PID 4576 wrote to memory of 4756 4576 jpjdv.exe ntbnnh.exe PID 4576 wrote to memory of 4756 4576 jpjdv.exe ntbnnh.exe PID 4576 wrote to memory of 4756 4576 jpjdv.exe ntbnnh.exe PID 4756 wrote to memory of 4472 4756 ntbnnh.exe vjppp.exe PID 4756 wrote to memory of 4472 4756 ntbnnh.exe vjppp.exe PID 4756 wrote to memory of 4472 4756 ntbnnh.exe vjppp.exe PID 4472 wrote to memory of 5008 4472 vjppp.exe llxxrxl.exe PID 4472 wrote to memory of 5008 4472 vjppp.exe llxxrxl.exe PID 4472 wrote to memory of 5008 4472 vjppp.exe llxxrxl.exe PID 5008 wrote to memory of 4952 5008 llxxrxl.exe pjdpj.exe PID 5008 wrote to memory of 4952 5008 llxxrxl.exe pjdpj.exe PID 5008 wrote to memory of 4952 5008 llxxrxl.exe pjdpj.exe PID 4952 wrote to memory of 3820 4952 pjdpj.exe thbntb.exe PID 4952 wrote to memory of 3820 4952 pjdpj.exe thbntb.exe PID 4952 wrote to memory of 3820 4952 pjdpj.exe thbntb.exe PID 3820 wrote to memory of 4800 3820 thbntb.exe dvvvp.exe PID 3820 wrote to memory of 4800 3820 thbntb.exe dvvvp.exe PID 3820 wrote to memory of 4800 3820 thbntb.exe dvvvp.exe PID 4800 wrote to memory of 3964 4800 dvvvp.exe lflllll.exe PID 4800 wrote to memory of 3964 4800 dvvvp.exe lflllll.exe PID 4800 wrote to memory of 3964 4800 dvvvp.exe lflllll.exe PID 3964 wrote to memory of 1524 3964 lflllll.exe pvvvv.exe PID 3964 wrote to memory of 1524 3964 lflllll.exe pvvvv.exe PID 3964 wrote to memory of 1524 3964 lflllll.exe pvvvv.exe PID 1524 wrote to memory of 1096 1524 pvvvv.exe frxxxrl.exe PID 1524 wrote to memory of 1096 1524 pvvvv.exe frxxxrl.exe PID 1524 wrote to memory of 1096 1524 pvvvv.exe frxxxrl.exe PID 1096 wrote to memory of 3992 1096 frxxxrl.exe btbnhb.exe PID 1096 wrote to memory of 3992 1096 frxxxrl.exe btbnhb.exe PID 1096 wrote to memory of 3992 1096 frxxxrl.exe btbnhb.exe PID 3992 wrote to memory of 1624 3992 btbnhb.exe xrxrrlf.exe PID 3992 wrote to memory of 1624 3992 btbnhb.exe xrxrrlf.exe PID 3992 wrote to memory of 1624 3992 btbnhb.exe xrxrrlf.exe PID 1624 wrote to memory of 1896 1624 xrxrrlf.exe ppdvp.exe PID 1624 wrote to memory of 1896 1624 xrxrrlf.exe ppdvp.exe PID 1624 wrote to memory of 1896 1624 xrxrrlf.exe ppdvp.exe PID 1896 wrote to memory of 3092 1896 ppdvp.exe nhtthh.exe PID 1896 wrote to memory of 3092 1896 ppdvp.exe nhtthh.exe PID 1896 wrote to memory of 3092 1896 ppdvp.exe nhtthh.exe PID 3092 wrote to memory of 364 3092 nhtthh.exe tntnbt.exe PID 3092 wrote to memory of 364 3092 nhtthh.exe tntnbt.exe PID 3092 wrote to memory of 364 3092 nhtthh.exe tntnbt.exe PID 364 wrote to memory of 1628 364 tntnbt.exe lrxxrrr.exe PID 364 wrote to memory of 1628 364 tntnbt.exe lrxxrrr.exe PID 364 wrote to memory of 1628 364 tntnbt.exe lrxxrrr.exe PID 1628 wrote to memory of 2868 1628 lrxxrrr.exe hhtntt.exe PID 1628 wrote to memory of 2868 1628 lrxxrrr.exe hhtntt.exe PID 1628 wrote to memory of 2868 1628 lrxxrrr.exe hhtntt.exe PID 2868 wrote to memory of 5028 2868 hhtntt.exe dvddv.exe PID 2868 wrote to memory of 5028 2868 hhtntt.exe dvddv.exe PID 2868 wrote to memory of 5028 2868 hhtntt.exe dvddv.exe PID 5028 wrote to memory of 2888 5028 dvddv.exe xxfxxxr.exe PID 5028 wrote to memory of 2888 5028 dvddv.exe xxfxxxr.exe PID 5028 wrote to memory of 2888 5028 dvddv.exe xxfxxxr.exe PID 2888 wrote to memory of 4988 2888 xxfxxxr.exe vppvp.exe PID 2888 wrote to memory of 4988 2888 xxfxxxr.exe vppvp.exe PID 2888 wrote to memory of 4988 2888 xxfxxxr.exe vppvp.exe PID 4988 wrote to memory of 2876 4988 vppvp.exe rxlfrfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe"C:\Users\Admin\AppData\Local\Temp\30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\jjpjj.exec:\jjpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\jpjdv.exec:\jpjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\ntbnnh.exec:\ntbnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\vjppp.exec:\vjppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\llxxrxl.exec:\llxxrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\pjdpj.exec:\pjdpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\thbntb.exec:\thbntb.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\dvvvp.exec:\dvvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\lflllll.exec:\lflllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\pvvvv.exec:\pvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\frxxxrl.exec:\frxxxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\btbnhb.exec:\btbnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\xrxrrlf.exec:\xrxrrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ppdvp.exec:\ppdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\nhtthh.exec:\nhtthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\tntnbt.exec:\tntnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\hhtntt.exec:\hhtntt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\dvddv.exec:\dvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\xxfxxxr.exec:\xxfxxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vppvp.exec:\vppvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\rxlfrfx.exec:\rxlfrfx.exe23⤵
- Executes dropped EXE
PID:2876 -
\??\c:\djvjd.exec:\djvjd.exe24⤵
- Executes dropped EXE
PID:1008 -
\??\c:\pppjd.exec:\pppjd.exe25⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe26⤵
- Executes dropped EXE
PID:452 -
\??\c:\xllrrxl.exec:\xllrrxl.exe27⤵
- Executes dropped EXE
PID:4296 -
\??\c:\nbbbbt.exec:\nbbbbt.exe28⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nbhhtn.exec:\nbhhtn.exe29⤵
- Executes dropped EXE
PID:3352 -
\??\c:\bhtnhh.exec:\bhtnhh.exe30⤵
- Executes dropped EXE
PID:1124 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe31⤵
- Executes dropped EXE
PID:4216 -
\??\c:\hbhhht.exec:\hbhhht.exe32⤵
- Executes dropped EXE
PID:740 -
\??\c:\frxfxxl.exec:\frxfxxl.exe33⤵
- Executes dropped EXE
PID:3808 -
\??\c:\frrllfl.exec:\frrllfl.exe34⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ttbttn.exec:\ttbttn.exe35⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9vdjj.exec:\9vdjj.exe36⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hbbbnn.exec:\hbbbnn.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jvdvp.exec:\jvdvp.exe38⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ffxrflr.exec:\ffxrflr.exe39⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nnthhh.exec:\nnthhh.exe40⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jpdvp.exec:\jpdvp.exe41⤵
- Executes dropped EXE
PID:4444 -
\??\c:\7ntthn.exec:\7ntthn.exe42⤵
- Executes dropped EXE
PID:3596 -
\??\c:\tnbttt.exec:\tnbttt.exe43⤵
- Executes dropped EXE
PID:228 -
\??\c:\pdppp.exec:\pdppp.exe44⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lrlxfxl.exec:\lrlxfxl.exe45⤵
- Executes dropped EXE
PID:4432 -
\??\c:\nbhnbh.exec:\nbhnbh.exe46⤵
- Executes dropped EXE
PID:3136 -
\??\c:\3dpjp.exec:\3dpjp.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5dvjp.exec:\5dvjp.exe48⤵
- Executes dropped EXE
PID:3612 -
\??\c:\1llfxll.exec:\1llfxll.exe49⤵
- Executes dropped EXE
PID:1692 -
\??\c:\thnhbh.exec:\thnhbh.exe50⤵
- Executes dropped EXE
PID:1352 -
\??\c:\fllrrfx.exec:\fllrrfx.exe51⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbhhhn.exec:\hbhhhn.exe52⤵
- Executes dropped EXE
PID:852 -
\??\c:\dvddv.exec:\dvddv.exe53⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1vjdd.exec:\1vjdd.exe54⤵
- Executes dropped EXE
PID:4956 -
\??\c:\llffllx.exec:\llffllx.exe55⤵
- Executes dropped EXE
PID:4624 -
\??\c:\3hbhbh.exec:\3hbhbh.exe56⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vjjdd.exec:\vjjdd.exe57⤵
- Executes dropped EXE
PID:1128 -
\??\c:\ddjjv.exec:\ddjjv.exe58⤵
- Executes dropped EXE
PID:4848 -
\??\c:\7fxlflf.exec:\7fxlflf.exe59⤵
- Executes dropped EXE
PID:3436 -
\??\c:\hnbbbb.exec:\hnbbbb.exe60⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5dvpp.exec:\5dvpp.exe61⤵
- Executes dropped EXE
PID:4996 -
\??\c:\pjpvv.exec:\pjpvv.exe62⤵
- Executes dropped EXE
PID:4800 -
\??\c:\nbtttb.exec:\nbtttb.exe63⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe64⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bttnnn.exec:\bttnnn.exe65⤵
- Executes dropped EXE
PID:4488 -
\??\c:\bnbbbh.exec:\bnbbbh.exe66⤵PID:1016
-
\??\c:\pjvpv.exec:\pjvpv.exe67⤵PID:768
-
\??\c:\fffxlxx.exec:\fffxlxx.exe68⤵PID:5060
-
\??\c:\vjjdd.exec:\vjjdd.exe69⤵PID:1796
-
\??\c:\vvjjj.exec:\vvjjj.exe70⤵PID:2388
-
\??\c:\5tbbtt.exec:\5tbbtt.exe71⤵PID:2028
-
\??\c:\tbhbtt.exec:\tbhbtt.exe72⤵PID:2420
-
\??\c:\jddvj.exec:\jddvj.exe73⤵PID:4540
-
\??\c:\5xllffx.exec:\5xllffx.exe74⤵PID:4976
-
\??\c:\tnhnnb.exec:\tnhnnb.exe75⤵PID:2368
-
\??\c:\vvppp.exec:\vvppp.exe76⤵PID:1620
-
\??\c:\ffrllxx.exec:\ffrllxx.exe77⤵PID:936
-
\??\c:\bnhbth.exec:\bnhbth.exe78⤵PID:4532
-
\??\c:\dpdvv.exec:\dpdvv.exe79⤵PID:3580
-
\??\c:\rxfxllf.exec:\rxfxllf.exe80⤵PID:1472
-
\??\c:\hhhhbh.exec:\hhhhbh.exe81⤵PID:1532
-
\??\c:\ddvvp.exec:\ddvvp.exe82⤵PID:1612
-
\??\c:\3ppvp.exec:\3ppvp.exe83⤵PID:4944
-
\??\c:\7rxrflr.exec:\7rxrflr.exe84⤵
- System Location Discovery: System Language Discovery
PID:2016 -
\??\c:\nbhbtt.exec:\nbhbtt.exe85⤵PID:3344
-
\??\c:\ddjjv.exec:\ddjjv.exe86⤵PID:3972
-
\??\c:\rrllrrr.exec:\rrllrrr.exe87⤵PID:1728
-
\??\c:\fffxrrx.exec:\fffxrrx.exe88⤵PID:3848
-
\??\c:\9nnbtb.exec:\9nnbtb.exe89⤵PID:1672
-
\??\c:\vpddv.exec:\vpddv.exe90⤵PID:2612
-
\??\c:\pdpjj.exec:\pdpjj.exe91⤵PID:2556
-
\??\c:\xrfxxll.exec:\xrfxxll.exe92⤵PID:2972
-
\??\c:\xrflrrf.exec:\xrflrrf.exe93⤵PID:632
-
\??\c:\bhtthn.exec:\bhtthn.exe94⤵PID:3624
-
\??\c:\9ppjj.exec:\9ppjj.exe95⤵PID:4200
-
\??\c:\llrrrll.exec:\llrrrll.exe96⤵PID:3920
-
\??\c:\hhtnnn.exec:\hhtnnn.exe97⤵PID:3884
-
\??\c:\pjddv.exec:\pjddv.exe98⤵PID:1224
-
\??\c:\5rrxrrr.exec:\5rrxrrr.exe99⤵PID:4748
-
\??\c:\flxrlff.exec:\flxrlff.exe100⤵PID:2032
-
\??\c:\9vddd.exec:\9vddd.exe101⤵PID:1528
-
\??\c:\9lllfxx.exec:\9lllfxx.exe102⤵PID:3272
-
\??\c:\hnbbbb.exec:\hnbbbb.exe103⤵PID:956
-
\??\c:\jvpjd.exec:\jvpjd.exe104⤵PID:3560
-
\??\c:\xllffff.exec:\xllffff.exe105⤵PID:4508
-
\??\c:\7nhbtt.exec:\7nhbtt.exe106⤵PID:1476
-
\??\c:\vjjvv.exec:\vjjvv.exe107⤵PID:4948
-
\??\c:\xrfffxf.exec:\xrfffxf.exe108⤵PID:4052
-
\??\c:\pdddd.exec:\pdddd.exe109⤵PID:4796
-
\??\c:\pppjj.exec:\pppjj.exe110⤵PID:3152
-
\??\c:\rxlffll.exec:\rxlffll.exe111⤵PID:3460
-
\??\c:\hhbbhh.exec:\hhbbhh.exe112⤵PID:3324
-
\??\c:\bbhbtt.exec:\bbhbtt.exe113⤵PID:4564
-
\??\c:\ddvpj.exec:\ddvpj.exe114⤵PID:3548
-
\??\c:\rrfxrrf.exec:\rrfxrrf.exe115⤵PID:2052
-
\??\c:\nnnhbb.exec:\nnnhbb.exe116⤵PID:3412
-
\??\c:\jpvvv.exec:\jpvvv.exe117⤵PID:4692
-
\??\c:\ffrlffx.exec:\ffrlffx.exe118⤵PID:4124
-
\??\c:\hntnbt.exec:\hntnbt.exe119⤵PID:4784
-
\??\c:\btbtnn.exec:\btbtnn.exe120⤵PID:1172
-
\??\c:\vdjdp.exec:\vdjdp.exe121⤵PID:2936
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe122⤵PID:4268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-