Analysis
-
max time kernel
120s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 12:55
Behavioral task
behavioral1
Sample
1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe
-
Size
329KB
-
MD5
5d74832ce0107b6b114745d24b1755a0
-
SHA1
3eb55d32a3791015440cf9cfa3dce7fa2132b016
-
SHA256
1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675
-
SHA512
6c9521a777d3018d9ed868f3a872826d3e5fb1e56e0f5c5d4a07024cd4aba89b08fae673126d2f4ca99cc0845367f934356f6896f73959a0e20c9febfed91f82
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7ta:94wFHoStJdSjylh2b77BoTMA9gX59sTi
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3924-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/592-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3356-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-779-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-1112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-1135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1492 lxfxxxr.exe 3068 dvjdv.exe 4508 xflfxfx.exe 2440 9nbtnt.exe 2520 pppjd.exe 1184 dvddd.exe 4888 lxfxrrl.exe 4948 dpvvv.exe 2232 xflllfx.exe 3112 dvddv.exe 3064 llxrrxr.exe 3476 bhnbbn.exe 592 pjpdp.exe 4448 nhnntn.exe 1072 ppddp.exe 3852 rlrrlff.exe 3460 tnbbbh.exe 3620 dddvp.exe 4288 lrlflxl.exe 1012 dddvp.exe 4840 rfllflf.exe 4424 rrxxrrl.exe 1700 5rxllfx.exe 4764 ttnbnn.exe 3972 5ntbtt.exe 4256 ttbtnh.exe 4808 htnhnh.exe 3172 dvvpd.exe 624 jddvj.exe 1544 rxlrlxr.exe 384 ttnnhb.exe 3672 vdjdp.exe 184 lffrlff.exe 1860 hnbtth.exe 1240 pjddd.exe 3888 xxxflrf.exe 3000 hhhhhn.exe 4292 vvjdd.exe 3764 rllfrrl.exe 1332 hthntt.exe 1584 5dpjv.exe 2924 flrlfxf.exe 4180 9hnhtt.exe 4384 vjppj.exe 1640 rlffffx.exe 4404 ntnnhh.exe 1188 htntnt.exe 3496 jjvpv.exe 4392 xlrllll.exe 4052 nnbbtt.exe 1708 vdppj.exe 1496 nhnhbb.exe 1488 nththt.exe 1992 ppppj.exe 2156 xfffxrr.exe 2080 hbbttt.exe 3412 dpddp.exe 1088 fllllrr.exe 2036 nbhhbh.exe 4896 vdpdd.exe 2084 pdddd.exe 2444 9lrlxxl.exe 424 hhthht.exe 3168 vpddj.exe -
resource yara_rule behavioral2/memory/3924-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b30-3.dat upx behavioral2/memory/3924-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b83-8.dat upx behavioral2/memory/1492-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b84-11.dat upx behavioral2/memory/3068-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b85-18.dat upx behavioral2/memory/2440-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b86-25.dat upx behavioral2/memory/2440-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4508-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b87-29.dat upx behavioral2/memory/2520-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1184-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b88-34.dat upx behavioral2/files/0x0031000000023b89-39.dat upx behavioral2/memory/4888-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b8a-44.dat upx behavioral2/memory/4948-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-49.dat upx behavioral2/memory/2232-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-54.dat upx behavioral2/memory/3112-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-59.dat upx behavioral2/files/0x000a000000023b8e-63.dat upx behavioral2/memory/3476-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-68.dat upx behavioral2/memory/592-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b90-73.dat upx behavioral2/memory/4448-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b7c-78.dat upx behavioral2/memory/1072-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-83.dat upx behavioral2/memory/3852-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-88.dat upx behavioral2/memory/3460-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3620-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b93-94.dat upx behavioral2/files/0x000a000000023b92-98.dat upx behavioral2/memory/4288-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b94-103.dat upx behavioral2/memory/1012-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4424-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b95-108.dat upx behavioral2/files/0x000a000000023b96-113.dat upx behavioral2/memory/4424-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-118.dat upx behavioral2/memory/4764-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1700-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-124.dat upx behavioral2/memory/3972-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b99-130.dat upx behavioral2/files/0x000a000000023b9a-133.dat upx behavioral2/files/0x000a000000023b9b-137.dat upx behavioral2/memory/4808-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-142.dat upx behavioral2/memory/3172-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-147.dat upx behavioral2/files/0x000b000000023ba0-151.dat upx behavioral2/memory/1544-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023ba1-156.dat upx behavioral2/memory/384-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1860-165-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3924 wrote to memory of 1492 3924 1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe 83 PID 3924 wrote to memory of 1492 3924 1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe 83 PID 3924 wrote to memory of 1492 3924 1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe 83 PID 1492 wrote to memory of 3068 1492 lxfxxxr.exe 84 PID 1492 wrote to memory of 3068 1492 lxfxxxr.exe 84 PID 1492 wrote to memory of 3068 1492 lxfxxxr.exe 84 PID 3068 wrote to memory of 4508 3068 dvjdv.exe 85 PID 3068 wrote to memory of 4508 3068 dvjdv.exe 85 PID 3068 wrote to memory of 4508 3068 dvjdv.exe 85 PID 4508 wrote to memory of 2440 4508 xflfxfx.exe 86 PID 4508 wrote to memory of 2440 4508 xflfxfx.exe 86 PID 4508 wrote to memory of 2440 4508 xflfxfx.exe 86 PID 2440 wrote to memory of 2520 2440 9nbtnt.exe 88 PID 2440 wrote to memory of 2520 2440 9nbtnt.exe 88 PID 2440 wrote to memory of 2520 2440 9nbtnt.exe 88 PID 2520 wrote to memory of 1184 2520 pppjd.exe 91 PID 2520 wrote to memory of 1184 2520 pppjd.exe 91 PID 2520 wrote to memory of 1184 2520 pppjd.exe 91 PID 1184 wrote to memory of 4888 1184 dvddd.exe 92 PID 1184 wrote to memory of 4888 1184 dvddd.exe 92 PID 1184 wrote to memory of 4888 1184 dvddd.exe 92 PID 4888 wrote to memory of 4948 4888 lxfxrrl.exe 93 PID 4888 wrote to memory of 4948 4888 lxfxrrl.exe 93 PID 4888 wrote to memory of 4948 4888 lxfxrrl.exe 93 PID 4948 wrote to memory of 2232 4948 dpvvv.exe 94 PID 4948 wrote to memory of 2232 4948 dpvvv.exe 94 PID 4948 wrote to memory of 2232 4948 dpvvv.exe 94 PID 2232 wrote to memory of 3112 2232 xflllfx.exe 95 PID 2232 wrote to memory of 3112 2232 xflllfx.exe 95 PID 2232 wrote to memory of 3112 2232 xflllfx.exe 95 PID 3112 wrote to memory of 3064 3112 dvddv.exe 96 PID 3112 wrote to memory of 3064 3112 dvddv.exe 96 PID 3112 wrote to memory of 3064 3112 dvddv.exe 96 PID 3064 wrote to memory of 3476 3064 llxrrxr.exe 97 PID 3064 wrote to memory of 3476 3064 llxrrxr.exe 97 PID 3064 wrote to memory of 3476 3064 llxrrxr.exe 97 PID 3476 wrote to memory of 592 3476 bhnbbn.exe 98 PID 3476 wrote to memory of 592 3476 bhnbbn.exe 98 PID 3476 wrote to memory of 592 3476 bhnbbn.exe 98 PID 592 wrote to memory of 4448 592 pjpdp.exe 99 PID 592 wrote to memory of 4448 592 pjpdp.exe 99 PID 592 wrote to memory of 4448 592 pjpdp.exe 99 PID 4448 wrote to memory of 1072 4448 nhnntn.exe 100 PID 4448 wrote to memory of 1072 4448 nhnntn.exe 100 PID 4448 wrote to memory of 1072 4448 nhnntn.exe 100 PID 1072 wrote to memory of 3852 1072 ppddp.exe 101 PID 1072 wrote to memory of 3852 1072 ppddp.exe 101 PID 1072 wrote to memory of 3852 1072 ppddp.exe 101 PID 3852 wrote to memory of 3460 3852 rlrrlff.exe 102 PID 3852 wrote to memory of 3460 3852 rlrrlff.exe 102 PID 3852 wrote to memory of 3460 3852 rlrrlff.exe 102 PID 3460 wrote to memory of 3620 3460 tnbbbh.exe 103 PID 3460 wrote to memory of 3620 3460 tnbbbh.exe 103 PID 3460 wrote to memory of 3620 3460 tnbbbh.exe 103 PID 3620 wrote to memory of 4288 3620 dddvp.exe 104 PID 3620 wrote to memory of 4288 3620 dddvp.exe 104 PID 3620 wrote to memory of 4288 3620 dddvp.exe 104 PID 4288 wrote to memory of 1012 4288 lrlflxl.exe 105 PID 4288 wrote to memory of 1012 4288 lrlflxl.exe 105 PID 4288 wrote to memory of 1012 4288 lrlflxl.exe 105 PID 1012 wrote to memory of 4840 1012 dddvp.exe 106 PID 1012 wrote to memory of 4840 1012 dddvp.exe 106 PID 1012 wrote to memory of 4840 1012 dddvp.exe 106 PID 4840 wrote to memory of 4424 4840 rfllflf.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe"C:\Users\Admin\AppData\Local\Temp\1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\dvjdv.exec:\dvjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\xflfxfx.exec:\xflfxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\9nbtnt.exec:\9nbtnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\pppjd.exec:\pppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\dvddd.exec:\dvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\dpvvv.exec:\dpvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\xflllfx.exec:\xflllfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\dvddv.exec:\dvddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\llxrrxr.exec:\llxrrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\bhnbbn.exec:\bhnbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\pjpdp.exec:\pjpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\nhnntn.exec:\nhnntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\ppddp.exec:\ppddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\rlrrlff.exec:\rlrrlff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\tnbbbh.exec:\tnbbbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\dddvp.exec:\dddvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\lrlflxl.exec:\lrlflxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\dddvp.exec:\dddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\rfllflf.exec:\rfllflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\rrxxrrl.exec:\rrxxrrl.exe23⤵
- Executes dropped EXE
PID:4424 -
\??\c:\5rxllfx.exec:\5rxllfx.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ttnbnn.exec:\ttnbnn.exe25⤵
- Executes dropped EXE
PID:4764 -
\??\c:\5ntbtt.exec:\5ntbtt.exe26⤵
- Executes dropped EXE
PID:3972 -
\??\c:\ttbtnh.exec:\ttbtnh.exe27⤵
- Executes dropped EXE
PID:4256 -
\??\c:\htnhnh.exec:\htnhnh.exe28⤵
- Executes dropped EXE
PID:4808 -
\??\c:\dvvpd.exec:\dvvpd.exe29⤵
- Executes dropped EXE
PID:3172 -
\??\c:\jddvj.exec:\jddvj.exe30⤵
- Executes dropped EXE
PID:624 -
\??\c:\rxlrlxr.exec:\rxlrlxr.exe31⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ttnnhb.exec:\ttnnhb.exe32⤵
- Executes dropped EXE
PID:384 -
\??\c:\vdjdp.exec:\vdjdp.exe33⤵
- Executes dropped EXE
PID:3672 -
\??\c:\lffrlff.exec:\lffrlff.exe34⤵
- Executes dropped EXE
PID:184 -
\??\c:\hnbtth.exec:\hnbtth.exe35⤵
- Executes dropped EXE
PID:1860 -
\??\c:\pjddd.exec:\pjddd.exe36⤵
- Executes dropped EXE
PID:1240 -
\??\c:\xxxflrf.exec:\xxxflrf.exe37⤵
- Executes dropped EXE
PID:3888 -
\??\c:\hhhhhn.exec:\hhhhhn.exe38⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vvjdd.exec:\vvjdd.exe39⤵
- Executes dropped EXE
PID:4292 -
\??\c:\rllfrrl.exec:\rllfrrl.exe40⤵
- Executes dropped EXE
PID:3764 -
\??\c:\hthntt.exec:\hthntt.exe41⤵
- Executes dropped EXE
PID:1332 -
\??\c:\5dpjv.exec:\5dpjv.exe42⤵
- Executes dropped EXE
PID:1584 -
\??\c:\flrlfxf.exec:\flrlfxf.exe43⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9hnhtt.exec:\9hnhtt.exe44⤵
- Executes dropped EXE
PID:4180 -
\??\c:\vjppj.exec:\vjppj.exe45⤵
- Executes dropped EXE
PID:4384 -
\??\c:\rlffffx.exec:\rlffffx.exe46⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ntnnhh.exec:\ntnnhh.exe47⤵
- Executes dropped EXE
PID:4404 -
\??\c:\htntnt.exec:\htntnt.exe48⤵
- Executes dropped EXE
PID:1188 -
\??\c:\jjvpv.exec:\jjvpv.exe49⤵
- Executes dropped EXE
PID:3496 -
\??\c:\xlrllll.exec:\xlrllll.exe50⤵
- Executes dropped EXE
PID:4392 -
\??\c:\nnbbtt.exec:\nnbbtt.exe51⤵
- Executes dropped EXE
PID:4052 -
\??\c:\vdppj.exec:\vdppj.exe52⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nhnhbb.exec:\nhnhbb.exe53⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nththt.exec:\nththt.exe54⤵
- Executes dropped EXE
PID:1488 -
\??\c:\ppppj.exec:\ppppj.exe55⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xfffxrr.exec:\xfffxrr.exe56⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hbbttt.exec:\hbbttt.exe57⤵
- Executes dropped EXE
PID:2080 -
\??\c:\dpddp.exec:\dpddp.exe58⤵
- Executes dropped EXE
PID:3412 -
\??\c:\fllllrr.exec:\fllllrr.exe59⤵
- Executes dropped EXE
PID:1088 -
\??\c:\nbhhbh.exec:\nbhhbh.exe60⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vdpdd.exec:\vdpdd.exe61⤵
- Executes dropped EXE
PID:4896 -
\??\c:\pdddd.exec:\pdddd.exe62⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9lrlxxl.exec:\9lrlxxl.exe63⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hhthht.exec:\hhthht.exe64⤵
- Executes dropped EXE
PID:424 -
\??\c:\vpddj.exec:\vpddj.exe65⤵
- Executes dropped EXE
PID:3168 -
\??\c:\xflxxxx.exec:\xflxxxx.exe66⤵
- System Location Discovery: System Language Discovery
PID:2524 -
\??\c:\1thhbb.exec:\1thhbb.exe67⤵PID:4708
-
\??\c:\hhtntt.exec:\hhtntt.exe68⤵PID:3460
-
\??\c:\pvdpd.exec:\pvdpd.exe69⤵
- System Location Discovery: System Language Discovery
PID:2496 -
\??\c:\rflflfx.exec:\rflflfx.exe70⤵PID:4152
-
\??\c:\ntbtnh.exec:\ntbtnh.exe71⤵PID:4288
-
\??\c:\nnhthn.exec:\nnhthn.exe72⤵PID:3648
-
\??\c:\vdppd.exec:\vdppd.exe73⤵PID:4840
-
\??\c:\ddjdv.exec:\ddjdv.exe74⤵PID:1080
-
\??\c:\hnbthh.exec:\hnbthh.exe75⤵PID:1604
-
\??\c:\dpjjj.exec:\dpjjj.exe76⤵PID:4424
-
\??\c:\3pvpd.exec:\3pvpd.exe77⤵PID:3124
-
\??\c:\frrfxxr.exec:\frrfxxr.exe78⤵PID:1600
-
\??\c:\nnhbtn.exec:\nnhbtn.exe79⤵PID:4088
-
\??\c:\5thhnt.exec:\5thhnt.exe80⤵PID:3580
-
\??\c:\jdppj.exec:\jdppj.exe81⤵PID:1224
-
\??\c:\9fffrxx.exec:\9fffrxx.exe82⤵PID:392
-
\??\c:\tntbhh.exec:\tntbhh.exe83⤵PID:3196
-
\??\c:\tnnhhh.exec:\tnnhhh.exe84⤵PID:4740
-
\??\c:\7vddd.exec:\7vddd.exe85⤵PID:1776
-
\??\c:\xfxlffx.exec:\xfxlffx.exe86⤵PID:1408
-
\??\c:\1tbbbh.exec:\1tbbbh.exe87⤵PID:5092
-
\??\c:\jpddv.exec:\jpddv.exe88⤵PID:668
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe89⤵PID:3808
-
\??\c:\tnnnhh.exec:\tnnnhh.exe90⤵PID:2344
-
\??\c:\tnttnn.exec:\tnttnn.exe91⤵PID:4532
-
\??\c:\jjjdd.exec:\jjjdd.exe92⤵PID:3264
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe93⤵PID:2008
-
\??\c:\7hbbtt.exec:\7hbbtt.exe94⤵PID:4884
-
\??\c:\bnbhbh.exec:\bnbhbh.exe95⤵PID:3108
-
\??\c:\vppjj.exec:\vppjj.exe96⤵PID:3000
-
\??\c:\rllllll.exec:\rllllll.exe97⤵PID:2352
-
\??\c:\9tttnn.exec:\9tttnn.exe98⤵PID:2788
-
\??\c:\hnnhbb.exec:\hnnhbb.exe99⤵PID:4436
-
\??\c:\ppjjj.exec:\ppjjj.exe100⤵PID:3368
-
\??\c:\vdjdp.exec:\vdjdp.exe101⤵PID:1124
-
\??\c:\rfrrrll.exec:\rfrrrll.exe102⤵PID:4688
-
\??\c:\hthnnn.exec:\hthnnn.exe103⤵PID:1848
-
\??\c:\dppjd.exec:\dppjd.exe104⤵PID:3144
-
\??\c:\pjjdv.exec:\pjjdv.exe105⤵PID:1640
-
\??\c:\7ffrllf.exec:\7ffrllf.exe106⤵PID:4404
-
\??\c:\hthhhn.exec:\hthhhn.exe107⤵PID:1188
-
\??\c:\3bnhhh.exec:\3bnhhh.exe108⤵PID:3944
-
\??\c:\ddjdv.exec:\ddjdv.exe109⤵PID:4504
-
\??\c:\9xfrrrl.exec:\9xfrrrl.exe110⤵PID:4836
-
\??\c:\5fxxrxx.exec:\5fxxrxx.exe111⤵PID:3608
-
\??\c:\bthbbh.exec:\bthbbh.exe112⤵
- System Location Discovery: System Language Discovery
PID:1008 -
\??\c:\7pvpj.exec:\7pvpj.exe113⤵PID:408
-
\??\c:\ddjjp.exec:\ddjjp.exe114⤵PID:640
-
\??\c:\xfrlfff.exec:\xfrlfff.exe115⤵PID:2648
-
\??\c:\bnhhhh.exec:\bnhhhh.exe116⤵PID:1920
-
\??\c:\nhtnnh.exec:\nhtnnh.exe117⤵PID:1852
-
\??\c:\lfrrrlr.exec:\lfrrrlr.exe118⤵PID:1300
-
\??\c:\9xlxrrl.exec:\9xlxrrl.exe119⤵PID:4204
-
\??\c:\thnhbb.exec:\thnhbb.exe120⤵PID:3736
-
\??\c:\dvjjp.exec:\dvjjp.exe121⤵PID:3004
-
\??\c:\3llfxxr.exec:\3llfxxr.exe122⤵PID:208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-