Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 19:20
Static task
static1
Behavioral task
behavioral1
Sample
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe
Resource
win7-20240903-en
General
-
Target
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe
-
Size
454KB
-
MD5
9bdb9371d4f5c81e0ef03e158e84187a
-
SHA1
141c1d690291866191ac63c41781e05f2c9c5b8e
-
SHA256
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd
-
SHA512
0d245da98d0686a80f3b988a64b56828bf7bb164c2e6ec3ea025affa7fdeb7b148f7964eb3ab8bc77896d419bece48d37e470fc67fea749b9c0a396743c57121
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbecr:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1104-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2668-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/340-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/328-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-1123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-1139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-1442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dppvv.exenttnhb.exefxlffff.exe1bhhbh.exebnbttt.exerllfxxr.exetnhbtn.exejvddd.exentbbtt.exerlfxrxr.exebnnhbt.exedddjp.exefxfllxx.exebhhnht.exe7jpjp.exefxrlffx.exebhbtnn.exe5xfxxff.exebbhbtn.exerrrrfxr.exe7rrfxxr.exethnttb.exejjpjp.exenhntbn.exedjjdd.exelxfflfx.exe5ntnhh.exevppjd.exejvvpj.exexlxrlll.exevvpjj.exexllffxx.exe1tnhtt.exerxfflfl.exebnhnnt.exexrrlfff.exebbhbbb.exeflllfxx.exetnbnbt.exeppvpv.exehhttht.exepdvvv.exexrfxfrr.exebtthbb.exe7lrxlxr.exebtnnhh.exe7pvpp.exexfrxrrl.exetttnnh.exe5lrrlxx.exetnbtbh.exebttbtt.exevvjjd.exerlrllll.exetttntn.exe5vvpj.exellrlflf.exebhnhbt.exejdvvp.exerxlffll.exelflfxrr.exe3ntnnt.exe1jvpv.exerlxxrlf.exepid process 2304 dppvv.exe 1868 nttnhb.exe 3188 fxlffff.exe 1008 1bhhbh.exe 1864 bnbttt.exe 1772 rllfxxr.exe 760 tnhbtn.exe 3384 jvddd.exe 1788 ntbbtt.exe 3244 rlfxrxr.exe 1080 bnnhbt.exe 2164 dddjp.exe 4676 fxfllxx.exe 2596 bhhnht.exe 4992 7jpjp.exe 5068 fxrlffx.exe 3460 bhbtnn.exe 2668 5xfxxff.exe 4484 bbhbtn.exe 1112 rrrrfxr.exe 2236 7rrfxxr.exe 2008 thnttb.exe 2264 jjpjp.exe 1132 nhntbn.exe 2348 djjdd.exe 876 lxfflfx.exe 4888 5ntnhh.exe 2196 vppjd.exe 3664 jvvpj.exe 3984 xlxrlll.exe 2020 vvpjj.exe 3676 xllffxx.exe 4092 1tnhtt.exe 1712 rxfflfl.exe 960 bnhnnt.exe 2168 xrrlfff.exe 800 bbhbbb.exe 2928 flllfxx.exe 3232 tnbnbt.exe 1096 ppvpv.exe 1320 hhttht.exe 4076 pdvvv.exe 1376 xrfxfrr.exe 3872 btthbb.exe 4184 7lrxlxr.exe 340 btnnhh.exe 4384 7pvpp.exe 1624 xfrxrrl.exe 468 tttnnh.exe 2768 5lrrlxx.exe 1868 tnbtbh.exe 4228 bttbtt.exe 4916 vvjjd.exe 4900 rlrllll.exe 4444 tttntn.exe 1124 5vvpj.exe 1572 llrlflf.exe 2724 bhnhbt.exe 2132 jdvvp.exe 4880 rxlffll.exe 3368 lflfxrr.exe 1208 3ntnnt.exe 328 1jvpv.exe 2288 rlxxrlf.exe -
Processes:
resource yara_rule behavioral2/memory/1104-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/340-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/328-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-604-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
xrfxfrr.exetbbbnb.exevpppj.exerfrlfxr.exehbbnhb.exe3vdvp.exe3vvvj.exepdvpj.exe7rxrlfr.exexrlxlxr.exe7frffff.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exedppvv.exenttnhb.exefxlffff.exe1bhhbh.exebnbttt.exerllfxxr.exetnhbtn.exejvddd.exentbbtt.exerlfxrxr.exebnnhbt.exedddjp.exefxfllxx.exebhhnht.exe7jpjp.exefxrlffx.exebhbtnn.exe5xfxxff.exebbhbtn.exerrrrfxr.exe7rrfxxr.exedescription pid process target process PID 1104 wrote to memory of 2304 1104 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe dppvv.exe PID 1104 wrote to memory of 2304 1104 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe dppvv.exe PID 1104 wrote to memory of 2304 1104 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe dppvv.exe PID 2304 wrote to memory of 1868 2304 dppvv.exe nttnhb.exe PID 2304 wrote to memory of 1868 2304 dppvv.exe nttnhb.exe PID 2304 wrote to memory of 1868 2304 dppvv.exe nttnhb.exe PID 1868 wrote to memory of 3188 1868 nttnhb.exe fxlffff.exe PID 1868 wrote to memory of 3188 1868 nttnhb.exe fxlffff.exe PID 1868 wrote to memory of 3188 1868 nttnhb.exe fxlffff.exe PID 3188 wrote to memory of 1008 3188 fxlffff.exe 1bhhbh.exe PID 3188 wrote to memory of 1008 3188 fxlffff.exe 1bhhbh.exe PID 3188 wrote to memory of 1008 3188 fxlffff.exe 1bhhbh.exe PID 1008 wrote to memory of 1864 1008 1bhhbh.exe bnbttt.exe PID 1008 wrote to memory of 1864 1008 1bhhbh.exe bnbttt.exe PID 1008 wrote to memory of 1864 1008 1bhhbh.exe bnbttt.exe PID 1864 wrote to memory of 1772 1864 bnbttt.exe rllfxxr.exe PID 1864 wrote to memory of 1772 1864 bnbttt.exe rllfxxr.exe PID 1864 wrote to memory of 1772 1864 bnbttt.exe rllfxxr.exe PID 1772 wrote to memory of 760 1772 rllfxxr.exe tnhbtn.exe PID 1772 wrote to memory of 760 1772 rllfxxr.exe tnhbtn.exe PID 1772 wrote to memory of 760 1772 rllfxxr.exe tnhbtn.exe PID 760 wrote to memory of 3384 760 tnhbtn.exe jvddd.exe PID 760 wrote to memory of 3384 760 tnhbtn.exe jvddd.exe PID 760 wrote to memory of 3384 760 tnhbtn.exe jvddd.exe PID 3384 wrote to memory of 1788 3384 jvddd.exe ntbbtt.exe PID 3384 wrote to memory of 1788 3384 jvddd.exe ntbbtt.exe PID 3384 wrote to memory of 1788 3384 jvddd.exe ntbbtt.exe PID 1788 wrote to memory of 3244 1788 ntbbtt.exe rlfxrxr.exe PID 1788 wrote to memory of 3244 1788 ntbbtt.exe rlfxrxr.exe PID 1788 wrote to memory of 3244 1788 ntbbtt.exe rlfxrxr.exe PID 3244 wrote to memory of 1080 3244 rlfxrxr.exe bnnhbt.exe PID 3244 wrote to memory of 1080 3244 rlfxrxr.exe bnnhbt.exe PID 3244 wrote to memory of 1080 3244 rlfxrxr.exe bnnhbt.exe PID 1080 wrote to memory of 2164 1080 bnnhbt.exe dddjp.exe PID 1080 wrote to memory of 2164 1080 bnnhbt.exe dddjp.exe PID 1080 wrote to memory of 2164 1080 bnnhbt.exe dddjp.exe PID 2164 wrote to memory of 4676 2164 dddjp.exe fxfllxx.exe PID 2164 wrote to memory of 4676 2164 dddjp.exe fxfllxx.exe PID 2164 wrote to memory of 4676 2164 dddjp.exe fxfllxx.exe PID 4676 wrote to memory of 2596 4676 fxfllxx.exe bhhnht.exe PID 4676 wrote to memory of 2596 4676 fxfllxx.exe bhhnht.exe PID 4676 wrote to memory of 2596 4676 fxfllxx.exe bhhnht.exe PID 2596 wrote to memory of 4992 2596 bhhnht.exe 7jpjp.exe PID 2596 wrote to memory of 4992 2596 bhhnht.exe 7jpjp.exe PID 2596 wrote to memory of 4992 2596 bhhnht.exe 7jpjp.exe PID 4992 wrote to memory of 5068 4992 7jpjp.exe fxrlffx.exe PID 4992 wrote to memory of 5068 4992 7jpjp.exe fxrlffx.exe PID 4992 wrote to memory of 5068 4992 7jpjp.exe fxrlffx.exe PID 5068 wrote to memory of 3460 5068 fxrlffx.exe bhbtnn.exe PID 5068 wrote to memory of 3460 5068 fxrlffx.exe bhbtnn.exe PID 5068 wrote to memory of 3460 5068 fxrlffx.exe bhbtnn.exe PID 3460 wrote to memory of 2668 3460 bhbtnn.exe 5xfxxff.exe PID 3460 wrote to memory of 2668 3460 bhbtnn.exe 5xfxxff.exe PID 3460 wrote to memory of 2668 3460 bhbtnn.exe 5xfxxff.exe PID 2668 wrote to memory of 4484 2668 5xfxxff.exe bbhbtn.exe PID 2668 wrote to memory of 4484 2668 5xfxxff.exe bbhbtn.exe PID 2668 wrote to memory of 4484 2668 5xfxxff.exe bbhbtn.exe PID 4484 wrote to memory of 1112 4484 bbhbtn.exe rrrrfxr.exe PID 4484 wrote to memory of 1112 4484 bbhbtn.exe rrrrfxr.exe PID 4484 wrote to memory of 1112 4484 bbhbtn.exe rrrrfxr.exe PID 1112 wrote to memory of 2236 1112 rrrrfxr.exe 7rrfxxr.exe PID 1112 wrote to memory of 2236 1112 rrrrfxr.exe 7rrfxxr.exe PID 1112 wrote to memory of 2236 1112 rrrrfxr.exe 7rrfxxr.exe PID 2236 wrote to memory of 2008 2236 7rrfxxr.exe thnttb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe"C:\Users\Admin\AppData\Local\Temp\07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\dppvv.exec:\dppvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\nttnhb.exec:\nttnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\fxlffff.exec:\fxlffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\1bhhbh.exec:\1bhhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\bnbttt.exec:\bnbttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\rllfxxr.exec:\rllfxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\tnhbtn.exec:\tnhbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\jvddd.exec:\jvddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\ntbbtt.exec:\ntbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\rlfxrxr.exec:\rlfxrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\bnnhbt.exec:\bnnhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\dddjp.exec:\dddjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\fxfllxx.exec:\fxfllxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\bhhnht.exec:\bhhnht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\7jpjp.exec:\7jpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\fxrlffx.exec:\fxrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\bhbtnn.exec:\bhbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\5xfxxff.exec:\5xfxxff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bbhbtn.exec:\bbhbtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\rrrrfxr.exec:\rrrrfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\7rrfxxr.exec:\7rrfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\thnttb.exec:\thnttb.exe23⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jjpjp.exec:\jjpjp.exe24⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nhntbn.exec:\nhntbn.exe25⤵
- Executes dropped EXE
PID:1132 -
\??\c:\djjdd.exec:\djjdd.exe26⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lxfflfx.exec:\lxfflfx.exe27⤵
- Executes dropped EXE
PID:876 -
\??\c:\5ntnhh.exec:\5ntnhh.exe28⤵
- Executes dropped EXE
PID:4888 -
\??\c:\vppjd.exec:\vppjd.exe29⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jvvpj.exec:\jvvpj.exe30⤵
- Executes dropped EXE
PID:3664 -
\??\c:\xlxrlll.exec:\xlxrlll.exe31⤵
- Executes dropped EXE
PID:3984 -
\??\c:\vvpjj.exec:\vvpjj.exe32⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xllffxx.exec:\xllffxx.exe33⤵
- Executes dropped EXE
PID:3676 -
\??\c:\1tnhtt.exec:\1tnhtt.exe34⤵
- Executes dropped EXE
PID:4092 -
\??\c:\rxfflfl.exec:\rxfflfl.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\bnhnnt.exec:\bnhnnt.exe36⤵
- Executes dropped EXE
PID:960 -
\??\c:\xrrlfff.exec:\xrrlfff.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\bbhbbb.exec:\bbhbbb.exe38⤵
- Executes dropped EXE
PID:800 -
\??\c:\flllfxx.exec:\flllfxx.exe39⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tnbnbt.exec:\tnbnbt.exe40⤵
- Executes dropped EXE
PID:3232 -
\??\c:\ppvpv.exec:\ppvpv.exe41⤵
- Executes dropped EXE
PID:1096 -
\??\c:\hhttht.exec:\hhttht.exe42⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pdvvv.exec:\pdvvv.exe43⤵
- Executes dropped EXE
PID:4076 -
\??\c:\xrfxfrr.exec:\xrfxfrr.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1376 -
\??\c:\btthbb.exec:\btthbb.exe45⤵
- Executes dropped EXE
PID:3872 -
\??\c:\7lrxlxr.exec:\7lrxlxr.exe46⤵
- Executes dropped EXE
PID:4184 -
\??\c:\btnnhh.exec:\btnnhh.exe47⤵
- Executes dropped EXE
PID:340 -
\??\c:\7pvpp.exec:\7pvpp.exe48⤵
- Executes dropped EXE
PID:4384 -
\??\c:\xfrxrrl.exec:\xfrxrrl.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tttnnh.exec:\tttnnh.exe50⤵
- Executes dropped EXE
PID:468 -
\??\c:\5lrrlxx.exec:\5lrrlxx.exe51⤵
- Executes dropped EXE
PID:2768 -
\??\c:\tnbtbh.exec:\tnbtbh.exe52⤵
- Executes dropped EXE
PID:1868 -
\??\c:\bttbtt.exec:\bttbtt.exe53⤵
- Executes dropped EXE
PID:4228 -
\??\c:\vvjjd.exec:\vvjjd.exe54⤵
- Executes dropped EXE
PID:4916 -
\??\c:\rlrllll.exec:\rlrllll.exe55⤵
- Executes dropped EXE
PID:4900 -
\??\c:\tttntn.exec:\tttntn.exe56⤵
- Executes dropped EXE
PID:4444 -
\??\c:\5vvpj.exec:\5vvpj.exe57⤵
- Executes dropped EXE
PID:1124 -
\??\c:\llrlflf.exec:\llrlflf.exe58⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bhnhbt.exec:\bhnhbt.exe59⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jdvvp.exec:\jdvvp.exe60⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rxlffll.exec:\rxlffll.exe61⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lflfxrr.exec:\lflfxrr.exe62⤵
- Executes dropped EXE
PID:3368 -
\??\c:\3ntnnt.exec:\3ntnnt.exe63⤵
- Executes dropped EXE
PID:1208 -
\??\c:\1jvpv.exec:\1jvpv.exe64⤵
- Executes dropped EXE
PID:328 -
\??\c:\rlxxrlf.exec:\rlxxrlf.exe65⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nbhhhh.exec:\nbhhhh.exe66⤵PID:2500
-
\??\c:\dvddv.exec:\dvddv.exe67⤵PID:4676
-
\??\c:\1jdvp.exec:\1jdvp.exe68⤵PID:1088
-
\??\c:\ttbttb.exec:\ttbttb.exe69⤵PID:2000
-
\??\c:\jvpjj.exec:\jvpjj.exe70⤵PID:4464
-
\??\c:\rflrxxx.exec:\rflrxxx.exe71⤵PID:2028
-
\??\c:\nhhbhh.exec:\nhhbhh.exe72⤵PID:1936
-
\??\c:\tnhhhh.exec:\tnhhhh.exe73⤵PID:5096
-
\??\c:\vvdvv.exec:\vvdvv.exe74⤵PID:4024
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe75⤵PID:4484
-
\??\c:\1htnnt.exec:\1htnnt.exe76⤵PID:4608
-
\??\c:\9vdvp.exec:\9vdvp.exe77⤵PID:112
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe78⤵PID:2280
-
\??\c:\nnnttt.exec:\nnnttt.exe79⤵PID:208
-
\??\c:\jvvjd.exec:\jvvjd.exe80⤵PID:1004
-
\??\c:\xrrrlll.exec:\xrrrlll.exe81⤵PID:2348
-
\??\c:\lrfffxf.exec:\lrfffxf.exe82⤵PID:2632
-
\??\c:\bbbttt.exec:\bbbttt.exe83⤵PID:432
-
\??\c:\vvjdv.exec:\vvjdv.exe84⤵PID:2244
-
\??\c:\jvvvp.exec:\jvvvp.exe85⤵PID:4864
-
\??\c:\fxxxrrf.exec:\fxxxrrf.exe86⤵PID:4352
-
\??\c:\bthnhh.exec:\bthnhh.exe87⤵PID:1196
-
\??\c:\5ppjp.exec:\5ppjp.exe88⤵PID:3676
-
\??\c:\djppj.exec:\djppj.exe89⤵PID:380
-
\??\c:\9rxrllf.exec:\9rxrllf.exe90⤵PID:1712
-
\??\c:\bnhhbb.exec:\bnhhbb.exe91⤵PID:2168
-
\??\c:\jjvpp.exec:\jjvpp.exe92⤵PID:4744
-
\??\c:\xrrlffx.exec:\xrrlffx.exe93⤵PID:2528
-
\??\c:\nthbnn.exec:\nthbnn.exe94⤵PID:2832
-
\??\c:\9bbtnb.exec:\9bbtnb.exe95⤵PID:2300
-
\??\c:\pjjpp.exec:\pjjpp.exe96⤵PID:1724
-
\??\c:\rrlxrff.exec:\rrlxrff.exe97⤵PID:3752
-
\??\c:\bnbnhh.exec:\bnbnhh.exe98⤵PID:3396
-
\??\c:\1pvvd.exec:\1pvvd.exe99⤵PID:2032
-
\??\c:\xfrfxxx.exec:\xfrfxxx.exe100⤵PID:3872
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe101⤵PID:4184
-
\??\c:\bhbhht.exec:\bhbhht.exe102⤵PID:340
-
\??\c:\ddpjv.exec:\ddpjv.exe103⤵PID:668
-
\??\c:\xfffxxr.exec:\xfffxxr.exe104⤵PID:3296
-
\??\c:\hhtbht.exec:\hhtbht.exe105⤵PID:2304
-
\??\c:\jvppj.exec:\jvppj.exe106⤵PID:2768
-
\??\c:\rllllll.exec:\rllllll.exe107⤵PID:3484
-
\??\c:\htbbth.exec:\htbbth.exe108⤵PID:4720
-
\??\c:\5btnhb.exec:\5btnhb.exe109⤵PID:4984
-
\??\c:\jvdjj.exec:\jvdjj.exe110⤵PID:2780
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe111⤵PID:968
-
\??\c:\tnbntt.exec:\tnbntt.exe112⤵PID:4264
-
\??\c:\vpppj.exec:\vpppj.exe113⤵
- System Location Discovery: System Language Discovery
PID:760 -
\??\c:\rlllffl.exec:\rlllffl.exe114⤵PID:4500
-
\??\c:\tbnhtb.exec:\tbnhtb.exe115⤵PID:5052
-
\??\c:\htnhbh.exec:\htnhbh.exe116⤵PID:3824
-
\??\c:\dvjvp.exec:\dvjvp.exe117⤵PID:2324
-
\??\c:\rfffxxx.exec:\rfffxxx.exe118⤵PID:3904
-
\??\c:\nttnnn.exec:\nttnnn.exe119⤵PID:4960
-
\??\c:\jpvpj.exec:\jpvpj.exe120⤵PID:1776
-
\??\c:\1dvvv.exec:\1dvvv.exe121⤵PID:4940
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe122⤵PID:1880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-