Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 07:47
Static task
static1
Behavioral task
behavioral1
Sample
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe
Resource
win7-20240903-en
General
-
Target
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe
-
Size
455KB
-
MD5
38ca51c1f67607323a862005e6101600
-
SHA1
09d31aa71a6c00ff9b735ba369ee1ec3ca031aab
-
SHA256
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6
-
SHA512
bf2b1df7f48c5c6316f0c157b24599d143366e3cecbbe03560059e95d8d093b7f38efe52a61f80a2fc340e995397fa7c4a90f3e4917141ae8fc09ad86a1333ac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR2:q7Tc2NYHUrAwfMp3CDR2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/4996-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/828-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-848-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-1075-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-1513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5xlllrl.exepppjp.exe1llffll.exerlllffx.exerxllrlx.exelxlrlll.exe3bbtnn.exepdjdd.exerlfxffl.exelrrrrrr.exebbbnth.exevdjvv.exefllxlrf.exevpvvd.exexlrrrxx.exexxxxxxx.exenhnbtt.exevpppj.exe9lrrllf.exebhbtbt.exe7ffxrrr.exedvjjd.exetnhhhh.exe9lrxlll.exeppdvp.exelxrlrxr.exedjppp.exefxllrrl.exeppvpp.exenbhbbb.exevjvvv.exeddpjd.exejdppp.exetntnhh.exepjjjd.exevdpjj.exenbnhhn.exedvddp.exelfxlxlr.exe7tttnn.exedjvpd.exe1hhhhh.exe9jvpp.exexlxrllf.exetnhhbb.exevvdvp.exefrlrrrr.exexlxflfl.exennnnhh.exevpppj.exeffxrlrr.exetbbbtb.exepjjvp.exe9rxxrrf.exehhnnnh.exevpdvp.exerfrlfxx.exe1rrlffx.exehbnnnt.exevdppp.exelflffxx.exeffrrffx.exennhnbb.exedjddd.exepid Process 4520 5xlllrl.exe 3252 pppjp.exe 3620 1llffll.exe 1564 rlllffx.exe 3624 rxllrlx.exe 1380 lxlrlll.exe 976 3bbtnn.exe 2912 pdjdd.exe 4284 rlfxffl.exe 100 lrrrrrr.exe 4100 bbbnth.exe 2880 vdjvv.exe 1264 fllxlrf.exe 3656 vpvvd.exe 3948 xlrrrxx.exe 1824 xxxxxxx.exe 828 nhnbtt.exe 3240 vpppj.exe 3096 9lrrllf.exe 1216 bhbtbt.exe 1476 7ffxrrr.exe 1428 dvjjd.exe 2648 tnhhhh.exe 1300 9lrxlll.exe 3452 ppdvp.exe 772 lxrlrxr.exe 4708 djppp.exe 4600 fxllrrl.exe 4728 ppvpp.exe 3964 nbhbbb.exe 2216 vjvvv.exe 2924 ddpjd.exe 1208 jdppp.exe 2500 tntnhh.exe 4784 pjjjd.exe 1624 vdpjj.exe 2228 nbnhhn.exe 1076 dvddp.exe 1040 lfxlxlr.exe 1668 7tttnn.exe 2124 djvpd.exe 4048 1hhhhh.exe 2732 9jvpp.exe 4788 xlxrllf.exe 3680 tnhhbb.exe 220 vvdvp.exe 1492 frlrrrr.exe 1044 xlxflfl.exe 4336 nnnnhh.exe 1420 vpppj.exe 1952 ffxrlrr.exe 3480 tbbbtb.exe 3252 pjjvp.exe 3508 9rxxrrf.exe 4880 hhnnnh.exe 1116 vpdvp.exe 2788 rfrlfxx.exe 224 1rrlffx.exe 1796 hbnnnt.exe 2896 vdppp.exe 2576 lflffxx.exe 3328 ffrrffx.exe 1456 nnhnbb.exe 4388 djddd.exe -
Processes:
resource yara_rule behavioral2/memory/4996-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/828-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-742-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
vdjvv.exebnbbbh.exevpjjj.exedjdvv.exellrrlll.exetttnnn.exerfxrrll.exexxxfrrr.exejdvpj.exe9lrrllf.exeppddd.exexrrlffx.exeppvpv.exerlxrrrr.exettbttb.exenhnntn.exehthbtt.exexlxrllf.exeppvdd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe5xlllrl.exepppjp.exe1llffll.exerlllffx.exerxllrlx.exelxlrlll.exe3bbtnn.exepdjdd.exerlfxffl.exelrrrrrr.exebbbnth.exevdjvv.exefllxlrf.exevpvvd.exexlrrrxx.exexxxxxxx.exenhnbtt.exevpppj.exe9lrrllf.exebhbtbt.exe7ffxrrr.exedescription pid Process procid_target PID 4996 wrote to memory of 4520 4996 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe 83 PID 4996 wrote to memory of 4520 4996 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe 83 PID 4996 wrote to memory of 4520 4996 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe 83 PID 4520 wrote to memory of 3252 4520 5xlllrl.exe 84 PID 4520 wrote to memory of 3252 4520 5xlllrl.exe 84 PID 4520 wrote to memory of 3252 4520 5xlllrl.exe 84 PID 3252 wrote to memory of 3620 3252 pppjp.exe 85 PID 3252 wrote to memory of 3620 3252 pppjp.exe 85 PID 3252 wrote to memory of 3620 3252 pppjp.exe 85 PID 3620 wrote to memory of 1564 3620 1llffll.exe 86 PID 3620 wrote to memory of 1564 3620 1llffll.exe 86 PID 3620 wrote to memory of 1564 3620 1llffll.exe 86 PID 1564 wrote to memory of 3624 1564 rlllffx.exe 87 PID 1564 wrote to memory of 3624 1564 rlllffx.exe 87 PID 1564 wrote to memory of 3624 1564 rlllffx.exe 87 PID 3624 wrote to memory of 1380 3624 rxllrlx.exe 88 PID 3624 wrote to memory of 1380 3624 rxllrlx.exe 88 PID 3624 wrote to memory of 1380 3624 rxllrlx.exe 88 PID 1380 wrote to memory of 976 1380 lxlrlll.exe 89 PID 1380 wrote to memory of 976 1380 lxlrlll.exe 89 PID 1380 wrote to memory of 976 1380 lxlrlll.exe 89 PID 976 wrote to memory of 2912 976 3bbtnn.exe 90 PID 976 wrote to memory of 2912 976 3bbtnn.exe 90 PID 976 wrote to memory of 2912 976 3bbtnn.exe 90 PID 2912 wrote to memory of 4284 2912 pdjdd.exe 91 PID 2912 wrote to memory of 4284 2912 pdjdd.exe 91 PID 2912 wrote to memory of 4284 2912 pdjdd.exe 91 PID 4284 wrote to memory of 100 4284 rlfxffl.exe 92 PID 4284 wrote to memory of 100 4284 rlfxffl.exe 92 PID 4284 wrote to memory of 100 4284 rlfxffl.exe 92 PID 100 wrote to memory of 4100 100 lrrrrrr.exe 93 PID 100 wrote to memory of 4100 100 lrrrrrr.exe 93 PID 100 wrote to memory of 4100 100 lrrrrrr.exe 93 PID 4100 wrote to memory of 2880 4100 bbbnth.exe 94 PID 4100 wrote to memory of 2880 4100 bbbnth.exe 94 PID 4100 wrote to memory of 2880 4100 bbbnth.exe 94 PID 2880 wrote to memory of 1264 2880 vdjvv.exe 95 PID 2880 wrote to memory of 1264 2880 vdjvv.exe 95 PID 2880 wrote to memory of 1264 2880 vdjvv.exe 95 PID 1264 wrote to memory of 3656 1264 fllxlrf.exe 96 PID 1264 wrote to memory of 3656 1264 fllxlrf.exe 96 PID 1264 wrote to memory of 3656 1264 fllxlrf.exe 96 PID 3656 wrote to memory of 3948 3656 vpvvd.exe 97 PID 3656 wrote to memory of 3948 3656 vpvvd.exe 97 PID 3656 wrote to memory of 3948 3656 vpvvd.exe 97 PID 3948 wrote to memory of 1824 3948 xlrrrxx.exe 98 PID 3948 wrote to memory of 1824 3948 xlrrrxx.exe 98 PID 3948 wrote to memory of 1824 3948 xlrrrxx.exe 98 PID 1824 wrote to memory of 828 1824 xxxxxxx.exe 99 PID 1824 wrote to memory of 828 1824 xxxxxxx.exe 99 PID 1824 wrote to memory of 828 1824 xxxxxxx.exe 99 PID 828 wrote to memory of 3240 828 nhnbtt.exe 100 PID 828 wrote to memory of 3240 828 nhnbtt.exe 100 PID 828 wrote to memory of 3240 828 nhnbtt.exe 100 PID 3240 wrote to memory of 3096 3240 vpppj.exe 101 PID 3240 wrote to memory of 3096 3240 vpppj.exe 101 PID 3240 wrote to memory of 3096 3240 vpppj.exe 101 PID 3096 wrote to memory of 1216 3096 9lrrllf.exe 102 PID 3096 wrote to memory of 1216 3096 9lrrllf.exe 102 PID 3096 wrote to memory of 1216 3096 9lrrllf.exe 102 PID 1216 wrote to memory of 1476 1216 bhbtbt.exe 103 PID 1216 wrote to memory of 1476 1216 bhbtbt.exe 103 PID 1216 wrote to memory of 1476 1216 bhbtbt.exe 103 PID 1476 wrote to memory of 1428 1476 7ffxrrr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe"C:\Users\Admin\AppData\Local\Temp\33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\5xlllrl.exec:\5xlllrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\pppjp.exec:\pppjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\1llffll.exec:\1llffll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\rlllffx.exec:\rlllffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\rxllrlx.exec:\rxllrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\lxlrlll.exec:\lxlrlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\3bbtnn.exec:\3bbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\pdjdd.exec:\pdjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rlfxffl.exec:\rlfxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\bbbnth.exec:\bbbnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\vdjvv.exec:\vdjvv.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fllxlrf.exec:\fllxlrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\vpvvd.exec:\vpvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\nhnbtt.exec:\nhnbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\vpppj.exec:\vpppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\9lrrllf.exec:\9lrrllf.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\bhbtbt.exec:\bhbtbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\7ffxrrr.exec:\7ffxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\dvjjd.exec:\dvjjd.exe23⤵
- Executes dropped EXE
PID:1428 -
\??\c:\tnhhhh.exec:\tnhhhh.exe24⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9lrxlll.exec:\9lrxlll.exe25⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ppdvp.exec:\ppdvp.exe26⤵
- Executes dropped EXE
PID:3452 -
\??\c:\lxrlrxr.exec:\lxrlrxr.exe27⤵
- Executes dropped EXE
PID:772 -
\??\c:\djppp.exec:\djppp.exe28⤵
- Executes dropped EXE
PID:4708 -
\??\c:\fxllrrl.exec:\fxllrrl.exe29⤵
- Executes dropped EXE
PID:4600 -
\??\c:\ppvpp.exec:\ppvpp.exe30⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nbhbbb.exec:\nbhbbb.exe31⤵
- Executes dropped EXE
PID:3964 -
\??\c:\vjvvv.exec:\vjvvv.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ddpjd.exec:\ddpjd.exe33⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jdppp.exec:\jdppp.exe34⤵
- Executes dropped EXE
PID:1208 -
\??\c:\tntnhh.exec:\tntnhh.exe35⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pjjjd.exec:\pjjjd.exe36⤵
- Executes dropped EXE
PID:4784 -
\??\c:\vdpjj.exec:\vdpjj.exe37⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nbnhhn.exec:\nbnhhn.exe38⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dvddp.exec:\dvddp.exe39⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lfxlxlr.exec:\lfxlxlr.exe40⤵
- Executes dropped EXE
PID:1040 -
\??\c:\7tttnn.exec:\7tttnn.exe41⤵
- Executes dropped EXE
PID:1668 -
\??\c:\djvpd.exec:\djvpd.exe42⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1hhhhh.exec:\1hhhhh.exe43⤵
- Executes dropped EXE
PID:4048 -
\??\c:\9jvpp.exec:\9jvpp.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xlxrllf.exec:\xlxrllf.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4788 -
\??\c:\tnhhbb.exec:\tnhhbb.exe46⤵
- Executes dropped EXE
PID:3680 -
\??\c:\vvdvp.exec:\vvdvp.exe47⤵
- Executes dropped EXE
PID:220 -
\??\c:\frlrrrr.exec:\frlrrrr.exe48⤵
- Executes dropped EXE
PID:1492 -
\??\c:\xlxflfl.exec:\xlxflfl.exe49⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nnnnhh.exec:\nnnnhh.exe50⤵
- Executes dropped EXE
PID:4336 -
\??\c:\vpppj.exec:\vpppj.exe51⤵
- Executes dropped EXE
PID:1420 -
\??\c:\ffxrlrr.exec:\ffxrlrr.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tbbbtb.exec:\tbbbtb.exe53⤵
- Executes dropped EXE
PID:3480 -
\??\c:\pjjvp.exec:\pjjvp.exe54⤵
- Executes dropped EXE
PID:3252 -
\??\c:\9rxxrrf.exec:\9rxxrrf.exe55⤵
- Executes dropped EXE
PID:3508 -
\??\c:\hhnnnh.exec:\hhnnnh.exe56⤵
- Executes dropped EXE
PID:4880 -
\??\c:\vpdvp.exec:\vpdvp.exe57⤵
- Executes dropped EXE
PID:1116 -
\??\c:\rfrlfxx.exec:\rfrlfxx.exe58⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1rrlffx.exec:\1rrlffx.exe59⤵
- Executes dropped EXE
PID:224 -
\??\c:\hbnnnt.exec:\hbnnnt.exe60⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vdppp.exec:\vdppp.exe61⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lflffxx.exec:\lflffxx.exe62⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ffrrffx.exec:\ffrrffx.exe63⤵
- Executes dropped EXE
PID:3328 -
\??\c:\nnhnbb.exec:\nnhnbb.exe64⤵
- Executes dropped EXE
PID:1456 -
\??\c:\djddd.exec:\djddd.exe65⤵
- Executes dropped EXE
PID:4388 -
\??\c:\xrxrllf.exec:\xrxrllf.exe66⤵PID:1488
-
\??\c:\thntnn.exec:\thntnn.exe67⤵PID:2132
-
\??\c:\7pdvv.exec:\7pdvv.exe68⤵PID:3140
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe69⤵PID:776
-
\??\c:\tbhbtt.exec:\tbhbtt.exe70⤵PID:3656
-
\??\c:\jjjdv.exec:\jjjdv.exe71⤵PID:736
-
\??\c:\lrfflfx.exec:\lrfflfx.exe72⤵PID:3676
-
\??\c:\hbtntt.exec:\hbtntt.exe73⤵PID:4940
-
\??\c:\dvvvv.exec:\dvvvv.exe74⤵PID:3096
-
\??\c:\vjpdj.exec:\vjpdj.exe75⤵PID:3040
-
\??\c:\5frrrrr.exec:\5frrrrr.exe76⤵PID:3324
-
\??\c:\bbbtnn.exec:\bbbtnn.exe77⤵PID:4924
-
\??\c:\pvvpp.exec:\pvvpp.exe78⤵PID:5100
-
\??\c:\lrrlfff.exec:\lrrlfff.exe79⤵PID:3464
-
\??\c:\lffllff.exec:\lffllff.exe80⤵PID:4432
-
\??\c:\dddvd.exec:\dddvd.exe81⤵PID:3824
-
\??\c:\5lxrrrl.exec:\5lxrrrl.exe82⤵PID:3184
-
\??\c:\thtnhn.exec:\thtnhn.exe83⤵PID:4008
-
\??\c:\tttttt.exec:\tttttt.exe84⤵PID:2112
-
\??\c:\ddjjd.exec:\ddjjd.exe85⤵PID:932
-
\??\c:\3xxxxxx.exec:\3xxxxxx.exe86⤵PID:2528
-
\??\c:\xrfxllr.exec:\xrfxllr.exe87⤵PID:3932
-
\??\c:\btnhbb.exec:\btnhbb.exe88⤵PID:2764
-
\??\c:\ppvvv.exec:\ppvvv.exe89⤵PID:4608
-
\??\c:\jjvjj.exec:\jjvjj.exe90⤵PID:5020
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe91⤵PID:2124
-
\??\c:\bnbbhh.exec:\bnbbhh.exe92⤵PID:1700
-
\??\c:\7hhhhn.exec:\7hhhhn.exe93⤵PID:4360
-
\??\c:\vvdjd.exec:\vvdjd.exe94⤵PID:2068
-
\??\c:\rllfxxx.exec:\rllfxxx.exe95⤵PID:2172
-
\??\c:\7ffxrrr.exec:\7ffxrrr.exe96⤵PID:1536
-
\??\c:\tbnhbh.exec:\tbnhbh.exe97⤵PID:4332
-
\??\c:\jdvpp.exec:\jdvpp.exe98⤵PID:3260
-
\??\c:\llxxffl.exec:\llxxffl.exe99⤵PID:2044
-
\??\c:\tbhttn.exec:\tbhttn.exe100⤵PID:3632
-
\??\c:\ppvdd.exec:\ppvdd.exe101⤵
- System Location Discovery: System Language Discovery
PID:2692 -
\??\c:\rlrlffx.exec:\rlrlffx.exe102⤵PID:3968
-
\??\c:\bbbttt.exec:\bbbttt.exe103⤵PID:3748
-
\??\c:\nbnhbh.exec:\nbnhbh.exe104⤵PID:3624
-
\??\c:\vpvjj.exec:\vpvjj.exe105⤵PID:1116
-
\??\c:\lllxlfx.exec:\lllxlfx.exe106⤵PID:1380
-
\??\c:\nntnhh.exec:\nntnhh.exe107⤵PID:224
-
\??\c:\pddjj.exec:\pddjj.exe108⤵PID:4604
-
\??\c:\lfffffx.exec:\lfffffx.exe109⤵PID:2896
-
\??\c:\tnhhnn.exec:\tnhhnn.exe110⤵PID:4776
-
\??\c:\htnnnt.exec:\htnnnt.exe111⤵PID:3460
-
\??\c:\7djjp.exec:\7djjp.exe112⤵PID:100
-
\??\c:\lfrxrxx.exec:\lfrxrxx.exe113⤵PID:5048
-
\??\c:\1xrlllx.exec:\1xrlllx.exe114⤵PID:3380
-
\??\c:\hnbtnn.exec:\hnbtnn.exe115⤵PID:2964
-
\??\c:\dpdvp.exec:\dpdvp.exe116⤵PID:552
-
\??\c:\dvpjd.exec:\dvpjd.exe117⤵PID:3152
-
\??\c:\xfrrlrx.exec:\xfrrlrx.exe118⤵PID:1612
-
\??\c:\nnttnn.exec:\nnttnn.exe119⤵PID:3172
-
\??\c:\pjvpj.exec:\pjvpj.exe120⤵PID:2380
-
\??\c:\5rrlfff.exec:\5rrlfff.exe121⤵PID:1032
-
\??\c:\rlxrlll.exec:\rlxrlll.exe122⤵PID:3948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-