Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2024 00:03
Behavioral task
behavioral1
Sample
73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe
Resource
win7-20240903-en
General
-
Target
73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe
-
Size
3.7MB
-
MD5
ba1c24b2d74a8a09351d3f6a64a7af23
-
SHA1
3c0d35568a4525242cdba87ef34efce57b3eb424
-
SHA256
73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0
-
SHA512
cd690a7ec3464522421fbd87c11ebb5403f61745176fdeebc140a3f73928b9199c3a27a1791b76c6f22baa002142b017ba1cf9b66df7e1db790771764c317c1d
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98l:U6XLq/qPPslzKx/dJg1ErmNI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1488-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3816-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/388-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1756-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/772-608-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-700-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-731-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-834-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-856-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-965-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
Processes:
ffllfff.exepdjjj.exeflrlxxf.exe9frlfll.exebttnnt.exe7lflxfx.exennhbtn.exe9nthbb.exellfxrlf.exevpjdp.exe9vddv.exerxfrlll.exe1jvvp.exepjvpj.exehbbtnn.exenhttnt.exe1nnhht.exethnhhh.exe5thhbb.exe5dppj.exevjvdv.exe7nnhhn.exevvdvv.exenhthtn.exetnhhbt.exelffrllf.exexrlfffx.exeflrlfxr.exelxrrrrl.exe1fllfxx.exejvjdv.exeddvpj.exe9tnhbh.exe7bhhnt.exentnnbb.exehbbtnn.exehbtthn.exe3hhbtt.exexrrlffx.exefxfxffl.exelffxxxr.exetbhhbb.exe7bthhn.exe5btttt.exefxffxlx.exe3xxxffl.exefxxxxlr.exe3lxxlrf.exeffffffx.exefxrlllx.exefxrlfff.exerrrrlrr.exe7vvdv.exeddjdd.exedpdvv.exevdpjv.exe1jjjj.exexlxffff.exejjvvv.exedvjdp.exeflrlxxx.exefxfxrxr.exexxrxrxr.exexxllrxf.exepid Process 2276 ffllfff.exe 4928 pdjjj.exe 4820 flrlxxf.exe 4740 9frlfll.exe 1364 bttnnt.exe 2708 7lflxfx.exe 3724 nnhbtn.exe 2520 9nthbb.exe 3468 llfxrlf.exe 4664 vpjdp.exe 3540 9vddv.exe 3588 rxfrlll.exe 3552 1jvvp.exe 2316 pjvpj.exe 3280 hbbtnn.exe 732 nhttnt.exe 3524 1nnhht.exe 3968 thnhhh.exe 5016 5thhbb.exe 1492 5dppj.exe 1836 vjvdv.exe 4324 7nnhhn.exe 1880 vvdvv.exe 1888 nhthtn.exe 4544 tnhhbt.exe 3096 lffrllf.exe 972 xrlfffx.exe 4716 flrlfxr.exe 2228 lxrrrrl.exe 5088 1fllfxx.exe 4600 jvjdv.exe 5000 ddvpj.exe 4568 9tnhbh.exe 2172 7bhhnt.exe 3800 ntnnbb.exe 4820 hbbtnn.exe 1280 hbtthn.exe 2704 3hhbtt.exe 2268 xrrlffx.exe 4520 fxfxffl.exe 3628 lffxxxr.exe 2760 tbhhbb.exe 2536 7bthhn.exe 4536 5btttt.exe 3816 fxffxlx.exe 2756 3xxxffl.exe 4816 fxxxxlr.exe 2908 3lxxlrf.exe 1592 ffffffx.exe 424 fxrlllx.exe 388 fxrlfff.exe 2916 rrrrlrr.exe 3280 7vvdv.exe 760 ddjdd.exe 1496 dpdvv.exe 1148 vdpjv.exe 1060 1jjjj.exe 3060 xlxffff.exe 912 jjvvv.exe 4432 dvjdp.exe 1272 flrlxxx.exe 5004 fxfxrxr.exe 1756 xxrxrxr.exe 4324 xxllrxf.exe -
Processes:
resource yara_rule behavioral2/memory/1488-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023c95-3.dat upx behavioral2/memory/1488-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9f-9.dat upx behavioral2/memory/4928-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2276-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca0-14.dat upx behavioral2/memory/4820-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c9b-22.dat upx behavioral2/files/0x0007000000023ca1-27.dat upx behavioral2/memory/4740-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca3-33.dat upx behavioral2/memory/1364-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca4-39.dat upx behavioral2/memory/2708-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca5-45.dat upx behavioral2/memory/3724-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca6-51.dat upx behavioral2/memory/3468-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2520-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca7-58.dat upx behavioral2/files/0x0007000000023ca8-63.dat upx behavioral2/memory/3540-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4664-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023caa-71.dat upx behavioral2/memory/3588-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3540-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cab-77.dat upx behavioral2/memory/3588-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cac-83.dat upx behavioral2/memory/3552-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cad-89.dat upx behavioral2/files/0x0007000000023cae-94.dat upx behavioral2/files/0x0007000000023caf-99.dat upx behavioral2/memory/732-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb0-105.dat upx behavioral2/memory/3524-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-111.dat upx behavioral2/files/0x0007000000023cb3-116.dat upx behavioral2/files/0x0007000000023cb4-121.dat upx behavioral2/memory/1492-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb5-126.dat upx behavioral2/memory/1836-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb6-133.dat upx behavioral2/files/0x0007000000023cb7-138.dat upx behavioral2/files/0x0007000000023cb8-143.dat upx behavioral2/memory/1888-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-149.dat upx behavioral2/memory/4544-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cba-155.dat upx behavioral2/memory/3096-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbb-161.dat upx behavioral2/memory/972-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbc-167.dat upx behavioral2/memory/2228-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-174.dat upx behavioral2/files/0x0007000000023cbf-178.dat upx behavioral2/files/0x0007000000023cc2-183.dat upx behavioral2/memory/4568-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4820-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4520-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2760-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2536-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4536-227-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bttnnt.exejpjvp.exe5hhbbb.exejpdpd.exetnnnhb.exe1nnhht.exe1fllfxx.exe3xxxffl.exetbhhbt.exebthbbt.exe9frlfll.exerllffxr.exebtnhbb.exejjvpj.exeddvdv.exe9pvpd.exetbbtnh.exeppdpd.exevpvpd.exejjdvv.exe1ddjv.exenhnhbn.exedpdpj.exedvvjd.exe1jddv.exe7hhbhb.exe1nbtnn.exe5htnnh.exe9dvvj.exedvvvv.exedvdvj.exepddpj.exedvppj.exepdjvj.exetbbnbt.exe5xxlxrf.exefrflxrx.exe1rlxlfr.exe1jjjj.exerlxrrlr.exe3ppjp.exenhnbtn.exejjjdv.exe3fllxxr.exevjvdv.exevvvpp.exe3nhbtn.exehhnnnh.exehhbtnh.exenhhbnn.exe9vpvp.exennnnhn.exefflfxxx.exejvvjv.exe5dvpj.exejdvjd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fllfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exeffllfff.exepdjjj.exeflrlxxf.exe9frlfll.exebttnnt.exe7lflxfx.exennhbtn.exe9nthbb.exellfxrlf.exevpjdp.exe9vddv.exerxfrlll.exe1jvvp.exepjvpj.exehbbtnn.exenhttnt.exe1nnhht.exethnhhh.exe5thhbb.exe5dppj.exevjvdv.exedescription pid Process procid_target PID 1488 wrote to memory of 2276 1488 73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe 83 PID 1488 wrote to memory of 2276 1488 73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe 83 PID 1488 wrote to memory of 2276 1488 73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe 83 PID 2276 wrote to memory of 4928 2276 ffllfff.exe 84 PID 2276 wrote to memory of 4928 2276 ffllfff.exe 84 PID 2276 wrote to memory of 4928 2276 ffllfff.exe 84 PID 4928 wrote to memory of 4820 4928 pdjjj.exe 85 PID 4928 wrote to memory of 4820 4928 pdjjj.exe 85 PID 4928 wrote to memory of 4820 4928 pdjjj.exe 85 PID 4820 wrote to memory of 4740 4820 flrlxxf.exe 86 PID 4820 wrote to memory of 4740 4820 flrlxxf.exe 86 PID 4820 wrote to memory of 4740 4820 flrlxxf.exe 86 PID 4740 wrote to memory of 1364 4740 9frlfll.exe 87 PID 4740 wrote to memory of 1364 4740 9frlfll.exe 87 PID 4740 wrote to memory of 1364 4740 9frlfll.exe 87 PID 1364 wrote to memory of 2708 1364 bttnnt.exe 88 PID 1364 wrote to memory of 2708 1364 bttnnt.exe 88 PID 1364 wrote to memory of 2708 1364 bttnnt.exe 88 PID 2708 wrote to memory of 3724 2708 7lflxfx.exe 89 PID 2708 wrote to memory of 3724 2708 7lflxfx.exe 89 PID 2708 wrote to memory of 3724 2708 7lflxfx.exe 89 PID 3724 wrote to memory of 2520 3724 nnhbtn.exe 90 PID 3724 wrote to memory of 2520 3724 nnhbtn.exe 90 PID 3724 wrote to memory of 2520 3724 nnhbtn.exe 90 PID 2520 wrote to memory of 3468 2520 9nthbb.exe 91 PID 2520 wrote to memory of 3468 2520 9nthbb.exe 91 PID 2520 wrote to memory of 3468 2520 9nthbb.exe 91 PID 3468 wrote to memory of 4664 3468 llfxrlf.exe 94 PID 3468 wrote to memory of 4664 3468 llfxrlf.exe 94 PID 3468 wrote to memory of 4664 3468 llfxrlf.exe 94 PID 4664 wrote to memory of 3540 4664 vpjdp.exe 96 PID 4664 wrote to memory of 3540 4664 vpjdp.exe 96 PID 4664 wrote to memory of 3540 4664 vpjdp.exe 96 PID 3540 wrote to memory of 3588 3540 9vddv.exe 98 PID 3540 wrote to memory of 3588 3540 9vddv.exe 98 PID 3540 wrote to memory of 3588 3540 9vddv.exe 98 PID 3588 wrote to memory of 3552 3588 rxfrlll.exe 99 PID 3588 wrote to memory of 3552 3588 rxfrlll.exe 99 PID 3588 wrote to memory of 3552 3588 rxfrlll.exe 99 PID 3552 wrote to memory of 2316 3552 1jvvp.exe 100 PID 3552 wrote to memory of 2316 3552 1jvvp.exe 100 PID 3552 wrote to memory of 2316 3552 1jvvp.exe 100 PID 2316 wrote to memory of 3280 2316 pjvpj.exe 101 PID 2316 wrote to memory of 3280 2316 pjvpj.exe 101 PID 2316 wrote to memory of 3280 2316 pjvpj.exe 101 PID 3280 wrote to memory of 732 3280 hbbtnn.exe 102 PID 3280 wrote to memory of 732 3280 hbbtnn.exe 102 PID 3280 wrote to memory of 732 3280 hbbtnn.exe 102 PID 732 wrote to memory of 3524 732 nhttnt.exe 103 PID 732 wrote to memory of 3524 732 nhttnt.exe 103 PID 732 wrote to memory of 3524 732 nhttnt.exe 103 PID 3524 wrote to memory of 3968 3524 1nnhht.exe 104 PID 3524 wrote to memory of 3968 3524 1nnhht.exe 104 PID 3524 wrote to memory of 3968 3524 1nnhht.exe 104 PID 3968 wrote to memory of 5016 3968 thnhhh.exe 107 PID 3968 wrote to memory of 5016 3968 thnhhh.exe 107 PID 3968 wrote to memory of 5016 3968 thnhhh.exe 107 PID 5016 wrote to memory of 1492 5016 5thhbb.exe 108 PID 5016 wrote to memory of 1492 5016 5thhbb.exe 108 PID 5016 wrote to memory of 1492 5016 5thhbb.exe 108 PID 1492 wrote to memory of 1836 1492 5dppj.exe 109 PID 1492 wrote to memory of 1836 1492 5dppj.exe 109 PID 1492 wrote to memory of 1836 1492 5dppj.exe 109 PID 1836 wrote to memory of 4324 1836 vjvdv.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe"C:\Users\Admin\AppData\Local\Temp\73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\ffllfff.exec:\ffllfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\pdjjj.exec:\pdjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\flrlxxf.exec:\flrlxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\9frlfll.exec:\9frlfll.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\bttnnt.exec:\bttnnt.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\7lflxfx.exec:\7lflxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\nnhbtn.exec:\nnhbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\9nthbb.exec:\9nthbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\llfxrlf.exec:\llfxrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\vpjdp.exec:\vpjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\9vddv.exec:\9vddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\rxfrlll.exec:\rxfrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\1jvvp.exec:\1jvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\pjvpj.exec:\pjvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\hbbtnn.exec:\hbbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\nhttnt.exec:\nhttnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\1nnhht.exec:\1nnhht.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\thnhhh.exec:\thnhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\5thhbb.exec:\5thhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\5dppj.exec:\5dppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\vjvdv.exec:\vjvdv.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\7nnhhn.exec:\7nnhhn.exe23⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vvdvv.exec:\vvdvv.exe24⤵
- Executes dropped EXE
PID:1880 -
\??\c:\nhthtn.exec:\nhthtn.exe25⤵
- Executes dropped EXE
PID:1888 -
\??\c:\tnhhbt.exec:\tnhhbt.exe26⤵
- Executes dropped EXE
PID:4544 -
\??\c:\lffrllf.exec:\lffrllf.exe27⤵
- Executes dropped EXE
PID:3096 -
\??\c:\xrlfffx.exec:\xrlfffx.exe28⤵
- Executes dropped EXE
PID:972 -
\??\c:\flrlfxr.exec:\flrlfxr.exe29⤵
- Executes dropped EXE
PID:4716 -
\??\c:\lxrrrrl.exec:\lxrrrrl.exe30⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1fllfxx.exec:\1fllfxx.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5088 -
\??\c:\jvjdv.exec:\jvjdv.exe32⤵
- Executes dropped EXE
PID:4600 -
\??\c:\ddvpj.exec:\ddvpj.exe33⤵
- Executes dropped EXE
PID:5000 -
\??\c:\9tnhbh.exec:\9tnhbh.exe34⤵
- Executes dropped EXE
PID:4568 -
\??\c:\7bhhnt.exec:\7bhhnt.exe35⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ntnnbb.exec:\ntnnbb.exe36⤵
- Executes dropped EXE
PID:3800 -
\??\c:\hbbtnn.exec:\hbbtnn.exe37⤵
- Executes dropped EXE
PID:4820 -
\??\c:\hbtthn.exec:\hbtthn.exe38⤵
- Executes dropped EXE
PID:1280 -
\??\c:\3hhbtt.exec:\3hhbtt.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xrrlffx.exec:\xrrlffx.exe40⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fxfxffl.exec:\fxfxffl.exe41⤵
- Executes dropped EXE
PID:4520 -
\??\c:\lffxxxr.exec:\lffxxxr.exe42⤵
- Executes dropped EXE
PID:3628 -
\??\c:\tbhhbb.exec:\tbhhbb.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\7bthhn.exec:\7bthhn.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\5btttt.exec:\5btttt.exe45⤵
- Executes dropped EXE
PID:4536 -
\??\c:\fxffxlx.exec:\fxffxlx.exe46⤵
- Executes dropped EXE
PID:3816 -
\??\c:\3xxxffl.exec:\3xxxffl.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2756 -
\??\c:\fxxxxlr.exec:\fxxxxlr.exe48⤵
- Executes dropped EXE
PID:4816 -
\??\c:\3lxxlrf.exec:\3lxxlrf.exe49⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ffffffx.exec:\ffffffx.exe50⤵
- Executes dropped EXE
PID:1592 -
\??\c:\fxrlllx.exec:\fxrlllx.exe51⤵
- Executes dropped EXE
PID:424 -
\??\c:\fxrlfff.exec:\fxrlfff.exe52⤵
- Executes dropped EXE
PID:388 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe53⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7vvdv.exec:\7vvdv.exe54⤵
- Executes dropped EXE
PID:3280 -
\??\c:\ddjdd.exec:\ddjdd.exe55⤵
- Executes dropped EXE
PID:760 -
\??\c:\dpdvv.exec:\dpdvv.exe56⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vdpjv.exec:\vdpjv.exe57⤵
- Executes dropped EXE
PID:1148 -
\??\c:\1jjjj.exec:\1jjjj.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1060 -
\??\c:\xlxffff.exec:\xlxffff.exe59⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jjvvv.exec:\jjvvv.exe60⤵
- Executes dropped EXE
PID:912 -
\??\c:\dvjdp.exec:\dvjdp.exe61⤵
- Executes dropped EXE
PID:4432 -
\??\c:\flrlxxx.exec:\flrlxxx.exe62⤵
- Executes dropped EXE
PID:1272 -
\??\c:\fxfxrxr.exec:\fxfxrxr.exe63⤵
- Executes dropped EXE
PID:5004 -
\??\c:\xxrxrxr.exec:\xxrxrxr.exe64⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xxllrxf.exec:\xxllrxf.exe65⤵
- Executes dropped EXE
PID:4324 -
\??\c:\lxrlfff.exec:\lxrlfff.exe66⤵PID:2300
-
\??\c:\vvvpp.exec:\vvvpp.exe67⤵
- System Location Discovery: System Language Discovery
PID:5092 -
\??\c:\ddppv.exec:\ddppv.exe68⤵PID:4240
-
\??\c:\rfrlrrr.exec:\rfrlrrr.exe69⤵PID:4572
-
\??\c:\rrxxxrr.exec:\rrxxxrr.exe70⤵PID:4172
-
\??\c:\lxrrxxr.exec:\lxrrxxr.exe71⤵PID:2244
-
\??\c:\rrfxxrx.exec:\rrfxxrx.exe72⤵PID:3564
-
\??\c:\ddddd.exec:\ddddd.exe73⤵PID:2228
-
\??\c:\jjvpj.exec:\jjvpj.exe74⤵
- System Location Discovery: System Language Discovery
PID:4140 -
\??\c:\dvdjj.exec:\dvdjj.exe75⤵PID:920
-
\??\c:\pdvpv.exec:\pdvpv.exe76⤵PID:2180
-
\??\c:\pjjvv.exec:\pjjvv.exe77⤵PID:3620
-
\??\c:\jvppj.exec:\jvppj.exe78⤵PID:1008
-
\??\c:\dvppj.exec:\dvppj.exe79⤵PID:4928
-
\??\c:\bttttt.exec:\bttttt.exe80⤵PID:1532
-
\??\c:\ntbbbb.exec:\ntbbbb.exe81⤵PID:4972
-
\??\c:\nbbttb.exec:\nbbttb.exe82⤵PID:4400
-
\??\c:\hbtttn.exec:\hbtttn.exe83⤵PID:1948
-
\??\c:\fxfxrfr.exec:\fxfxrfr.exe84⤵PID:4848
-
\??\c:\7lrxlrx.exec:\7lrxlrx.exe85⤵PID:3172
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe86⤵PID:836
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe87⤵PID:2708
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe88⤵PID:4088
-
\??\c:\lfxxllx.exec:\lfxxllx.exe89⤵PID:3628
-
\??\c:\xxxllfx.exec:\xxxllfx.exe90⤵PID:3504
-
\??\c:\lxllllr.exec:\lxllllr.exe91⤵PID:4516
-
\??\c:\dvppp.exec:\dvppp.exe92⤵PID:3796
-
\??\c:\ddjdv.exec:\ddjdv.exe93⤵PID:1936
-
\??\c:\ppdvv.exec:\ppdvv.exe94⤵PID:1520
-
\??\c:\vpppj.exec:\vpppj.exe95⤵PID:2124
-
\??\c:\jdppp.exec:\jdppp.exe96⤵PID:2256
-
\??\c:\jvdvp.exec:\jvdvp.exe97⤵PID:1580
-
\??\c:\vpjvj.exec:\vpjvj.exe98⤵PID:712
-
\??\c:\7dddp.exec:\7dddp.exe99⤵PID:2792
-
\??\c:\jjjjv.exec:\jjjjv.exe100⤵PID:1592
-
\??\c:\3pvvj.exec:\3pvvj.exe101⤵PID:4588
-
\??\c:\bnnhbh.exec:\bnnhbh.exe102⤵PID:3440
-
\??\c:\thnhbt.exec:\thnhbt.exe103⤵PID:4664
-
\??\c:\nthtnn.exec:\nthtnn.exe104⤵PID:3280
-
\??\c:\httbtb.exec:\httbtb.exe105⤵PID:2012
-
\??\c:\bbhhtt.exec:\bbhhtt.exe106⤵PID:1892
-
\??\c:\1tbbnn.exec:\1tbbnn.exe107⤵PID:3968
-
\??\c:\nntnnh.exec:\nntnnh.exe108⤵PID:3852
-
\??\c:\5htnhh.exec:\5htnhh.exe109⤵PID:5016
-
\??\c:\1rxrlrl.exec:\1rxrlrl.exe110⤵PID:3384
-
\??\c:\3lxxxxr.exec:\3lxxxxr.exe111⤵PID:2552
-
\??\c:\9rflfll.exec:\9rflfll.exe112⤵PID:1492
-
\??\c:\lxrrllf.exec:\lxrrllf.exe113⤵PID:2232
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe114⤵PID:1020
-
\??\c:\ppdvd.exec:\ppdvd.exe115⤵PID:1756
-
\??\c:\vjpdv.exec:\vjpdv.exe116⤵PID:4324
-
\??\c:\pvdvv.exec:\pvdvv.exe117⤵PID:3736
-
\??\c:\thbhbb.exec:\thbhbb.exe118⤵PID:5116
-
\??\c:\3nnhbt.exec:\3nnhbt.exe119⤵PID:3260
-
\??\c:\bbhhtt.exec:\bbhhtt.exe120⤵PID:3956
-
\??\c:\9rrlxxl.exec:\9rrlxxl.exe121⤵PID:1332
-
\??\c:\5lrlrrr.exec:\5lrlrrr.exe122⤵PID:652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-