Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 02:55
Behavioral task
behavioral1
Sample
778c75f6ed032dbd225be82f6e7baf70N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
778c75f6ed032dbd225be82f6e7baf70N.exe
-
Size
59KB
-
MD5
778c75f6ed032dbd225be82f6e7baf70
-
SHA1
90f7dc76e9a65a3948d45a527cb446550f8a3f0d
-
SHA256
60449e2705d99a54366a4fc690970dfe1702ec9ab5042c89ea3b4693843329f6
-
SHA512
8ba3b4e5a0dbc1143236b848b073b999261c6bd671707c1180382bbf68b67e254b88f6d8f95cc64fe85f1dabf0a1e0d48967d14bcd10d738a7da7911e800c6f0
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNlIQjdWZ9+J8:khOmTsF93UYfwC6GIoutpYcvjdWn
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5004-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/648-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3248-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2072-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1288-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/348-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-610-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-641-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/320-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-732-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-772-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-864-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/924-900-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-907-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-914-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-1200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3140 fxlllrx.exe 4092 1xlrxxr.exe 4520 llflflf.exe 1448 9ffrlfx.exe 5028 3tbnnn.exe 2120 frfc860.exe 3696 8284260.exe 3848 80266.exe 4640 llxrxxx.exe 648 nnhntt.exe 4180 84620.exe 2440 48844.exe 2096 fxrrlrl.exe 4824 hnnhbt.exe 1656 0862004.exe 2908 8240622.exe 2500 vpjvp.exe 3248 xrlfxrl.exe 3112 nhbbbh.exe 2280 jjpdd.exe 2356 08060.exe 4904 7fxfrrl.exe 4540 flfrxlx.exe 4732 64208.exe 368 o882666.exe 4392 3vdpj.exe 2072 pdpjv.exe 5004 lflfxlf.exe 3428 bbtttt.exe 3348 60666.exe 896 680844.exe 4552 ffrlxxl.exe 2120 fxxrlff.exe 4456 486622.exe 708 48848.exe 3848 i248000.exe 1612 lfffxxr.exe 1688 880044.exe 4180 68442.exe 4832 020408.exe 1180 62220.exe 3432 thhthh.exe 4088 8404822.exe 1656 nbnnnb.exe 4736 8844248.exe 2908 6246006.exe 1052 82444.exe 4316 htbttt.exe 4248 6444664.exe 908 06826.exe 3516 80682.exe 2144 2800882.exe 3448 04066.exe 336 202648.exe 5084 bnbthb.exe 4764 60862.exe 2260 frxrxrl.exe 1288 k88266.exe 4268 488080.exe 3712 nbhnbb.exe 1212 lxffrll.exe 5004 ddvvp.exe 2400 lrrrllf.exe 3548 42206.exe -
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000235ce-3.dat upx behavioral2/memory/5004-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000235d1-9.dat upx behavioral2/memory/4092-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235d5-11.dat upx behavioral2/files/0x00070000000235d6-22.dat upx behavioral2/memory/4520-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3140-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235d7-27.dat upx behavioral2/files/0x00070000000235d9-32.dat upx behavioral2/memory/2120-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3696-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235da-40.dat upx behavioral2/files/0x00070000000235db-46.dat upx behavioral2/memory/3848-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5028-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235dc-51.dat upx behavioral2/memory/3848-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235dd-56.dat upx behavioral2/memory/4640-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235de-62.dat upx behavioral2/memory/648-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235df-67.dat upx behavioral2/memory/4180-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235e0-73.dat upx behavioral2/memory/2440-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235e1-79.dat upx behavioral2/memory/2096-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4824-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235e2-84.dat upx behavioral2/files/0x00070000000235e3-90.dat upx behavioral2/files/0x00070000000235e4-96.dat upx behavioral2/memory/2908-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235e5-101.dat upx behavioral2/memory/2500-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235e6-107.dat upx behavioral2/memory/3248-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3112-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2280-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235e7-115.dat upx behavioral2/files/0x00070000000235e8-120.dat upx behavioral2/memory/2356-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235e9-126.dat upx behavioral2/files/0x00070000000235ea-131.dat upx behavioral2/memory/4904-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235eb-137.dat upx behavioral2/files/0x00080000000235d2-143.dat upx behavioral2/files/0x00070000000235ec-147.dat upx behavioral2/files/0x00070000000235ed-153.dat upx behavioral2/files/0x00070000000235ee-157.dat upx behavioral2/memory/5004-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2072-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235ef-164.dat upx behavioral2/files/0x00070000000235f0-171.dat upx behavioral2/memory/3428-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235f1-175.dat upx behavioral2/memory/3348-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235f2-182.dat upx behavioral2/memory/896-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2120-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3848-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1612-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4832-216-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66264.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 800082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8226020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 406644.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4260826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 3140 5004 778c75f6ed032dbd225be82f6e7baf70N.exe 91 PID 5004 wrote to memory of 3140 5004 778c75f6ed032dbd225be82f6e7baf70N.exe 91 PID 5004 wrote to memory of 3140 5004 778c75f6ed032dbd225be82f6e7baf70N.exe 91 PID 3140 wrote to memory of 4092 3140 fxlllrx.exe 92 PID 3140 wrote to memory of 4092 3140 fxlllrx.exe 92 PID 3140 wrote to memory of 4092 3140 fxlllrx.exe 92 PID 4092 wrote to memory of 4520 4092 1xlrxxr.exe 93 PID 4092 wrote to memory of 4520 4092 1xlrxxr.exe 93 PID 4092 wrote to memory of 4520 4092 1xlrxxr.exe 93 PID 4520 wrote to memory of 1448 4520 llflflf.exe 94 PID 4520 wrote to memory of 1448 4520 llflflf.exe 94 PID 4520 wrote to memory of 1448 4520 llflflf.exe 94 PID 1448 wrote to memory of 5028 1448 9ffrlfx.exe 95 PID 1448 wrote to memory of 5028 1448 9ffrlfx.exe 95 PID 1448 wrote to memory of 5028 1448 9ffrlfx.exe 95 PID 5028 wrote to memory of 2120 5028 3tbnnn.exe 96 PID 5028 wrote to memory of 2120 5028 3tbnnn.exe 96 PID 5028 wrote to memory of 2120 5028 3tbnnn.exe 96 PID 2120 wrote to memory of 3696 2120 frfc860.exe 97 PID 2120 wrote to memory of 3696 2120 frfc860.exe 97 PID 2120 wrote to memory of 3696 2120 frfc860.exe 97 PID 3696 wrote to memory of 3848 3696 8284260.exe 98 PID 3696 wrote to memory of 3848 3696 8284260.exe 98 PID 3696 wrote to memory of 3848 3696 8284260.exe 98 PID 3848 wrote to memory of 4640 3848 80266.exe 99 PID 3848 wrote to memory of 4640 3848 80266.exe 99 PID 3848 wrote to memory of 4640 3848 80266.exe 99 PID 4640 wrote to memory of 648 4640 llxrxxx.exe 100 PID 4640 wrote to memory of 648 4640 llxrxxx.exe 100 PID 4640 wrote to memory of 648 4640 llxrxxx.exe 100 PID 648 wrote to memory of 4180 648 nnhntt.exe 101 PID 648 wrote to memory of 4180 648 nnhntt.exe 101 PID 648 wrote to memory of 4180 648 nnhntt.exe 101 PID 4180 wrote to memory of 2440 4180 84620.exe 102 PID 4180 wrote to memory of 2440 4180 84620.exe 102 PID 4180 wrote to memory of 2440 4180 84620.exe 102 PID 2440 wrote to memory of 2096 2440 48844.exe 104 PID 2440 wrote to memory of 2096 2440 48844.exe 104 PID 2440 wrote to memory of 2096 2440 48844.exe 104 PID 2096 wrote to memory of 4824 2096 fxrrlrl.exe 105 PID 2096 wrote to memory of 4824 2096 fxrrlrl.exe 105 PID 2096 wrote to memory of 4824 2096 fxrrlrl.exe 105 PID 4824 wrote to memory of 1656 4824 hnnhbt.exe 106 PID 4824 wrote to memory of 1656 4824 hnnhbt.exe 106 PID 4824 wrote to memory of 1656 4824 hnnhbt.exe 106 PID 1656 wrote to memory of 2908 1656 0862004.exe 107 PID 1656 wrote to memory of 2908 1656 0862004.exe 107 PID 1656 wrote to memory of 2908 1656 0862004.exe 107 PID 2908 wrote to memory of 2500 2908 8240622.exe 108 PID 2908 wrote to memory of 2500 2908 8240622.exe 108 PID 2908 wrote to memory of 2500 2908 8240622.exe 108 PID 2500 wrote to memory of 3248 2500 vpjvp.exe 109 PID 2500 wrote to memory of 3248 2500 vpjvp.exe 109 PID 2500 wrote to memory of 3248 2500 vpjvp.exe 109 PID 3248 wrote to memory of 3112 3248 xrlfxrl.exe 110 PID 3248 wrote to memory of 3112 3248 xrlfxrl.exe 110 PID 3248 wrote to memory of 3112 3248 xrlfxrl.exe 110 PID 3112 wrote to memory of 2280 3112 nhbbbh.exe 111 PID 3112 wrote to memory of 2280 3112 nhbbbh.exe 111 PID 3112 wrote to memory of 2280 3112 nhbbbh.exe 111 PID 2280 wrote to memory of 2356 2280 jjpdd.exe 113 PID 2280 wrote to memory of 2356 2280 jjpdd.exe 113 PID 2280 wrote to memory of 2356 2280 jjpdd.exe 113 PID 2356 wrote to memory of 4904 2356 08060.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\778c75f6ed032dbd225be82f6e7baf70N.exe"C:\Users\Admin\AppData\Local\Temp\778c75f6ed032dbd225be82f6e7baf70N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\fxlllrx.exec:\fxlllrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\1xlrxxr.exec:\1xlrxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\llflflf.exec:\llflflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\9ffrlfx.exec:\9ffrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\3tbnnn.exec:\3tbnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\frfc860.exec:\frfc860.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\8284260.exec:\8284260.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\80266.exec:\80266.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\llxrxxx.exec:\llxrxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\nnhntt.exec:\nnhntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\84620.exec:\84620.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\48844.exec:\48844.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\fxrrlrl.exec:\fxrrlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\hnnhbt.exec:\hnnhbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\0862004.exec:\0862004.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\8240622.exec:\8240622.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vpjvp.exec:\vpjvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\nhbbbh.exec:\nhbbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\jjpdd.exec:\jjpdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\08060.exec:\08060.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\7fxfrrl.exec:\7fxfrrl.exe23⤵
- Executes dropped EXE
PID:4904 -
\??\c:\flfrxlx.exec:\flfrxlx.exe24⤵
- Executes dropped EXE
PID:4540 -
\??\c:\64208.exec:\64208.exe25⤵
- Executes dropped EXE
PID:4732 -
\??\c:\o882666.exec:\o882666.exe26⤵
- Executes dropped EXE
PID:368 -
\??\c:\3vdpj.exec:\3vdpj.exe27⤵
- Executes dropped EXE
PID:4392 -
\??\c:\pdpjv.exec:\pdpjv.exe28⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lflfxlf.exec:\lflfxlf.exe29⤵
- Executes dropped EXE
PID:5004 -
\??\c:\bbtttt.exec:\bbtttt.exe30⤵
- Executes dropped EXE
PID:3428 -
\??\c:\60666.exec:\60666.exe31⤵
- Executes dropped EXE
PID:3348 -
\??\c:\680844.exec:\680844.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\ffrlxxl.exec:\ffrlxxl.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\fxxrlff.exec:\fxxrlff.exe34⤵
- Executes dropped EXE
PID:2120 -
\??\c:\486622.exec:\486622.exe35⤵
- Executes dropped EXE
PID:4456 -
\??\c:\48848.exec:\48848.exe36⤵
- Executes dropped EXE
PID:708 -
\??\c:\i248000.exec:\i248000.exe37⤵
- Executes dropped EXE
PID:3848 -
\??\c:\lfffxxr.exec:\lfffxxr.exe38⤵
- Executes dropped EXE
PID:1612 -
\??\c:\880044.exec:\880044.exe39⤵
- Executes dropped EXE
PID:1688 -
\??\c:\68442.exec:\68442.exe40⤵
- Executes dropped EXE
PID:4180 -
\??\c:\020408.exec:\020408.exe41⤵
- Executes dropped EXE
PID:4832 -
\??\c:\62220.exec:\62220.exe42⤵
- Executes dropped EXE
PID:1180 -
\??\c:\thhthh.exec:\thhthh.exe43⤵
- Executes dropped EXE
PID:3432 -
\??\c:\8404822.exec:\8404822.exe44⤵
- Executes dropped EXE
PID:4088 -
\??\c:\nbnnnb.exec:\nbnnnb.exe45⤵
- Executes dropped EXE
PID:1656 -
\??\c:\8844248.exec:\8844248.exe46⤵
- Executes dropped EXE
PID:4736 -
\??\c:\6246006.exec:\6246006.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\82444.exec:\82444.exe48⤵
- Executes dropped EXE
PID:1052 -
\??\c:\htbttt.exec:\htbttt.exe49⤵
- Executes dropped EXE
PID:4316 -
\??\c:\6444664.exec:\6444664.exe50⤵
- Executes dropped EXE
PID:4248 -
\??\c:\06826.exec:\06826.exe51⤵
- Executes dropped EXE
PID:908 -
\??\c:\80682.exec:\80682.exe52⤵
- Executes dropped EXE
PID:3516 -
\??\c:\2800882.exec:\2800882.exe53⤵
- Executes dropped EXE
PID:2144 -
\??\c:\04066.exec:\04066.exe54⤵
- Executes dropped EXE
PID:3448 -
\??\c:\202648.exec:\202648.exe55⤵
- Executes dropped EXE
PID:336 -
\??\c:\bnbthb.exec:\bnbthb.exe56⤵
- Executes dropped EXE
PID:5084 -
\??\c:\60862.exec:\60862.exe57⤵
- Executes dropped EXE
PID:4764 -
\??\c:\frxrxrl.exec:\frxrxrl.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\k88266.exec:\k88266.exe59⤵
- Executes dropped EXE
PID:1288 -
\??\c:\488080.exec:\488080.exe60⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nbhnbb.exec:\nbhnbb.exe61⤵
- Executes dropped EXE
PID:3712 -
\??\c:\lxffrll.exec:\lxffrll.exe62⤵
- Executes dropped EXE
PID:1212 -
\??\c:\ddvvp.exec:\ddvvp.exe63⤵
- Executes dropped EXE
PID:5004 -
\??\c:\lrrrllf.exec:\lrrrllf.exe64⤵
- Executes dropped EXE
PID:2400 -
\??\c:\42206.exec:\42206.exe65⤵
- Executes dropped EXE
PID:3548 -
\??\c:\lrxxrll.exec:\lrxxrll.exe66⤵PID:3348
-
\??\c:\8602880.exec:\8602880.exe67⤵PID:412
-
\??\c:\2244226.exec:\2244226.exe68⤵PID:2052
-
\??\c:\882622.exec:\882622.exe69⤵PID:3412
-
\??\c:\c622828.exec:\c622828.exe70⤵PID:1960
-
\??\c:\26882.exec:\26882.exe71⤵PID:4456
-
\??\c:\rlfllfr.exec:\rlfllfr.exe72⤵PID:2468
-
\??\c:\5llllff.exec:\5llllff.exe73⤵PID:532
-
\??\c:\228002.exec:\228002.exe74⤵PID:648
-
\??\c:\nhtnbh.exec:\nhtnbh.exe75⤵PID:2364
-
\??\c:\9pdjd.exec:\9pdjd.exe76⤵PID:2440
-
\??\c:\24660.exec:\24660.exe77⤵PID:692
-
\??\c:\824884.exec:\824884.exe78⤵PID:4700
-
\??\c:\28040.exec:\28040.exe79⤵PID:5040
-
\??\c:\222048.exec:\222048.exe80⤵PID:1888
-
\??\c:\9pppd.exec:\9pppd.exe81⤵PID:3924
-
\??\c:\64666.exec:\64666.exe82⤵PID:3220
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe83⤵
- System Location Discovery: System Language Discovery
PID:4024 -
\??\c:\4866264.exec:\4866264.exe84⤵PID:4984
-
\??\c:\64026.exec:\64026.exe85⤵PID:1940
-
\??\c:\406644.exec:\406644.exe86⤵
- System Location Discovery: System Language Discovery
PID:3768 -
\??\c:\llfxxxx.exec:\llfxxxx.exe87⤵PID:2944
-
\??\c:\btbnnb.exec:\btbnnb.exe88⤵PID:3664
-
\??\c:\u844222.exec:\u844222.exe89⤵PID:2256
-
\??\c:\6800044.exec:\6800044.exe90⤵PID:336
-
\??\c:\ppvpv.exec:\ppvpv.exe91⤵PID:3232
-
\??\c:\84266.exec:\84266.exe92⤵PID:4764
-
\??\c:\u460448.exec:\u460448.exe93⤵PID:4720
-
\??\c:\22662.exec:\22662.exe94⤵PID:1924
-
\??\c:\66284.exec:\66284.exe95⤵PID:4204
-
\??\c:\0066448.exec:\0066448.exe96⤵PID:2420
-
\??\c:\2444222.exec:\2444222.exe97⤵PID:1564
-
\??\c:\hthbbb.exec:\hthbbb.exe98⤵PID:5004
-
\??\c:\668444.exec:\668444.exe99⤵PID:2400
-
\??\c:\000044.exec:\000044.exe100⤵PID:3036
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe101⤵PID:3348
-
\??\c:\08688.exec:\08688.exe102⤵PID:400
-
\??\c:\xlllxxl.exec:\xlllxxl.exe103⤵PID:2052
-
\??\c:\pjjpp.exec:\pjjpp.exe104⤵PID:348
-
\??\c:\7xrlxrf.exec:\7xrlxrf.exe105⤵PID:1960
-
\??\c:\nbbbbb.exec:\nbbbbb.exe106⤵PID:4156
-
\??\c:\60666.exec:\60666.exe107⤵PID:3848
-
\??\c:\u060488.exec:\u060488.exe108⤵PID:4480
-
\??\c:\288826.exec:\288826.exe109⤵PID:4676
-
\??\c:\4808226.exec:\4808226.exe110⤵PID:2364
-
\??\c:\44666.exec:\44666.exe111⤵PID:2440
-
\??\c:\5hnhhh.exec:\5hnhhh.exe112⤵PID:692
-
\??\c:\thhbnn.exec:\thhbnn.exe113⤵PID:4700
-
\??\c:\xfllfxx.exec:\xfllfxx.exe114⤵PID:840
-
\??\c:\btnhbn.exec:\btnhbn.exe115⤵PID:944
-
\??\c:\804406.exec:\804406.exe116⤵PID:2984
-
\??\c:\nththb.exec:\nththb.exe117⤵PID:2044
-
\??\c:\llxxxfx.exec:\llxxxfx.exe118⤵PID:908
-
\??\c:\6000864.exec:\6000864.exe119⤵PID:2004
-
\??\c:\a0826.exec:\a0826.exe120⤵PID:4536
-
\??\c:\260440.exec:\260440.exe121⤵PID:1916
-
\??\c:\46260.exec:\46260.exe122⤵PID:1992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-