Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 03:34
Static task
static1
Behavioral task
behavioral1
Sample
c48c0b9a500c4ee2418708fb70cf9dda5369267f0a704faf21105628d8ea9ef3.exe
Resource
win7-20240708-en
General
-
Target
c48c0b9a500c4ee2418708fb70cf9dda5369267f0a704faf21105628d8ea9ef3.exe
-
Size
332KB
-
MD5
89e6f48bb26666b4fcb9e63f21b02f36
-
SHA1
f0af71e90aa9216f4af24e2b52c966e9d8866a44
-
SHA256
c48c0b9a500c4ee2418708fb70cf9dda5369267f0a704faf21105628d8ea9ef3
-
SHA512
179663cfb274fa07e67d2b50e81b7b4b8a9d06597ab710c343ee57be28cc583443e5fbafed2c1e952bce81f20a09f8faddae30dfb08d6640d27be6c36804961a
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhu:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTe
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1588-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/904-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/796-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-975-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-1057-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-1491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 8 7vvpj.exe 3692 lxfxrlf.exe 4064 7lxrxxl.exe 432 thtnhb.exe 2848 jpvvv.exe 1888 pvpjp.exe 1900 fxfxfff.exe 4316 ttnhnh.exe 3440 jjppj.exe 408 rxlfxrl.exe 3020 dpvvp.exe 4852 rllxrfx.exe 5048 llffxxr.exe 2936 pjpvp.exe 4680 lxrffll.exe 4884 hbttnn.exe 4192 3pvpd.exe 5044 1lxrfxr.exe 3204 tnbbhb.exe 1904 vvpvj.exe 2428 fxfxxrr.exe 2160 btnhnn.exe 904 rffxxxx.exe 3296 bnttbt.exe 4980 pjvvd.exe 3396 rfrllfl.exe 1176 thnnhh.exe 2424 dpdvj.exe 1996 lffrlll.exe 4556 3nnbnh.exe 5000 1nbbbh.exe 2028 5xxrxrf.exe 3668 7rxlxrf.exe 2376 1htnbt.exe 4632 vjpjp.exe 4400 rxlxffl.exe 2780 xrxlxrf.exe 3576 nhtbnb.exe 3004 jpvpv.exe 3848 1xlxxrr.exe 4708 bhhttn.exe 3360 ddddv.exe 4356 jddpd.exe 2792 xllxfxl.exe 1932 tbbnhh.exe 3420 5nthnh.exe 4004 vvppd.exe 436 ffflxrf.exe 1004 lflrxlf.exe 2408 nbhtnh.exe 2324 dpjdp.exe 1580 9xfrffr.exe 2712 3nnbnh.exe 2500 5vjdp.exe 736 3ffxlfr.exe 1600 nbhttn.exe 412 nbhtbt.exe 2080 vjvdv.exe 4700 9xxxlxl.exe 1076 xrrlfxr.exe 5084 hnnhtb.exe 4624 dpdjp.exe 1848 5jdpj.exe 4268 xlrlfxl.exe -
resource yara_rule behavioral2/memory/1588-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/904-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/796-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-751-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1588 wrote to memory of 8 1588 c48c0b9a500c4ee2418708fb70cf9dda5369267f0a704faf21105628d8ea9ef3.exe 83 PID 1588 wrote to memory of 8 1588 c48c0b9a500c4ee2418708fb70cf9dda5369267f0a704faf21105628d8ea9ef3.exe 83 PID 1588 wrote to memory of 8 1588 c48c0b9a500c4ee2418708fb70cf9dda5369267f0a704faf21105628d8ea9ef3.exe 83 PID 8 wrote to memory of 3692 8 7vvpj.exe 84 PID 8 wrote to memory of 3692 8 7vvpj.exe 84 PID 8 wrote to memory of 3692 8 7vvpj.exe 84 PID 3692 wrote to memory of 4064 3692 lxfxrlf.exe 85 PID 3692 wrote to memory of 4064 3692 lxfxrlf.exe 85 PID 3692 wrote to memory of 4064 3692 lxfxrlf.exe 85 PID 4064 wrote to memory of 432 4064 7lxrxxl.exe 86 PID 4064 wrote to memory of 432 4064 7lxrxxl.exe 86 PID 4064 wrote to memory of 432 4064 7lxrxxl.exe 86 PID 432 wrote to memory of 2848 432 thtnhb.exe 87 PID 432 wrote to memory of 2848 432 thtnhb.exe 87 PID 432 wrote to memory of 2848 432 thtnhb.exe 87 PID 2848 wrote to memory of 1888 2848 jpvvv.exe 88 PID 2848 wrote to memory of 1888 2848 jpvvv.exe 88 PID 2848 wrote to memory of 1888 2848 jpvvv.exe 88 PID 1888 wrote to memory of 1900 1888 pvpjp.exe 89 PID 1888 wrote to memory of 1900 1888 pvpjp.exe 89 PID 1888 wrote to memory of 1900 1888 pvpjp.exe 89 PID 1900 wrote to memory of 4316 1900 fxfxfff.exe 90 PID 1900 wrote to memory of 4316 1900 fxfxfff.exe 90 PID 1900 wrote to memory of 4316 1900 fxfxfff.exe 90 PID 4316 wrote to memory of 3440 4316 ttnhnh.exe 92 PID 4316 wrote to memory of 3440 4316 ttnhnh.exe 92 PID 4316 wrote to memory of 3440 4316 ttnhnh.exe 92 PID 3440 wrote to memory of 408 3440 jjppj.exe 93 PID 3440 wrote to memory of 408 3440 jjppj.exe 93 PID 3440 wrote to memory of 408 3440 jjppj.exe 93 PID 408 wrote to memory of 3020 408 rxlfxrl.exe 94 PID 408 wrote to memory of 3020 408 rxlfxrl.exe 94 PID 408 wrote to memory of 3020 408 rxlfxrl.exe 94 PID 3020 wrote to memory of 4852 3020 dpvvp.exe 96 PID 3020 wrote to memory of 4852 3020 dpvvp.exe 96 PID 3020 wrote to memory of 4852 3020 dpvvp.exe 96 PID 4852 wrote to memory of 5048 4852 rllxrfx.exe 97 PID 4852 wrote to memory of 5048 4852 rllxrfx.exe 97 PID 4852 wrote to memory of 5048 4852 rllxrfx.exe 97 PID 5048 wrote to memory of 2936 5048 llffxxr.exe 98 PID 5048 wrote to memory of 2936 5048 llffxxr.exe 98 PID 5048 wrote to memory of 2936 5048 llffxxr.exe 98 PID 2936 wrote to memory of 4680 2936 pjpvp.exe 99 PID 2936 wrote to memory of 4680 2936 pjpvp.exe 99 PID 2936 wrote to memory of 4680 2936 pjpvp.exe 99 PID 4680 wrote to memory of 4884 4680 lxrffll.exe 100 PID 4680 wrote to memory of 4884 4680 lxrffll.exe 100 PID 4680 wrote to memory of 4884 4680 lxrffll.exe 100 PID 4884 wrote to memory of 4192 4884 hbttnn.exe 101 PID 4884 wrote to memory of 4192 4884 hbttnn.exe 101 PID 4884 wrote to memory of 4192 4884 hbttnn.exe 101 PID 4192 wrote to memory of 5044 4192 3pvpd.exe 103 PID 4192 wrote to memory of 5044 4192 3pvpd.exe 103 PID 4192 wrote to memory of 5044 4192 3pvpd.exe 103 PID 5044 wrote to memory of 3204 5044 1lxrfxr.exe 104 PID 5044 wrote to memory of 3204 5044 1lxrfxr.exe 104 PID 5044 wrote to memory of 3204 5044 1lxrfxr.exe 104 PID 3204 wrote to memory of 1904 3204 tnbbhb.exe 105 PID 3204 wrote to memory of 1904 3204 tnbbhb.exe 105 PID 3204 wrote to memory of 1904 3204 tnbbhb.exe 105 PID 1904 wrote to memory of 2428 1904 vvpvj.exe 106 PID 1904 wrote to memory of 2428 1904 vvpvj.exe 106 PID 1904 wrote to memory of 2428 1904 vvpvj.exe 106 PID 2428 wrote to memory of 2160 2428 fxfxxrr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c48c0b9a500c4ee2418708fb70cf9dda5369267f0a704faf21105628d8ea9ef3.exe"C:\Users\Admin\AppData\Local\Temp\c48c0b9a500c4ee2418708fb70cf9dda5369267f0a704faf21105628d8ea9ef3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\7vvpj.exec:\7vvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\7lxrxxl.exec:\7lxrxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\thtnhb.exec:\thtnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\jpvvv.exec:\jpvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\pvpjp.exec:\pvpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\fxfxfff.exec:\fxfxfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\ttnhnh.exec:\ttnhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\jjppj.exec:\jjppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\dpvvp.exec:\dpvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\rllxrfx.exec:\rllxrfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\llffxxr.exec:\llffxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\pjpvp.exec:\pjpvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lxrffll.exec:\lxrffll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\hbttnn.exec:\hbttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\3pvpd.exec:\3pvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\1lxrfxr.exec:\1lxrfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\tnbbhb.exec:\tnbbhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\vvpvj.exec:\vvpvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\btnhnn.exec:\btnhnn.exe23⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rffxxxx.exec:\rffxxxx.exe24⤵
- Executes dropped EXE
PID:904 -
\??\c:\bnttbt.exec:\bnttbt.exe25⤵
- Executes dropped EXE
PID:3296 -
\??\c:\pjvvd.exec:\pjvvd.exe26⤵
- Executes dropped EXE
PID:4980 -
\??\c:\rfrllfl.exec:\rfrllfl.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3396 -
\??\c:\thnnhh.exec:\thnnhh.exe28⤵
- Executes dropped EXE
PID:1176 -
\??\c:\dpdvj.exec:\dpdvj.exe29⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lffrlll.exec:\lffrlll.exe30⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3nnbnh.exec:\3nnbnh.exe31⤵
- Executes dropped EXE
PID:4556 -
\??\c:\1nbbbh.exec:\1nbbbh.exe32⤵
- Executes dropped EXE
PID:5000 -
\??\c:\5xxrxrf.exec:\5xxrxrf.exe33⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7rxlxrf.exec:\7rxlxrf.exe34⤵
- Executes dropped EXE
PID:3668 -
\??\c:\1htnbt.exec:\1htnbt.exe35⤵
- Executes dropped EXE
PID:2376 -
\??\c:\vjpjp.exec:\vjpjp.exe36⤵
- Executes dropped EXE
PID:4632 -
\??\c:\rxlxffl.exec:\rxlxffl.exe37⤵
- Executes dropped EXE
PID:4400 -
\??\c:\xrxlxrf.exec:\xrxlxrf.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nhtbnb.exec:\nhtbnb.exe39⤵
- Executes dropped EXE
PID:3576 -
\??\c:\jpvpv.exec:\jpvpv.exe40⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1xlxxrr.exec:\1xlxxrr.exe41⤵
- Executes dropped EXE
PID:3848 -
\??\c:\bhhttn.exec:\bhhttn.exe42⤵
- Executes dropped EXE
PID:4708 -
\??\c:\ddddv.exec:\ddddv.exe43⤵
- Executes dropped EXE
PID:3360 -
\??\c:\jddpd.exec:\jddpd.exe44⤵
- Executes dropped EXE
PID:4356 -
\??\c:\xllxfxl.exec:\xllxfxl.exe45⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tbbnhh.exec:\tbbnhh.exe46⤵
- Executes dropped EXE
PID:1932 -
\??\c:\5nthnh.exec:\5nthnh.exe47⤵
- Executes dropped EXE
PID:3420 -
\??\c:\vvppd.exec:\vvppd.exe48⤵
- Executes dropped EXE
PID:4004 -
\??\c:\ffflxrf.exec:\ffflxrf.exe49⤵
- Executes dropped EXE
PID:436 -
\??\c:\lflrxlf.exec:\lflrxlf.exe50⤵
- Executes dropped EXE
PID:1004 -
\??\c:\nbhtnh.exec:\nbhtnh.exe51⤵
- Executes dropped EXE
PID:2408 -
\??\c:\dpjdp.exec:\dpjdp.exe52⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9xfrffr.exec:\9xfrffr.exe53⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3nnbnh.exec:\3nnbnh.exe54⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5vjdp.exec:\5vjdp.exe55⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3ffxlfr.exec:\3ffxlfr.exe56⤵
- Executes dropped EXE
PID:736 -
\??\c:\nbhttn.exec:\nbhttn.exe57⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nbhtbt.exec:\nbhtbt.exe58⤵
- Executes dropped EXE
PID:412 -
\??\c:\vjvdv.exec:\vjvdv.exe59⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9xxxlxl.exec:\9xxxlxl.exe60⤵
- Executes dropped EXE
PID:4700 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe61⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hnnhtb.exec:\hnnhtb.exe62⤵
- Executes dropped EXE
PID:5084 -
\??\c:\dpdjp.exec:\dpdjp.exe63⤵
- Executes dropped EXE
PID:4624 -
\??\c:\5jdpj.exec:\5jdpj.exe64⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xlrlfxl.exec:\xlrlfxl.exe65⤵
- Executes dropped EXE
PID:4268 -
\??\c:\xlxrfxl.exec:\xlxrfxl.exe66⤵PID:1940
-
\??\c:\bnthhb.exec:\bnthhb.exe67⤵PID:400
-
\??\c:\jvjvv.exec:\jvjvv.exe68⤵PID:2756
-
\??\c:\pddpj.exec:\pddpj.exe69⤵PID:1220
-
\??\c:\lrxfrlx.exec:\lrxfrlx.exe70⤵PID:4272
-
\??\c:\ntbthb.exec:\ntbthb.exe71⤵PID:3248
-
\??\c:\pjpjp.exec:\pjpjp.exe72⤵PID:4040
-
\??\c:\jvpdp.exec:\jvpdp.exe73⤵PID:2996
-
\??\c:\llffffx.exec:\llffffx.exe74⤵PID:1200
-
\??\c:\rfrxffl.exec:\rfrxffl.exe75⤵PID:3560
-
\??\c:\nbbnbb.exec:\nbbnbb.exe76⤵PID:1504
-
\??\c:\bhbhnn.exec:\bhbhnn.exe77⤵PID:3352
-
\??\c:\dvjdj.exec:\dvjdj.exe78⤵PID:748
-
\??\c:\rllfrll.exec:\rllfrll.exe79⤵PID:3292
-
\??\c:\rfxrffx.exec:\rfxrffx.exe80⤵PID:2368
-
\??\c:\bbbthh.exec:\bbbthh.exe81⤵PID:3532
-
\??\c:\bhnbnn.exec:\bhnbnn.exe82⤵PID:1080
-
\??\c:\jppvj.exec:\jppvj.exe83⤵PID:1148
-
\??\c:\rxrlrlf.exec:\rxrlrlf.exe84⤵PID:4588
-
\??\c:\3bbthb.exec:\3bbthb.exe85⤵PID:2824
-
\??\c:\vvvvj.exec:\vvvvj.exe86⤵PID:4076
-
\??\c:\pdjvj.exec:\pdjvj.exe87⤵PID:4632
-
\??\c:\rffrxrl.exec:\rffrxrl.exe88⤵PID:796
-
\??\c:\rrxlxrl.exec:\rrxlxrl.exe89⤵PID:1740
-
\??\c:\3bnhtt.exec:\3bnhtt.exe90⤵PID:1916
-
\??\c:\vdpjv.exec:\vdpjv.exe91⤵PID:320
-
\??\c:\rflrfxf.exec:\rflrfxf.exe92⤵PID:708
-
\??\c:\frrfrlf.exec:\frrfrlf.exe93⤵PID:2856
-
\??\c:\hntnhh.exec:\hntnhh.exe94⤵PID:2572
-
\??\c:\nbbtnh.exec:\nbbtnh.exe95⤵PID:3880
-
\??\c:\vdjdp.exec:\vdjdp.exe96⤵PID:1932
-
\??\c:\xlxrxff.exec:\xlxrxff.exe97⤵PID:3420
-
\??\c:\thbttt.exec:\thbttt.exe98⤵PID:4420
-
\??\c:\tntbnb.exec:\tntbnb.exe99⤵PID:3440
-
\??\c:\3pjvd.exec:\3pjvd.exe100⤵PID:4476
-
\??\c:\5ddpj.exec:\5ddpj.exe101⤵PID:1196
-
\??\c:\xflxfxr.exec:\xflxfxr.exe102⤵PID:4080
-
\??\c:\fllfrrf.exec:\fllfrrf.exe103⤵PID:4852
-
\??\c:\nhnhbb.exec:\nhnhbb.exe104⤵PID:4144
-
\??\c:\xlrxfxl.exec:\xlrxfxl.exe105⤵PID:2936
-
\??\c:\bthbbn.exec:\bthbbn.exe106⤵PID:1180
-
\??\c:\nhhtnh.exec:\nhhtnh.exe107⤵PID:3952
-
\??\c:\vvdvj.exec:\vvdvj.exe108⤵PID:412
-
\??\c:\lflfxrr.exec:\lflfxrr.exe109⤵PID:3892
-
\??\c:\7ttbtt.exec:\7ttbtt.exe110⤵PID:60
-
\??\c:\nbbtnn.exec:\nbbtnn.exe111⤵
- System Location Discovery: System Language Discovery
PID:1076 -
\??\c:\jvjdp.exec:\jvjdp.exe112⤵PID:664
-
\??\c:\frxlxrl.exec:\frxlxrl.exe113⤵PID:2812
-
\??\c:\rlffxrr.exec:\rlffxrr.exe114⤵PID:4320
-
\??\c:\hhnbnh.exec:\hhnbnh.exe115⤵PID:5040
-
\??\c:\jvpjd.exec:\jvpjd.exe116⤵PID:4828
-
\??\c:\jdjdp.exec:\jdjdp.exe117⤵PID:4984
-
\??\c:\fflfllx.exec:\fflfllx.exe118⤵PID:3864
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe119⤵PID:2160
-
\??\c:\ntthbt.exec:\ntthbt.exe120⤵PID:2924
-
\??\c:\jjjjv.exec:\jjjjv.exe121⤵PID:2544
-
\??\c:\djjpj.exec:\djjpj.exe122⤵PID:1840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-