Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 07:40
Static task
static1
Behavioral task
behavioral1
Sample
b24841e422f1eec0737898148a37e5fbb436dfd5688983529f5f200e70a62266N.exe
Resource
win7-20241023-en
General
-
Target
b24841e422f1eec0737898148a37e5fbb436dfd5688983529f5f200e70a62266N.exe
-
Size
453KB
-
MD5
8edb37a3cee29ec228a566ce11a6daf0
-
SHA1
d2625987ad84aaa62e50f074a66e19a6e78cc403
-
SHA256
b24841e422f1eec0737898148a37e5fbb436dfd5688983529f5f200e70a62266
-
SHA512
7757511c62c141909a79a27909270fbff6466511d9b5fe14d5453228551d28ccf91efcea9d2903484e9d0c6162d0312a753466707b4e826cbbbd5861eae207d1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeI:q7Tc2NYHUrAwfMp3CDI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/2520-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/332-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-969-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-1064-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-1249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-1703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-1815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrrlfxr.exepvpdp.exe1lfxxxx.exexxfxlfx.exevvppv.exenhnnnt.exedvjjd.exetnbtnn.exefxlfrlf.exebhtbnn.exe3pdvj.exexrrrllf.exetntnnt.exexflrrfl.exepdjdp.exepjpjj.exetntnhb.exeppvjd.exelllfxxr.exeddjjd.exelfrrffl.exehbbthb.exeffllllf.exexrrlxxr.exetnnhhh.exevppjd.exerxfxllx.exepvdpj.exetntnhh.exeppjdv.exebntnnt.exe5nhbtt.exepdjdd.exehntnbb.exevdvvp.exepjpjv.exelxrlffx.exethbhhb.exedvvpj.exexxxxxlx.exebhnhbb.exevppdp.exe3rrrffx.exeffxrfff.exetthtnn.exejdjvj.exexxxrllf.exentbtnn.exehnbnth.exefllfxxr.exetttntn.exepjjdp.exepddvj.exerxfflxl.exethtnhh.exebtnnbt.exeppjjj.exexrlfrrl.exe7nhhbt.exe9ppjd.exefrfxrrl.exexrxrllf.exe5tbthb.exejjjpj.exepid process 2276 xrrlfxr.exe 740 pvpdp.exe 1228 1lfxxxx.exe 4584 xxfxlfx.exe 2140 vvppv.exe 2148 nhnnnt.exe 1100 dvjjd.exe 2172 tnbtnn.exe 1460 fxlfrlf.exe 1312 bhtbnn.exe 1192 3pdvj.exe 2116 xrrrllf.exe 3480 tntnnt.exe 2280 xflrrfl.exe 3916 pdjdp.exe 4776 pjpjj.exe 212 tntnhb.exe 2084 ppvjd.exe 3692 lllfxxr.exe 1660 ddjjd.exe 1268 lfrrffl.exe 3644 hbbthb.exe 944 ffllllf.exe 5112 xrrlxxr.exe 1688 tnnhhh.exe 2872 vppjd.exe 4364 rxfxllx.exe 5048 pvdpj.exe 952 tntnhh.exe 1808 ppjdv.exe 2856 bntnnt.exe 3156 5nhbtt.exe 2212 pdjdd.exe 3680 hntnbb.exe 2744 vdvvp.exe 4216 pjpjv.exe 2712 lxrlffx.exe 3516 thbhhb.exe 4280 dvvpj.exe 4960 xxxxxlx.exe 4516 bhnhbb.exe 3028 vppdp.exe 3108 3rrrffx.exe 1364 ffxrfff.exe 740 tthtnn.exe 1152 jdjvj.exe 1704 xxxrllf.exe 3844 ntbtnn.exe 4284 hnbnth.exe 4480 fllfxxr.exe 2228 tttntn.exe 3952 pjjdp.exe 4880 pddvj.exe 1100 rxfflxl.exe 848 thtnhh.exe 4048 btnnbt.exe 4884 ppjjj.exe 4036 xrlfrrl.exe 3964 7nhhbt.exe 5104 9ppjd.exe 1120 frfxrrl.exe 3520 xrxrllf.exe 3712 5tbthb.exe 3812 jjjpj.exe -
Processes:
resource yara_rule behavioral2/memory/2520-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-738-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dpvpj.exejjjvj.exehtbtnh.exelrlfxrl.exexrrlxxr.exethbbnn.exevvdvd.exeppjdv.exebhhbtt.exehhttbn.exellllrrx.exefrrlffl.exefxlfrlf.exeffrlrff.exe1hnhhh.exepvjdv.exevpdvd.exebtbhth.exe3vpdv.exe1tbnbb.exe1rxrfff.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrfff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b24841e422f1eec0737898148a37e5fbb436dfd5688983529f5f200e70a62266N.exexrrlfxr.exepvpdp.exe1lfxxxx.exexxfxlfx.exevvppv.exenhnnnt.exedvjjd.exetnbtnn.exefxlfrlf.exebhtbnn.exe3pdvj.exexrrrllf.exetntnnt.exexflrrfl.exepdjdp.exepjpjj.exetntnhb.exeppvjd.exelllfxxr.exeddjjd.exelfrrffl.exedescription pid process target process PID 2520 wrote to memory of 2276 2520 b24841e422f1eec0737898148a37e5fbb436dfd5688983529f5f200e70a62266N.exe xrrlfxr.exe PID 2520 wrote to memory of 2276 2520 b24841e422f1eec0737898148a37e5fbb436dfd5688983529f5f200e70a62266N.exe xrrlfxr.exe PID 2520 wrote to memory of 2276 2520 b24841e422f1eec0737898148a37e5fbb436dfd5688983529f5f200e70a62266N.exe xrrlfxr.exe PID 2276 wrote to memory of 740 2276 xrrlfxr.exe pvpdp.exe PID 2276 wrote to memory of 740 2276 xrrlfxr.exe pvpdp.exe PID 2276 wrote to memory of 740 2276 xrrlfxr.exe pvpdp.exe PID 740 wrote to memory of 1228 740 pvpdp.exe 1lfxxxx.exe PID 740 wrote to memory of 1228 740 pvpdp.exe 1lfxxxx.exe PID 740 wrote to memory of 1228 740 pvpdp.exe 1lfxxxx.exe PID 1228 wrote to memory of 4584 1228 1lfxxxx.exe xxfxlfx.exe PID 1228 wrote to memory of 4584 1228 1lfxxxx.exe xxfxlfx.exe PID 1228 wrote to memory of 4584 1228 1lfxxxx.exe xxfxlfx.exe PID 4584 wrote to memory of 2140 4584 xxfxlfx.exe vvppv.exe PID 4584 wrote to memory of 2140 4584 xxfxlfx.exe vvppv.exe PID 4584 wrote to memory of 2140 4584 xxfxlfx.exe vvppv.exe PID 2140 wrote to memory of 2148 2140 vvppv.exe nhnnnt.exe PID 2140 wrote to memory of 2148 2140 vvppv.exe nhnnnt.exe PID 2140 wrote to memory of 2148 2140 vvppv.exe nhnnnt.exe PID 2148 wrote to memory of 1100 2148 nhnnnt.exe dvjjd.exe PID 2148 wrote to memory of 1100 2148 nhnnnt.exe dvjjd.exe PID 2148 wrote to memory of 1100 2148 nhnnnt.exe dvjjd.exe PID 1100 wrote to memory of 2172 1100 dvjjd.exe tnbtnn.exe PID 1100 wrote to memory of 2172 1100 dvjjd.exe tnbtnn.exe PID 1100 wrote to memory of 2172 1100 dvjjd.exe tnbtnn.exe PID 2172 wrote to memory of 1460 2172 tnbtnn.exe fxlfrlf.exe PID 2172 wrote to memory of 1460 2172 tnbtnn.exe fxlfrlf.exe PID 2172 wrote to memory of 1460 2172 tnbtnn.exe fxlfrlf.exe PID 1460 wrote to memory of 1312 1460 fxlfrlf.exe bhtbnn.exe PID 1460 wrote to memory of 1312 1460 fxlfrlf.exe bhtbnn.exe PID 1460 wrote to memory of 1312 1460 fxlfrlf.exe bhtbnn.exe PID 1312 wrote to memory of 1192 1312 bhtbnn.exe 3pdvj.exe PID 1312 wrote to memory of 1192 1312 bhtbnn.exe 3pdvj.exe PID 1312 wrote to memory of 1192 1312 bhtbnn.exe 3pdvj.exe PID 1192 wrote to memory of 2116 1192 3pdvj.exe xrrrllf.exe PID 1192 wrote to memory of 2116 1192 3pdvj.exe xrrrllf.exe PID 1192 wrote to memory of 2116 1192 3pdvj.exe xrrrllf.exe PID 2116 wrote to memory of 3480 2116 xrrrllf.exe tntnnt.exe PID 2116 wrote to memory of 3480 2116 xrrrllf.exe tntnnt.exe PID 2116 wrote to memory of 3480 2116 xrrrllf.exe tntnnt.exe PID 3480 wrote to memory of 2280 3480 tntnnt.exe xflrrfl.exe PID 3480 wrote to memory of 2280 3480 tntnnt.exe xflrrfl.exe PID 3480 wrote to memory of 2280 3480 tntnnt.exe xflrrfl.exe PID 2280 wrote to memory of 3916 2280 xflrrfl.exe pdjdp.exe PID 2280 wrote to memory of 3916 2280 xflrrfl.exe pdjdp.exe PID 2280 wrote to memory of 3916 2280 xflrrfl.exe pdjdp.exe PID 3916 wrote to memory of 4776 3916 pdjdp.exe pjpjj.exe PID 3916 wrote to memory of 4776 3916 pdjdp.exe pjpjj.exe PID 3916 wrote to memory of 4776 3916 pdjdp.exe pjpjj.exe PID 4776 wrote to memory of 212 4776 pjpjj.exe tntnhb.exe PID 4776 wrote to memory of 212 4776 pjpjj.exe tntnhb.exe PID 4776 wrote to memory of 212 4776 pjpjj.exe tntnhb.exe PID 212 wrote to memory of 2084 212 tntnhb.exe ppvjd.exe PID 212 wrote to memory of 2084 212 tntnhb.exe ppvjd.exe PID 212 wrote to memory of 2084 212 tntnhb.exe ppvjd.exe PID 2084 wrote to memory of 3692 2084 ppvjd.exe lllfxxr.exe PID 2084 wrote to memory of 3692 2084 ppvjd.exe lllfxxr.exe PID 2084 wrote to memory of 3692 2084 ppvjd.exe lllfxxr.exe PID 3692 wrote to memory of 1660 3692 lllfxxr.exe ddjjd.exe PID 3692 wrote to memory of 1660 3692 lllfxxr.exe ddjjd.exe PID 3692 wrote to memory of 1660 3692 lllfxxr.exe ddjjd.exe PID 1660 wrote to memory of 1268 1660 ddjjd.exe lfrrffl.exe PID 1660 wrote to memory of 1268 1660 ddjjd.exe lfrrffl.exe PID 1660 wrote to memory of 1268 1660 ddjjd.exe lfrrffl.exe PID 1268 wrote to memory of 3644 1268 lfrrffl.exe hbbthb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b24841e422f1eec0737898148a37e5fbb436dfd5688983529f5f200e70a62266N.exe"C:\Users\Admin\AppData\Local\Temp\b24841e422f1eec0737898148a37e5fbb436dfd5688983529f5f200e70a62266N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\pvpdp.exec:\pvpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\1lfxxxx.exec:\1lfxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\xxfxlfx.exec:\xxfxlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\vvppv.exec:\vvppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\nhnnnt.exec:\nhnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\dvjjd.exec:\dvjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\tnbtnn.exec:\tnbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\fxlfrlf.exec:\fxlfrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\bhtbnn.exec:\bhtbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\3pdvj.exec:\3pdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\xrrrllf.exec:\xrrrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\tntnnt.exec:\tntnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\xflrrfl.exec:\xflrrfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\pdjdp.exec:\pdjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\pjpjj.exec:\pjpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\tntnhb.exec:\tntnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\ppvjd.exec:\ppvjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\lllfxxr.exec:\lllfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\ddjjd.exec:\ddjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\lfrrffl.exec:\lfrrffl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\hbbthb.exec:\hbbthb.exe23⤵
- Executes dropped EXE
PID:3644 -
\??\c:\ffllllf.exec:\ffllllf.exe24⤵
- Executes dropped EXE
PID:944 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5112 -
\??\c:\tnnhhh.exec:\tnnhhh.exe26⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vppjd.exec:\vppjd.exe27⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rxfxllx.exec:\rxfxllx.exe28⤵
- Executes dropped EXE
PID:4364 -
\??\c:\pvdpj.exec:\pvdpj.exe29⤵
- Executes dropped EXE
PID:5048 -
\??\c:\tntnhh.exec:\tntnhh.exe30⤵
- Executes dropped EXE
PID:952 -
\??\c:\ppjdv.exec:\ppjdv.exe31⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bntnnt.exec:\bntnnt.exe32⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5nhbtt.exec:\5nhbtt.exe33⤵
- Executes dropped EXE
PID:3156 -
\??\c:\pdjdd.exec:\pdjdd.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hntnbb.exec:\hntnbb.exe35⤵
- Executes dropped EXE
PID:3680 -
\??\c:\vdvvp.exec:\vdvvp.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pjpjv.exec:\pjpjv.exe37⤵
- Executes dropped EXE
PID:4216 -
\??\c:\lxrlffx.exec:\lxrlffx.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\thbhhb.exec:\thbhhb.exe39⤵
- Executes dropped EXE
PID:3516 -
\??\c:\dvvpj.exec:\dvvpj.exe40⤵
- Executes dropped EXE
PID:4280 -
\??\c:\xxxxxlx.exec:\xxxxxlx.exe41⤵
- Executes dropped EXE
PID:4960 -
\??\c:\bhnhbb.exec:\bhnhbb.exe42⤵
- Executes dropped EXE
PID:4516 -
\??\c:\vppdp.exec:\vppdp.exe43⤵
- Executes dropped EXE
PID:3028 -
\??\c:\3rrrffx.exec:\3rrrffx.exe44⤵
- Executes dropped EXE
PID:3108 -
\??\c:\ffxrfff.exec:\ffxrfff.exe45⤵
- Executes dropped EXE
PID:1364 -
\??\c:\tthtnn.exec:\tthtnn.exe46⤵
- Executes dropped EXE
PID:740 -
\??\c:\jdjvj.exec:\jdjvj.exe47⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xxxrllf.exec:\xxxrllf.exe48⤵
- Executes dropped EXE
PID:1704 -
\??\c:\ntbtnn.exec:\ntbtnn.exe49⤵
- Executes dropped EXE
PID:3844 -
\??\c:\hnbnth.exec:\hnbnth.exe50⤵
- Executes dropped EXE
PID:4284 -
\??\c:\fllfxxr.exec:\fllfxxr.exe51⤵
- Executes dropped EXE
PID:4480 -
\??\c:\tttntn.exec:\tttntn.exe52⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pjjdp.exec:\pjjdp.exe53⤵
- Executes dropped EXE
PID:3952 -
\??\c:\pddvj.exec:\pddvj.exe54⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rxfflxl.exec:\rxfflxl.exe55⤵
- Executes dropped EXE
PID:1100 -
\??\c:\thtnhh.exec:\thtnhh.exe56⤵
- Executes dropped EXE
PID:848 -
\??\c:\btnnbt.exec:\btnnbt.exe57⤵
- Executes dropped EXE
PID:4048 -
\??\c:\ppjjj.exec:\ppjjj.exe58⤵
- Executes dropped EXE
PID:4884 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe59⤵
- Executes dropped EXE
PID:4036 -
\??\c:\7nhhbt.exec:\7nhhbt.exe60⤵
- Executes dropped EXE
PID:3964 -
\??\c:\9ppjd.exec:\9ppjd.exe61⤵
- Executes dropped EXE
PID:5104 -
\??\c:\frfxrrl.exec:\frfxrrl.exe62⤵
- Executes dropped EXE
PID:1120 -
\??\c:\xrxrllf.exec:\xrxrllf.exe63⤵
- Executes dropped EXE
PID:3520 -
\??\c:\5tbthb.exec:\5tbthb.exe64⤵
- Executes dropped EXE
PID:3712 -
\??\c:\jjjpj.exec:\jjjpj.exe65⤵
- Executes dropped EXE
PID:3812 -
\??\c:\1xrrxxr.exec:\1xrrxxr.exe66⤵PID:2948
-
\??\c:\thhbnn.exec:\thhbnn.exe67⤵PID:1996
-
\??\c:\djpjv.exec:\djpjv.exe68⤵PID:1196
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe69⤵PID:3220
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe70⤵PID:1308
-
\??\c:\ttnnhb.exec:\ttnnhb.exe71⤵PID:672
-
\??\c:\dppjd.exec:\dppjd.exe72⤵PID:3644
-
\??\c:\jpdvp.exec:\jpdvp.exe73⤵PID:1916
-
\??\c:\3rxlfxx.exec:\3rxlfxx.exe74⤵PID:1672
-
\??\c:\htbtnn.exec:\htbtnn.exe75⤵PID:4916
-
\??\c:\dpvpd.exec:\dpvpd.exe76⤵PID:4996
-
\??\c:\xrrxllf.exec:\xrrxllf.exe77⤵PID:2872
-
\??\c:\ntbnhb.exec:\ntbnhb.exe78⤵PID:2024
-
\??\c:\tbnhtt.exec:\tbnhtt.exe79⤵PID:4536
-
\??\c:\pdpjd.exec:\pdpjd.exe80⤵PID:440
-
\??\c:\5rlfrlf.exec:\5rlfrlf.exe81⤵PID:4028
-
\??\c:\bhhbtt.exec:\bhhbtt.exe82⤵PID:2368
-
\??\c:\vjvpv.exec:\vjvpv.exe83⤵PID:3556
-
\??\c:\9ddvj.exec:\9ddvj.exe84⤵PID:2264
-
\??\c:\lrxrxxr.exec:\lrxrxxr.exe85⤵PID:3100
-
\??\c:\thhhnh.exec:\thhhnh.exe86⤵PID:4796
-
\??\c:\jpvpj.exec:\jpvpj.exe87⤵PID:2608
-
\??\c:\3rlfrrl.exec:\3rlfrrl.exe88⤵PID:3680
-
\??\c:\bhbhbt.exec:\bhbhbt.exe89⤵PID:632
-
\??\c:\jddvv.exec:\jddvv.exe90⤵PID:4216
-
\??\c:\ppjdv.exec:\ppjdv.exe91⤵
- System Location Discovery: System Language Discovery
PID:2628 -
\??\c:\xffxlff.exec:\xffxlff.exe92⤵PID:4684
-
\??\c:\hhbthh.exec:\hhbthh.exe93⤵PID:2100
-
\??\c:\jjpjp.exec:\jjpjp.exe94⤵PID:4844
-
\??\c:\9llfxxx.exec:\9llfxxx.exe95⤵PID:1728
-
\??\c:\bttnhh.exec:\bttnhh.exe96⤵PID:3108
-
\??\c:\3nbtnh.exec:\3nbtnh.exe97⤵PID:3176
-
\??\c:\7vpdv.exec:\7vpdv.exe98⤵PID:1228
-
\??\c:\1xxrlll.exec:\1xxrlll.exe99⤵PID:4148
-
\??\c:\flxxfxx.exec:\flxxfxx.exe100⤵PID:3664
-
\??\c:\jdddv.exec:\jdddv.exe101⤵PID:3152
-
\??\c:\vpvdp.exec:\vpvdp.exe102⤵PID:3252
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe103⤵PID:1168
-
\??\c:\nttttt.exec:\nttttt.exe104⤵PID:2428
-
\??\c:\pdjdd.exec:\pdjdd.exe105⤵PID:1312
-
\??\c:\vppdp.exec:\vppdp.exe106⤵PID:1564
-
\??\c:\hbtttb.exec:\hbtttb.exe107⤵PID:4400
-
\??\c:\jjdvp.exec:\jjdvp.exe108⤵PID:1344
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe109⤵PID:3480
-
\??\c:\hnhbtt.exec:\hnhbtt.exe110⤵PID:3760
-
\??\c:\bhnhbn.exec:\bhnhbn.exe111⤵PID:3436
-
\??\c:\1jdvv.exec:\1jdvv.exe112⤵PID:1632
-
\??\c:\flrlfxx.exec:\flrlfxx.exe113⤵PID:212
-
\??\c:\thbtnn.exec:\thbtnn.exe114⤵PID:3696
-
\??\c:\9nbtbh.exec:\9nbtbh.exe115⤵PID:2948
-
\??\c:\vddvj.exec:\vddvj.exe116⤵PID:1996
-
\??\c:\xrlxrrl.exec:\xrlxrrl.exe117⤵PID:1180
-
\??\c:\ntnhtt.exec:\ntnhtt.exe118⤵PID:3220
-
\??\c:\1vpjd.exec:\1vpjd.exe119⤵PID:1308
-
\??\c:\xllfxrf.exec:\xllfxrf.exe120⤵PID:672
-
\??\c:\3nnbnn.exec:\3nnbnn.exe121⤵PID:1104
-
\??\c:\nbhtnh.exec:\nbhtnh.exe122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-