Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 05:41
Behavioral task
behavioral1
Sample
fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe
Resource
win7-20240903-en
General
-
Target
fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe
-
Size
371KB
-
MD5
ad83a0fb512017846d400bcbe0dc3086
-
SHA1
bc212f1f366dfaa55bf843481143ac222c1c18f0
-
SHA256
fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc
-
SHA512
76151b00c0754b0afa1d5da5f6d302305b953cf542b27178000b0aa1c4ac3eb06a9d349ac23e8639a58b0db752923a1b03366a3b0fe462e722e65be783bc8c28
-
SSDEEP
6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf72:/4wFHoSA4KofHfHTXQLzgvnzHPowYbvH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1532-7-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1696-13-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2948-20-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/224-43-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2024-56-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4224-54-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1444-53-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3572-50-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3776-28-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3776-21-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4224-64-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4228-79-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4064-69-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/864-85-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1404-91-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/688-90-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1404-95-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2324-103-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2960-104-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2960-112-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4084-117-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4968-126-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1672-131-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4504-138-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1784-144-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3000-156-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3164-159-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2896-196-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2888-269-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4544-279-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3692-337-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2268-333-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4076-330-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3692-328-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3244-326-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4696-323-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3576-319-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2080-313-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3576-310-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3632-308-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/492-306-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3520-302-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/492-298-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4300-295-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2008-293-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4300-289-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3776-286-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4360-283-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1556-273-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1556-267-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2360-266-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3084-262-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3612-256-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1952-252-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3612-250-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5052-249-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2772-245-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3228-239-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4536-236-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4880-231-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3640-228-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4948-223-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3640-220-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/336-219-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
86640.exe0622646.exe62482.exefxlxlfr.exem6604.exellxrrrr.exe400820.exec864242.exejdjdv.exe88000.exe2620004.exe004866.exellfxrlf.exew06002.exea8268.exe8288264.exejddvj.exetnttht.exe88448.exevpvvv.exebtnntt.exedjppd.exe66442.exe5hnbhn.exevpvvp.exejdvpp.exe2282282.exelxllllx.exefrffllx.exebhhbtt.exenbnnnn.exepdjdd.exe4682288.exejpvvd.exe5tbtnh.exe1rrlxff.exelxffxxr.exepjpjj.exe26884.exe000422.exe426846.exe480284.exehhntnb.exe60648.exerrfxllf.exe082208.exerxrxxxf.exe80428.exei608462.exe42882.exevpvpd.exe7bnnhh.exem6220.exe2226860.exe62820.exedvvpp.exebbhbbb.exelfllffx.exe660000.exerrfflrx.exetbbbtt.exevjppd.exe60266.exea2048.exepid Process 1696 86640.exe 2948 0622646.exe 3776 62482.exe 1444 fxlxlfr.exe 224 m6604.exe 3572 llxrrrr.exe 2024 400820.exe 4224 c864242.exe 4064 jdjdv.exe 4228 88000.exe 864 2620004.exe 688 004866.exe 1404 llfxrlf.exe 2324 w06002.exe 2960 a8268.exe 4084 8288264.exe 4968 jddvj.exe 1672 tnttht.exe 4504 88448.exe 1784 vpvvv.exe 3000 btnntt.exe 1284 djppd.exe 3164 66442.exe 4928 5hnbhn.exe 1208 vpvvp.exe 4580 jdvpp.exe 2896 2282282.exe 5056 lxllllx.exe 1640 frffllx.exe 336 bhhbtt.exe 4948 nbnnnn.exe 3640 pdjdd.exe 4880 4682288.exe 4536 jpvvd.exe 3228 5tbtnh.exe 2772 1rrlxff.exe 5052 lxffxxr.exe 1952 pjpjj.exe 3612 26884.exe 3084 000422.exe 2360 426846.exe 2888 480284.exe 1556 hhntnb.exe 4544 60648.exe 4360 rrfxllf.exe 3776 082208.exe 2008 rxrxxxf.exe 4300 80428.exe 3520 i608462.exe 492 42882.exe 3632 vpvpd.exe 2080 7bnnhh.exe 3576 m6220.exe 4696 2226860.exe 3244 62820.exe 4076 dvvpp.exe 3692 bbhbbb.exe 2268 lfllffx.exe 2912 660000.exe 864 rrfflrx.exe 2444 tbbbtt.exe 2968 vjppd.exe 4516 60266.exe 4128 a2048.exe -
Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
Processes:
resource yara_rule behavioral2/files/0x000c000000023b01-3.dat molebox behavioral2/files/0x000b000000023b5a-10.dat molebox behavioral2/files/0x000a000000023b5f-15.dat molebox behavioral2/files/0x000a000000023b60-24.dat molebox behavioral2/files/0x000a000000023b61-30.dat molebox behavioral2/files/0x000a000000023b64-52.dat molebox behavioral2/files/0x000a000000023b63-45.dat molebox behavioral2/files/0x000a000000023b62-38.dat molebox behavioral2/files/0x000a000000023b65-60.dat molebox behavioral2/files/0x0032000000023b5b-66.dat molebox behavioral2/files/0x000a000000023b66-74.dat molebox behavioral2/files/0x000a000000023b67-81.dat molebox behavioral2/files/0x000a000000023b68-87.dat molebox behavioral2/files/0x000a000000023b69-96.dat molebox behavioral2/files/0x000a000000023b6b-101.dat molebox behavioral2/files/0x000a000000023b6c-108.dat molebox behavioral2/files/0x000a000000023b6e-123.dat molebox behavioral2/files/0x000a000000023b6d-119.dat molebox behavioral2/files/0x000a000000023b6f-129.dat molebox behavioral2/files/0x000a000000023b70-136.dat molebox behavioral2/files/0x000a000000023b71-145.dat molebox behavioral2/files/0x000a000000023b72-150.dat molebox behavioral2/files/0x000a000000023b74-165.dat molebox behavioral2/files/0x000a000000023b76-179.dat molebox behavioral2/files/0x000a000000023b7c-216.dat molebox behavioral2/files/0x000a000000023b7b-210.dat molebox behavioral2/files/0x000a000000023b7a-205.dat molebox behavioral2/files/0x000a000000023b79-199.dat molebox behavioral2/files/0x000a000000023b78-192.dat molebox behavioral2/files/0x000a000000023b77-186.dat molebox behavioral2/files/0x000a000000023b75-172.dat molebox behavioral2/files/0x000a000000023b73-158.dat molebox -
Processes:
resource yara_rule behavioral2/memory/1532-0-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000c000000023b01-3.dat upx behavioral2/memory/1532-7-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1696-4-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000b000000023b5a-10.dat upx behavioral2/memory/2948-14-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1696-13-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b5f-15.dat upx behavioral2/memory/2948-20-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b60-24.dat upx behavioral2/files/0x000a000000023b61-30.dat upx behavioral2/memory/224-33-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/224-43-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2024-47-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b64-52.dat upx behavioral2/memory/2024-56-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4224-54-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1444-53-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3572-50-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b63-45.dat upx behavioral2/memory/3572-40-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b62-38.dat upx behavioral2/memory/1444-32-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3776-28-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3776-21-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b65-60.dat upx behavioral2/memory/4224-64-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0032000000023b5b-66.dat upx behavioral2/memory/4228-71-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b66-74.dat upx behavioral2/memory/864-75-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/688-82-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b67-81.dat upx behavioral2/memory/4228-79-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4064-69-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4064-62-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/864-85-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b68-87.dat upx behavioral2/memory/1404-91-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/688-90-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2324-97-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b69-96.dat upx behavioral2/memory/1404-95-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b6b-101.dat upx behavioral2/memory/2324-103-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b6c-108.dat upx behavioral2/memory/4084-110-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2960-104-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2960-112-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4084-117-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4968-118-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b6e-123.dat upx behavioral2/memory/4968-126-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1672-124-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b6d-119.dat upx behavioral2/files/0x000a000000023b6f-129.dat upx behavioral2/memory/4504-132-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1672-131-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b70-136.dat upx behavioral2/memory/1784-140-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4504-138-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1784-144-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b71-145.dat upx behavioral2/memory/3000-147-0x0000000000400000-0x0000000000460000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
jdjdv.exe4680040.exe66204.exepdpdj.exexxxxflr.exejppdv.exec460444.exenhhnbb.exe6800444.exe26884.exe1bthtn.exe6244800.exe62824.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4680040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c460444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6800444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6244800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62824.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe86640.exe0622646.exe62482.exefxlxlfr.exem6604.exellxrrrr.exe400820.exec864242.exejdjdv.exe88000.exe2620004.exe004866.exellfxrlf.exew06002.exea8268.exe8288264.exejddvj.exetnttht.exe88448.exevpvvv.exebtnntt.exedescription pid Process procid_target PID 1532 wrote to memory of 1696 1532 fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe 83 PID 1532 wrote to memory of 1696 1532 fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe 83 PID 1532 wrote to memory of 1696 1532 fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe 83 PID 1696 wrote to memory of 2948 1696 86640.exe 84 PID 1696 wrote to memory of 2948 1696 86640.exe 84 PID 1696 wrote to memory of 2948 1696 86640.exe 84 PID 2948 wrote to memory of 3776 2948 0622646.exe 85 PID 2948 wrote to memory of 3776 2948 0622646.exe 85 PID 2948 wrote to memory of 3776 2948 0622646.exe 85 PID 3776 wrote to memory of 1444 3776 62482.exe 86 PID 3776 wrote to memory of 1444 3776 62482.exe 86 PID 3776 wrote to memory of 1444 3776 62482.exe 86 PID 1444 wrote to memory of 224 1444 fxlxlfr.exe 87 PID 1444 wrote to memory of 224 1444 fxlxlfr.exe 87 PID 1444 wrote to memory of 224 1444 fxlxlfr.exe 87 PID 224 wrote to memory of 3572 224 m6604.exe 88 PID 224 wrote to memory of 3572 224 m6604.exe 88 PID 224 wrote to memory of 3572 224 m6604.exe 88 PID 3572 wrote to memory of 2024 3572 llxrrrr.exe 89 PID 3572 wrote to memory of 2024 3572 llxrrrr.exe 89 PID 3572 wrote to memory of 2024 3572 llxrrrr.exe 89 PID 2024 wrote to memory of 4224 2024 400820.exe 90 PID 2024 wrote to memory of 4224 2024 400820.exe 90 PID 2024 wrote to memory of 4224 2024 400820.exe 90 PID 4224 wrote to memory of 4064 4224 c864242.exe 91 PID 4224 wrote to memory of 4064 4224 c864242.exe 91 PID 4224 wrote to memory of 4064 4224 c864242.exe 91 PID 4064 wrote to memory of 4228 4064 jdjdv.exe 92 PID 4064 wrote to memory of 4228 4064 jdjdv.exe 92 PID 4064 wrote to memory of 4228 4064 jdjdv.exe 92 PID 4228 wrote to memory of 864 4228 88000.exe 93 PID 4228 wrote to memory of 864 4228 88000.exe 93 PID 4228 wrote to memory of 864 4228 88000.exe 93 PID 864 wrote to memory of 688 864 2620004.exe 94 PID 864 wrote to memory of 688 864 2620004.exe 94 PID 864 wrote to memory of 688 864 2620004.exe 94 PID 688 wrote to memory of 1404 688 004866.exe 95 PID 688 wrote to memory of 1404 688 004866.exe 95 PID 688 wrote to memory of 1404 688 004866.exe 95 PID 1404 wrote to memory of 2324 1404 llfxrlf.exe 96 PID 1404 wrote to memory of 2324 1404 llfxrlf.exe 96 PID 1404 wrote to memory of 2324 1404 llfxrlf.exe 96 PID 2324 wrote to memory of 2960 2324 w06002.exe 97 PID 2324 wrote to memory of 2960 2324 w06002.exe 97 PID 2324 wrote to memory of 2960 2324 w06002.exe 97 PID 2960 wrote to memory of 4084 2960 a8268.exe 98 PID 2960 wrote to memory of 4084 2960 a8268.exe 98 PID 2960 wrote to memory of 4084 2960 a8268.exe 98 PID 4084 wrote to memory of 4968 4084 8288264.exe 99 PID 4084 wrote to memory of 4968 4084 8288264.exe 99 PID 4084 wrote to memory of 4968 4084 8288264.exe 99 PID 4968 wrote to memory of 1672 4968 jddvj.exe 100 PID 4968 wrote to memory of 1672 4968 jddvj.exe 100 PID 4968 wrote to memory of 1672 4968 jddvj.exe 100 PID 1672 wrote to memory of 4504 1672 tnttht.exe 101 PID 1672 wrote to memory of 4504 1672 tnttht.exe 101 PID 1672 wrote to memory of 4504 1672 tnttht.exe 101 PID 4504 wrote to memory of 1784 4504 88448.exe 102 PID 4504 wrote to memory of 1784 4504 88448.exe 102 PID 4504 wrote to memory of 1784 4504 88448.exe 102 PID 1784 wrote to memory of 3000 1784 vpvvv.exe 103 PID 1784 wrote to memory of 3000 1784 vpvvv.exe 103 PID 1784 wrote to memory of 3000 1784 vpvvv.exe 103 PID 3000 wrote to memory of 1284 3000 btnntt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe"C:\Users\Admin\AppData\Local\Temp\fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\86640.exec:\86640.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\0622646.exec:\0622646.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\62482.exec:\62482.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\fxlxlfr.exec:\fxlxlfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\m6604.exec:\m6604.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\llxrrrr.exec:\llxrrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\400820.exec:\400820.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\c864242.exec:\c864242.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\jdjdv.exec:\jdjdv.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\88000.exec:\88000.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\2620004.exec:\2620004.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\004866.exec:\004866.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\llfxrlf.exec:\llfxrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\w06002.exec:\w06002.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\a8268.exec:\a8268.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\8288264.exec:\8288264.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\jddvj.exec:\jddvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\tnttht.exec:\tnttht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\88448.exec:\88448.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\vpvvv.exec:\vpvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\btnntt.exec:\btnntt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\djppd.exec:\djppd.exe23⤵
- Executes dropped EXE
PID:1284 -
\??\c:\66442.exec:\66442.exe24⤵
- Executes dropped EXE
PID:3164 -
\??\c:\5hnbhn.exec:\5hnbhn.exe25⤵
- Executes dropped EXE
PID:4928 -
\??\c:\vpvvp.exec:\vpvvp.exe26⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jdvpp.exec:\jdvpp.exe27⤵
- Executes dropped EXE
PID:4580 -
\??\c:\2282282.exec:\2282282.exe28⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lxllllx.exec:\lxllllx.exe29⤵
- Executes dropped EXE
PID:5056 -
\??\c:\frffllx.exec:\frffllx.exe30⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bhhbtt.exec:\bhhbtt.exe31⤵
- Executes dropped EXE
PID:336 -
\??\c:\nbnnnn.exec:\nbnnnn.exe32⤵
- Executes dropped EXE
PID:4948 -
\??\c:\pdjdd.exec:\pdjdd.exe33⤵
- Executes dropped EXE
PID:3640 -
\??\c:\4682288.exec:\4682288.exe34⤵
- Executes dropped EXE
PID:4880 -
\??\c:\jpvvd.exec:\jpvvd.exe35⤵
- Executes dropped EXE
PID:4536 -
\??\c:\5tbtnh.exec:\5tbtnh.exe36⤵
- Executes dropped EXE
PID:3228 -
\??\c:\1rrlxff.exec:\1rrlxff.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lxffxxr.exec:\lxffxxr.exe38⤵
- Executes dropped EXE
PID:5052 -
\??\c:\pjpjj.exec:\pjpjj.exe39⤵
- Executes dropped EXE
PID:1952 -
\??\c:\26884.exec:\26884.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3612 -
\??\c:\000422.exec:\000422.exe41⤵
- Executes dropped EXE
PID:3084 -
\??\c:\426846.exec:\426846.exe42⤵
- Executes dropped EXE
PID:2360 -
\??\c:\480284.exec:\480284.exe43⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hhntnb.exec:\hhntnb.exe44⤵
- Executes dropped EXE
PID:1556 -
\??\c:\60648.exec:\60648.exe45⤵
- Executes dropped EXE
PID:4544 -
\??\c:\rrfxllf.exec:\rrfxllf.exe46⤵
- Executes dropped EXE
PID:4360 -
\??\c:\082208.exec:\082208.exe47⤵
- Executes dropped EXE
PID:3776 -
\??\c:\rxrxxxf.exec:\rxrxxxf.exe48⤵
- Executes dropped EXE
PID:2008 -
\??\c:\80428.exec:\80428.exe49⤵
- Executes dropped EXE
PID:4300 -
\??\c:\i608462.exec:\i608462.exe50⤵
- Executes dropped EXE
PID:3520 -
\??\c:\42882.exec:\42882.exe51⤵
- Executes dropped EXE
PID:492 -
\??\c:\vpvpd.exec:\vpvpd.exe52⤵
- Executes dropped EXE
PID:3632 -
\??\c:\7bnnhh.exec:\7bnnhh.exe53⤵
- Executes dropped EXE
PID:2080 -
\??\c:\m6220.exec:\m6220.exe54⤵
- Executes dropped EXE
PID:3576 -
\??\c:\2226860.exec:\2226860.exe55⤵
- Executes dropped EXE
PID:4696 -
\??\c:\62820.exec:\62820.exe56⤵
- Executes dropped EXE
PID:3244 -
\??\c:\dvvpp.exec:\dvvpp.exe57⤵
- Executes dropped EXE
PID:4076 -
\??\c:\bbhbbb.exec:\bbhbbb.exe58⤵
- Executes dropped EXE
PID:3692 -
\??\c:\lfllffx.exec:\lfllffx.exe59⤵
- Executes dropped EXE
PID:2268 -
\??\c:\660000.exec:\660000.exe60⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrfflrx.exec:\rrfflrx.exe61⤵
- Executes dropped EXE
PID:864 -
\??\c:\tbbbtt.exec:\tbbbtt.exe62⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vjppd.exec:\vjppd.exe63⤵
- Executes dropped EXE
PID:2968 -
\??\c:\60266.exec:\60266.exe64⤵
- Executes dropped EXE
PID:4516 -
\??\c:\a2048.exec:\a2048.exe65⤵
- Executes dropped EXE
PID:4128 -
\??\c:\jdpdj.exec:\jdpdj.exe66⤵PID:3560
-
\??\c:\1xfrfxf.exec:\1xfrfxf.exe67⤵PID:1228
-
\??\c:\thhbth.exec:\thhbth.exe68⤵PID:212
-
\??\c:\4282266.exec:\4282266.exe69⤵PID:4816
-
\??\c:\bbhnnn.exec:\bbhnnn.exe70⤵PID:972
-
\??\c:\0060482.exec:\0060482.exe71⤵PID:4212
-
\??\c:\jvpdv.exec:\jvpdv.exe72⤵PID:644
-
\??\c:\46848.exec:\46848.exe73⤵PID:1528
-
\??\c:\nhhnbb.exec:\nhhnbb.exe74⤵
- System Location Discovery: System Language Discovery
PID:3792 -
\??\c:\vpvpj.exec:\vpvpj.exe75⤵PID:2544
-
\??\c:\jvddv.exec:\jvddv.exe76⤵PID:1520
-
\??\c:\04868.exec:\04868.exe77⤵PID:3068
-
\??\c:\1nnbbb.exec:\1nnbbb.exe78⤵PID:4940
-
\??\c:\9frfxfx.exec:\9frfxfx.exe79⤵PID:1868
-
\??\c:\4806048.exec:\4806048.exe80⤵PID:884
-
\??\c:\rffxrlr.exec:\rffxrlr.exe81⤵PID:5060
-
\??\c:\7nbnhb.exec:\7nbnhb.exe82⤵PID:2340
-
\??\c:\k02602.exec:\k02602.exe83⤵PID:4948
-
\??\c:\m2080.exec:\m2080.exe84⤵PID:4052
-
\??\c:\3tnnhh.exec:\3tnnhh.exe85⤵PID:4536
-
\??\c:\nthbbh.exec:\nthbbh.exe86⤵PID:4500
-
\??\c:\1djdj.exec:\1djdj.exe87⤵PID:2132
-
\??\c:\jpvjv.exec:\jpvjv.exe88⤵PID:1728
-
\??\c:\8640484.exec:\8640484.exe89⤵PID:4944
-
\??\c:\284822.exec:\284822.exe90⤵PID:888
-
\??\c:\66442.exec:\66442.exe91⤵PID:4472
-
\??\c:\80684.exec:\80684.exe92⤵PID:4544
-
\??\c:\hhnnnb.exec:\hhnnnb.exe93⤵PID:2664
-
\??\c:\xxlfrrx.exec:\xxlfrrx.exe94⤵PID:4300
-
\??\c:\e44466.exec:\e44466.exe95⤵PID:4384
-
\??\c:\48400.exec:\48400.exe96⤵PID:4204
-
\??\c:\4682282.exec:\4682282.exe97⤵PID:3784
-
\??\c:\hnnntt.exec:\hnnntt.exe98⤵PID:2492
-
\??\c:\4804882.exec:\4804882.exe99⤵PID:3976
-
\??\c:\22488.exec:\22488.exe100⤵PID:3248
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe101⤵PID:856
-
\??\c:\2880442.exec:\2880442.exe102⤵PID:4468
-
\??\c:\m8288.exec:\m8288.exe103⤵PID:2984
-
\??\c:\pdvjv.exec:\pdvjv.exe104⤵PID:4732
-
\??\c:\lflrrrx.exec:\lflrrrx.exe105⤵PID:1084
-
\??\c:\4644888.exec:\4644888.exe106⤵PID:4980
-
\??\c:\w06600.exec:\w06600.exe107⤵PID:1228
-
\??\c:\1httbb.exec:\1httbb.exe108⤵PID:212
-
\??\c:\q84428.exec:\q84428.exe109⤵PID:4664
-
\??\c:\846666.exec:\846666.exe110⤵PID:2784
-
\??\c:\00626.exec:\00626.exe111⤵PID:972
-
\??\c:\jjdvj.exec:\jjdvj.exe112⤵PID:2256
-
\??\c:\2422666.exec:\2422666.exe113⤵PID:2476
-
\??\c:\440268.exec:\440268.exe114⤵PID:2260
-
\??\c:\llrrffl.exec:\llrrffl.exe115⤵PID:2392
-
\??\c:\k02406.exec:\k02406.exe116⤵PID:5096
-
\??\c:\28044.exec:\28044.exe117⤵PID:1520
-
\??\c:\46482.exec:\46482.exe118⤵PID:4956
-
\??\c:\xxxfrrl.exec:\xxxfrrl.exe119⤵PID:1836
-
\??\c:\c466666.exec:\c466666.exe120⤵PID:2632
-
\??\c:\c248288.exec:\c248288.exe121⤵PID:3524
-
\??\c:\vvddv.exec:\vvddv.exe122⤵PID:1208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-