Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 11:42
Behavioral task
behavioral1
Sample
514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe
Resource
win7-20240903-en
General
-
Target
514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe
-
Size
371KB
-
MD5
ec3b6afe666a2970bd5b04da0dcfbac0
-
SHA1
0665e788e5fb0c541fd7f991f11b780f025d7689
-
SHA256
514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eef
-
SHA512
94c6a19d1504abaf903cbdea3b411fff9f93fdbf1cb1ccfa2fa2e14eb1730596bd10eda0742c8e910f98c3e68a9492904d66e811af66c4e7776a3474aebcd39f
-
SSDEEP
6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf72:/4wFHoSA4KofHfHTXQLzgvnzHPowYbvd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1596-6-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4380-13-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4640-21-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4640-15-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2708-27-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2992-33-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5056-43-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3676-47-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1436-56-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/448-63-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/548-62-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/548-57-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/448-67-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4540-69-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4540-77-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1552-86-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5052-111-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4144-130-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2720-263-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4460-285-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4852-305-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3016-353-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4308-374-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3288-370-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5116-365-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4408-362-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4316-358-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/224-350-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/396-345-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5052-342-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1692-338-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2360-333-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1656-330-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4684-326-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/32-320-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2100-317-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5076-312-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4612-309-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3792-301-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2172-297-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1816-292-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1436-288-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3676-280-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3208-277-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2720-270-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3060-265-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2820-261-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4636-256-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2820-254-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1424-252-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2856-247-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4204-244-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4344-239-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2436-236-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1696-231-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3988-227-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4668-221-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1976-218-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4560-213-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2356-207-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4672-200-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1136-194-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1180-187-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3488-180-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rlllxfl.exenhnhhn.exevdjjd.exe3vjjv.exexfxxlfx.exettbhth.exe1jppv.exebnhhtn.exevjvvp.exepppjj.exejvvdj.exefxfxflf.exethhnnh.exe3vvjp.exerlxxxrr.exebttbtn.exejdpdd.exe7llllrr.exe1tbbbb.exejjvpj.exevvjdv.exefxflrxf.exebnhhhn.exe3jpjd.exepdjvj.exerllrlrr.exenhnnhh.exennnnnh.exejpjpv.exerfxxxff.exerxxfflf.exehhnhhb.exejdjdd.exeppjjd.exexxrrrxx.exebbnnnt.exebnbhbn.exe5vpvv.exellllfxr.exehnnhbb.exe1vvpj.exejjpjp.exeflrlfff.exebnbtnn.exepddpv.exerllfxxl.exenbnbht.exebttthb.exevjvdd.exefxxxrrr.exetttttb.exebbbbbn.exeddjjd.exelxfflrx.exelrrllll.exe7nttnt.exejjppv.exejddpj.exerflllll.exehnhnnb.exebttttt.exejdvpp.exe3llrlrr.exerrlflrr.exepid Process 4380 rlllxfl.exe 4640 nhnhhn.exe 2708 vdjjd.exe 2992 3vjjv.exe 5056 xfxxlfx.exe 3676 ttbhth.exe 1436 1jppv.exe 548 bnhhtn.exe 448 vjvvp.exe 4540 pppjj.exe 1552 jvvdj.exe 4684 fxfxflf.exe 664 thhnnh.exe 232 3vvjp.exe 5052 rlxxxrr.exe 4860 bttbtn.exe 1172 jdpdd.exe 4144 7llllrr.exe 3200 1tbbbb.exe 4556 jjvpj.exe 2376 vvjdv.exe 4160 fxflrxf.exe 636 bnhhhn.exe 1868 3jpjd.exe 2412 pdjvj.exe 3488 rllrlrr.exe 1180 nhnnhh.exe 1136 nnnnnh.exe 4672 jpjpv.exe 2356 rfxxxff.exe 4560 rxxfflf.exe 1976 hhnhhb.exe 4668 jdjdd.exe 3988 ppjjd.exe 1696 xxrrrxx.exe 2436 bbnnnt.exe 4344 bnbhbn.exe 4204 5vpvv.exe 2856 llllfxr.exe 1424 hnnhbb.exe 4636 1vvpj.exe 2820 jjpjp.exe 3060 flrlfff.exe 2720 bnbtnn.exe 2660 pddpv.exe 3208 rllfxxl.exe 3676 nbnbht.exe 4460 bttthb.exe 1436 vjvdd.exe 1816 fxxxrrr.exe 2172 tttttb.exe 3792 bbbbbn.exe 4852 ddjjd.exe 4612 lxfflrx.exe 5076 lrrllll.exe 2100 7nttnt.exe 32 jjppv.exe 4684 jddpj.exe 1656 rflllll.exe 2360 hnhnnb.exe 1692 bttttt.exe 5052 jdvpp.exe 396 3llrlrr.exe 224 rrlflrr.exe -
Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
Processes:
resource yara_rule behavioral2/files/0x000c000000023b33-3.dat molebox behavioral2/files/0x000b000000023b8e-10.dat molebox behavioral2/files/0x000a000000023b92-14.dat molebox behavioral2/files/0x000a000000023b94-25.dat molebox behavioral2/files/0x000a000000023b95-31.dat molebox behavioral2/files/0x000a000000023b96-38.dat molebox behavioral2/files/0x000a000000023b97-49.dat molebox behavioral2/files/0x000a000000023b98-52.dat molebox behavioral2/files/0x000a000000023b99-60.dat molebox behavioral2/files/0x000b000000023b8f-68.dat molebox behavioral2/files/0x000a000000023b9b-73.dat molebox behavioral2/files/0x000a000000023b9c-81.dat molebox behavioral2/files/0x000a000000023b9d-90.dat molebox behavioral2/files/0x000a000000023b9f-102.dat molebox behavioral2/files/0x000a000000023ba0-107.dat molebox behavioral2/files/0x000a000000023ba2-120.dat molebox behavioral2/files/0x000a000000023baa-170.dat molebox behavioral2/files/0x000a000000023bb0-209.dat molebox behavioral2/files/0x000a000000023baf-203.dat molebox behavioral2/files/0x000a000000023bae-197.dat molebox behavioral2/files/0x000a000000023bad-190.dat molebox behavioral2/files/0x000a000000023bac-183.dat molebox behavioral2/files/0x000a000000023bab-177.dat molebox behavioral2/files/0x000a000000023ba9-165.dat molebox behavioral2/files/0x000a000000023ba8-159.dat molebox behavioral2/files/0x000a000000023ba7-153.dat molebox behavioral2/files/0x0058000000023ba6-147.dat molebox behavioral2/files/0x000a000000023ba5-140.dat molebox behavioral2/files/0x0031000000023ba4-133.dat molebox behavioral2/files/0x000a000000023ba3-126.dat molebox behavioral2/files/0x000a000000023ba1-114.dat molebox behavioral2/files/0x000a000000023b9e-95.dat molebox -
Processes:
resource yara_rule behavioral2/memory/1596-0-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000c000000023b33-3.dat upx behavioral2/memory/4380-8-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1596-6-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000b000000023b8e-10.dat upx behavioral2/memory/4380-13-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b92-14.dat upx behavioral2/memory/4640-21-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2708-19-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4640-15-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b94-25.dat upx behavioral2/memory/2992-29-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2708-27-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b95-31.dat upx behavioral2/memory/2992-33-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5056-35-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b96-38.dat upx behavioral2/memory/3676-40-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5056-43-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1436-48-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3676-47-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b97-49.dat upx behavioral2/files/0x000a000000023b98-52.dat upx behavioral2/memory/1436-56-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b99-60.dat upx behavioral2/memory/448-63-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/548-62-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/548-57-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/448-67-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000b000000023b8f-68.dat upx behavioral2/memory/4540-69-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b9b-73.dat upx behavioral2/memory/4540-77-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1552-75-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b9c-81.dat upx behavioral2/memory/4684-83-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1552-86-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b9d-90.dat upx behavioral2/memory/232-97-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023b9f-102.dat upx behavioral2/files/0x000a000000023ba0-107.dat upx behavioral2/memory/5052-111-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023ba2-120.dat upx behavioral2/memory/4144-130-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000a000000023baa-170.dat upx behavioral2/memory/2720-263-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4460-285-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4852-305-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3016-353-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4308-374-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3288-370-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5116-365-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4408-362-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4316-358-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/224-350-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/396-345-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5052-342-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1692-338-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2360-333-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1656-330-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4684-326-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1656-323-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/32-320-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2100-317-0x0000000000400000-0x0000000000460000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hbhnnt.exexxxrlll.exe5pvpv.exetbtbbh.exettntnt.exenbhhtt.exejdvvj.exettnnnn.exepdvdd.exe9btttb.exethnhhn.exelxffrfl.exevvjjv.exelrlllfx.exe5jvpp.exe3jjjd.exenhhbbt.exebbbbbn.exe5ffxrxr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exerlllxfl.exenhnhhn.exevdjjd.exe3vjjv.exexfxxlfx.exettbhth.exe1jppv.exebnhhtn.exevjvvp.exepppjj.exejvvdj.exefxfxflf.exethhnnh.exe3vvjp.exerlxxxrr.exebttbtn.exejdpdd.exe7llllrr.exe1tbbbb.exejjvpj.exevvjdv.exedescription pid Process procid_target PID 1596 wrote to memory of 4380 1596 514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe 83 PID 1596 wrote to memory of 4380 1596 514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe 83 PID 1596 wrote to memory of 4380 1596 514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe 83 PID 4380 wrote to memory of 4640 4380 rlllxfl.exe 84 PID 4380 wrote to memory of 4640 4380 rlllxfl.exe 84 PID 4380 wrote to memory of 4640 4380 rlllxfl.exe 84 PID 4640 wrote to memory of 2708 4640 nhnhhn.exe 85 PID 4640 wrote to memory of 2708 4640 nhnhhn.exe 85 PID 4640 wrote to memory of 2708 4640 nhnhhn.exe 85 PID 2708 wrote to memory of 2992 2708 vdjjd.exe 86 PID 2708 wrote to memory of 2992 2708 vdjjd.exe 86 PID 2708 wrote to memory of 2992 2708 vdjjd.exe 86 PID 2992 wrote to memory of 5056 2992 3vjjv.exe 168 PID 2992 wrote to memory of 5056 2992 3vjjv.exe 168 PID 2992 wrote to memory of 5056 2992 3vjjv.exe 168 PID 5056 wrote to memory of 3676 5056 xfxxlfx.exe 129 PID 5056 wrote to memory of 3676 5056 xfxxlfx.exe 129 PID 5056 wrote to memory of 3676 5056 xfxxlfx.exe 129 PID 3676 wrote to memory of 1436 3676 ttbhth.exe 131 PID 3676 wrote to memory of 1436 3676 ttbhth.exe 131 PID 3676 wrote to memory of 1436 3676 ttbhth.exe 131 PID 1436 wrote to memory of 548 1436 1jppv.exe 90 PID 1436 wrote to memory of 548 1436 1jppv.exe 90 PID 1436 wrote to memory of 548 1436 1jppv.exe 90 PID 548 wrote to memory of 448 548 bnhhtn.exe 91 PID 548 wrote to memory of 448 548 bnhhtn.exe 91 PID 548 wrote to memory of 448 548 bnhhtn.exe 91 PID 448 wrote to memory of 4540 448 vjvvp.exe 92 PID 448 wrote to memory of 4540 448 vjvvp.exe 92 PID 448 wrote to memory of 4540 448 vjvvp.exe 92 PID 4540 wrote to memory of 1552 4540 pppjj.exe 178 PID 4540 wrote to memory of 1552 4540 pppjj.exe 178 PID 4540 wrote to memory of 1552 4540 pppjj.exe 178 PID 1552 wrote to memory of 4684 1552 jvvdj.exe 140 PID 1552 wrote to memory of 4684 1552 jvvdj.exe 140 PID 1552 wrote to memory of 4684 1552 jvvdj.exe 140 PID 4684 wrote to memory of 664 4684 fxfxflf.exe 95 PID 4684 wrote to memory of 664 4684 fxfxflf.exe 95 PID 4684 wrote to memory of 664 4684 fxfxflf.exe 95 PID 664 wrote to memory of 232 664 thhnnh.exe 96 PID 664 wrote to memory of 232 664 thhnnh.exe 96 PID 664 wrote to memory of 232 664 thhnnh.exe 96 PID 232 wrote to memory of 5052 232 3vvjp.exe 144 PID 232 wrote to memory of 5052 232 3vvjp.exe 144 PID 232 wrote to memory of 5052 232 3vvjp.exe 144 PID 5052 wrote to memory of 4860 5052 rlxxxrr.exe 98 PID 5052 wrote to memory of 4860 5052 rlxxxrr.exe 98 PID 5052 wrote to memory of 4860 5052 rlxxxrr.exe 98 PID 4860 wrote to memory of 1172 4860 bttbtn.exe 99 PID 4860 wrote to memory of 1172 4860 bttbtn.exe 99 PID 4860 wrote to memory of 1172 4860 bttbtn.exe 99 PID 1172 wrote to memory of 4144 1172 jdpdd.exe 100 PID 1172 wrote to memory of 4144 1172 jdpdd.exe 100 PID 1172 wrote to memory of 4144 1172 jdpdd.exe 100 PID 4144 wrote to memory of 3200 4144 7llllrr.exe 101 PID 4144 wrote to memory of 3200 4144 7llllrr.exe 101 PID 4144 wrote to memory of 3200 4144 7llllrr.exe 101 PID 3200 wrote to memory of 4556 3200 1tbbbb.exe 102 PID 3200 wrote to memory of 4556 3200 1tbbbb.exe 102 PID 3200 wrote to memory of 4556 3200 1tbbbb.exe 102 PID 4556 wrote to memory of 2376 4556 jjvpj.exe 103 PID 4556 wrote to memory of 2376 4556 jjvpj.exe 103 PID 4556 wrote to memory of 2376 4556 jjvpj.exe 103 PID 2376 wrote to memory of 4160 2376 vvjdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe"C:\Users\Admin\AppData\Local\Temp\514e81046dccc5a5b669ffd5b2109519226f85c402c75c013782f6df742f7eefN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\rlllxfl.exec:\rlllxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\nhnhhn.exec:\nhnhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\vdjjd.exec:\vdjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\3vjjv.exec:\3vjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\xfxxlfx.exec:\xfxxlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\ttbhth.exec:\ttbhth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\1jppv.exec:\1jppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\bnhhtn.exec:\bnhhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\vjvvp.exec:\vjvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\pppjj.exec:\pppjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\jvvdj.exec:\jvvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\fxfxflf.exec:\fxfxflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\thhnnh.exec:\thhnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\3vvjp.exec:\3vvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\rlxxxrr.exec:\rlxxxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\bttbtn.exec:\bttbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\jdpdd.exec:\jdpdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\7llllrr.exec:\7llllrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\1tbbbb.exec:\1tbbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\jjvpj.exec:\jjvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\vvjdv.exec:\vvjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\fxflrxf.exec:\fxflrxf.exe23⤵
- Executes dropped EXE
PID:4160 -
\??\c:\bnhhhn.exec:\bnhhhn.exe24⤵
- Executes dropped EXE
PID:636 -
\??\c:\3jpjd.exec:\3jpjd.exe25⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pdjvj.exec:\pdjvj.exe26⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rllrlrr.exec:\rllrlrr.exe27⤵
- Executes dropped EXE
PID:3488 -
\??\c:\nhnnhh.exec:\nhnnhh.exe28⤵
- Executes dropped EXE
PID:1180 -
\??\c:\nnnnnh.exec:\nnnnnh.exe29⤵
- Executes dropped EXE
PID:1136 -
\??\c:\jpjpv.exec:\jpjpv.exe30⤵
- Executes dropped EXE
PID:4672 -
\??\c:\rfxxxff.exec:\rfxxxff.exe31⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rxxfflf.exec:\rxxfflf.exe32⤵
- Executes dropped EXE
PID:4560 -
\??\c:\hhnhhb.exec:\hhnhhb.exe33⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jdjdd.exec:\jdjdd.exe34⤵
- Executes dropped EXE
PID:4668 -
\??\c:\ppjjd.exec:\ppjjd.exe35⤵
- Executes dropped EXE
PID:3988 -
\??\c:\xxrrrxx.exec:\xxrrrxx.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bbnnnt.exec:\bbnnnt.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\bnbhbn.exec:\bnbhbn.exe38⤵
- Executes dropped EXE
PID:4344 -
\??\c:\5vpvv.exec:\5vpvv.exe39⤵
- Executes dropped EXE
PID:4204 -
\??\c:\llllfxr.exec:\llllfxr.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hnnhbb.exec:\hnnhbb.exe41⤵
- Executes dropped EXE
PID:1424 -
\??\c:\1vvpj.exec:\1vvpj.exe42⤵
- Executes dropped EXE
PID:4636 -
\??\c:\jjpjp.exec:\jjpjp.exe43⤵
- Executes dropped EXE
PID:2820 -
\??\c:\flrlfff.exec:\flrlfff.exe44⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bnbtnn.exec:\bnbtnn.exe45⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pddpv.exec:\pddpv.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rllfxxl.exec:\rllfxxl.exe47⤵
- Executes dropped EXE
PID:3208 -
\??\c:\nbnbht.exec:\nbnbht.exe48⤵
- Executes dropped EXE
PID:3676 -
\??\c:\bttthb.exec:\bttthb.exe49⤵
- Executes dropped EXE
PID:4460 -
\??\c:\vjvdd.exec:\vjvdd.exe50⤵
- Executes dropped EXE
PID:1436 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe51⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tttttb.exec:\tttttb.exe52⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bbbbbn.exec:\bbbbbn.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3792 -
\??\c:\ddjjd.exec:\ddjjd.exe54⤵
- Executes dropped EXE
PID:4852 -
\??\c:\lxfflrx.exec:\lxfflrx.exe55⤵
- Executes dropped EXE
PID:4612 -
\??\c:\lrrllll.exec:\lrrllll.exe56⤵
- Executes dropped EXE
PID:5076 -
\??\c:\7nttnt.exec:\7nttnt.exe57⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jjppv.exec:\jjppv.exe58⤵
- Executes dropped EXE
PID:32 -
\??\c:\jddpj.exec:\jddpj.exe59⤵
- Executes dropped EXE
PID:4684 -
\??\c:\rflllll.exec:\rflllll.exe60⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hnhnnb.exec:\hnhnnb.exe61⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bttttt.exec:\bttttt.exe62⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jdvpp.exec:\jdvpp.exe63⤵
- Executes dropped EXE
PID:5052 -
\??\c:\3llrlrr.exec:\3llrlrr.exe64⤵
- Executes dropped EXE
PID:396 -
\??\c:\rrlflrr.exec:\rrlflrr.exe65⤵
- Executes dropped EXE
PID:224 -
\??\c:\nbtbhn.exec:\nbtbhn.exe66⤵PID:3016
-
\??\c:\vdppj.exec:\vdppj.exe67⤵PID:4316
-
\??\c:\fflrlrr.exec:\fflrlrr.exe68⤵PID:4408
-
\??\c:\ffxxllx.exec:\ffxxllx.exe69⤵PID:5116
-
\??\c:\7nhbbh.exec:\7nhbbh.exe70⤵PID:3288
-
\??\c:\jpdpp.exec:\jpdpp.exe71⤵PID:4308
-
\??\c:\lfxffxx.exec:\lfxffxx.exe72⤵PID:736
-
\??\c:\tbnbbt.exec:\tbnbbt.exe73⤵PID:4780
-
\??\c:\jjvjv.exec:\jjvjv.exe74⤵PID:4024
-
\??\c:\lxllllx.exec:\lxllllx.exe75⤵PID:4984
-
\??\c:\thnttb.exec:\thnttb.exe76⤵PID:1976
-
\??\c:\pjvvp.exec:\pjvvp.exe77⤵PID:4668
-
\??\c:\frxrrll.exec:\frxrrll.exe78⤵PID:3988
-
\??\c:\lxfllll.exec:\lxfllll.exe79⤵PID:1696
-
\??\c:\htnnnt.exec:\htnnnt.exe80⤵PID:3544
-
\??\c:\vppjd.exec:\vppjd.exe81⤵PID:4688
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe82⤵PID:4080
-
\??\c:\xrxxxxr.exec:\xrxxxxr.exe83⤵PID:2188
-
\??\c:\bhbtnn.exec:\bhbtnn.exe84⤵PID:4772
-
\??\c:\jdjjj.exec:\jdjjj.exe85⤵PID:1780
-
\??\c:\fllfrrf.exec:\fllfrrf.exe86⤵PID:4356
-
\??\c:\rxrrllx.exec:\rxrrllx.exe87⤵PID:5056
-
\??\c:\tttttt.exec:\tttttt.exe88⤵PID:1472
-
\??\c:\dvdpv.exec:\dvdpv.exe89⤵PID:4496
-
\??\c:\vjjdv.exec:\vjjdv.exe90⤵PID:1036
-
\??\c:\rllxrrr.exec:\rllxrrr.exe91⤵PID:3868
-
\??\c:\bhhhnn.exec:\bhhhnn.exe92⤵PID:2916
-
\??\c:\jvvvv.exec:\jvvvv.exe93⤵PID:1228
-
\??\c:\lflfffx.exec:\lflfffx.exe94⤵PID:4692
-
\??\c:\hbhhbb.exec:\hbhhbb.exe95⤵PID:1184
-
\??\c:\9bnhbb.exec:\9bnhbb.exe96⤵PID:3304
-
\??\c:\3pvjp.exec:\3pvjp.exe97⤵PID:1552
-
\??\c:\lxfffff.exec:\lxfffff.exe98⤵PID:4784
-
\??\c:\hhbnht.exec:\hhbnht.exe99⤵PID:4172
-
\??\c:\llflxrf.exec:\llflxrf.exe100⤵PID:5020
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe101⤵PID:5052
-
\??\c:\bnnntn.exec:\bnnntn.exe102⤵PID:400
-
\??\c:\jjddd.exec:\jjddd.exe103⤵PID:224
-
\??\c:\djjdd.exec:\djjdd.exe104⤵PID:3016
-
\??\c:\rrlrrxf.exec:\rrlrrxf.exe105⤵PID:4316
-
\??\c:\ttttth.exec:\ttttth.exe106⤵PID:1440
-
\??\c:\tnnhtb.exec:\tnnhtb.exe107⤵PID:3260
-
\??\c:\jvddd.exec:\jvddd.exe108⤵PID:4184
-
\??\c:\1xrfxff.exec:\1xrfxff.exe109⤵PID:1180
-
\??\c:\bbttnn.exec:\bbttnn.exe110⤵PID:1136
-
\??\c:\hbhnnt.exec:\hbhnnt.exe111⤵
- System Location Discovery: System Language Discovery
PID:4672 -
\??\c:\vpvpp.exec:\vpvpp.exe112⤵PID:2728
-
\??\c:\xxrxflr.exec:\xxrxflr.exe113⤵PID:2432
-
\??\c:\hnbhht.exec:\hnbhht.exe114⤵PID:4796
-
\??\c:\vpjjj.exec:\vpjjj.exe115⤵PID:1320
-
\??\c:\vvddd.exec:\vvddd.exe116⤵PID:2464
-
\??\c:\bhbnbt.exec:\bhbnbt.exe117⤵PID:2824
-
\??\c:\vdpjj.exec:\vdpjj.exe118⤵PID:3756
-
\??\c:\xxffxxx.exec:\xxffxxx.exe119⤵PID:868
-
\??\c:\jdvvv.exec:\jdvvv.exe120⤵PID:2948
-
\??\c:\lllxlrx.exec:\lllxlrx.exe121⤵PID:2220
-
\??\c:\btnnnt.exec:\btnnnt.exe122⤵PID:4472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-