Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 11:29
Behavioral task
behavioral1
Sample
87383d76d32c9525455960904873b6d0N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
87383d76d32c9525455960904873b6d0N.exe
-
Size
97KB
-
MD5
87383d76d32c9525455960904873b6d0
-
SHA1
ac90a9b30222885ce76fd9b2faa448f2a1a6dec7
-
SHA256
b0ac6a8cc062e7b0e7fe4bf78e005e2f8b17a003e506a8d9b67b404e63c46d49
-
SHA512
2285006bd97e6a71fe7e96ebff2c9e7d1a508c44dc3789cf550de0586bb10f3b229a37f2ced3adde9b9caf69819fe29109b7b7c9c06a5bee0ec878f6a2efa3c0
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzQ:8cm4FmowdHoSgWrXUQ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3996-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1076-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1876-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-729-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4284 tbntnb.exe 3088 jjjdj.exe 4856 ppjdp.exe 4896 fflfxff.exe 3104 3xffrrl.exe 3476 tttttt.exe 1628 1vvpj.exe 1076 ffxffxr.exe 4072 tbbthb.exe 2912 dpvvd.exe 2344 fllfrrr.exe 4496 htbttt.exe 2476 pjvvd.exe 2464 pjjdv.exe 964 ffxrllf.exe 4460 tnnnnn.exe 4796 5jddj.exe 3048 rxrlfxr.exe 2956 5hhttb.exe 2936 pdpjj.exe 2792 fflrllr.exe 472 xlflrlr.exe 1008 9ntnhn.exe 3132 1vjjp.exe 4908 7flfxxr.exe 1212 hnhtbb.exe 2556 ddvvp.exe 3368 jdjvp.exe 1828 5lxrxlf.exe 3952 httnnn.exe 4536 jdvdv.exe 3508 jdvpv.exe 540 xrlfxxr.exe 1428 thhbbb.exe 1852 vjpjj.exe 4108 jvdjj.exe 1884 5nthhb.exe 2584 jjjdp.exe 2124 ppvdd.exe 3716 lllfxxr.exe 4088 tnhbbb.exe 3968 7ttnhn.exe 4988 pjpjj.exe 4296 dppvp.exe 208 fffxrrr.exe 116 thhbhb.exe 5032 bthhnt.exe 1064 jdjdj.exe 4324 lxlxxrf.exe 3304 xlrrlrr.exe 4524 tnnhhn.exe 5088 tnhbbt.exe 2440 7pddv.exe 3144 lfxxrrf.exe 644 1lfxrfx.exe 872 btnhhb.exe 3728 nnbthh.exe 4072 jdvvj.exe 2424 xrrfffx.exe 1204 5ntnnt.exe 4684 fxxrfxx.exe 2240 djddv.exe 3636 rrrxrrl.exe 3404 pppjp.exe -
resource yara_rule behavioral2/memory/3996-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023491-3.dat upx behavioral2/memory/3996-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234f3-8.dat upx behavioral2/memory/4284-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f4-11.dat upx behavioral2/files/0x00070000000234f5-19.dat upx behavioral2/memory/4856-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4896-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f6-24.dat upx behavioral2/memory/3088-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3104-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f7-30.dat upx behavioral2/memory/3104-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f8-34.dat upx behavioral2/memory/3476-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f9-39.dat upx behavioral2/memory/1628-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1076-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fa-44.dat upx behavioral2/files/0x00070000000234fb-49.dat upx behavioral2/memory/4072-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fc-54.dat upx behavioral2/memory/2912-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fd-59.dat upx behavioral2/memory/2344-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4496-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4496-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fe-65.dat upx behavioral2/memory/2476-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ff-71.dat upx behavioral2/memory/964-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2464-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023500-76.dat upx behavioral2/files/0x0007000000023501-81.dat upx behavioral2/files/0x0007000000023502-87.dat upx behavioral2/memory/4460-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023503-90.dat upx behavioral2/memory/4796-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023504-95.dat upx behavioral2/files/0x0007000000023505-99.dat upx behavioral2/files/0x0007000000023506-103.dat upx behavioral2/memory/2936-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2792-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023507-110.dat upx behavioral2/files/0x0007000000023508-113.dat upx behavioral2/memory/1008-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023509-117.dat upx behavioral2/files/0x000700000002350a-122.dat upx behavioral2/memory/3132-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234f1-127.dat upx behavioral2/memory/4908-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1212-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002350b-133.dat upx behavioral2/files/0x000700000002350c-137.dat upx behavioral2/memory/2556-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002350f-142.dat upx behavioral2/memory/3368-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002350d-147.dat upx behavioral2/memory/1828-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023510-152.dat upx behavioral2/files/0x0007000000023511-156.dat upx behavioral2/memory/4536-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3508-161-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3996 wrote to memory of 4284 3996 87383d76d32c9525455960904873b6d0N.exe 83 PID 3996 wrote to memory of 4284 3996 87383d76d32c9525455960904873b6d0N.exe 83 PID 3996 wrote to memory of 4284 3996 87383d76d32c9525455960904873b6d0N.exe 83 PID 4284 wrote to memory of 3088 4284 tbntnb.exe 84 PID 4284 wrote to memory of 3088 4284 tbntnb.exe 84 PID 4284 wrote to memory of 3088 4284 tbntnb.exe 84 PID 3088 wrote to memory of 4856 3088 jjjdj.exe 85 PID 3088 wrote to memory of 4856 3088 jjjdj.exe 85 PID 3088 wrote to memory of 4856 3088 jjjdj.exe 85 PID 4856 wrote to memory of 4896 4856 ppjdp.exe 86 PID 4856 wrote to memory of 4896 4856 ppjdp.exe 86 PID 4856 wrote to memory of 4896 4856 ppjdp.exe 86 PID 4896 wrote to memory of 3104 4896 fflfxff.exe 87 PID 4896 wrote to memory of 3104 4896 fflfxff.exe 87 PID 4896 wrote to memory of 3104 4896 fflfxff.exe 87 PID 3104 wrote to memory of 3476 3104 3xffrrl.exe 89 PID 3104 wrote to memory of 3476 3104 3xffrrl.exe 89 PID 3104 wrote to memory of 3476 3104 3xffrrl.exe 89 PID 3476 wrote to memory of 1628 3476 tttttt.exe 90 PID 3476 wrote to memory of 1628 3476 tttttt.exe 90 PID 3476 wrote to memory of 1628 3476 tttttt.exe 90 PID 1628 wrote to memory of 1076 1628 1vvpj.exe 91 PID 1628 wrote to memory of 1076 1628 1vvpj.exe 91 PID 1628 wrote to memory of 1076 1628 1vvpj.exe 91 PID 1076 wrote to memory of 4072 1076 ffxffxr.exe 92 PID 1076 wrote to memory of 4072 1076 ffxffxr.exe 92 PID 1076 wrote to memory of 4072 1076 ffxffxr.exe 92 PID 4072 wrote to memory of 2912 4072 tbbthb.exe 94 PID 4072 wrote to memory of 2912 4072 tbbthb.exe 94 PID 4072 wrote to memory of 2912 4072 tbbthb.exe 94 PID 2912 wrote to memory of 2344 2912 dpvvd.exe 95 PID 2912 wrote to memory of 2344 2912 dpvvd.exe 95 PID 2912 wrote to memory of 2344 2912 dpvvd.exe 95 PID 2344 wrote to memory of 4496 2344 fllfrrr.exe 96 PID 2344 wrote to memory of 4496 2344 fllfrrr.exe 96 PID 2344 wrote to memory of 4496 2344 fllfrrr.exe 96 PID 4496 wrote to memory of 2476 4496 htbttt.exe 97 PID 4496 wrote to memory of 2476 4496 htbttt.exe 97 PID 4496 wrote to memory of 2476 4496 htbttt.exe 97 PID 2476 wrote to memory of 2464 2476 pjvvd.exe 98 PID 2476 wrote to memory of 2464 2476 pjvvd.exe 98 PID 2476 wrote to memory of 2464 2476 pjvvd.exe 98 PID 2464 wrote to memory of 964 2464 pjjdv.exe 100 PID 2464 wrote to memory of 964 2464 pjjdv.exe 100 PID 2464 wrote to memory of 964 2464 pjjdv.exe 100 PID 964 wrote to memory of 4460 964 ffxrllf.exe 101 PID 964 wrote to memory of 4460 964 ffxrllf.exe 101 PID 964 wrote to memory of 4460 964 ffxrllf.exe 101 PID 4460 wrote to memory of 4796 4460 tnnnnn.exe 102 PID 4460 wrote to memory of 4796 4460 tnnnnn.exe 102 PID 4460 wrote to memory of 4796 4460 tnnnnn.exe 102 PID 4796 wrote to memory of 3048 4796 5jddj.exe 103 PID 4796 wrote to memory of 3048 4796 5jddj.exe 103 PID 4796 wrote to memory of 3048 4796 5jddj.exe 103 PID 3048 wrote to memory of 2956 3048 rxrlfxr.exe 104 PID 3048 wrote to memory of 2956 3048 rxrlfxr.exe 104 PID 3048 wrote to memory of 2956 3048 rxrlfxr.exe 104 PID 2956 wrote to memory of 2936 2956 5hhttb.exe 105 PID 2956 wrote to memory of 2936 2956 5hhttb.exe 105 PID 2956 wrote to memory of 2936 2956 5hhttb.exe 105 PID 2936 wrote to memory of 2792 2936 pdpjj.exe 106 PID 2936 wrote to memory of 2792 2936 pdpjj.exe 106 PID 2936 wrote to memory of 2792 2936 pdpjj.exe 106 PID 2792 wrote to memory of 472 2792 fflrllr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\87383d76d32c9525455960904873b6d0N.exe"C:\Users\Admin\AppData\Local\Temp\87383d76d32c9525455960904873b6d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\tbntnb.exec:\tbntnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\jjjdj.exec:\jjjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\ppjdp.exec:\ppjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\fflfxff.exec:\fflfxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\3xffrrl.exec:\3xffrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\tttttt.exec:\tttttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\1vvpj.exec:\1vvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\ffxffxr.exec:\ffxffxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\tbbthb.exec:\tbbthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\dpvvd.exec:\dpvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\fllfrrr.exec:\fllfrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\htbttt.exec:\htbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\pjvvd.exec:\pjvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\pjjdv.exec:\pjjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\ffxrllf.exec:\ffxrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\tnnnnn.exec:\tnnnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\5jddj.exec:\5jddj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\5hhttb.exec:\5hhttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\pdpjj.exec:\pdpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\fflrllr.exec:\fflrllr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xlflrlr.exec:\xlflrlr.exe23⤵
- Executes dropped EXE
PID:472 -
\??\c:\9ntnhn.exec:\9ntnhn.exe24⤵
- Executes dropped EXE
PID:1008 -
\??\c:\1vjjp.exec:\1vjjp.exe25⤵
- Executes dropped EXE
PID:3132 -
\??\c:\7flfxxr.exec:\7flfxxr.exe26⤵
- Executes dropped EXE
PID:4908 -
\??\c:\hnhtbb.exec:\hnhtbb.exe27⤵
- Executes dropped EXE
PID:1212 -
\??\c:\ddvvp.exec:\ddvvp.exe28⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jdjvp.exec:\jdjvp.exe29⤵
- Executes dropped EXE
PID:3368 -
\??\c:\5lxrxlf.exec:\5lxrxlf.exe30⤵
- Executes dropped EXE
PID:1828 -
\??\c:\httnnn.exec:\httnnn.exe31⤵
- Executes dropped EXE
PID:3952 -
\??\c:\jdvdv.exec:\jdvdv.exe32⤵
- Executes dropped EXE
PID:4536 -
\??\c:\jdvpv.exec:\jdvpv.exe33⤵
- Executes dropped EXE
PID:3508 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe34⤵
- Executes dropped EXE
PID:540 -
\??\c:\thhbbb.exec:\thhbbb.exe35⤵
- Executes dropped EXE
PID:1428 -
\??\c:\vjpjj.exec:\vjpjj.exe36⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jvdjj.exec:\jvdjj.exe37⤵
- Executes dropped EXE
PID:4108 -
\??\c:\5nthhb.exec:\5nthhb.exe38⤵
- Executes dropped EXE
PID:1884 -
\??\c:\jjjdp.exec:\jjjdp.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ppvdd.exec:\ppvdd.exe40⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lllfxxr.exec:\lllfxxr.exe41⤵
- Executes dropped EXE
PID:3716 -
\??\c:\tnhbbb.exec:\tnhbbb.exe42⤵
- Executes dropped EXE
PID:4088 -
\??\c:\7ttnhn.exec:\7ttnhn.exe43⤵
- Executes dropped EXE
PID:3968 -
\??\c:\pjpjj.exec:\pjpjj.exe44⤵
- Executes dropped EXE
PID:4988 -
\??\c:\dppvp.exec:\dppvp.exe45⤵
- Executes dropped EXE
PID:4296 -
\??\c:\fffxrrr.exec:\fffxrrr.exe46⤵
- Executes dropped EXE
PID:208 -
\??\c:\thhbhb.exec:\thhbhb.exe47⤵
- Executes dropped EXE
PID:116 -
\??\c:\bthhnt.exec:\bthhnt.exe48⤵
- Executes dropped EXE
PID:5032 -
\??\c:\jdjdj.exec:\jdjdj.exe49⤵
- Executes dropped EXE
PID:1064 -
\??\c:\lxlxxrf.exec:\lxlxxrf.exe50⤵
- Executes dropped EXE
PID:4324 -
\??\c:\xlrrlrr.exec:\xlrrlrr.exe51⤵
- Executes dropped EXE
PID:3304 -
\??\c:\tnnhhn.exec:\tnnhhn.exe52⤵
- Executes dropped EXE
PID:4524 -
\??\c:\tnhbbt.exec:\tnhbbt.exe53⤵
- Executes dropped EXE
PID:5088 -
\??\c:\7pddv.exec:\7pddv.exe54⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lfxxrrf.exec:\lfxxrrf.exe55⤵
- Executes dropped EXE
PID:3144 -
\??\c:\1lfxrfx.exec:\1lfxrfx.exe56⤵
- Executes dropped EXE
PID:644 -
\??\c:\btnhhb.exec:\btnhhb.exe57⤵
- Executes dropped EXE
PID:872 -
\??\c:\nnbthh.exec:\nnbthh.exe58⤵
- Executes dropped EXE
PID:3728 -
\??\c:\jdvvj.exec:\jdvvj.exe59⤵
- Executes dropped EXE
PID:4072 -
\??\c:\xrrfffx.exec:\xrrfffx.exe60⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5ntnnt.exec:\5ntnnt.exe61⤵
- Executes dropped EXE
PID:1204 -
\??\c:\fxxrfxx.exec:\fxxrfxx.exe62⤵
- Executes dropped EXE
PID:4684 -
\??\c:\djddv.exec:\djddv.exe63⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rrrxrrl.exec:\rrrxrrl.exe64⤵
- Executes dropped EXE
PID:3636 -
\??\c:\pppjp.exec:\pppjp.exe65⤵
- Executes dropped EXE
PID:3404 -
\??\c:\lrfrlll.exec:\lrfrlll.exe66⤵PID:1452
-
\??\c:\hbtnhb.exec:\hbtnhb.exe67⤵PID:4884
-
\??\c:\hbttnn.exec:\hbttnn.exe68⤵PID:2464
-
\??\c:\pjpjd.exec:\pjpjd.exe69⤵PID:964
-
\??\c:\dvjvj.exec:\dvjvj.exe70⤵PID:4672
-
\??\c:\1rflllf.exec:\1rflllf.exe71⤵PID:4132
-
\??\c:\nthbnn.exec:\nthbnn.exe72⤵PID:4160
-
\??\c:\tnnhtn.exec:\tnnhtn.exe73⤵PID:5068
-
\??\c:\9vpjv.exec:\9vpjv.exe74⤵PID:2628
-
\??\c:\rrxrrlf.exec:\rrxrrlf.exe75⤵PID:2956
-
\??\c:\1xxrlxr.exec:\1xxrlxr.exe76⤵PID:2936
-
\??\c:\nnhnhh.exec:\nnhnhh.exe77⤵PID:3688
-
\??\c:\nbbnbh.exec:\nbbnbh.exe78⤵PID:1800
-
\??\c:\dddvj.exec:\dddvj.exe79⤵PID:5092
-
\??\c:\xrlfllx.exec:\xrlfllx.exe80⤵PID:4592
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe81⤵PID:1468
-
\??\c:\nhtnnh.exec:\nhtnnh.exe82⤵PID:756
-
\??\c:\bhhbtt.exec:\bhhbtt.exe83⤵PID:1600
-
\??\c:\jpvvj.exec:\jpvvj.exe84⤵PID:2172
-
\??\c:\xlffrll.exec:\xlffrll.exe85⤵
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\llffxxx.exec:\llffxxx.exe86⤵PID:2556
-
\??\c:\tttnhh.exec:\tttnhh.exe87⤵PID:3960
-
\??\c:\hhhbtt.exec:\hhhbtt.exe88⤵PID:2516
-
\??\c:\1jpjd.exec:\1jpjd.exe89⤵PID:968
-
\??\c:\5lrlxxx.exec:\5lrlxxx.exe90⤵
- System Location Discovery: System Language Discovery
PID:4912 -
\??\c:\frrrlff.exec:\frrrlff.exe91⤵PID:1892
-
\??\c:\bhhbtt.exec:\bhhbtt.exe92⤵PID:2688
-
\??\c:\3nbbhn.exec:\3nbbhn.exe93⤵PID:3536
-
\??\c:\vvvvj.exec:\vvvvj.exe94⤵PID:4212
-
\??\c:\rffxrrl.exec:\rffxrrl.exe95⤵PID:1620
-
\??\c:\rxrflfr.exec:\rxrflfr.exe96⤵PID:4888
-
\??\c:\1hnhnn.exec:\1hnhnn.exe97⤵PID:4344
-
\??\c:\pjvjp.exec:\pjvjp.exe98⤵PID:4444
-
\??\c:\djjjd.exec:\djjjd.exe99⤵PID:3628
-
\??\c:\xxfrfff.exec:\xxfrfff.exe100⤵PID:3780
-
\??\c:\3xllllf.exec:\3xllllf.exe101⤵PID:4180
-
\??\c:\bthtbt.exec:\bthtbt.exe102⤵PID:5020
-
\??\c:\ppdvp.exec:\ppdvp.exe103⤵PID:4736
-
\??\c:\7vjdd.exec:\7vjdd.exe104⤵PID:4560
-
\??\c:\lflrlrl.exec:\lflrlrl.exe105⤵
- System Location Discovery: System Language Discovery
PID:4960 -
\??\c:\xlfffrl.exec:\xlfffrl.exe106⤵PID:520
-
\??\c:\thbbtt.exec:\thbbtt.exe107⤵PID:4284
-
\??\c:\ttbnbb.exec:\ttbnbb.exe108⤵PID:1688
-
\??\c:\pvddd.exec:\pvddd.exe109⤵PID:3044
-
\??\c:\5pvpp.exec:\5pvpp.exe110⤵PID:2140
-
\??\c:\rllllll.exec:\rllllll.exe111⤵PID:3580
-
\??\c:\tnhhbn.exec:\tnhhbn.exe112⤵PID:4864
-
\??\c:\nnhhbb.exec:\nnhhbb.exe113⤵PID:3344
-
\??\c:\3jpjv.exec:\3jpjv.exe114⤵PID:1420
-
\??\c:\fxffrrl.exec:\fxffrrl.exe115⤵PID:2592
-
\??\c:\lflfrrx.exec:\lflfrrx.exe116⤵PID:3144
-
\??\c:\tbhhbb.exec:\tbhhbb.exe117⤵PID:644
-
\??\c:\nnntbn.exec:\nnntbn.exe118⤵PID:872
-
\??\c:\dpjvp.exec:\dpjvp.exe119⤵PID:3728
-
\??\c:\7jdvp.exec:\7jdvp.exe120⤵PID:2024
-
\??\c:\7rxrllf.exec:\7rxrllf.exe121⤵PID:3900
-
\??\c:\hntbnb.exec:\hntbnb.exe122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-