Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 01:20
Behavioral task
behavioral1
Sample
94f0164f1d14013b34efb7c24b7224993805f2cbdc70b55b761e3eea0d4091ab.exe
Resource
win7-20240729-en
General
-
Target
94f0164f1d14013b34efb7c24b7224993805f2cbdc70b55b761e3eea0d4091ab.exe
-
Size
371KB
-
MD5
be402eb4f3bf19730787930dc42a8288
-
SHA1
6797f0d77b7d600ae0dd5c89d60f09e69ac95a43
-
SHA256
94f0164f1d14013b34efb7c24b7224993805f2cbdc70b55b761e3eea0d4091ab
-
SHA512
836a5bb14aef1219c38bd1d514d7fefe65a43cbbfaada9037a6789a5647c6ef052f7a7ee78e8f2961a28d0da3343f62e9705865d1054ed11fdbfd133250387e4
-
SSDEEP
6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7Q:/4wFHoSA4KofHfHTXQLzgvnzHPowYbvF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/964-7-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4496-13-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1700-49-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4960-95-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1088-173-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4624-243-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3700-307-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2132-322-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2912-335-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4216-384-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3128-382-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1656-377-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4024-369-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1184-365-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/932-361-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3936-357-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/816-353-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/812-349-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/816-346-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2068-343-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3120-340-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2068-337-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2544-331-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1936-326-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2976-318-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4824-315-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/428-311-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3000-303-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1416-298-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4720-291-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2412-288-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1428-284-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5012-280-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2216-276-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4380-271-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1312-268-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4380-265-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5104-263-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2084-259-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4840-254-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2752-250-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1380-247-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2552-239-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2860-235-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2036-231-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1844-225-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2368-220-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1728-217-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4140-209-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4528-203-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4984-197-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4528-194-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1668-190-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/516-178-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1676-167-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1088-164-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4024-160-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3960-154-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1328-147-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4692-140-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1328-137-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4872-134-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/816-127-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4872-125-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4496 s2208.exe 3392 ddvjj.exe 4084 600826.exe 5004 xfxrfxr.exe 2612 nbbbtt.exe 1700 ffflxlx.exe 4184 224800.exe 4500 dvddd.exe 3440 vjvvd.exe 4832 264844.exe 5020 804444.exe 3156 80288.exe 4960 6028228.exe 2912 lfllllf.exe 512 8626000.exe 2868 284866.exe 536 5bbbtt.exe 816 48260.exe 4872 40842.exe 4692 lrxrrrr.exe 1328 48606.exe 3960 40820.exe 4024 404022.exe 1676 rrfrxxl.exe 1088 rrlrxlf.exe 516 62826.exe 4964 htbbtb.exe 1668 9hhtth.exe 4984 xxxrfxr.exe 4528 844826.exe 4140 22268.exe 1004 2004220.exe 1728 nnhbnh.exe 2368 fxxlxrf.exe 1844 o626480.exe 2036 htthbb.exe 2860 fllfrrf.exe 2552 444860.exe 4624 o848648.exe 1380 82482.exe 2752 rrlrlfx.exe 4840 tthbnn.exe 2084 nnbhbb.exe 5104 0266486.exe 1312 rlxrffl.exe 4380 84042.exe 2216 lfrrxxr.exe 5012 5vjdd.exe 1428 rlrlrlf.exe 2412 lrxlw62.exe 4720 7xxfrlx.exe 5004 pddvv.exe 1416 w46642.exe 3000 084860.exe 3700 rffxrrl.exe 428 1bbnbt.exe 4824 7djdp.exe 2976 a2868.exe 2132 0222284.exe 1936 i242660.exe 2544 thhtnh.exe 2912 u000260.exe 3120 c288826.exe 2068 3ttnnn.exe -
Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
resource yara_rule behavioral2/files/0x000a000000023bb0-3.dat molebox behavioral2/files/0x0007000000023c85-15.dat molebox behavioral2/files/0x0007000000023c86-25.dat molebox behavioral2/files/0x0007000000023c89-45.dat molebox behavioral2/files/0x0007000000023c8a-52.dat molebox behavioral2/files/0x0007000000023c8c-64.dat molebox behavioral2/files/0x0007000000023c8d-71.dat molebox behavioral2/files/0x0007000000023c92-103.dat molebox behavioral2/files/0x0007000000023ca3-205.dat molebox behavioral2/files/0x0007000000023ca2-199.dat molebox behavioral2/files/0x0007000000023ca0-192.dat molebox behavioral2/files/0x0008000000023c9f-186.dat molebox behavioral2/files/0x0007000000023c9e-181.dat molebox behavioral2/files/0x0007000000023c9d-175.dat molebox behavioral2/files/0x0007000000023c9c-169.dat molebox behavioral2/files/0x0007000000023c9b-162.dat molebox behavioral2/files/0x0007000000023c9a-156.dat molebox behavioral2/files/0x0007000000023c99-150.dat molebox behavioral2/files/0x0007000000023c98-143.dat molebox behavioral2/files/0x0007000000023c97-136.dat molebox behavioral2/files/0x0007000000023c96-130.dat molebox behavioral2/files/0x0007000000023c95-123.dat molebox behavioral2/files/0x0007000000023c94-116.dat molebox behavioral2/files/0x0007000000023c93-110.dat molebox behavioral2/files/0x0007000000023c91-97.dat molebox behavioral2/files/0x0007000000023c90-91.dat molebox behavioral2/files/0x0007000000023c8f-85.dat molebox behavioral2/files/0x0007000000023c8e-78.dat molebox behavioral2/files/0x0007000000023c8b-58.dat molebox behavioral2/files/0x0007000000023c88-38.dat molebox behavioral2/files/0x0007000000023c87-32.dat molebox behavioral2/files/0x0009000000023c7e-11.dat molebox -
resource yara_rule behavioral2/memory/964-0-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023bb0-3.dat upx behavioral2/memory/964-7-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4496-4-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4496-13-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3392-14-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023c85-15.dat upx behavioral2/files/0x0007000000023c86-25.dat upx behavioral2/memory/1700-40-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023c89-45.dat upx behavioral2/memory/1700-49-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023c8a-52.dat upx behavioral2/files/0x0007000000023c8c-64.dat upx behavioral2/files/0x0007000000023c8d-71.dat upx behavioral2/memory/4960-95-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023c92-103.dat upx behavioral2/memory/1088-173-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4624-243-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3700-307-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2132-322-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2912-335-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4216-384-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3128-382-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1112-379-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1656-377-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4024-369-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1184-365-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4024-363-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/932-361-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3936-357-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/816-353-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/812-349-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/816-346-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2068-343-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3120-340-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2068-337-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2544-331-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1936-326-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2976-318-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4824-315-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/428-311-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3000-303-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1416-298-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4720-291-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2412-288-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1428-284-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5012-280-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2216-276-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4380-271-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1312-268-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4380-265-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5104-263-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2084-259-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4840-254-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2752-250-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1380-247-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2552-239-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2860-235-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2036-231-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2860-228-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1844-225-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2036-223-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2368-220-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1728-217-0x0000000000400000-0x0000000000460000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w26048.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40620.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffffll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 964 wrote to memory of 4496 964 94f0164f1d14013b34efb7c24b7224993805f2cbdc70b55b761e3eea0d4091ab.exe 85 PID 964 wrote to memory of 4496 964 94f0164f1d14013b34efb7c24b7224993805f2cbdc70b55b761e3eea0d4091ab.exe 85 PID 964 wrote to memory of 4496 964 94f0164f1d14013b34efb7c24b7224993805f2cbdc70b55b761e3eea0d4091ab.exe 85 PID 4496 wrote to memory of 3392 4496 s2208.exe 86 PID 4496 wrote to memory of 3392 4496 s2208.exe 86 PID 4496 wrote to memory of 3392 4496 s2208.exe 86 PID 3392 wrote to memory of 4084 3392 ddvjj.exe 87 PID 3392 wrote to memory of 4084 3392 ddvjj.exe 87 PID 3392 wrote to memory of 4084 3392 ddvjj.exe 87 PID 4084 wrote to memory of 5004 4084 600826.exe 88 PID 4084 wrote to memory of 5004 4084 600826.exe 88 PID 4084 wrote to memory of 5004 4084 600826.exe 88 PID 5004 wrote to memory of 2612 5004 xfxrfxr.exe 89 PID 5004 wrote to memory of 2612 5004 xfxrfxr.exe 89 PID 5004 wrote to memory of 2612 5004 xfxrfxr.exe 89 PID 2612 wrote to memory of 1700 2612 nbbbtt.exe 90 PID 2612 wrote to memory of 1700 2612 nbbbtt.exe 90 PID 2612 wrote to memory of 1700 2612 nbbbtt.exe 90 PID 1700 wrote to memory of 4184 1700 ffflxlx.exe 182 PID 1700 wrote to memory of 4184 1700 ffflxlx.exe 182 PID 1700 wrote to memory of 4184 1700 ffflxlx.exe 182 PID 4184 wrote to memory of 4500 4184 224800.exe 92 PID 4184 wrote to memory of 4500 4184 224800.exe 92 PID 4184 wrote to memory of 4500 4184 224800.exe 92 PID 4500 wrote to memory of 3440 4500 dvddd.exe 93 PID 4500 wrote to memory of 3440 4500 dvddd.exe 93 PID 4500 wrote to memory of 3440 4500 dvddd.exe 93 PID 3440 wrote to memory of 4832 3440 vjvvd.exe 94 PID 3440 wrote to memory of 4832 3440 vjvvd.exe 94 PID 3440 wrote to memory of 4832 3440 vjvvd.exe 94 PID 4832 wrote to memory of 5020 4832 264844.exe 185 PID 4832 wrote to memory of 5020 4832 264844.exe 185 PID 4832 wrote to memory of 5020 4832 264844.exe 185 PID 5020 wrote to memory of 3156 5020 804444.exe 96 PID 5020 wrote to memory of 3156 5020 804444.exe 96 PID 5020 wrote to memory of 3156 5020 804444.exe 96 PID 3156 wrote to memory of 4960 3156 80288.exe 97 PID 3156 wrote to memory of 4960 3156 80288.exe 97 PID 3156 wrote to memory of 4960 3156 80288.exe 97 PID 4960 wrote to memory of 2912 4960 6028228.exe 98 PID 4960 wrote to memory of 2912 4960 6028228.exe 98 PID 4960 wrote to memory of 2912 4960 6028228.exe 98 PID 2912 wrote to memory of 512 2912 lfllllf.exe 99 PID 2912 wrote to memory of 512 2912 lfllllf.exe 99 PID 2912 wrote to memory of 512 2912 lfllllf.exe 99 PID 512 wrote to memory of 2868 512 8626000.exe 100 PID 512 wrote to memory of 2868 512 8626000.exe 100 PID 512 wrote to memory of 2868 512 8626000.exe 100 PID 2868 wrote to memory of 536 2868 284866.exe 101 PID 2868 wrote to memory of 536 2868 284866.exe 101 PID 2868 wrote to memory of 536 2868 284866.exe 101 PID 536 wrote to memory of 816 536 5bbbtt.exe 102 PID 536 wrote to memory of 816 536 5bbbtt.exe 102 PID 536 wrote to memory of 816 536 5bbbtt.exe 102 PID 816 wrote to memory of 4872 816 48260.exe 103 PID 816 wrote to memory of 4872 816 48260.exe 103 PID 816 wrote to memory of 4872 816 48260.exe 103 PID 4872 wrote to memory of 4692 4872 40842.exe 104 PID 4872 wrote to memory of 4692 4872 40842.exe 104 PID 4872 wrote to memory of 4692 4872 40842.exe 104 PID 4692 wrote to memory of 1328 4692 lrxrrrr.exe 105 PID 4692 wrote to memory of 1328 4692 lrxrrrr.exe 105 PID 4692 wrote to memory of 1328 4692 lrxrrrr.exe 105 PID 1328 wrote to memory of 3960 1328 48606.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\94f0164f1d14013b34efb7c24b7224993805f2cbdc70b55b761e3eea0d4091ab.exe"C:\Users\Admin\AppData\Local\Temp\94f0164f1d14013b34efb7c24b7224993805f2cbdc70b55b761e3eea0d4091ab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\s2208.exec:\s2208.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\ddvjj.exec:\ddvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\600826.exec:\600826.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\xfxrfxr.exec:\xfxrfxr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\nbbbtt.exec:\nbbbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\ffflxlx.exec:\ffflxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\224800.exec:\224800.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\dvddd.exec:\dvddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\vjvvd.exec:\vjvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\264844.exec:\264844.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\804444.exec:\804444.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\80288.exec:\80288.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\6028228.exec:\6028228.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\lfllllf.exec:\lfllllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\8626000.exec:\8626000.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\284866.exec:\284866.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\5bbbtt.exec:\5bbbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\48260.exec:\48260.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\40842.exec:\40842.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\48606.exec:\48606.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\40820.exec:\40820.exe23⤵
- Executes dropped EXE
PID:3960 -
\??\c:\404022.exec:\404022.exe24⤵
- Executes dropped EXE
PID:4024 -
\??\c:\rrfrxxl.exec:\rrfrxxl.exe25⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rrlrxlf.exec:\rrlrxlf.exe26⤵
- Executes dropped EXE
PID:1088 -
\??\c:\62826.exec:\62826.exe27⤵
- Executes dropped EXE
PID:516 -
\??\c:\htbbtb.exec:\htbbtb.exe28⤵
- Executes dropped EXE
PID:4964 -
\??\c:\9hhtth.exec:\9hhtth.exe29⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xxxrfxr.exec:\xxxrfxr.exe30⤵
- Executes dropped EXE
PID:4984 -
\??\c:\844826.exec:\844826.exe31⤵
- Executes dropped EXE
PID:4528 -
\??\c:\22268.exec:\22268.exe32⤵
- Executes dropped EXE
PID:4140 -
\??\c:\2004220.exec:\2004220.exe33⤵
- Executes dropped EXE
PID:1004 -
\??\c:\nnhbnh.exec:\nnhbnh.exe34⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxxlxrf.exec:\fxxlxrf.exe35⤵
- Executes dropped EXE
PID:2368 -
\??\c:\o626480.exec:\o626480.exe36⤵
- Executes dropped EXE
PID:1844 -
\??\c:\htthbb.exec:\htthbb.exe37⤵
- Executes dropped EXE
PID:2036 -
\??\c:\fllfrrf.exec:\fllfrrf.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\444860.exec:\444860.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\o848648.exec:\o848648.exe40⤵
- Executes dropped EXE
PID:4624 -
\??\c:\82482.exec:\82482.exe41⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rrlrlfx.exec:\rrlrlfx.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\tthbnn.exec:\tthbnn.exe43⤵
- Executes dropped EXE
PID:4840 -
\??\c:\nnbhbb.exec:\nnbhbb.exe44⤵
- Executes dropped EXE
PID:2084 -
\??\c:\0266486.exec:\0266486.exe45⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rlxrffl.exec:\rlxrffl.exe46⤵
- Executes dropped EXE
PID:1312 -
\??\c:\84042.exec:\84042.exe47⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lfrrxxr.exec:\lfrrxxr.exe48⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5vjdd.exec:\5vjdd.exe49⤵
- Executes dropped EXE
PID:5012 -
\??\c:\rlrlrlf.exec:\rlrlrlf.exe50⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lrxlw62.exec:\lrxlw62.exe51⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7xxfrlx.exec:\7xxfrlx.exe52⤵
- Executes dropped EXE
PID:4720 -
\??\c:\pddvv.exec:\pddvv.exe53⤵
- Executes dropped EXE
PID:5004 -
\??\c:\w46642.exec:\w46642.exe54⤵
- Executes dropped EXE
PID:1416 -
\??\c:\084860.exec:\084860.exe55⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rffxrrl.exec:\rffxrrl.exe56⤵
- Executes dropped EXE
PID:3700 -
\??\c:\1bbnbt.exec:\1bbnbt.exe57⤵
- Executes dropped EXE
PID:428 -
\??\c:\7djdp.exec:\7djdp.exe58⤵
- Executes dropped EXE
PID:4824 -
\??\c:\a2868.exec:\a2868.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976 -
\??\c:\0222284.exec:\0222284.exe60⤵
- Executes dropped EXE
PID:2132 -
\??\c:\i242660.exec:\i242660.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\thhtnh.exec:\thhtnh.exe62⤵
- Executes dropped EXE
PID:2544 -
\??\c:\u000260.exec:\u000260.exe63⤵
- Executes dropped EXE
PID:2912 -
\??\c:\c288826.exec:\c288826.exe64⤵
- Executes dropped EXE
PID:3120 -
\??\c:\3ttnnn.exec:\3ttnnn.exe65⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nbbbtb.exec:\nbbbtb.exe66⤵PID:812
-
\??\c:\tnnhhb.exec:\tnnhhb.exe67⤵PID:816
-
\??\c:\0460448.exec:\0460448.exe68⤵PID:3936
-
\??\c:\i866228.exec:\i866228.exe69⤵PID:932
-
\??\c:\hnttnn.exec:\hnttnn.exe70⤵PID:1184
-
\??\c:\40228.exec:\40228.exe71⤵
- System Location Discovery: System Language Discovery
PID:4024 -
\??\c:\8044222.exec:\8044222.exe72⤵PID:2980
-
\??\c:\llrrxxf.exec:\llrrxxf.exe73⤵PID:1656
-
\??\c:\ppjjd.exec:\ppjjd.exe74⤵PID:3128
-
\??\c:\022286.exec:\022286.exe75⤵PID:1112
-
\??\c:\llxxrff.exec:\llxxrff.exe76⤵PID:4216
-
\??\c:\8222628.exec:\8222628.exe77⤵PID:4984
-
\??\c:\86282.exec:\86282.exe78⤵PID:2584
-
\??\c:\jvdjv.exec:\jvdjv.exe79⤵PID:640
-
\??\c:\rrfxllr.exec:\rrfxllr.exe80⤵
- System Location Discovery: System Language Discovery
PID:4748 -
\??\c:\rffxrrf.exec:\rffxrrf.exe81⤵PID:2368
-
\??\c:\2444444.exec:\2444444.exe82⤵PID:392
-
\??\c:\dppdv.exec:\dppdv.exe83⤵PID:3680
-
\??\c:\242202.exec:\242202.exe84⤵PID:3548
-
\??\c:\jdjdd.exec:\jdjdd.exe85⤵PID:1060
-
\??\c:\ffrlllr.exec:\ffrlllr.exe86⤵PID:4624
-
\??\c:\dvvvj.exec:\dvvvj.exe87⤵PID:2880
-
\??\c:\pjjdd.exec:\pjjdd.exe88⤵PID:3632
-
\??\c:\46600.exec:\46600.exe89⤵PID:384
-
\??\c:\xrxrlll.exec:\xrxrlll.exe90⤵PID:1952
-
\??\c:\3lllflf.exec:\3lllflf.exe91⤵PID:348
-
\??\c:\4820260.exec:\4820260.exe92⤵PID:2216
-
\??\c:\62000.exec:\62000.exe93⤵PID:4496
-
\??\c:\btbbhh.exec:\btbbhh.exe94⤵PID:2864
-
\??\c:\5rrlxxx.exec:\5rrlxxx.exe95⤵PID:4424
-
\??\c:\228066.exec:\228066.exe96⤵PID:4180
-
\??\c:\6404222.exec:\6404222.exe97⤵PID:1416
-
\??\c:\6240006.exec:\6240006.exe98⤵PID:4268
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe99⤵PID:4184
-
\??\c:\64608.exec:\64608.exe100⤵PID:3644
-
\??\c:\k28866.exec:\k28866.exe101⤵PID:2440
-
\??\c:\488222.exec:\488222.exe102⤵PID:5020
-
\??\c:\rrxffxx.exec:\rrxffxx.exe103⤵PID:2224
-
\??\c:\1hnhnn.exec:\1hnhnn.exe104⤵PID:4228
-
\??\c:\7dvpj.exec:\7dvpj.exe105⤵PID:3116
-
\??\c:\tnthbt.exec:\tnthbt.exe106⤵PID:612
-
\??\c:\nbhhbb.exec:\nbhhbb.exe107⤵PID:3120
-
\??\c:\8446060.exec:\8446060.exe108⤵PID:1696
-
\??\c:\28004.exec:\28004.exe109⤵PID:748
-
\??\c:\bbnnbb.exec:\bbnnbb.exe110⤵PID:3272
-
\??\c:\06260.exec:\06260.exe111⤵PID:1464
-
\??\c:\204406.exec:\204406.exe112⤵PID:216
-
\??\c:\0406000.exec:\0406000.exe113⤵PID:4868
-
\??\c:\8428248.exec:\8428248.exe114⤵PID:4692
-
\??\c:\802602.exec:\802602.exe115⤵PID:1328
-
\??\c:\22440.exec:\22440.exe116⤵PID:1116
-
\??\c:\pppjj.exec:\pppjj.exe117⤵PID:4736
-
\??\c:\40808.exec:\40808.exe118⤵PID:3908
-
\??\c:\hbbttt.exec:\hbbttt.exe119⤵PID:1112
-
\??\c:\04266.exec:\04266.exe120⤵PID:516
-
\??\c:\hbbttt.exec:\hbbttt.exe121⤵PID:3136
-
\??\c:\jdddv.exec:\jdddv.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-