Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 03:41
Static task
static1
Behavioral task
behavioral1
Sample
cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe
Resource
win7-20241010-en
General
-
Target
cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe
-
Size
333KB
-
MD5
03aafbcad47f175b49a9f4f1df0dd63a
-
SHA1
aeda57fa3ab1098bc00297adb1bf9be06bf37e21
-
SHA256
cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700
-
SHA512
fa8e5ada0db2a5c0b1dc01c57f9701be216942ec6f80a1a751d44d712f6e5d693caa197092e7d6595f45a0ddea49a3ea3f09cb06632619ea123be39cd7eef0e1
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhC:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3132-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/796-851-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-907-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-1209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdddd.exexrfrrxr.exe1nthhn.exedjjjd.exefxffxxr.exe5lllllr.exerfxxxff.exerrrflrr.exehbbbtt.exedpvvv.exexllxlrr.exe1httbh.exelxxxrrr.exejjpdd.exerffxrrl.exebbnttb.exe5pddd.exexrxfflf.exenntttb.exerllllrr.exebnbtbn.exedvpvp.exetnntnb.exerrrrrxx.exe3ppjp.exevjjdd.exerlrfffr.exevvvvv.exerxxlrrr.exe1ddvp.exetbhbbh.exepdpjv.exelxxrrrl.exepvppj.exerrrrlrr.exenntttb.exevpvdd.exefxlllrr.exebhntbb.exeppvdd.exerrxfxfl.exehhnhbb.exedpddd.exe5ffrrrr.exetbhtnn.exedjvvj.exerfrxflx.exentnhbb.exevvddj.exejjvvv.exerxfflfr.exebnhbhn.exe1pddd.exe5frxlxr.exetnbhtt.exevvjjj.exe1lfffrr.exebbhtnt.exexfxxxxf.exevvjjj.exeflxxxff.exetnnntb.exepvjjj.exerrllrlr.exepid process 5036 pdddd.exe 4796 xrfrrxr.exe 1440 1nthhn.exe 2456 djjjd.exe 4200 fxffxxr.exe 1128 5lllllr.exe 4324 rfxxxff.exe 3136 rrrflrr.exe 2260 hbbbtt.exe 4516 dpvvv.exe 1520 xllxlrr.exe 3628 1httbh.exe 4260 lxxxrrr.exe 4576 jjpdd.exe 4688 rffxrrl.exe 4476 bbnttb.exe 4620 5pddd.exe 684 xrxfflf.exe 1884 nntttb.exe 3152 rllllrr.exe 3076 bnbtbn.exe 4092 dvpvp.exe 1700 tnntnb.exe 892 rrrrrxx.exe 4528 3ppjp.exe 2016 vjjdd.exe 2324 rlrfffr.exe 220 vvvvv.exe 4024 rxxlrrr.exe 1232 1ddvp.exe 3956 tbhbbh.exe 4184 pdpjv.exe 636 lxxrrrl.exe 3748 pvppj.exe 1932 rrrrlrr.exe 2348 nntttb.exe 3772 vpvdd.exe 3700 fxlllrr.exe 2176 bhntbb.exe 1616 ppvdd.exe 3268 rrxfxfl.exe 1200 hhnhbb.exe 5104 dpddd.exe 1860 5ffrrrr.exe 4540 tbhtnn.exe 2652 djvvj.exe 4048 rfrxflx.exe 2312 ntnhbb.exe 1420 vvddj.exe 3132 jjvvv.exe 3932 rxfflfr.exe 2360 bnhbhn.exe 512 1pddd.exe 3796 5frxlxr.exe 2296 tnbhtt.exe 2352 vvjjj.exe 2648 1lfffrr.exe 3108 bbhtnt.exe 3936 xfxxxxf.exe 1340 vvjjj.exe 4680 flxxxff.exe 3724 tnnntb.exe 3888 pvjjj.exe 4888 rrllrlr.exe -
Processes:
resource yara_rule behavioral2/memory/3132-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-721-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
flrxllr.exexflfrrx.exepdvpp.exehbbttn.exebttbbh.exeppjjj.exerxffrrf.exehthhtt.exedjjjj.exexllxrll.exeffrxxfl.exedvvdv.exexrrlffx.exedvjpd.exefrllffx.exevpddj.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exepdddd.exexrfrrxr.exe1nthhn.exedjjjd.exefxffxxr.exe5lllllr.exerfxxxff.exerrrflrr.exehbbbtt.exedpvvv.exexllxlrr.exe1httbh.exelxxxrrr.exejjpdd.exerffxrrl.exebbnttb.exe5pddd.exexrxfflf.exenntttb.exerllllrr.exebnbtbn.exedescription pid process target process PID 3132 wrote to memory of 5036 3132 cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe pdddd.exe PID 3132 wrote to memory of 5036 3132 cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe pdddd.exe PID 3132 wrote to memory of 5036 3132 cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe pdddd.exe PID 5036 wrote to memory of 4796 5036 pdddd.exe xrfrrxr.exe PID 5036 wrote to memory of 4796 5036 pdddd.exe xrfrrxr.exe PID 5036 wrote to memory of 4796 5036 pdddd.exe xrfrrxr.exe PID 4796 wrote to memory of 1440 4796 xrfrrxr.exe 1nthhn.exe PID 4796 wrote to memory of 1440 4796 xrfrrxr.exe 1nthhn.exe PID 4796 wrote to memory of 1440 4796 xrfrrxr.exe 1nthhn.exe PID 1440 wrote to memory of 2456 1440 1nthhn.exe djjjd.exe PID 1440 wrote to memory of 2456 1440 1nthhn.exe djjjd.exe PID 1440 wrote to memory of 2456 1440 1nthhn.exe djjjd.exe PID 2456 wrote to memory of 4200 2456 djjjd.exe fxffxxr.exe PID 2456 wrote to memory of 4200 2456 djjjd.exe fxffxxr.exe PID 2456 wrote to memory of 4200 2456 djjjd.exe fxffxxr.exe PID 4200 wrote to memory of 1128 4200 fxffxxr.exe 5lllllr.exe PID 4200 wrote to memory of 1128 4200 fxffxxr.exe 5lllllr.exe PID 4200 wrote to memory of 1128 4200 fxffxxr.exe 5lllllr.exe PID 1128 wrote to memory of 4324 1128 5lllllr.exe rfxxxff.exe PID 1128 wrote to memory of 4324 1128 5lllllr.exe rfxxxff.exe PID 1128 wrote to memory of 4324 1128 5lllllr.exe rfxxxff.exe PID 4324 wrote to memory of 3136 4324 rfxxxff.exe rrrflrr.exe PID 4324 wrote to memory of 3136 4324 rfxxxff.exe rrrflrr.exe PID 4324 wrote to memory of 3136 4324 rfxxxff.exe rrrflrr.exe PID 3136 wrote to memory of 2260 3136 rrrflrr.exe hbbbtt.exe PID 3136 wrote to memory of 2260 3136 rrrflrr.exe hbbbtt.exe PID 3136 wrote to memory of 2260 3136 rrrflrr.exe hbbbtt.exe PID 2260 wrote to memory of 4516 2260 hbbbtt.exe dpvvv.exe PID 2260 wrote to memory of 4516 2260 hbbbtt.exe dpvvv.exe PID 2260 wrote to memory of 4516 2260 hbbbtt.exe dpvvv.exe PID 4516 wrote to memory of 1520 4516 dpvvv.exe xllxlrr.exe PID 4516 wrote to memory of 1520 4516 dpvvv.exe xllxlrr.exe PID 4516 wrote to memory of 1520 4516 dpvvv.exe xllxlrr.exe PID 1520 wrote to memory of 3628 1520 xllxlrr.exe 1httbh.exe PID 1520 wrote to memory of 3628 1520 xllxlrr.exe 1httbh.exe PID 1520 wrote to memory of 3628 1520 xllxlrr.exe 1httbh.exe PID 3628 wrote to memory of 4260 3628 1httbh.exe lxxxrrr.exe PID 3628 wrote to memory of 4260 3628 1httbh.exe lxxxrrr.exe PID 3628 wrote to memory of 4260 3628 1httbh.exe lxxxrrr.exe PID 4260 wrote to memory of 4576 4260 lxxxrrr.exe jjpdd.exe PID 4260 wrote to memory of 4576 4260 lxxxrrr.exe jjpdd.exe PID 4260 wrote to memory of 4576 4260 lxxxrrr.exe jjpdd.exe PID 4576 wrote to memory of 4688 4576 jjpdd.exe rffxrrl.exe PID 4576 wrote to memory of 4688 4576 jjpdd.exe rffxrrl.exe PID 4576 wrote to memory of 4688 4576 jjpdd.exe rffxrrl.exe PID 4688 wrote to memory of 4476 4688 rffxrrl.exe bbnttb.exe PID 4688 wrote to memory of 4476 4688 rffxrrl.exe bbnttb.exe PID 4688 wrote to memory of 4476 4688 rffxrrl.exe bbnttb.exe PID 4476 wrote to memory of 4620 4476 bbnttb.exe 5pddd.exe PID 4476 wrote to memory of 4620 4476 bbnttb.exe 5pddd.exe PID 4476 wrote to memory of 4620 4476 bbnttb.exe 5pddd.exe PID 4620 wrote to memory of 684 4620 5pddd.exe xrxfflf.exe PID 4620 wrote to memory of 684 4620 5pddd.exe xrxfflf.exe PID 4620 wrote to memory of 684 4620 5pddd.exe xrxfflf.exe PID 684 wrote to memory of 1884 684 xrxfflf.exe nntttb.exe PID 684 wrote to memory of 1884 684 xrxfflf.exe nntttb.exe PID 684 wrote to memory of 1884 684 xrxfflf.exe nntttb.exe PID 1884 wrote to memory of 3152 1884 nntttb.exe rllllrr.exe PID 1884 wrote to memory of 3152 1884 nntttb.exe rllllrr.exe PID 1884 wrote to memory of 3152 1884 nntttb.exe rllllrr.exe PID 3152 wrote to memory of 3076 3152 rllllrr.exe bnbtbn.exe PID 3152 wrote to memory of 3076 3152 rllllrr.exe bnbtbn.exe PID 3152 wrote to memory of 3076 3152 rllllrr.exe bnbtbn.exe PID 3076 wrote to memory of 4092 3076 bnbtbn.exe dvpvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe"C:\Users\Admin\AppData\Local\Temp\cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\pdddd.exec:\pdddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\xrfrrxr.exec:\xrfrrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\1nthhn.exec:\1nthhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\djjjd.exec:\djjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\fxffxxr.exec:\fxffxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\5lllllr.exec:\5lllllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\rfxxxff.exec:\rfxxxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\rrrflrr.exec:\rrrflrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\hbbbtt.exec:\hbbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\dpvvv.exec:\dpvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\xllxlrr.exec:\xllxlrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\1httbh.exec:\1httbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\jjpdd.exec:\jjpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\rffxrrl.exec:\rffxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\bbnttb.exec:\bbnttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\5pddd.exec:\5pddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\xrxfflf.exec:\xrxfflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\nntttb.exec:\nntttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\rllllrr.exec:\rllllrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\bnbtbn.exec:\bnbtbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\dvpvp.exec:\dvpvp.exe23⤵
- Executes dropped EXE
PID:4092 -
\??\c:\tnntnb.exec:\tnntnb.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe25⤵
- Executes dropped EXE
PID:892 -
\??\c:\3ppjp.exec:\3ppjp.exe26⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vjjdd.exec:\vjjdd.exe27⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlrfffr.exec:\rlrfffr.exe28⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vvvvv.exec:\vvvvv.exe29⤵
- Executes dropped EXE
PID:220 -
\??\c:\rxxlrrr.exec:\rxxlrrr.exe30⤵
- Executes dropped EXE
PID:4024 -
\??\c:\1ddvp.exec:\1ddvp.exe31⤵
- Executes dropped EXE
PID:1232 -
\??\c:\tbhbbh.exec:\tbhbbh.exe32⤵
- Executes dropped EXE
PID:3956 -
\??\c:\pdpjv.exec:\pdpjv.exe33⤵
- Executes dropped EXE
PID:4184 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe34⤵
- Executes dropped EXE
PID:636 -
\??\c:\pvppj.exec:\pvppj.exe35⤵
- Executes dropped EXE
PID:3748 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe36⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nntttb.exec:\nntttb.exe37⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vpvdd.exec:\vpvdd.exe38⤵
- Executes dropped EXE
PID:3772 -
\??\c:\fxlllrr.exec:\fxlllrr.exe39⤵
- Executes dropped EXE
PID:3700 -
\??\c:\bhntbb.exec:\bhntbb.exe40⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ppvdd.exec:\ppvdd.exe41⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rrxfxfl.exec:\rrxfxfl.exe42⤵
- Executes dropped EXE
PID:3268 -
\??\c:\hhnhbb.exec:\hhnhbb.exe43⤵
- Executes dropped EXE
PID:1200 -
\??\c:\dpddd.exec:\dpddd.exe44⤵
- Executes dropped EXE
PID:5104 -
\??\c:\5ffrrrr.exec:\5ffrrrr.exe45⤵
- Executes dropped EXE
PID:1860 -
\??\c:\tbhtnn.exec:\tbhtnn.exe46⤵
- Executes dropped EXE
PID:4540 -
\??\c:\djvvj.exec:\djvvj.exe47⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rfrxflx.exec:\rfrxflx.exe48⤵
- Executes dropped EXE
PID:4048 -
\??\c:\ntnhbb.exec:\ntnhbb.exe49⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vvddj.exec:\vvddj.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jjvvv.exec:\jjvvv.exe51⤵
- Executes dropped EXE
PID:3132 -
\??\c:\rxfflfr.exec:\rxfflfr.exe52⤵
- Executes dropped EXE
PID:3932 -
\??\c:\bnhbhn.exec:\bnhbhn.exe53⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1pddd.exec:\1pddd.exe54⤵
- Executes dropped EXE
PID:512 -
\??\c:\5frxlxr.exec:\5frxlxr.exe55⤵
- Executes dropped EXE
PID:3796 -
\??\c:\tnbhtt.exec:\tnbhtt.exe56⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vvjjj.exec:\vvjjj.exe57⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1lfffrr.exec:\1lfffrr.exe58⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bbhtnt.exec:\bbhtnt.exe59⤵
- Executes dropped EXE
PID:3108 -
\??\c:\xfxxxxf.exec:\xfxxxxf.exe60⤵
- Executes dropped EXE
PID:3936 -
\??\c:\vvjjj.exec:\vvjjj.exe61⤵
- Executes dropped EXE
PID:1340 -
\??\c:\flxxxff.exec:\flxxxff.exe62⤵
- Executes dropped EXE
PID:4680 -
\??\c:\tnnntb.exec:\tnnntb.exe63⤵
- Executes dropped EXE
PID:3724 -
\??\c:\pvjjj.exec:\pvjjj.exe64⤵
- Executes dropped EXE
PID:3888 -
\??\c:\rrllrlr.exec:\rrllrlr.exe65⤵
- Executes dropped EXE
PID:4888 -
\??\c:\ttthhh.exec:\ttthhh.exe66⤵PID:3280
-
\??\c:\djdvp.exec:\djdvp.exe67⤵PID:2988
-
\??\c:\9ffxrrx.exec:\9ffxrrx.exe68⤵PID:4580
-
\??\c:\bthhhn.exec:\bthhhn.exe69⤵PID:964
-
\??\c:\btnbtt.exec:\btnbtt.exe70⤵PID:4912
-
\??\c:\rllxxxx.exec:\rllxxxx.exe71⤵PID:2880
-
\??\c:\nthhbn.exec:\nthhbn.exe72⤵PID:4620
-
\??\c:\hhbnhn.exec:\hhbnhn.exe73⤵PID:3404
-
\??\c:\dppvv.exec:\dppvv.exe74⤵PID:3228
-
\??\c:\rllxffl.exec:\rllxffl.exe75⤵PID:4384
-
\??\c:\ttnbnb.exec:\ttnbnb.exe76⤵PID:4480
-
\??\c:\bbhbbb.exec:\bbhbbb.exe77⤵PID:1388
-
\??\c:\ppppj.exec:\ppppj.exe78⤵PID:1712
-
\??\c:\xxlllrr.exec:\xxlllrr.exe79⤵PID:2300
-
\??\c:\rrffrlf.exec:\rrffrlf.exe80⤵PID:4168
-
\??\c:\1hhhhn.exec:\1hhhhn.exe81⤵PID:1224
-
\??\c:\vpvpj.exec:\vpvpj.exe82⤵PID:1048
-
\??\c:\pvdpv.exec:\pvdpv.exe83⤵PID:2024
-
\??\c:\lxllxxl.exec:\lxllxxl.exe84⤵PID:324
-
\??\c:\rffffll.exec:\rffffll.exe85⤵PID:3208
-
\??\c:\tbtbtb.exec:\tbtbtb.exe86⤵PID:736
-
\??\c:\7jvjv.exec:\7jvjv.exe87⤵PID:1232
-
\??\c:\vvpjj.exec:\vvpjj.exe88⤵PID:1648
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe89⤵PID:1156
-
\??\c:\tttttt.exec:\tttttt.exe90⤵PID:3196
-
\??\c:\7hbbtb.exec:\7hbbtb.exe91⤵PID:2056
-
\??\c:\jdvjj.exec:\jdvjj.exe92⤵PID:1504
-
\??\c:\xrffrxl.exec:\xrffrxl.exe93⤵PID:2572
-
\??\c:\vdjdv.exec:\vdjdv.exe94⤵PID:4716
-
\??\c:\llrrlll.exec:\llrrlll.exe95⤵PID:2952
-
\??\c:\bhhhhb.exec:\bhhhhb.exe96⤵PID:820
-
\??\c:\dpvvp.exec:\dpvvp.exe97⤵PID:1616
-
\??\c:\xflfrrx.exec:\xflfrrx.exe98⤵
- System Location Discovery: System Language Discovery
PID:2500 -
\??\c:\ddvdd.exec:\ddvdd.exe99⤵PID:1200
-
\??\c:\llfxxlr.exec:\llfxxlr.exe100⤵PID:5104
-
\??\c:\hhhnnn.exec:\hhhnnn.exe101⤵PID:3248
-
\??\c:\1vvvv.exec:\1vvvv.exe102⤵PID:3984
-
\??\c:\xrllllf.exec:\xrllllf.exe103⤵PID:4112
-
\??\c:\fllrfxx.exec:\fllrfxx.exe104⤵PID:2204
-
\??\c:\hnttbh.exec:\hnttbh.exe105⤵PID:2312
-
\??\c:\pdpjj.exec:\pdpjj.exe106⤵PID:1420
-
\??\c:\rxxxrfl.exec:\rxxxrfl.exe107⤵PID:732
-
\??\c:\nbbbtn.exec:\nbbbtn.exe108⤵PID:3088
-
\??\c:\jddjd.exec:\jddjd.exe109⤵PID:1880
-
\??\c:\jpppj.exec:\jpppj.exe110⤵PID:5028
-
\??\c:\ntnnhh.exec:\ntnnhh.exe111⤵PID:456
-
\??\c:\bntbbb.exec:\bntbbb.exe112⤵PID:4600
-
\??\c:\vpppp.exec:\vpppp.exe113⤵PID:4044
-
\??\c:\ffxllrr.exec:\ffxllrr.exe114⤵PID:3080
-
\??\c:\5nnnnt.exec:\5nnnnt.exe115⤵PID:3684
-
\??\c:\vvvdv.exec:\vvvdv.exe116⤵PID:5032
-
\??\c:\llxxxfx.exec:\llxxxfx.exe117⤵PID:4744
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe118⤵PID:3660
-
\??\c:\ntbbbb.exec:\ntbbbb.exe119⤵PID:2408
-
\??\c:\ppppj.exec:\ppppj.exe120⤵PID:2884
-
\??\c:\flrxllr.exec:\flrxllr.exe121⤵
- System Location Discovery: System Language Discovery
PID:4500 -
\??\c:\1hhtth.exec:\1hhtth.exe122⤵PID:3488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-