Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 05:23
Static task
static1
Behavioral task
behavioral1
Sample
f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe
Resource
win7-20240903-en
General
-
Target
f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe
-
Size
347KB
-
MD5
f93203be77bac24876c9f4c8728185ef
-
SHA1
1b09931ba39a455617d851b90ecfc41ca7161e7d
-
SHA256
f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145
-
SHA512
53d3a4096dad3107db699ee0cd9982d1fe28af0dad10a73728cd0fb55e72633e231cb7e1a00a16ddbd99183e552bf43283dc5f7ef6ca0c91077be53bb23580b4
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAn:l7TcbWXZshJX2VGdn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3444-4-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4088-10-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3944-16-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/524-24-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/936-23-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/232-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1308-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2076-47-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4416-54-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2872-60-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1196-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4052-73-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2356-75-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4744-94-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2448-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2280-106-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3660-112-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3676-122-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1388-127-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/736-134-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3592-139-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1312-147-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4596-152-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3816-155-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3080-159-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5008-174-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4196-181-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3352-187-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2876-195-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/712-199-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2844-203-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4872-209-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4764-222-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3076-235-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2816-248-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4860-258-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5060-277-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4712-281-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1856-285-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2532-289-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1808-299-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1576-309-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4852-340-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3456-344-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2028-348-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/872-364-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3404-379-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2300-384-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3540-389-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3884-404-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4536-435-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2888-472-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2804-476-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/828-486-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1172-517-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3660-530-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3488-540-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4760-578-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3184-582-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1600-604-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5112-740-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4740-819-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2188-1373-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3372-1876-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
thhhbb.exevdjvp.exethbbtb.exexxfrrrr.exebtbbhh.exevppjd.exexrlfxxf.exexxxxrrx.exehttbnb.exexffxrrl.exetnnhtt.exelfrlrlr.exebtbttn.exevjvpv.exellrfrlf.exejjpjd.exerrrfrlx.exe5ttbnn.exenbbthb.exevpddp.exe3rflfxr.exehbtnbn.exevjjvp.exerlxlxrf.exenbnhbb.exexllflll.exe3xrfrlf.exetnnhbt.exexlrllfx.exevdppd.exeffrllfl.exebbttnh.exelflfxxr.exetnnhbb.exenhhbnn.exe7jpjj.exerrxrfff.exerlfxrlf.exehhhhbt.exepjpjp.exedjpjp.exerrfxfrl.exebnnhbt.exedppdp.exerllffxr.exebnhhbh.exe5hhbtt.exevvvjd.exe3jdpd.exefrxrllf.exehhbnhb.exe9vpdv.exe7lfxlfx.exellrlxxr.exehtbtnn.exevpjvj.exe5dvpd.exethbbnn.exevdvpj.exepddvj.exe5rrrlfr.exebhnbtn.exepdpdp.exexrlxxrx.exepid process 4088 thhhbb.exe 3944 vdjvp.exe 936 thbbtb.exe 524 xxfrrrr.exe 232 btbbhh.exe 1308 vppjd.exe 2076 xrlfxxf.exe 4416 xxxxrrx.exe 2872 httbnb.exe 1196 xffxrrl.exe 4052 tnnhtt.exe 2356 lfrlrlr.exe 4104 btbttn.exe 676 vjvpv.exe 4744 llrfrlf.exe 2448 jjpjd.exe 2280 rrrfrlx.exe 3660 5ttbnn.exe 3464 nbbthb.exe 3676 vpddp.exe 1388 3rflfxr.exe 736 hbtnbn.exe 3592 vjjvp.exe 1312 rlxlxrf.exe 4596 nbnhbb.exe 3816 xllflll.exe 3080 3xrfrlf.exe 3208 tnnhbt.exe 5008 xlrllfx.exe 4196 vdppd.exe 3352 ffrllfl.exe 2244 bbttnh.exe 2876 lflfxxr.exe 712 tnnhbb.exe 2844 nhhbnn.exe 1636 7jpjj.exe 4872 rrxrfff.exe 1984 rlfxrlf.exe 3468 hhhhbt.exe 2884 pjpjp.exe 4764 djpjp.exe 3220 rrfxfrl.exe 4900 bnnhbt.exe 4508 dppdp.exe 3076 rllffxr.exe 5080 bnhhbh.exe 4936 5hhbtt.exe 760 vvvjd.exe 2816 3jdpd.exe 1572 frxrllf.exe 4480 hhbnhb.exe 4860 9vpdv.exe 4076 7lfxlfx.exe 4088 llrlxxr.exe 4280 htbtnn.exe 1152 vpjvj.exe 936 5dvpd.exe 5060 thbbnn.exe 4712 vdvpj.exe 1856 pddvj.exe 2532 5rrrlfr.exe 3596 bhnbtn.exe 3620 pdpdp.exe 1808 xrlxxrx.exe -
Processes:
resource yara_rule behavioral2/memory/3444-4-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4088-10-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3944-16-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/524-24-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/936-23-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/232-30-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/232-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1308-41-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2076-47-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4416-54-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2872-60-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1196-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4052-73-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2356-75-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4744-94-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2448-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2280-106-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3660-112-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3676-122-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1388-127-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/736-134-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3592-139-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1312-147-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4596-152-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3816-155-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3080-159-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5008-174-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4196-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3352-187-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2876-195-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/712-199-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2844-203-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4872-209-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4764-222-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3076-235-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2816-248-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4860-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5060-277-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4712-281-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1856-285-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2532-289-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1808-299-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1576-309-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4852-340-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3456-344-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2028-348-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/872-364-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3404-379-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2300-384-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3540-389-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3884-404-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4536-435-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2888-472-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2804-476-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/828-486-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1172-517-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3660-530-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3488-540-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3676-541-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4760-578-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3184-582-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1600-604-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5112-740-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4740-819-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dvvvp.exeddvpj.exennbtnn.exeppvpp.exedvvvp.exe7tnhtt.exenthbnh.exefxfxxxl.exexlfrlrl.exelffrlxr.exelllfxxr.exeffrllfl.exeppvpj.exenhtntt.exe5djvv.exetbhbbt.exethnhhh.exenthbbb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exethhhbb.exevdjvp.exethbbtb.exexxfrrrr.exebtbbhh.exevppjd.exexrlfxxf.exexxxxrrx.exehttbnb.exexffxrrl.exetnnhtt.exelfrlrlr.exebtbttn.exevjvpv.exellrfrlf.exejjpjd.exerrrfrlx.exe5ttbnn.exenbbthb.exevpddp.exe3rflfxr.exedescription pid process target process PID 3444 wrote to memory of 4088 3444 f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe thhhbb.exe PID 3444 wrote to memory of 4088 3444 f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe thhhbb.exe PID 3444 wrote to memory of 4088 3444 f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe thhhbb.exe PID 4088 wrote to memory of 3944 4088 thhhbb.exe vdjvp.exe PID 4088 wrote to memory of 3944 4088 thhhbb.exe vdjvp.exe PID 4088 wrote to memory of 3944 4088 thhhbb.exe vdjvp.exe PID 3944 wrote to memory of 936 3944 vdjvp.exe thbbtb.exe PID 3944 wrote to memory of 936 3944 vdjvp.exe thbbtb.exe PID 3944 wrote to memory of 936 3944 vdjvp.exe thbbtb.exe PID 936 wrote to memory of 524 936 thbbtb.exe xxfrrrr.exe PID 936 wrote to memory of 524 936 thbbtb.exe xxfrrrr.exe PID 936 wrote to memory of 524 936 thbbtb.exe xxfrrrr.exe PID 524 wrote to memory of 232 524 xxfrrrr.exe btbbhh.exe PID 524 wrote to memory of 232 524 xxfrrrr.exe btbbhh.exe PID 524 wrote to memory of 232 524 xxfrrrr.exe btbbhh.exe PID 232 wrote to memory of 1308 232 btbbhh.exe vppjd.exe PID 232 wrote to memory of 1308 232 btbbhh.exe vppjd.exe PID 232 wrote to memory of 1308 232 btbbhh.exe vppjd.exe PID 1308 wrote to memory of 2076 1308 vppjd.exe xrlfxxf.exe PID 1308 wrote to memory of 2076 1308 vppjd.exe xrlfxxf.exe PID 1308 wrote to memory of 2076 1308 vppjd.exe xrlfxxf.exe PID 2076 wrote to memory of 4416 2076 xrlfxxf.exe xxxxrrx.exe PID 2076 wrote to memory of 4416 2076 xrlfxxf.exe xxxxrrx.exe PID 2076 wrote to memory of 4416 2076 xrlfxxf.exe xxxxrrx.exe PID 4416 wrote to memory of 2872 4416 xxxxrrx.exe httbnb.exe PID 4416 wrote to memory of 2872 4416 xxxxrrx.exe httbnb.exe PID 4416 wrote to memory of 2872 4416 xxxxrrx.exe httbnb.exe PID 2872 wrote to memory of 1196 2872 httbnb.exe xffxrrl.exe PID 2872 wrote to memory of 1196 2872 httbnb.exe xffxrrl.exe PID 2872 wrote to memory of 1196 2872 httbnb.exe xffxrrl.exe PID 1196 wrote to memory of 4052 1196 xffxrrl.exe tnnhtt.exe PID 1196 wrote to memory of 4052 1196 xffxrrl.exe tnnhtt.exe PID 1196 wrote to memory of 4052 1196 xffxrrl.exe tnnhtt.exe PID 4052 wrote to memory of 2356 4052 tnnhtt.exe lfrlrlr.exe PID 4052 wrote to memory of 2356 4052 tnnhtt.exe lfrlrlr.exe PID 4052 wrote to memory of 2356 4052 tnnhtt.exe lfrlrlr.exe PID 2356 wrote to memory of 4104 2356 lfrlrlr.exe btbttn.exe PID 2356 wrote to memory of 4104 2356 lfrlrlr.exe btbttn.exe PID 2356 wrote to memory of 4104 2356 lfrlrlr.exe btbttn.exe PID 4104 wrote to memory of 676 4104 btbttn.exe vjvpv.exe PID 4104 wrote to memory of 676 4104 btbttn.exe vjvpv.exe PID 4104 wrote to memory of 676 4104 btbttn.exe vjvpv.exe PID 676 wrote to memory of 4744 676 vjvpv.exe llrfrlf.exe PID 676 wrote to memory of 4744 676 vjvpv.exe llrfrlf.exe PID 676 wrote to memory of 4744 676 vjvpv.exe llrfrlf.exe PID 4744 wrote to memory of 2448 4744 llrfrlf.exe jjpjd.exe PID 4744 wrote to memory of 2448 4744 llrfrlf.exe jjpjd.exe PID 4744 wrote to memory of 2448 4744 llrfrlf.exe jjpjd.exe PID 2448 wrote to memory of 2280 2448 jjpjd.exe rrrfrlx.exe PID 2448 wrote to memory of 2280 2448 jjpjd.exe rrrfrlx.exe PID 2448 wrote to memory of 2280 2448 jjpjd.exe rrrfrlx.exe PID 2280 wrote to memory of 3660 2280 rrrfrlx.exe 5ttbnn.exe PID 2280 wrote to memory of 3660 2280 rrrfrlx.exe 5ttbnn.exe PID 2280 wrote to memory of 3660 2280 rrrfrlx.exe 5ttbnn.exe PID 3660 wrote to memory of 3464 3660 5ttbnn.exe nbbthb.exe PID 3660 wrote to memory of 3464 3660 5ttbnn.exe nbbthb.exe PID 3660 wrote to memory of 3464 3660 5ttbnn.exe nbbthb.exe PID 3464 wrote to memory of 3676 3464 nbbthb.exe vpddp.exe PID 3464 wrote to memory of 3676 3464 nbbthb.exe vpddp.exe PID 3464 wrote to memory of 3676 3464 nbbthb.exe vpddp.exe PID 3676 wrote to memory of 1388 3676 vpddp.exe 3rflfxr.exe PID 3676 wrote to memory of 1388 3676 vpddp.exe 3rflfxr.exe PID 3676 wrote to memory of 1388 3676 vpddp.exe 3rflfxr.exe PID 1388 wrote to memory of 736 1388 3rflfxr.exe hbtnbn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe"C:\Users\Admin\AppData\Local\Temp\f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\thhhbb.exec:\thhhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\vdjvp.exec:\vdjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\thbbtb.exec:\thbbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\xxfrrrr.exec:\xxfrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\btbbhh.exec:\btbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\vppjd.exec:\vppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\xrlfxxf.exec:\xrlfxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\xxxxrrx.exec:\xxxxrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\httbnb.exec:\httbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\xffxrrl.exec:\xffxrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\tnnhtt.exec:\tnnhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\btbttn.exec:\btbttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\vjvpv.exec:\vjvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\llrfrlf.exec:\llrfrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\jjpjd.exec:\jjpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\rrrfrlx.exec:\rrrfrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\5ttbnn.exec:\5ttbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\nbbthb.exec:\nbbthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\vpddp.exec:\vpddp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\3rflfxr.exec:\3rflfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\hbtnbn.exec:\hbtnbn.exe23⤵
- Executes dropped EXE
PID:736 -
\??\c:\vjjvp.exec:\vjjvp.exe24⤵
- Executes dropped EXE
PID:3592 -
\??\c:\rlxlxrf.exec:\rlxlxrf.exe25⤵
- Executes dropped EXE
PID:1312 -
\??\c:\nbnhbb.exec:\nbnhbb.exe26⤵
- Executes dropped EXE
PID:4596 -
\??\c:\xllflll.exec:\xllflll.exe27⤵
- Executes dropped EXE
PID:3816 -
\??\c:\3xrfrlf.exec:\3xrfrlf.exe28⤵
- Executes dropped EXE
PID:3080 -
\??\c:\tnnhbt.exec:\tnnhbt.exe29⤵
- Executes dropped EXE
PID:3208 -
\??\c:\xlrllfx.exec:\xlrllfx.exe30⤵
- Executes dropped EXE
PID:5008 -
\??\c:\vdppd.exec:\vdppd.exe31⤵
- Executes dropped EXE
PID:4196 -
\??\c:\ffrllfl.exec:\ffrllfl.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3352 -
\??\c:\bbttnh.exec:\bbttnh.exe33⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lflfxxr.exec:\lflfxxr.exe34⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tnnhbb.exec:\tnnhbb.exe35⤵
- Executes dropped EXE
PID:712 -
\??\c:\nhhbnn.exec:\nhhbnn.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7jpjj.exec:\7jpjj.exe37⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rrxrfff.exec:\rrxrfff.exe38⤵
- Executes dropped EXE
PID:4872 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe39⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hhhhbt.exec:\hhhhbt.exe40⤵
- Executes dropped EXE
PID:3468 -
\??\c:\pjpjp.exec:\pjpjp.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\djpjp.exec:\djpjp.exe42⤵
- Executes dropped EXE
PID:4764 -
\??\c:\rrfxfrl.exec:\rrfxfrl.exe43⤵
- Executes dropped EXE
PID:3220 -
\??\c:\bnnhbt.exec:\bnnhbt.exe44⤵
- Executes dropped EXE
PID:4900 -
\??\c:\dppdp.exec:\dppdp.exe45⤵
- Executes dropped EXE
PID:4508 -
\??\c:\rllffxr.exec:\rllffxr.exe46⤵
- Executes dropped EXE
PID:3076 -
\??\c:\bnhhbh.exec:\bnhhbh.exe47⤵
- Executes dropped EXE
PID:5080 -
\??\c:\5hhbtt.exec:\5hhbtt.exe48⤵
- Executes dropped EXE
PID:4936 -
\??\c:\vvvjd.exec:\vvvjd.exe49⤵
- Executes dropped EXE
PID:760 -
\??\c:\3jdpd.exec:\3jdpd.exe50⤵
- Executes dropped EXE
PID:2816 -
\??\c:\frxrllf.exec:\frxrllf.exe51⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hhbnhb.exec:\hhbnhb.exe52⤵
- Executes dropped EXE
PID:4480 -
\??\c:\9vpdv.exec:\9vpdv.exe53⤵
- Executes dropped EXE
PID:4860 -
\??\c:\7lfxlfx.exec:\7lfxlfx.exe54⤵
- Executes dropped EXE
PID:4076 -
\??\c:\llrlxxr.exec:\llrlxxr.exe55⤵
- Executes dropped EXE
PID:4088 -
\??\c:\htbtnn.exec:\htbtnn.exe56⤵
- Executes dropped EXE
PID:4280 -
\??\c:\vpjvj.exec:\vpjvj.exe57⤵
- Executes dropped EXE
PID:1152 -
\??\c:\5dvpd.exec:\5dvpd.exe58⤵
- Executes dropped EXE
PID:936 -
\??\c:\thbbnn.exec:\thbbnn.exe59⤵
- Executes dropped EXE
PID:5060 -
\??\c:\vdvpj.exec:\vdvpj.exe60⤵
- Executes dropped EXE
PID:4712 -
\??\c:\pddvj.exec:\pddvj.exe61⤵
- Executes dropped EXE
PID:1856 -
\??\c:\5rrrlfr.exec:\5rrrlfr.exe62⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bhnbtn.exec:\bhnbtn.exe63⤵
- Executes dropped EXE
PID:3596 -
\??\c:\pdpdp.exec:\pdpdp.exe64⤵
- Executes dropped EXE
PID:3620 -
\??\c:\xrlxxrx.exec:\xrlxxrx.exe65⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe66⤵PID:3396
-
\??\c:\nttnhb.exec:\nttnhb.exe67⤵PID:4700
-
\??\c:\jvppj.exec:\jvppj.exe68⤵PID:1576
-
\??\c:\pdjjd.exec:\pdjjd.exe69⤵PID:2396
-
\??\c:\fllfrxr.exec:\fllfrxr.exe70⤵PID:4492
-
\??\c:\5bhtnh.exec:\5bhtnh.exe71⤵PID:4612
-
\??\c:\bnbthh.exec:\bnbthh.exe72⤵PID:980
-
\??\c:\vjpdp.exec:\vjpdp.exe73⤵PID:2188
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe74⤵PID:4856
-
\??\c:\xrfxlrf.exec:\xrfxlrf.exe75⤵PID:1136
-
\??\c:\thnbnh.exec:\thnbnh.exe76⤵PID:4348
-
\??\c:\hhhthh.exec:\hhhthh.exe77⤵PID:4252
-
\??\c:\vvpdj.exec:\vvpdj.exe78⤵PID:4852
-
\??\c:\xfxlfrl.exec:\xfxlfrl.exe79⤵PID:3456
-
\??\c:\fllxrfx.exec:\fllxrfx.exe80⤵PID:2028
-
\??\c:\thhhhh.exec:\thhhhh.exe81⤵PID:4628
-
\??\c:\jpvjv.exec:\jpvjv.exe82⤵PID:3676
-
\??\c:\ffxlxrf.exec:\ffxlxrf.exe83⤵PID:4780
-
\??\c:\ttthbn.exec:\ttthbn.exe84⤵PID:5032
-
\??\c:\bhhthb.exec:\bhhthb.exe85⤵PID:872
-
\??\c:\jdpjv.exec:\jdpjv.exe86⤵PID:1216
-
\??\c:\llxlxlr.exec:\llxlxlr.exe87⤵PID:2552
-
\??\c:\bnnhnh.exec:\bnnhnh.exe88⤵PID:4600
-
\??\c:\tttnhb.exec:\tttnhb.exe89⤵PID:1676
-
\??\c:\9vpdv.exec:\9vpdv.exe90⤵PID:3404
-
\??\c:\pjpdp.exec:\pjpdp.exe91⤵PID:2300
-
\??\c:\hbhttn.exec:\hbhttn.exe92⤵PID:4360
-
\??\c:\jdvpd.exec:\jdvpd.exe93⤵PID:3540
-
\??\c:\7dvjv.exec:\7dvjv.exe94⤵PID:4760
-
\??\c:\llxlrlf.exec:\llxlrlf.exe95⤵PID:2320
-
\??\c:\9hbhbb.exec:\9hbhbb.exe96⤵PID:4196
-
\??\c:\dpdvv.exec:\dpdvv.exe97⤵PID:3884
-
\??\c:\jvvjd.exec:\jvvjd.exe98⤵PID:2876
-
\??\c:\lffxrlf.exec:\lffxrlf.exe99⤵PID:4588
-
\??\c:\thnhhh.exec:\thnhhh.exe100⤵
- System Location Discovery: System Language Discovery
PID:4356 -
\??\c:\vpdvd.exec:\vpdvd.exe101⤵PID:2740
-
\??\c:\rxxrffx.exec:\rxxrffx.exe102⤵PID:4432
-
\??\c:\rxfxllf.exec:\rxfxllf.exe103⤵PID:2112
-
\??\c:\bbhbtn.exec:\bbhbtn.exe104⤵PID:4824
-
\??\c:\nhnhbt.exec:\nhnhbt.exe105⤵PID:3912
-
\??\c:\pdjjv.exec:\pdjjv.exe106⤵PID:2096
-
\??\c:\5rlffff.exec:\5rlffff.exe107⤵PID:4536
-
\??\c:\thhtnh.exec:\thhtnh.exe108⤵PID:3848
-
\??\c:\tbhbtt.exec:\tbhbtt.exe109⤵PID:4024
-
\??\c:\ppddv.exec:\ppddv.exe110⤵PID:3120
-
\??\c:\dvpdv.exec:\dvpdv.exe111⤵PID:4084
-
\??\c:\lflfxxr.exec:\lflfxxr.exe112⤵PID:1932
-
\??\c:\3xxxrfx.exec:\3xxxrfx.exe113⤵PID:2268
-
\??\c:\nbbhbb.exec:\nbbhbb.exe114⤵PID:4020
-
\??\c:\3jjpj.exec:\3jjpj.exe115⤵PID:1848
-
\??\c:\dvvvp.exec:\dvvvp.exe116⤵
- System Location Discovery: System Language Discovery
PID:4480 -
\??\c:\llxllrx.exec:\llxllrx.exe117⤵PID:4120
-
\??\c:\tnhtbn.exec:\tnhtbn.exe118⤵PID:2104
-
\??\c:\jddvp.exec:\jddvp.exe119⤵PID:2888
-
\??\c:\lfxrffx.exec:\lfxrffx.exe120⤵PID:2804
-
\??\c:\bnthtn.exec:\bnthtn.exe121⤵PID:1152
-
\??\c:\7hhhtt.exec:\7hhhtt.exe122⤵PID:936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-