Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 19:23
Static task
static1
Behavioral task
behavioral1
Sample
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe
Resource
win7-20241010-en
General
-
Target
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe
-
Size
454KB
-
MD5
9bdb9371d4f5c81e0ef03e158e84187a
-
SHA1
141c1d690291866191ac63c41781e05f2c9c5b8e
-
SHA256
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd
-
SHA512
0d245da98d0686a80f3b988a64b56828bf7bb164c2e6ec3ea025affa7fdeb7b148f7964eb3ab8bc77896d419bece48d37e470fc67fea749b9c0a396743c57121
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbecr:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4240-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-885-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-913-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-975-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhhbtt.exeddpjv.exe1jjdj.exerflfxxr.exethnbnn.exevppjd.exedvdvj.exeppvpj.exerfllfff.exejjvvp.exe1bnhbh.exepjjdv.exehbnhnn.exelrrlfff.exefxlrrxx.exe9btnhh.exevjvpp.exepvjdv.exefxffxfx.exedpvpp.exetbnnnb.exevpjvp.exefxfxxxx.exepjddj.exelxflffr.exevvjjp.exerlrllrr.exerrxxxxx.exetntttb.exellxfflr.exepppjj.exehhnttb.exedjvdd.exerrllrrf.exetbbhhn.exevpjdp.exexrrllff.exetnbbhb.exepjvpp.exexxxrxxf.exethhhhh.exentntnt.exeddvvp.exelxfffll.exexxffffl.exenbhbbb.exe3djpv.exexrfxxll.exennhnbb.exevpvpj.exefrfrllf.exebnbhtb.exevpjdv.exelfrrxxf.exefflllrr.exetthntt.exedpjjp.exefxfxrrl.exehhbhnt.exejvppp.exedjjdj.exerxrllrr.exetbhbhn.exepvjpj.exepid process 4240 nhhbtt.exe 4228 ddpjv.exe 2408 1jjdj.exe 2384 rflfxxr.exe 3164 thnbnn.exe 3820 vppjd.exe 3172 dvdvj.exe 2644 ppvpj.exe 4756 rfllfff.exe 3340 jjvvp.exe 1392 1bnhbh.exe 3024 pjjdv.exe 2180 hbnhnn.exe 4792 lrrlfff.exe 3048 fxlrrxx.exe 3084 9btnhh.exe 2544 vjvpp.exe 3000 pvjdv.exe 3280 fxffxfx.exe 4072 dpvpp.exe 3120 tbnnnb.exe 4024 vpjvp.exe 1784 fxfxxxx.exe 1492 pjddj.exe 4844 lxflffr.exe 1720 vvjjp.exe 1196 rlrllrr.exe 1052 rrxxxxx.exe 1200 tntttb.exe 2808 llxfflr.exe 2668 pppjj.exe 4980 hhnttb.exe 936 djvdd.exe 4940 rrllrrf.exe 5004 tbbhhn.exe 1092 vpjdp.exe 2356 xrrllff.exe 3540 tnbbhb.exe 3276 pjvpp.exe 1148 xxxrxxf.exe 4876 thhhhh.exe 3572 ntntnt.exe 3980 ddvvp.exe 224 lxfffll.exe 4452 xxffffl.exe 4464 nbhbbb.exe 2452 3djpv.exe 1652 xrfxxll.exe 2460 nnhnbb.exe 4124 vpvpj.exe 3268 frfrllf.exe 2984 bnbhtb.exe 1800 vpjdv.exe 4312 lfrrxxf.exe 2484 fflllrr.exe 1816 tthntt.exe 2704 dpjjp.exe 1928 fxfxrrl.exe 3324 hhbhnt.exe 1296 jvppp.exe 456 djjdj.exe 2056 rxrllrr.exe 3592 tbhbhn.exe 4796 pvjpj.exe -
Processes:
resource yara_rule behavioral2/memory/4240-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-818-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bhnnhh.exefllrrxl.exenhhhhh.exevjvpp.exevpppd.exedpvpj.exetnbhhn.exepjppj.exebthhbh.exerflrxff.exebhnhbh.exedpvdv.exevjvpp.exerrrfxlf.exellfrrlr.exennbhnt.exe5bbhhh.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exenhhbtt.exeddpjv.exe1jjdj.exerflfxxr.exethnbnn.exevppjd.exedvdvj.exeppvpj.exerfllfff.exejjvvp.exe1bnhbh.exepjjdv.exehbnhnn.exelrrlfff.exefxlrrxx.exe9btnhh.exevjvpp.exepvjdv.exefxffxfx.exedpvpp.exetbnnnb.exedescription pid process target process PID 2452 wrote to memory of 4240 2452 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe nhhbtt.exe PID 2452 wrote to memory of 4240 2452 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe nhhbtt.exe PID 2452 wrote to memory of 4240 2452 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe nhhbtt.exe PID 4240 wrote to memory of 4228 4240 nhhbtt.exe ddpjv.exe PID 4240 wrote to memory of 4228 4240 nhhbtt.exe ddpjv.exe PID 4240 wrote to memory of 4228 4240 nhhbtt.exe ddpjv.exe PID 4228 wrote to memory of 2408 4228 ddpjv.exe 1jjdj.exe PID 4228 wrote to memory of 2408 4228 ddpjv.exe 1jjdj.exe PID 4228 wrote to memory of 2408 4228 ddpjv.exe 1jjdj.exe PID 2408 wrote to memory of 2384 2408 1jjdj.exe rflfxxr.exe PID 2408 wrote to memory of 2384 2408 1jjdj.exe rflfxxr.exe PID 2408 wrote to memory of 2384 2408 1jjdj.exe rflfxxr.exe PID 2384 wrote to memory of 3164 2384 rflfxxr.exe thnbnn.exe PID 2384 wrote to memory of 3164 2384 rflfxxr.exe thnbnn.exe PID 2384 wrote to memory of 3164 2384 rflfxxr.exe thnbnn.exe PID 3164 wrote to memory of 3820 3164 thnbnn.exe vppjd.exe PID 3164 wrote to memory of 3820 3164 thnbnn.exe vppjd.exe PID 3164 wrote to memory of 3820 3164 thnbnn.exe vppjd.exe PID 3820 wrote to memory of 3172 3820 vppjd.exe dvdvj.exe PID 3820 wrote to memory of 3172 3820 vppjd.exe dvdvj.exe PID 3820 wrote to memory of 3172 3820 vppjd.exe dvdvj.exe PID 3172 wrote to memory of 2644 3172 dvdvj.exe ppvpj.exe PID 3172 wrote to memory of 2644 3172 dvdvj.exe ppvpj.exe PID 3172 wrote to memory of 2644 3172 dvdvj.exe ppvpj.exe PID 2644 wrote to memory of 4756 2644 ppvpj.exe rfllfff.exe PID 2644 wrote to memory of 4756 2644 ppvpj.exe rfllfff.exe PID 2644 wrote to memory of 4756 2644 ppvpj.exe rfllfff.exe PID 4756 wrote to memory of 3340 4756 rfllfff.exe jjvvp.exe PID 4756 wrote to memory of 3340 4756 rfllfff.exe jjvvp.exe PID 4756 wrote to memory of 3340 4756 rfllfff.exe jjvvp.exe PID 3340 wrote to memory of 1392 3340 jjvvp.exe 1bnhbh.exe PID 3340 wrote to memory of 1392 3340 jjvvp.exe 1bnhbh.exe PID 3340 wrote to memory of 1392 3340 jjvvp.exe 1bnhbh.exe PID 1392 wrote to memory of 3024 1392 1bnhbh.exe pjjdv.exe PID 1392 wrote to memory of 3024 1392 1bnhbh.exe pjjdv.exe PID 1392 wrote to memory of 3024 1392 1bnhbh.exe pjjdv.exe PID 3024 wrote to memory of 2180 3024 pjjdv.exe hbnhnn.exe PID 3024 wrote to memory of 2180 3024 pjjdv.exe hbnhnn.exe PID 3024 wrote to memory of 2180 3024 pjjdv.exe hbnhnn.exe PID 2180 wrote to memory of 4792 2180 hbnhnn.exe lrrlfff.exe PID 2180 wrote to memory of 4792 2180 hbnhnn.exe lrrlfff.exe PID 2180 wrote to memory of 4792 2180 hbnhnn.exe lrrlfff.exe PID 4792 wrote to memory of 3048 4792 lrrlfff.exe fxlrrxx.exe PID 4792 wrote to memory of 3048 4792 lrrlfff.exe fxlrrxx.exe PID 4792 wrote to memory of 3048 4792 lrrlfff.exe fxlrrxx.exe PID 3048 wrote to memory of 3084 3048 fxlrrxx.exe 9btnhh.exe PID 3048 wrote to memory of 3084 3048 fxlrrxx.exe 9btnhh.exe PID 3048 wrote to memory of 3084 3048 fxlrrxx.exe 9btnhh.exe PID 3084 wrote to memory of 2544 3084 9btnhh.exe vjvpp.exe PID 3084 wrote to memory of 2544 3084 9btnhh.exe vjvpp.exe PID 3084 wrote to memory of 2544 3084 9btnhh.exe vjvpp.exe PID 2544 wrote to memory of 3000 2544 vjvpp.exe pvjdv.exe PID 2544 wrote to memory of 3000 2544 vjvpp.exe pvjdv.exe PID 2544 wrote to memory of 3000 2544 vjvpp.exe pvjdv.exe PID 3000 wrote to memory of 3280 3000 pvjdv.exe fxffxfx.exe PID 3000 wrote to memory of 3280 3000 pvjdv.exe fxffxfx.exe PID 3000 wrote to memory of 3280 3000 pvjdv.exe fxffxfx.exe PID 3280 wrote to memory of 4072 3280 fxffxfx.exe dpvpp.exe PID 3280 wrote to memory of 4072 3280 fxffxfx.exe dpvpp.exe PID 3280 wrote to memory of 4072 3280 fxffxfx.exe dpvpp.exe PID 4072 wrote to memory of 3120 4072 dpvpp.exe tbnnnb.exe PID 4072 wrote to memory of 3120 4072 dpvpp.exe tbnnnb.exe PID 4072 wrote to memory of 3120 4072 dpvpp.exe tbnnnb.exe PID 3120 wrote to memory of 4024 3120 tbnnnb.exe vpjvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe"C:\Users\Admin\AppData\Local\Temp\07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\nhhbtt.exec:\nhhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\ddpjv.exec:\ddpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\1jjdj.exec:\1jjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\rflfxxr.exec:\rflfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\thnbnn.exec:\thnbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\vppjd.exec:\vppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\dvdvj.exec:\dvdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\ppvpj.exec:\ppvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rfllfff.exec:\rfllfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\jjvvp.exec:\jjvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\1bnhbh.exec:\1bnhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\pjjdv.exec:\pjjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\hbnhnn.exec:\hbnhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\lrrlfff.exec:\lrrlfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\fxlrrxx.exec:\fxlrrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9btnhh.exec:\9btnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\vjvpp.exec:\vjvpp.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\pvjdv.exec:\pvjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\fxffxfx.exec:\fxffxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\dpvpp.exec:\dpvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\tbnnnb.exec:\tbnnnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\vpjvp.exec:\vpjvp.exe23⤵
- Executes dropped EXE
PID:4024 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe24⤵
- Executes dropped EXE
PID:1784 -
\??\c:\pjddj.exec:\pjddj.exe25⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lxflffr.exec:\lxflffr.exe26⤵
- Executes dropped EXE
PID:4844 -
\??\c:\vvjjp.exec:\vvjjp.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rlrllrr.exec:\rlrllrr.exe28⤵
- Executes dropped EXE
PID:1196 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe29⤵
- Executes dropped EXE
PID:1052 -
\??\c:\tntttb.exec:\tntttb.exe30⤵
- Executes dropped EXE
PID:1200 -
\??\c:\llxfflr.exec:\llxfflr.exe31⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pppjj.exec:\pppjj.exe32⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hhnttb.exec:\hhnttb.exe33⤵
- Executes dropped EXE
PID:4980 -
\??\c:\djvdd.exec:\djvdd.exe34⤵
- Executes dropped EXE
PID:936 -
\??\c:\rrllrrf.exec:\rrllrrf.exe35⤵
- Executes dropped EXE
PID:4940 -
\??\c:\tbbhhn.exec:\tbbhhn.exe36⤵
- Executes dropped EXE
PID:5004 -
\??\c:\vpjdp.exec:\vpjdp.exe37⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xrrllff.exec:\xrrllff.exe38⤵
- Executes dropped EXE
PID:2356 -
\??\c:\tnbbhb.exec:\tnbbhb.exe39⤵
- Executes dropped EXE
PID:3540 -
\??\c:\pjvpp.exec:\pjvpp.exe40⤵
- Executes dropped EXE
PID:3276 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe41⤵
- Executes dropped EXE
PID:1148 -
\??\c:\thhhhh.exec:\thhhhh.exe42⤵
- Executes dropped EXE
PID:4876 -
\??\c:\ntntnt.exec:\ntntnt.exe43⤵
- Executes dropped EXE
PID:3572 -
\??\c:\ddvvp.exec:\ddvvp.exe44⤵
- Executes dropped EXE
PID:3980 -
\??\c:\lxfffll.exec:\lxfffll.exe45⤵
- Executes dropped EXE
PID:224 -
\??\c:\xxffffl.exec:\xxffffl.exe46⤵
- Executes dropped EXE
PID:4452 -
\??\c:\nbhbbb.exec:\nbhbbb.exe47⤵
- Executes dropped EXE
PID:4464 -
\??\c:\3djpv.exec:\3djpv.exe48⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xrfxxll.exec:\xrfxxll.exe49⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nnhnbb.exec:\nnhnbb.exe50⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vpvpj.exec:\vpvpj.exe51⤵
- Executes dropped EXE
PID:4124 -
\??\c:\frfrllf.exec:\frfrllf.exe52⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bnbhtb.exec:\bnbhtb.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vpjdv.exec:\vpjdv.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe55⤵
- Executes dropped EXE
PID:4312 -
\??\c:\fflllrr.exec:\fflllrr.exe56⤵
- Executes dropped EXE
PID:2484 -
\??\c:\tthntt.exec:\tthntt.exe57⤵
- Executes dropped EXE
PID:1816 -
\??\c:\dpjjp.exec:\dpjjp.exe58⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hhbhnt.exec:\hhbhnt.exe60⤵
- Executes dropped EXE
PID:3324 -
\??\c:\jvppp.exec:\jvppp.exe61⤵
- Executes dropped EXE
PID:1296 -
\??\c:\djjdj.exec:\djjdj.exe62⤵
- Executes dropped EXE
PID:456 -
\??\c:\rxrllrr.exec:\rxrllrr.exe63⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tbhbhn.exec:\tbhbhn.exe64⤵
- Executes dropped EXE
PID:3592 -
\??\c:\pvjpj.exec:\pvjpj.exe65⤵
- Executes dropped EXE
PID:4796 -
\??\c:\rxrrrfr.exec:\rxrrrfr.exe66⤵PID:1868
-
\??\c:\bbbbnt.exec:\bbbbnt.exe67⤵PID:744
-
\??\c:\vvppj.exec:\vvppj.exe68⤵PID:4180
-
\??\c:\vddpp.exec:\vddpp.exe69⤵PID:4168
-
\??\c:\fflllrr.exec:\fflllrr.exe70⤵PID:2860
-
\??\c:\tnbtnt.exec:\tnbtnt.exe71⤵PID:3992
-
\??\c:\bhnttb.exec:\bhnttb.exe72⤵PID:2024
-
\??\c:\ddppp.exec:\ddppp.exe73⤵PID:1464
-
\??\c:\llxxffl.exec:\llxxffl.exe74⤵PID:4368
-
\??\c:\nnhbbh.exec:\nnhbbh.exe75⤵PID:4828
-
\??\c:\dpdpp.exec:\dpdpp.exe76⤵PID:3916
-
\??\c:\xrrlffx.exec:\xrrlffx.exe77⤵PID:4976
-
\??\c:\ppvvp.exec:\ppvvp.exe78⤵PID:1388
-
\??\c:\xxxxxff.exec:\xxxxxff.exe79⤵PID:1784
-
\??\c:\hhbhbn.exec:\hhbhbn.exe80⤵PID:4020
-
\??\c:\bttnhb.exec:\bttnhb.exe81⤵PID:4428
-
\??\c:\pjpjd.exec:\pjpjd.exe82⤵PID:4944
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe83⤵PID:2744
-
\??\c:\fxlfrlx.exec:\fxlfrlx.exe84⤵PID:2728
-
\??\c:\5bhbbb.exec:\5bhbbb.exe85⤵PID:5088
-
\??\c:\5pvvd.exec:\5pvvd.exe86⤵PID:740
-
\??\c:\fxrrllf.exec:\fxrrllf.exe87⤵PID:3644
-
\??\c:\hntnth.exec:\hntnth.exe88⤵PID:2808
-
\??\c:\tbbttn.exec:\tbbttn.exe89⤵PID:968
-
\??\c:\jvdvv.exec:\jvdvv.exe90⤵PID:3140
-
\??\c:\rlrlffx.exec:\rlrlffx.exe91⤵PID:2228
-
\??\c:\fxrlflf.exec:\fxrlflf.exe92⤵PID:1016
-
\??\c:\hhtnhn.exec:\hhtnhn.exe93⤵PID:2584
-
\??\c:\9jjpj.exec:\9jjpj.exe94⤵PID:2720
-
\??\c:\llfxxlx.exec:\llfxxlx.exe95⤵PID:4776
-
\??\c:\bbthhh.exec:\bbthhh.exe96⤵PID:1260
-
\??\c:\pjjjv.exec:\pjjjv.exe97⤵PID:4524
-
\??\c:\jjjdv.exec:\jjjdv.exe98⤵PID:4960
-
\??\c:\nnnhnt.exec:\nnnhnt.exe99⤵PID:1796
-
\??\c:\nbnhhh.exec:\nbnhhh.exe100⤵PID:548
-
\??\c:\frxrrrl.exec:\frxrrrl.exe101⤵PID:2880
-
\??\c:\xlxrllf.exec:\xlxrllf.exe102⤵PID:3572
-
\??\c:\thhbbb.exec:\thhbbb.exe103⤵PID:4336
-
\??\c:\vvjjp.exec:\vvjjp.exe104⤵PID:1732
-
\??\c:\3vpjp.exec:\3vpjp.exe105⤵PID:1736
-
\??\c:\3lllfll.exec:\3lllfll.exe106⤵PID:3700
-
\??\c:\tnhbtt.exec:\tnhbtt.exe107⤵PID:1688
-
\??\c:\jvvdd.exec:\jvvdd.exe108⤵PID:4688
-
\??\c:\vjvdd.exec:\vjvdd.exe109⤵PID:3744
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe110⤵PID:3772
-
\??\c:\9nhhbh.exec:\9nhhbh.exe111⤵PID:780
-
\??\c:\jdjjd.exec:\jdjjd.exe112⤵PID:3456
-
\??\c:\vdpjp.exec:\vdpjp.exe113⤵PID:3240
-
\??\c:\jvpdv.exec:\jvpdv.exe114⤵PID:1004
-
\??\c:\ddjjv.exec:\ddjjv.exe115⤵PID:2936
-
\??\c:\xfrrrrl.exec:\xfrrrrl.exe116⤵PID:2376
-
\??\c:\nntnnn.exec:\nntnnn.exe117⤵PID:1124
-
\??\c:\ddjdv.exec:\ddjdv.exe118⤵PID:2368
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe119⤵PID:4756
-
\??\c:\bnnbhb.exec:\bnnbhb.exe120⤵PID:4244
-
\??\c:\7vjdd.exec:\7vjdd.exe121⤵PID:4056
-
\??\c:\fxrxxll.exec:\fxrxxll.exe122⤵PID:812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-