Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 22:06
Static task
static1
Behavioral task
behavioral1
Sample
bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe
Resource
win7-20240708-en
General
-
Target
bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe
-
Size
456KB
-
MD5
9a0acb46e58a2e5731df6b5bc09a3f32
-
SHA1
d263d4b927971896eb1fef2f05f5c3248da290ee
-
SHA256
bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c
-
SHA512
33e1782f8a7d064daa2f0d948dbfe1cee6d993eadf0fabacdb1011bef693baef211ccdb097816e3572d66c11acca208c2f825478d491bec1755e4b264bd6f0bd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRc:q7Tc2NYHUrAwfMp3CDRc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/4968-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-1200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fxlfxxx.exe3vjdd.exerffxxxr.exe5bhbtb.exe3vdvp.exefrrrlxr.exehhhhbb.exebttttt.exexrrrlll.exelfrrlll.exehbhhhh.exerllllll.exeppdvp.exerlflffx.exevdjjv.exexxffxxx.exentnhhh.exe5ttntt.exe3lrlrrl.exejvppp.exe1nnhnn.exepjppp.exehbhnnt.exedpvvd.exe3xxrlll.exedpdpd.exethnnnn.exepddpp.exedjjvj.exehhnbbh.exerrrrllf.exexrrrrxr.exebnhnbt.exerrxrllf.exexxlllrr.exebnbbtt.exerrlfffx.exenbhhnb.exeddddd.exerxfxlfr.exebtbttt.exejjjjj.exe7xxrllf.exe3nttnt.exerllllrx.exebbhnnn.exedvvvv.exe7xxxxfx.exebhhbbb.exevdddp.exelflllll.exethtthh.exeppjvv.exerflxlxl.exerrxrxxl.exehhntth.exejddvv.exefxfxxrf.exehhnhnn.exe5djjj.exelfxxrlr.exehhnnnn.exeppdjp.exe9vdvv.exepid process 3804 fxlfxxx.exe 1124 3vjdd.exe 3184 rffxxxr.exe 4776 5bhbtb.exe 64 3vdvp.exe 4472 frrrlxr.exe 216 hhhhbb.exe 2088 bttttt.exe 3536 xrrrlll.exe 5032 lfrrlll.exe 3148 hbhhhh.exe 2472 rllllll.exe 3532 ppdvp.exe 3076 rlflffx.exe 4924 vdjjv.exe 3996 xxffxxx.exe 4280 ntnhhh.exe 2780 5ttntt.exe 2648 3lrlrrl.exe 1904 jvppp.exe 5108 1nnhnn.exe 4804 pjppp.exe 3304 hbhnnt.exe 2064 dpvvd.exe 1832 3xxrlll.exe 3136 dpdpd.exe 2924 thnnnn.exe 4032 pddpp.exe 4172 djjvj.exe 4292 hhnbbh.exe 972 rrrrllf.exe 4228 xrrrrxr.exe 544 bnhnbt.exe 3080 rrxrllf.exe 4824 xxlllrr.exe 748 bnbbtt.exe 2920 rrlfffx.exe 3756 nbhhnb.exe 4232 ddddd.exe 5056 rxfxlfr.exe 4020 btbttt.exe 3712 jjjjj.exe 2768 7xxrllf.exe 3812 3nttnt.exe 804 rllllrx.exe 4512 bbhnnn.exe 2804 dvvvv.exe 4380 7xxxxfx.exe 752 bhhbbb.exe 764 vdddp.exe 3676 lflllll.exe 2488 thtthh.exe 3640 ppjvv.exe 3488 rflxlxl.exe 4472 rrxrxxl.exe 4556 hhntth.exe 3224 jddvv.exe 1960 fxfxxrf.exe 1876 hhnhnn.exe 5112 5djjj.exe 2800 lfxxrlr.exe 4836 hhnnnn.exe 3696 ppdjp.exe 3076 9vdvv.exe -
Processes:
resource yara_rule behavioral2/memory/4968-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-739-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dddvv.exe7bhbbh.exebbhhhb.exe7rrlffx.exeppjdd.exetthhnt.exehhnbbh.exe3vddv.exellfxfxf.exefxrlfxr.exepppjj.exeddjdp.exepjppp.exelxfxxfx.exerlflxrr.exepjdvd.exejjpjv.exedvjvp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exefxlfxxx.exe3vjdd.exerffxxxr.exe5bhbtb.exe3vdvp.exefrrrlxr.exehhhhbb.exebttttt.exexrrrlll.exelfrrlll.exehbhhhh.exerllllll.exeppdvp.exerlflffx.exevdjjv.exexxffxxx.exentnhhh.exe5ttntt.exe3lrlrrl.exejvppp.exe1nnhnn.exedescription pid process target process PID 4968 wrote to memory of 3804 4968 bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe fxlfxxx.exe PID 4968 wrote to memory of 3804 4968 bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe fxlfxxx.exe PID 4968 wrote to memory of 3804 4968 bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe fxlfxxx.exe PID 3804 wrote to memory of 1124 3804 fxlfxxx.exe 3vjdd.exe PID 3804 wrote to memory of 1124 3804 fxlfxxx.exe 3vjdd.exe PID 3804 wrote to memory of 1124 3804 fxlfxxx.exe 3vjdd.exe PID 1124 wrote to memory of 3184 1124 3vjdd.exe rffxxxr.exe PID 1124 wrote to memory of 3184 1124 3vjdd.exe rffxxxr.exe PID 1124 wrote to memory of 3184 1124 3vjdd.exe rffxxxr.exe PID 3184 wrote to memory of 4776 3184 rffxxxr.exe 5bhbtb.exe PID 3184 wrote to memory of 4776 3184 rffxxxr.exe 5bhbtb.exe PID 3184 wrote to memory of 4776 3184 rffxxxr.exe 5bhbtb.exe PID 4776 wrote to memory of 64 4776 5bhbtb.exe 3vdvp.exe PID 4776 wrote to memory of 64 4776 5bhbtb.exe 3vdvp.exe PID 4776 wrote to memory of 64 4776 5bhbtb.exe 3vdvp.exe PID 64 wrote to memory of 4472 64 3vdvp.exe frrrlxr.exe PID 64 wrote to memory of 4472 64 3vdvp.exe frrrlxr.exe PID 64 wrote to memory of 4472 64 3vdvp.exe frrrlxr.exe PID 4472 wrote to memory of 216 4472 frrrlxr.exe hhhhbb.exe PID 4472 wrote to memory of 216 4472 frrrlxr.exe hhhhbb.exe PID 4472 wrote to memory of 216 4472 frrrlxr.exe hhhhbb.exe PID 216 wrote to memory of 2088 216 hhhhbb.exe bttttt.exe PID 216 wrote to memory of 2088 216 hhhhbb.exe bttttt.exe PID 216 wrote to memory of 2088 216 hhhhbb.exe bttttt.exe PID 2088 wrote to memory of 3536 2088 bttttt.exe xrrrlll.exe PID 2088 wrote to memory of 3536 2088 bttttt.exe xrrrlll.exe PID 2088 wrote to memory of 3536 2088 bttttt.exe xrrrlll.exe PID 3536 wrote to memory of 5032 3536 xrrrlll.exe lfrrlll.exe PID 3536 wrote to memory of 5032 3536 xrrrlll.exe lfrrlll.exe PID 3536 wrote to memory of 5032 3536 xrrrlll.exe lfrrlll.exe PID 5032 wrote to memory of 3148 5032 lfrrlll.exe hbhhhh.exe PID 5032 wrote to memory of 3148 5032 lfrrlll.exe hbhhhh.exe PID 5032 wrote to memory of 3148 5032 lfrrlll.exe hbhhhh.exe PID 3148 wrote to memory of 2472 3148 hbhhhh.exe rllllll.exe PID 3148 wrote to memory of 2472 3148 hbhhhh.exe rllllll.exe PID 3148 wrote to memory of 2472 3148 hbhhhh.exe rllllll.exe PID 2472 wrote to memory of 3532 2472 rllllll.exe ppdvp.exe PID 2472 wrote to memory of 3532 2472 rllllll.exe ppdvp.exe PID 2472 wrote to memory of 3532 2472 rllllll.exe ppdvp.exe PID 3532 wrote to memory of 3076 3532 ppdvp.exe rlflffx.exe PID 3532 wrote to memory of 3076 3532 ppdvp.exe rlflffx.exe PID 3532 wrote to memory of 3076 3532 ppdvp.exe rlflffx.exe PID 3076 wrote to memory of 4924 3076 rlflffx.exe vdjjv.exe PID 3076 wrote to memory of 4924 3076 rlflffx.exe vdjjv.exe PID 3076 wrote to memory of 4924 3076 rlflffx.exe vdjjv.exe PID 4924 wrote to memory of 3996 4924 vdjjv.exe xxffxxx.exe PID 4924 wrote to memory of 3996 4924 vdjjv.exe xxffxxx.exe PID 4924 wrote to memory of 3996 4924 vdjjv.exe xxffxxx.exe PID 3996 wrote to memory of 4280 3996 xxffxxx.exe ntnhhh.exe PID 3996 wrote to memory of 4280 3996 xxffxxx.exe ntnhhh.exe PID 3996 wrote to memory of 4280 3996 xxffxxx.exe ntnhhh.exe PID 4280 wrote to memory of 2780 4280 ntnhhh.exe 5ttntt.exe PID 4280 wrote to memory of 2780 4280 ntnhhh.exe 5ttntt.exe PID 4280 wrote to memory of 2780 4280 ntnhhh.exe 5ttntt.exe PID 2780 wrote to memory of 2648 2780 5ttntt.exe 3lrlrrl.exe PID 2780 wrote to memory of 2648 2780 5ttntt.exe 3lrlrrl.exe PID 2780 wrote to memory of 2648 2780 5ttntt.exe 3lrlrrl.exe PID 2648 wrote to memory of 1904 2648 3lrlrrl.exe jvppp.exe PID 2648 wrote to memory of 1904 2648 3lrlrrl.exe jvppp.exe PID 2648 wrote to memory of 1904 2648 3lrlrrl.exe jvppp.exe PID 1904 wrote to memory of 5108 1904 jvppp.exe 1nnhnn.exe PID 1904 wrote to memory of 5108 1904 jvppp.exe 1nnhnn.exe PID 1904 wrote to memory of 5108 1904 jvppp.exe 1nnhnn.exe PID 5108 wrote to memory of 4804 5108 1nnhnn.exe pjppp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe"C:\Users\Admin\AppData\Local\Temp\bc0e342580e9985a967f09cf6fe250f9d99b05282800e682fa59174e3e34507c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\3vjdd.exec:\3vjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\rffxxxr.exec:\rffxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\5bhbtb.exec:\5bhbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\3vdvp.exec:\3vdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\frrrlxr.exec:\frrrlxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\hhhhbb.exec:\hhhhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\bttttt.exec:\bttttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\xrrrlll.exec:\xrrrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\lfrrlll.exec:\lfrrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\hbhhhh.exec:\hbhhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\rllllll.exec:\rllllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ppdvp.exec:\ppdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\rlflffx.exec:\rlflffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\vdjjv.exec:\vdjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\xxffxxx.exec:\xxffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\ntnhhh.exec:\ntnhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\5ttntt.exec:\5ttntt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\3lrlrrl.exec:\3lrlrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jvppp.exec:\jvppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\1nnhnn.exec:\1nnhnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\pjppp.exec:\pjppp.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4804 -
\??\c:\hbhnnt.exec:\hbhnnt.exe24⤵
- Executes dropped EXE
PID:3304 -
\??\c:\dpvvd.exec:\dpvvd.exe25⤵
- Executes dropped EXE
PID:2064 -
\??\c:\3xxrlll.exec:\3xxrlll.exe26⤵
- Executes dropped EXE
PID:1832 -
\??\c:\dpdpd.exec:\dpdpd.exe27⤵
- Executes dropped EXE
PID:3136 -
\??\c:\thnnnn.exec:\thnnnn.exe28⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pddpp.exec:\pddpp.exe29⤵
- Executes dropped EXE
PID:4032 -
\??\c:\djjvj.exec:\djjvj.exe30⤵
- Executes dropped EXE
PID:4172 -
\??\c:\hhnbbh.exec:\hhnbbh.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4292 -
\??\c:\rrrrllf.exec:\rrrrllf.exe32⤵
- Executes dropped EXE
PID:972 -
\??\c:\xrrrrxr.exec:\xrrrrxr.exe33⤵
- Executes dropped EXE
PID:4228 -
\??\c:\bnhnbt.exec:\bnhnbt.exe34⤵
- Executes dropped EXE
PID:544 -
\??\c:\rrxrllf.exec:\rrxrllf.exe35⤵
- Executes dropped EXE
PID:3080 -
\??\c:\xxlllrr.exec:\xxlllrr.exe36⤵
- Executes dropped EXE
PID:4824 -
\??\c:\bnbbtt.exec:\bnbbtt.exe37⤵
- Executes dropped EXE
PID:748 -
\??\c:\rrlfffx.exec:\rrlfffx.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nbhhnb.exec:\nbhhnb.exe39⤵
- Executes dropped EXE
PID:3756 -
\??\c:\ddddd.exec:\ddddd.exe40⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rxfxlfr.exec:\rxfxlfr.exe41⤵
- Executes dropped EXE
PID:5056 -
\??\c:\btbttt.exec:\btbttt.exe42⤵
- Executes dropped EXE
PID:4020 -
\??\c:\jjjjj.exec:\jjjjj.exe43⤵
- Executes dropped EXE
PID:3712 -
\??\c:\7xxrllf.exec:\7xxrllf.exe44⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3nttnt.exec:\3nttnt.exe45⤵
- Executes dropped EXE
PID:3812 -
\??\c:\rllllrx.exec:\rllllrx.exe46⤵
- Executes dropped EXE
PID:804 -
\??\c:\bbhnnn.exec:\bbhnnn.exe47⤵
- Executes dropped EXE
PID:4512 -
\??\c:\dvvvv.exec:\dvvvv.exe48⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7xxxxfx.exec:\7xxxxfx.exe49⤵
- Executes dropped EXE
PID:4380 -
\??\c:\bhhbbb.exec:\bhhbbb.exe50⤵
- Executes dropped EXE
PID:752 -
\??\c:\vdddp.exec:\vdddp.exe51⤵
- Executes dropped EXE
PID:764 -
\??\c:\lflllll.exec:\lflllll.exe52⤵
- Executes dropped EXE
PID:3676 -
\??\c:\thtthh.exec:\thtthh.exe53⤵
- Executes dropped EXE
PID:2488 -
\??\c:\ppjvv.exec:\ppjvv.exe54⤵
- Executes dropped EXE
PID:3640 -
\??\c:\rflxlxl.exec:\rflxlxl.exe55⤵
- Executes dropped EXE
PID:3488 -
\??\c:\rrxrxxl.exec:\rrxrxxl.exe56⤵
- Executes dropped EXE
PID:4472 -
\??\c:\hhntth.exec:\hhntth.exe57⤵
- Executes dropped EXE
PID:4556 -
\??\c:\jddvv.exec:\jddvv.exe58⤵
- Executes dropped EXE
PID:3224 -
\??\c:\fxfxxrf.exec:\fxfxxrf.exe59⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hhnhnn.exec:\hhnhnn.exe60⤵
- Executes dropped EXE
PID:1876 -
\??\c:\5djjj.exec:\5djjj.exe61⤵
- Executes dropped EXE
PID:5112 -
\??\c:\lfxxrlr.exec:\lfxxrlr.exe62⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hhnnnn.exec:\hhnnnn.exe63⤵
- Executes dropped EXE
PID:4836 -
\??\c:\ppdjp.exec:\ppdjp.exe64⤵
- Executes dropped EXE
PID:3696 -
\??\c:\9vdvv.exec:\9vdvv.exe65⤵
- Executes dropped EXE
PID:3076 -
\??\c:\rfllflf.exec:\rfllflf.exe66⤵PID:4916
-
\??\c:\tthnnn.exec:\tthnnn.exe67⤵PID:1364
-
\??\c:\jdvvv.exec:\jdvvv.exe68⤵PID:4088
-
\??\c:\xxffxrl.exec:\xxffxrl.exe69⤵PID:664
-
\??\c:\ntnhnb.exec:\ntnhnb.exe70⤵PID:4144
-
\??\c:\5pvpj.exec:\5pvpj.exe71⤵PID:1140
-
\??\c:\hhbhtb.exec:\hhbhtb.exe72⤵PID:1380
-
\??\c:\3pvpp.exec:\3pvpp.exe73⤵PID:3004
-
\??\c:\xxlfrrx.exec:\xxlfrrx.exe74⤵PID:4792
-
\??\c:\hnnthb.exec:\hnnthb.exe75⤵PID:4208
-
\??\c:\ppjjd.exec:\ppjjd.exe76⤵PID:4116
-
\??\c:\frxrlll.exec:\frxrlll.exe77⤵PID:3304
-
\??\c:\nhttbn.exec:\nhttbn.exe78⤵PID:5048
-
\??\c:\9pvpj.exec:\9pvpj.exe79⤵PID:1228
-
\??\c:\fxffffl.exec:\fxffffl.exe80⤵PID:688
-
\??\c:\hnbbtt.exec:\hnbbtt.exe81⤵PID:3172
-
\??\c:\7dddv.exec:\7dddv.exe82⤵PID:4264
-
\??\c:\lllxllf.exec:\lllxllf.exe83⤵PID:2240
-
\??\c:\nhttbh.exec:\nhttbh.exe84⤵PID:4160
-
\??\c:\ddvdv.exec:\ddvdv.exe85⤵PID:1404
-
\??\c:\9rrxlll.exec:\9rrxlll.exe86⤵PID:1920
-
\??\c:\nnnhnt.exec:\nnnhnt.exe87⤵PID:1544
-
\??\c:\jddvv.exec:\jddvv.exe88⤵PID:1400
-
\??\c:\9xrrrrl.exec:\9xrrrrl.exe89⤵PID:4656
-
\??\c:\nhtttt.exec:\nhtttt.exe90⤵PID:3872
-
\??\c:\ddddd.exec:\ddddd.exe91⤵PID:2004
-
\??\c:\ffxfxlf.exec:\ffxfxlf.exe92⤵PID:1776
-
\??\c:\9frrffl.exec:\9frrffl.exe93⤵PID:4112
-
\??\c:\hnbtnn.exec:\hnbtnn.exe94⤵PID:3408
-
\??\c:\5pppp.exec:\5pppp.exe95⤵PID:2948
-
\??\c:\7ddvj.exec:\7ddvj.exe96⤵PID:5072
-
\??\c:\1flllll.exec:\1flllll.exe97⤵PID:3552
-
\??\c:\thbtnn.exec:\thbtnn.exe98⤵PID:3732
-
\??\c:\vjjvv.exec:\vjjvv.exe99⤵PID:4596
-
\??\c:\pvjjd.exec:\pvjjd.exe100⤵PID:1512
-
\??\c:\7xxxlll.exec:\7xxxlll.exe101⤵PID:4040
-
\??\c:\nhnhhh.exec:\nhnhhh.exe102⤵PID:804
-
\??\c:\jvjdv.exec:\jvjdv.exe103⤵PID:1340
-
\??\c:\lfllflf.exec:\lfllflf.exe104⤵PID:2032
-
\??\c:\5ttnhn.exec:\5ttnhn.exe105⤵PID:2344
-
\??\c:\1vdvd.exec:\1vdvd.exe106⤵PID:2300
-
\??\c:\xlxxfff.exec:\xlxxfff.exe107⤵PID:4716
-
\??\c:\lfrllrr.exec:\lfrllrr.exe108⤵PID:3280
-
\??\c:\hbntbt.exec:\hbntbt.exe109⤵PID:4852
-
\??\c:\ddjdp.exec:\ddjdp.exe110⤵
- System Location Discovery: System Language Discovery
PID:4500 -
\??\c:\9lrllrr.exec:\9lrllrr.exe111⤵PID:3488
-
\??\c:\btttnn.exec:\btttnn.exe112⤵PID:2148
-
\??\c:\vjpjj.exec:\vjpjj.exe113⤵PID:692
-
\??\c:\3ppjd.exec:\3ppjd.exe114⤵PID:1116
-
\??\c:\rrrllrl.exec:\rrrllrl.exe115⤵PID:828
-
\??\c:\bbbttn.exec:\bbbttn.exe116⤵PID:4528
-
\??\c:\vdjjp.exec:\vdjjp.exe117⤵PID:1556
-
\??\c:\rrflxxl.exec:\rrflxxl.exe118⤵PID:3100
-
\??\c:\httbbb.exec:\httbbb.exe119⤵PID:5016
-
\??\c:\hnhnnh.exec:\hnhnnh.exe120⤵PID:1720
-
\??\c:\pjppp.exec:\pjppp.exe121⤵PID:1604
-
\??\c:\fxlxrrl.exec:\fxlxrrl.exe122⤵PID:3076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-