Analysis
-
max time kernel
113s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 11:42
Behavioral task
behavioral1
Sample
514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe
Resource
win7-20240903-en
General
-
Target
514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe
-
Size
371KB
-
MD5
ec3b6afe666a2970bd5b04da0dcfbac0
-
SHA1
0665e788e5fb0c541fd7f991f11b780f025d7689
-
SHA256
514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eef
-
SHA512
94c6a19d1504abaf903cbdea3b411fff9f93fdbf1cb1ccfa2fa2e14eb1730596bd10eda0742c8e910f98c3e68a9492904d66e811af66c4e7776a3474aebcd39f
-
SSDEEP
6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf72:/4wFHoSA4KofHfHTXQLzgvnzHPowYbvd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
Processes:
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2504-20-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2104-31-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2104-40-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1656-51-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2728-71-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1068-122-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2848-121-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1912-176-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2528-182-0x00000000002D0000-0x0000000000330000-memory.dmp family_blackmoon behavioral1/memory/2528-188-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1824-222-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1804-232-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1804-241-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2864-343-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2748-369-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2608-387-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/552-542-0x0000000077410000-0x000000007750A000-memory.dmp family_blackmoon behavioral1/memory/552-541-0x0000000077510000-0x000000007762F000-memory.dmp family_blackmoon behavioral1/memory/2644-395-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2740-378-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2740-377-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2584-360-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2864-351-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2796-342-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2144-333-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1060-314-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1608-304-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/592-289-0x0000000000220000-0x0000000000280000-memory.dmp family_blackmoon behavioral1/memory/592-294-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1544-283-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/924-272-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1304-261-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1628-251-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1824-231-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1824-229-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1016-220-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1016-218-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2212-209-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2408-199-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2408-192-0x0000000000220000-0x0000000000280000-memory.dmp family_blackmoon behavioral1/memory/2528-179-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2564-164-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2636-153-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1960-143-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1068-131-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2620-110-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2740-95-0x0000000000220000-0x0000000000280000-memory.dmp family_blackmoon behavioral1/memory/2748-90-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2584-79-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2584-78-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2768-61-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2104-38-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2504-30-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2656-18-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bhtnnt.exedjjpd.exefxrxrrx.exefrxxflx.exeddpvv.exedpjvp.exelxxrxrr.exe3thhnn.exetnnbnb.exefflrxrf.exebhbhbh.exe3djjj.exe5xffxlf.exehtnnnn.exejjdjv.exebtnbtb.exejdvpj.exefrflfrf.exe5fxlxfr.exetthbtb.exedvpvj.exefxrxfrx.exetnbtbb.exejvpjd.exerfrffrx.exe1nhbth.exerllrffr.exepjddj.exexxlffrx.exe1pjvd.exefxflllr.exebbbtbh.exebthnbb.exe1ppvp.exefxlrrxf.exe7jvvv.exedvppj.exe5llflxx.exe3hbhbh.exe1dvdv.exexxlrflx.exe1frrxlr.exenntnht.exefrlfxfx.exerllxrxf.exenhbhnt.exejdvjv.exejdjvj.exeffflflr.exetnhtbt.exebttttt.exeppjjp.exejdpvj.exelfrxllx.exe7fxxfrx.exebnbhhh.exevpdpd.exefxxfrlx.exe5rxxrxx.exethhtbn.exe7vvjj.exedvjvp.exerlxflrf.exerrlfrrx.exepid Process 2656 bhtnnt.exe 2504 djjpd.exe 2104 fxrxrrx.exe 1656 frxxflx.exe 2768 ddpvv.exe 2728 dpjvp.exe 2584 lxxrxrr.exe 2748 3thhnn.exe 2740 tnnbnb.exe 2620 fflrxrf.exe 2848 bhbhbh.exe 1068 3djjj.exe 1960 5xffxlf.exe 2636 htnnnn.exe 2564 jjdjv.exe 1912 btnbtb.exe 2528 jdvpj.exe 2408 frflfrf.exe 2212 5fxlxfr.exe 1016 tthbtb.exe 1824 dvpvj.exe 1804 fxrxfrx.exe 1628 tnbtbb.exe 1304 jvpjd.exe 924 rfrffrx.exe 1544 1nhbth.exe 592 rllrffr.exe 1608 pjddj.exe 1060 xxlffrx.exe 2520 1pjvd.exe 2144 fxflllr.exe 2796 bbbtbh.exe 2864 bthnbb.exe 2584 1ppvp.exe 2748 fxlrrxf.exe 2740 7jvvv.exe 2608 dvppj.exe 2644 5llflxx.exe 3024 3hbhbh.exe 1960 1dvdv.exe 2808 xxlrflx.exe 1976 1frrxlr.exe 3060 nntnht.exe 2436 frlfxfx.exe 2216 rllxrxf.exe 2004 nhbhnt.exe 2264 jdvjv.exe 2188 jdjvj.exe 2928 ffflflr.exe 2976 tnhtbt.exe 1824 bttttt.exe 844 ppjjp.exe 2300 jdpvj.exe 996 lfrxllx.exe 2448 7fxxfrx.exe 2308 bnbhhh.exe 552 vpdpd.exe 2332 fxxfrlx.exe 2924 5rxxrxx.exe 1060 thhtbn.exe 2784 7vvjj.exe 1056 dvjvp.exe 2728 rlxflrf.exe 2864 rrlfrrx.exe -
Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
Processes:
resource yara_rule behavioral1/files/0x00080000000120ff-5.dat molebox behavioral1/files/0x0008000000018d68-21.dat molebox behavioral1/files/0x0008000000019030-32.dat molebox behavioral1/files/0x000700000001920f-42.dat molebox behavioral1/files/0x0006000000019234-50.dat molebox behavioral1/files/0x00070000000192f0-82.dat molebox behavioral1/files/0x00070000000194da-92.dat molebox behavioral1/files/0x000500000001a061-102.dat molebox behavioral1/files/0x000500000001a2e7-123.dat molebox behavioral1/files/0x000500000001a41a-145.dat molebox behavioral1/files/0x000500000001a41d-177.dat molebox behavioral1/files/0x000500000001a455-212.dat molebox behavioral1/files/0x000500000001a497-263.dat molebox behavioral1/files/0x000500000001a4a0-275.dat molebox behavioral1/files/0x000500000001a4a2-286.dat molebox behavioral1/files/0x000500000001a4a8-297.dat molebox behavioral1/files/0x000500000001a4ac-307.dat molebox behavioral1/files/0x000500000001a4b3-335.dat molebox behavioral1/files/0x000500000001a4b1-325.dat molebox behavioral1/files/0x000500000001a4af-317.dat molebox behavioral1/files/0x000500000001a48a-253.dat molebox behavioral1/files/0x000500000001a486-243.dat molebox behavioral1/files/0x000500000001a478-233.dat molebox behavioral1/files/0x000500000001a477-221.dat molebox behavioral1/files/0x0007000000018761-201.dat molebox behavioral1/files/0x000500000001a41e-189.dat molebox behavioral1/files/0x000500000001a41c-167.dat molebox behavioral1/files/0x000500000001a41b-157.dat molebox behavioral1/files/0x000500000001a325-134.dat molebox behavioral1/files/0x000500000001a08a-112.dat molebox behavioral1/files/0x000600000001925c-72.dat molebox behavioral1/files/0x0006000000019241-63.dat molebox -
Processes:
resource yara_rule behavioral1/memory/2364-0-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x00080000000120ff-5.dat upx behavioral1/memory/2656-12-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2364-8-0x0000000000220000-0x0000000000280000-memory.dmp upx behavioral1/memory/2364-7-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x0008000000018d68-21.dat upx behavioral1/memory/2504-20-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x0008000000019030-32.dat upx behavioral1/memory/2104-31-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1656-41-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2104-40-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x000700000001920f-42.dat upx behavioral1/memory/1656-51-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x0006000000019234-50.dat upx behavioral1/memory/2728-71-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x00070000000192f0-82.dat upx behavioral1/memory/2748-81-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x00070000000194da-92.dat upx behavioral1/files/0x000500000001a061-102.dat upx behavioral1/memory/2620-101-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x000500000001a2e7-123.dat upx behavioral1/memory/1068-122-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2848-121-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1960-137-0x00000000002C0000-0x0000000000320000-memory.dmp upx behavioral1/files/0x000500000001a41a-145.dat upx behavioral1/memory/2636-144-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1912-166-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x000500000001a41d-177.dat upx behavioral1/memory/1912-176-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2528-188-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x000500000001a455-212.dat upx behavioral1/memory/1824-222-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1804-232-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1804-241-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1304-252-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x000500000001a497-263.dat upx behavioral1/files/0x000500000001a4a0-275.dat upx behavioral1/memory/592-285-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x000500000001a4a2-286.dat upx behavioral1/files/0x000500000001a4a8-297.dat upx behavioral1/files/0x000500000001a4ac-307.dat upx behavioral1/memory/1060-306-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2144-328-0x0000000000270000-0x00000000002D0000-memory.dmp upx behavioral1/memory/2864-343-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2584-352-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2748-361-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2748-369-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2608-387-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1960-411-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2608-382-0x0000000000220000-0x0000000000280000-memory.dmp upx behavioral1/memory/2608-379-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2740-378-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2740-377-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2740-376-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2740-372-0x0000000000220000-0x0000000000280000-memory.dmp upx behavioral1/memory/2748-364-0x0000000000220000-0x0000000000280000-memory.dmp upx behavioral1/memory/2584-360-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2584-358-0x00000000002D0000-0x0000000000330000-memory.dmp upx behavioral1/memory/2864-351-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2864-350-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2864-346-0x00000000002C0000-0x0000000000320000-memory.dmp upx behavioral1/memory/2796-342-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x000500000001a4b3-335.dat upx behavioral1/memory/2144-333-0x0000000000400000-0x0000000000460000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
xxffrxl.exellllfll.exedvpdp.exedvpvj.exejdjpj.exefrflxlx.exehttbhn.exevpjpv.exerlffffr.exebtntnn.exeppjjp.exevppvp.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exebhtnnt.exedjjpd.exefxrxrrx.exefrxxflx.exeddpvv.exedpjvp.exelxxrxrr.exe3thhnn.exetnnbnb.exefflrxrf.exebhbhbh.exe3djjj.exe5xffxlf.exehtnnnn.exejjdjv.exedescription pid Process procid_target PID 2364 wrote to memory of 2656 2364 514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe 30 PID 2364 wrote to memory of 2656 2364 514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe 30 PID 2364 wrote to memory of 2656 2364 514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe 30 PID 2364 wrote to memory of 2656 2364 514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe 30 PID 2656 wrote to memory of 2504 2656 bhtnnt.exe 31 PID 2656 wrote to memory of 2504 2656 bhtnnt.exe 31 PID 2656 wrote to memory of 2504 2656 bhtnnt.exe 31 PID 2656 wrote to memory of 2504 2656 bhtnnt.exe 31 PID 2504 wrote to memory of 2104 2504 djjpd.exe 32 PID 2504 wrote to memory of 2104 2504 djjpd.exe 32 PID 2504 wrote to memory of 2104 2504 djjpd.exe 32 PID 2504 wrote to memory of 2104 2504 djjpd.exe 32 PID 2104 wrote to memory of 1656 2104 fxrxrrx.exe 33 PID 2104 wrote to memory of 1656 2104 fxrxrrx.exe 33 PID 2104 wrote to memory of 1656 2104 fxrxrrx.exe 33 PID 2104 wrote to memory of 1656 2104 fxrxrrx.exe 33 PID 1656 wrote to memory of 2768 1656 frxxflx.exe 34 PID 1656 wrote to memory of 2768 1656 frxxflx.exe 34 PID 1656 wrote to memory of 2768 1656 frxxflx.exe 34 PID 1656 wrote to memory of 2768 1656 frxxflx.exe 34 PID 2768 wrote to memory of 2728 2768 ddpvv.exe 35 PID 2768 wrote to memory of 2728 2768 ddpvv.exe 35 PID 2768 wrote to memory of 2728 2768 ddpvv.exe 35 PID 2768 wrote to memory of 2728 2768 ddpvv.exe 35 PID 2728 wrote to memory of 2584 2728 dpjvp.exe 36 PID 2728 wrote to memory of 2584 2728 dpjvp.exe 36 PID 2728 wrote to memory of 2584 2728 dpjvp.exe 36 PID 2728 wrote to memory of 2584 2728 dpjvp.exe 36 PID 2584 wrote to memory of 2748 2584 lxxrxrr.exe 37 PID 2584 wrote to memory of 2748 2584 lxxrxrr.exe 37 PID 2584 wrote to memory of 2748 2584 lxxrxrr.exe 37 PID 2584 wrote to memory of 2748 2584 lxxrxrr.exe 37 PID 2748 wrote to memory of 2740 2748 3thhnn.exe 66 PID 2748 wrote to memory of 2740 2748 3thhnn.exe 66 PID 2748 wrote to memory of 2740 2748 3thhnn.exe 66 PID 2748 wrote to memory of 2740 2748 3thhnn.exe 66 PID 2740 wrote to memory of 2620 2740 tnnbnb.exe 39 PID 2740 wrote to memory of 2620 2740 tnnbnb.exe 39 PID 2740 wrote to memory of 2620 2740 tnnbnb.exe 39 PID 2740 wrote to memory of 2620 2740 tnnbnb.exe 39 PID 2620 wrote to memory of 2848 2620 fflrxrf.exe 40 PID 2620 wrote to memory of 2848 2620 fflrxrf.exe 40 PID 2620 wrote to memory of 2848 2620 fflrxrf.exe 40 PID 2620 wrote to memory of 2848 2620 fflrxrf.exe 40 PID 2848 wrote to memory of 1068 2848 bhbhbh.exe 41 PID 2848 wrote to memory of 1068 2848 bhbhbh.exe 41 PID 2848 wrote to memory of 1068 2848 bhbhbh.exe 41 PID 2848 wrote to memory of 1068 2848 bhbhbh.exe 41 PID 1068 wrote to memory of 1960 1068 3djjj.exe 42 PID 1068 wrote to memory of 1960 1068 3djjj.exe 42 PID 1068 wrote to memory of 1960 1068 3djjj.exe 42 PID 1068 wrote to memory of 1960 1068 3djjj.exe 42 PID 1960 wrote to memory of 2636 1960 5xffxlf.exe 43 PID 1960 wrote to memory of 2636 1960 5xffxlf.exe 43 PID 1960 wrote to memory of 2636 1960 5xffxlf.exe 43 PID 1960 wrote to memory of 2636 1960 5xffxlf.exe 43 PID 2636 wrote to memory of 2564 2636 htnnnn.exe 44 PID 2636 wrote to memory of 2564 2636 htnnnn.exe 44 PID 2636 wrote to memory of 2564 2636 htnnnn.exe 44 PID 2636 wrote to memory of 2564 2636 htnnnn.exe 44 PID 2564 wrote to memory of 1912 2564 jjdjv.exe 45 PID 2564 wrote to memory of 1912 2564 jjdjv.exe 45 PID 2564 wrote to memory of 1912 2564 jjdjv.exe 45 PID 2564 wrote to memory of 1912 2564 jjdjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe"C:\Users\Admin\AppData\Local\Temp\514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\bhtnnt.exec:\bhtnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\djjpd.exec:\djjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\fxrxrrx.exec:\fxrxrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\frxxflx.exec:\frxxflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\ddpvv.exec:\ddpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dpjvp.exec:\dpjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\lxxrxrr.exec:\lxxrxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\3thhnn.exec:\3thhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tnnbnb.exec:\tnnbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\fflrxrf.exec:\fflrxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\bhbhbh.exec:\bhbhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3djjj.exec:\3djjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\5xffxlf.exec:\5xffxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\htnnnn.exec:\htnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jjdjv.exec:\jjdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\btnbtb.exec:\btnbtb.exe17⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jdvpj.exec:\jdvpj.exe18⤵
- Executes dropped EXE
PID:2528 -
\??\c:\frflfrf.exec:\frflfrf.exe19⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5fxlxfr.exec:\5fxlxfr.exe20⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tthbtb.exec:\tthbtb.exe21⤵
- Executes dropped EXE
PID:1016 -
\??\c:\dvpvj.exec:\dvpvj.exe22⤵
- Executes dropped EXE
PID:1824 -
\??\c:\fxrxfrx.exec:\fxrxfrx.exe23⤵
- Executes dropped EXE
PID:1804 -
\??\c:\tnbtbb.exec:\tnbtbb.exe24⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jvpjd.exec:\jvpjd.exe25⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rfrffrx.exec:\rfrffrx.exe26⤵
- Executes dropped EXE
PID:924 -
\??\c:\1nhbth.exec:\1nhbth.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rllrffr.exec:\rllrffr.exe28⤵
- Executes dropped EXE
PID:592 -
\??\c:\pjddj.exec:\pjddj.exe29⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xxlffrx.exec:\xxlffrx.exe30⤵
- Executes dropped EXE
PID:1060 -
\??\c:\1pjvd.exec:\1pjvd.exe31⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fxflllr.exec:\fxflllr.exe32⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bbbtbh.exec:\bbbtbh.exe33⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bthnbb.exec:\bthnbb.exe34⤵
- Executes dropped EXE
PID:2864 -
\??\c:\1ppvp.exec:\1ppvp.exe35⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7jvvv.exec:\7jvvv.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dvppj.exec:\dvppj.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5llflxx.exec:\5llflxx.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3hbhbh.exec:\3hbhbh.exe40⤵
- Executes dropped EXE
PID:3024 -
\??\c:\1dvdv.exec:\1dvdv.exe41⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xxlrflx.exec:\xxlrflx.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1frrxlr.exec:\1frrxlr.exe43⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nntnht.exec:\nntnht.exe44⤵
- Executes dropped EXE
PID:3060 -
\??\c:\frlfxfx.exec:\frlfxfx.exe45⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rllxrxf.exec:\rllxrxf.exe46⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nhbhnt.exec:\nhbhnt.exe47⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jdvjv.exec:\jdvjv.exe48⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jdjvj.exec:\jdjvj.exe49⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ffflflr.exec:\ffflflr.exe50⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tnhtbt.exec:\tnhtbt.exe51⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bttttt.exec:\bttttt.exe52⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ppjjp.exec:\ppjjp.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:844 -
\??\c:\jdpvj.exec:\jdpvj.exe54⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lfrxllx.exec:\lfrxllx.exe55⤵
- Executes dropped EXE
PID:996 -
\??\c:\7fxxfrx.exec:\7fxxfrx.exe56⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bnbhhh.exec:\bnbhhh.exe57⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpdpd.exec:\vpdpd.exe58⤵
- Executes dropped EXE
PID:552 -
\??\c:\jpjvj.exec:\jpjvj.exe59⤵PID:2164
-
\??\c:\fxxfrlx.exec:\fxxfrlx.exe60⤵
- Executes dropped EXE
PID:2332 -
\??\c:\5rxxrxx.exec:\5rxxrxx.exe61⤵
- Executes dropped EXE
PID:2924 -
\??\c:\thhtbn.exec:\thhtbn.exe62⤵
- Executes dropped EXE
PID:1060 -
\??\c:\7vvjj.exec:\7vvjj.exe63⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dvjvp.exec:\dvjvp.exe64⤵
- Executes dropped EXE
PID:1056 -
\??\c:\rlxflrf.exec:\rlxflrf.exe65⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rrlfrrx.exec:\rrlfrrx.exe66⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tnttbh.exec:\tnttbh.exe67⤵PID:2908
-
\??\c:\ttbhth.exec:\ttbhth.exe68⤵PID:2432
-
\??\c:\ppvdj.exec:\ppvdj.exe69⤵PID:2968
-
\??\c:\jppjv.exec:\jppjv.exe70⤵PID:2708
-
\??\c:\9lxrxlr.exec:\9lxrxlr.exe71⤵PID:2992
-
\??\c:\lfrrllx.exec:\lfrrllx.exe72⤵PID:2744
-
\??\c:\tnhthn.exec:\tnhthn.exe73⤵PID:2128
-
\??\c:\nnnbhh.exec:\nnnbhh.exe74⤵PID:756
-
\??\c:\7vppj.exec:\7vppj.exe75⤵PID:2160
-
\??\c:\vvvvj.exec:\vvvvj.exe76⤵PID:2808
-
\??\c:\rfxxffl.exec:\rfxxffl.exe77⤵PID:760
-
\??\c:\rrffllx.exec:\rrffllx.exe78⤵PID:3004
-
\??\c:\hbbbtt.exec:\hbbbtt.exe79⤵PID:3060
-
\??\c:\jjdpd.exec:\jjdpd.exe80⤵PID:1816
-
\??\c:\pvpjv.exec:\pvpjv.exe81⤵PID:2876
-
\??\c:\lfxfrxx.exec:\lfxfrxx.exe82⤵PID:2260
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe83⤵PID:2208
-
\??\c:\tnhhnn.exec:\tnhhnn.exe84⤵PID:1872
-
\??\c:\nhbbnt.exec:\nhbbnt.exe85⤵PID:1220
-
\??\c:\jddvj.exec:\jddvj.exe86⤵PID:632
-
\??\c:\jjdvd.exec:\jjdvd.exe87⤵PID:1996
-
\??\c:\rlffffr.exec:\rlffffr.exe88⤵
- System Location Discovery: System Language Discovery
PID:352 -
\??\c:\9hntnb.exec:\9hntnb.exe89⤵PID:1824
-
\??\c:\hnttbb.exec:\hnttbb.exe90⤵PID:2428
-
\??\c:\dvdjv.exec:\dvdjv.exe91⤵PID:1156
-
\??\c:\dddvp.exec:\dddvp.exe92⤵PID:964
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe93⤵PID:1972
-
\??\c:\lfxflrx.exec:\lfxflrx.exe94⤵PID:2952
-
\??\c:\thbthn.exec:\thbthn.exe95⤵PID:1952
-
\??\c:\jdvdj.exec:\jdvdj.exe96⤵PID:2288
-
\??\c:\ppddj.exec:\ppddj.exe97⤵PID:448
-
\??\c:\1xlxrfl.exec:\1xlxrfl.exe98⤵PID:2016
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe99⤵PID:2328
-
\??\c:\hbttnn.exec:\hbttnn.exe100⤵PID:3068
-
\??\c:\3bhhnn.exec:\3bhhnn.exe101⤵PID:3052
-
\??\c:\ppdvd.exec:\ppdvd.exe102⤵PID:2720
-
\??\c:\vvvjv.exec:\vvvjv.exe103⤵PID:2488
-
\??\c:\dvppd.exec:\dvppd.exe104⤵PID:1056
-
\??\c:\lllxlfl.exec:\lllxlfl.exe105⤵PID:2920
-
\??\c:\1btthn.exec:\1btthn.exe106⤵PID:2664
-
\??\c:\bttbnb.exec:\bttbnb.exe107⤵PID:2712
-
\??\c:\nbnttt.exec:\nbnttt.exe108⤵PID:2576
-
\??\c:\3jvdp.exec:\3jvdp.exe109⤵PID:1664
-
\??\c:\llxflrf.exec:\llxflrf.exe110⤵PID:2932
-
\??\c:\xfrrrlx.exec:\xfrrrlx.exe111⤵PID:2832
-
\??\c:\nhnnnt.exec:\nhnnnt.exe112⤵PID:2896
-
\??\c:\nbhtbb.exec:\nbhtbb.exe113⤵PID:2872
-
\??\c:\pjjpv.exec:\pjjpv.exe114⤵PID:1944
-
\??\c:\vvjdj.exec:\vvjdj.exe115⤵PID:1960
-
\??\c:\rlxllrx.exec:\rlxllrx.exe116⤵PID:756
-
\??\c:\xxrfxrf.exec:\xxrfxrf.exe117⤵PID:1212
-
\??\c:\tnbhth.exec:\tnbhth.exe118⤵PID:3016
-
\??\c:\bbthth.exec:\bbthth.exe119⤵PID:1788
-
\??\c:\1jpjj.exec:\1jpjj.exe120⤵PID:1768
-
\??\c:\pjppd.exec:\pjppd.exe121⤵PID:2580
-
\??\c:\xfflrlx.exec:\xfflrlx.exe122⤵PID:1440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-