Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe
-
Size
452KB
-
MD5
5e4b7602c45a82420baef79bd855aaf2
-
SHA1
20946d2b058c7cffa1b4d03111fef70e1451a62f
-
SHA256
0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d
-
SHA512
d9cb365a5dde21810f0bac3797ac50c5be911b5965d81706fb8f0f39312894a6aaa845609b3170d22fc8d1f900782e03138a62f358479159a877d3103c33b7f5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2080-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/560-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-1009-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-1149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-1174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-1379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-1803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3676 vpvjj.exe 4172 llrrrrx.exe 244 djppp.exe 2104 xxrxrxx.exe 232 7htttt.exe 3136 btbbbn.exe 3636 pdddd.exe 5012 lrlrllf.exe 3396 vdpjp.exe 4480 nthbhb.exe 2792 tbbhhn.exe 4152 vdvpd.exe 3968 htbhhn.exe 2212 xllrrlr.exe 640 vpvdp.exe 2188 hhbtnh.exe 616 9thhhn.exe 4256 dpjdp.exe 1716 rrffxfl.exe 4860 nthbbb.exe 1728 9jvvv.exe 452 xrfxflr.exe 4760 nbbbbh.exe 1408 nhhbtn.exe 1568 rflxrlx.exe 2416 llllrlx.exe 4772 jjpvv.exe 4288 jvvpd.exe 2704 xflffff.exe 4568 thhbth.exe 4620 lxffffx.exe 3308 frrffff.exe 4344 nbbhhb.exe 1468 lxlffff.exe 4652 bthhbb.exe 4172 vpjvv.exe 4764 fxlfffl.exe 2660 thbhhn.exe 1424 djpdv.exe 4000 lrffxrl.exe 3568 hbnnhn.exe 4704 7jddj.exe 860 xxlfxfr.exe 2432 7nnttt.exe 1064 pjvvj.exe 704 rllxffr.exe 3496 tthnnh.exe 1952 jpjvv.exe 2232 xlrxxfx.exe 3556 vvpdv.exe 2624 vvvvd.exe 2264 lfxlrrr.exe 4440 thhtnh.exe 1964 dvdpv.exe 3788 rxxxffx.exe 1716 tbbnbb.exe 2388 vdvjd.exe 4424 3fxxlxx.exe 1116 bthhbh.exe 2532 jpdvp.exe 3000 rllrxfl.exe 560 nnntnn.exe 2140 ppvpv.exe 1172 fxrllfr.exe -
resource yara_rule behavioral2/memory/2080-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/560-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-1009-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 3676 2080 0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe 83 PID 2080 wrote to memory of 3676 2080 0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe 83 PID 2080 wrote to memory of 3676 2080 0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe 83 PID 3676 wrote to memory of 4172 3676 vpvjj.exe 84 PID 3676 wrote to memory of 4172 3676 vpvjj.exe 84 PID 3676 wrote to memory of 4172 3676 vpvjj.exe 84 PID 4172 wrote to memory of 244 4172 llrrrrx.exe 85 PID 4172 wrote to memory of 244 4172 llrrrrx.exe 85 PID 4172 wrote to memory of 244 4172 llrrrrx.exe 85 PID 244 wrote to memory of 2104 244 djppp.exe 86 PID 244 wrote to memory of 2104 244 djppp.exe 86 PID 244 wrote to memory of 2104 244 djppp.exe 86 PID 2104 wrote to memory of 232 2104 xxrxrxx.exe 87 PID 2104 wrote to memory of 232 2104 xxrxrxx.exe 87 PID 2104 wrote to memory of 232 2104 xxrxrxx.exe 87 PID 232 wrote to memory of 3136 232 7htttt.exe 88 PID 232 wrote to memory of 3136 232 7htttt.exe 88 PID 232 wrote to memory of 3136 232 7htttt.exe 88 PID 3136 wrote to memory of 3636 3136 btbbbn.exe 89 PID 3136 wrote to memory of 3636 3136 btbbbn.exe 89 PID 3136 wrote to memory of 3636 3136 btbbbn.exe 89 PID 3636 wrote to memory of 5012 3636 pdddd.exe 90 PID 3636 wrote to memory of 5012 3636 pdddd.exe 90 PID 3636 wrote to memory of 5012 3636 pdddd.exe 90 PID 5012 wrote to memory of 3396 5012 lrlrllf.exe 91 PID 5012 wrote to memory of 3396 5012 lrlrllf.exe 91 PID 5012 wrote to memory of 3396 5012 lrlrllf.exe 91 PID 3396 wrote to memory of 4480 3396 vdpjp.exe 92 PID 3396 wrote to memory of 4480 3396 vdpjp.exe 92 PID 3396 wrote to memory of 4480 3396 vdpjp.exe 92 PID 4480 wrote to memory of 2792 4480 nthbhb.exe 93 PID 4480 wrote to memory of 2792 4480 nthbhb.exe 93 PID 4480 wrote to memory of 2792 4480 nthbhb.exe 93 PID 2792 wrote to memory of 4152 2792 tbbhhn.exe 94 PID 2792 wrote to memory of 4152 2792 tbbhhn.exe 94 PID 2792 wrote to memory of 4152 2792 tbbhhn.exe 94 PID 4152 wrote to memory of 3968 4152 vdvpd.exe 95 PID 4152 wrote to memory of 3968 4152 vdvpd.exe 95 PID 4152 wrote to memory of 3968 4152 vdvpd.exe 95 PID 3968 wrote to memory of 2212 3968 htbhhn.exe 97 PID 3968 wrote to memory of 2212 3968 htbhhn.exe 97 PID 3968 wrote to memory of 2212 3968 htbhhn.exe 97 PID 2212 wrote to memory of 640 2212 xllrrlr.exe 98 PID 2212 wrote to memory of 640 2212 xllrrlr.exe 98 PID 2212 wrote to memory of 640 2212 xllrrlr.exe 98 PID 640 wrote to memory of 2188 640 vpvdp.exe 99 PID 640 wrote to memory of 2188 640 vpvdp.exe 99 PID 640 wrote to memory of 2188 640 vpvdp.exe 99 PID 2188 wrote to memory of 616 2188 hhbtnh.exe 101 PID 2188 wrote to memory of 616 2188 hhbtnh.exe 101 PID 2188 wrote to memory of 616 2188 hhbtnh.exe 101 PID 616 wrote to memory of 4256 616 9thhhn.exe 102 PID 616 wrote to memory of 4256 616 9thhhn.exe 102 PID 616 wrote to memory of 4256 616 9thhhn.exe 102 PID 4256 wrote to memory of 1716 4256 dpjdp.exe 103 PID 4256 wrote to memory of 1716 4256 dpjdp.exe 103 PID 4256 wrote to memory of 1716 4256 dpjdp.exe 103 PID 1716 wrote to memory of 4860 1716 rrffxfl.exe 104 PID 1716 wrote to memory of 4860 1716 rrffxfl.exe 104 PID 1716 wrote to memory of 4860 1716 rrffxfl.exe 104 PID 4860 wrote to memory of 1728 4860 nthbbb.exe 105 PID 4860 wrote to memory of 1728 4860 nthbbb.exe 105 PID 4860 wrote to memory of 1728 4860 nthbbb.exe 105 PID 1728 wrote to memory of 452 1728 9jvvv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe"C:\Users\Admin\AppData\Local\Temp\0f9dd055098dfa447bb6718f89d875c454d60d8c832a7c38128707c5b742d57d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\vpvjj.exec:\vpvjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\llrrrrx.exec:\llrrrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\djppp.exec:\djppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\xxrxrxx.exec:\xxrxrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\7htttt.exec:\7htttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\btbbbn.exec:\btbbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\pdddd.exec:\pdddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\lrlrllf.exec:\lrlrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\vdpjp.exec:\vdpjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\nthbhb.exec:\nthbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\tbbhhn.exec:\tbbhhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vdvpd.exec:\vdvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\htbhhn.exec:\htbhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\xllrrlr.exec:\xllrrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\vpvdp.exec:\vpvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\hhbtnh.exec:\hhbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\9thhhn.exec:\9thhhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\dpjdp.exec:\dpjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\rrffxfl.exec:\rrffxfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\nthbbb.exec:\nthbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\9jvvv.exec:\9jvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\xrfxflr.exec:\xrfxflr.exe23⤵
- Executes dropped EXE
PID:452 -
\??\c:\nbbbbh.exec:\nbbbbh.exe24⤵
- Executes dropped EXE
PID:4760 -
\??\c:\nhhbtn.exec:\nhhbtn.exe25⤵
- Executes dropped EXE
PID:1408 -
\??\c:\rflxrlx.exec:\rflxrlx.exe26⤵
- Executes dropped EXE
PID:1568 -
\??\c:\llllrlx.exec:\llllrlx.exe27⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jjpvv.exec:\jjpvv.exe28⤵
- Executes dropped EXE
PID:4772 -
\??\c:\jvvpd.exec:\jvvpd.exe29⤵
- Executes dropped EXE
PID:4288 -
\??\c:\xflffff.exec:\xflffff.exe30⤵
- Executes dropped EXE
PID:2704 -
\??\c:\thhbth.exec:\thhbth.exe31⤵
- Executes dropped EXE
PID:4568 -
\??\c:\lxffffx.exec:\lxffffx.exe32⤵
- Executes dropped EXE
PID:4620 -
\??\c:\frrffff.exec:\frrffff.exe33⤵
- Executes dropped EXE
PID:3308 -
\??\c:\nbbhhb.exec:\nbbhhb.exe34⤵
- Executes dropped EXE
PID:4344 -
\??\c:\lxlffff.exec:\lxlffff.exe35⤵
- Executes dropped EXE
PID:1468 -
\??\c:\bthhbb.exec:\bthhbb.exe36⤵
- Executes dropped EXE
PID:4652 -
\??\c:\vpjvv.exec:\vpjvv.exe37⤵
- Executes dropped EXE
PID:4172 -
\??\c:\fxlfffl.exec:\fxlfffl.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4764 -
\??\c:\thbhhn.exec:\thbhhn.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\djpdv.exec:\djpdv.exe40⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lrffxrl.exec:\lrffxrl.exe41⤵
- Executes dropped EXE
PID:4000 -
\??\c:\hbnnhn.exec:\hbnnhn.exe42⤵
- Executes dropped EXE
PID:3568 -
\??\c:\7jddj.exec:\7jddj.exe43⤵
- Executes dropped EXE
PID:4704 -
\??\c:\xxlfxfr.exec:\xxlfxfr.exe44⤵
- Executes dropped EXE
PID:860 -
\??\c:\7nnttt.exec:\7nnttt.exe45⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pjvvj.exec:\pjvvj.exe46⤵
- Executes dropped EXE
PID:1064 -
\??\c:\rllxffr.exec:\rllxffr.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:704 -
\??\c:\tthnnh.exec:\tthnnh.exe48⤵
- Executes dropped EXE
PID:3496 -
\??\c:\jpjvv.exec:\jpjvv.exe49⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xlrxxfx.exec:\xlrxxfx.exe50⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vvpdv.exec:\vvpdv.exe51⤵
- Executes dropped EXE
PID:3556 -
\??\c:\vvvvd.exec:\vvvvd.exe52⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lfxlrrr.exec:\lfxlrrr.exe53⤵
- Executes dropped EXE
PID:2264 -
\??\c:\thhtnh.exec:\thhtnh.exe54⤵
- Executes dropped EXE
PID:4440 -
\??\c:\dvdpv.exec:\dvdpv.exe55⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rxxxffx.exec:\rxxxffx.exe56⤵
- Executes dropped EXE
PID:3788 -
\??\c:\tbbnbb.exec:\tbbnbb.exe57⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vdvjd.exec:\vdvjd.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\3fxxlxx.exec:\3fxxlxx.exe59⤵
- Executes dropped EXE
PID:4424 -
\??\c:\bthhbh.exec:\bthhbh.exe60⤵
- Executes dropped EXE
PID:1116 -
\??\c:\jpdvp.exec:\jpdvp.exe61⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rllrxfl.exec:\rllrxfl.exe62⤵
- Executes dropped EXE
PID:3000 -
\??\c:\nnntnn.exec:\nnntnn.exe63⤵
- Executes dropped EXE
PID:560 -
\??\c:\ppvpv.exec:\ppvpv.exe64⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fxrllfr.exec:\fxrllfr.exe65⤵
- Executes dropped EXE
PID:1172 -
\??\c:\tbnbtt.exec:\tbnbtt.exe66⤵PID:2944
-
\??\c:\nhbbhh.exec:\nhbbhh.exe67⤵PID:4708
-
\??\c:\jvppj.exec:\jvppj.exe68⤵PID:2416
-
\??\c:\xrxrrxf.exec:\xrxrrxf.exe69⤵PID:4468
-
\??\c:\bnhhhh.exec:\bnhhhh.exe70⤵PID:2612
-
\??\c:\jddvd.exec:\jddvd.exe71⤵PID:3928
-
\??\c:\rlfrxrf.exec:\rlfrxrf.exe72⤵PID:2692
-
\??\c:\vdpjv.exec:\vdpjv.exe73⤵PID:5076
-
\??\c:\xflxlfx.exec:\xflxlfx.exe74⤵PID:3880
-
\??\c:\hbttth.exec:\hbttth.exe75⤵PID:2436
-
\??\c:\pdvvv.exec:\pdvvv.exe76⤵PID:2080
-
\??\c:\hbnnbh.exec:\hbnnbh.exe77⤵PID:1532
-
\??\c:\7hhhbt.exec:\7hhhbt.exe78⤵PID:4728
-
\??\c:\ddvvj.exec:\ddvvj.exe79⤵PID:4652
-
\??\c:\nnbhnb.exec:\nnbhnb.exe80⤵PID:3476
-
\??\c:\llxxxxl.exec:\llxxxxl.exe81⤵PID:4764
-
\??\c:\pvdvv.exec:\pvdvv.exe82⤵PID:3136
-
\??\c:\xfrfrfl.exec:\xfrfrfl.exe83⤵PID:4736
-
\??\c:\ttbbbb.exec:\ttbbbb.exe84⤵PID:3896
-
\??\c:\rxrlxxr.exec:\rxrlxxr.exe85⤵PID:1124
-
\??\c:\ntbbtb.exec:\ntbbtb.exe86⤵PID:3940
-
\??\c:\ppvpd.exec:\ppvpd.exe87⤵PID:860
-
\??\c:\fxrrrll.exec:\fxrrrll.exe88⤵PID:4480
-
\??\c:\ntttnh.exec:\ntttnh.exe89⤵PID:4160
-
\??\c:\jdpjd.exec:\jdpjd.exe90⤵PID:704
-
\??\c:\lfrfrrl.exec:\lfrfrrl.exe91⤵PID:2352
-
\??\c:\1hnbbb.exec:\1hnbbb.exe92⤵PID:2672
-
\??\c:\dvddd.exec:\dvddd.exe93⤵PID:5092
-
\??\c:\xxfffff.exec:\xxfffff.exe94⤵PID:2284
-
\??\c:\btbbtb.exec:\btbbtb.exe95⤵PID:3556
-
\??\c:\dvjvd.exec:\dvjvd.exe96⤵PID:2188
-
\??\c:\xrrxflf.exec:\xrrxflf.exe97⤵PID:4240
-
\??\c:\tntbbb.exec:\tntbbb.exe98⤵
- System Location Discovery: System Language Discovery
PID:4556 -
\??\c:\vpdjv.exec:\vpdjv.exe99⤵PID:3112
-
\??\c:\rrfxxxr.exec:\rrfxxxr.exe100⤵PID:4860
-
\??\c:\bbbttt.exec:\bbbttt.exe101⤵PID:1716
-
\??\c:\dpdjd.exec:\dpdjd.exe102⤵PID:1728
-
\??\c:\ppjpj.exec:\ppjpj.exe103⤵PID:2960
-
\??\c:\9rxrlff.exec:\9rxrlff.exe104⤵PID:1116
-
\??\c:\nbhnbn.exec:\nbhnbn.exe105⤵PID:2532
-
\??\c:\pddpp.exec:\pddpp.exe106⤵PID:3000
-
\??\c:\lxrllfx.exec:\lxrllfx.exe107⤵PID:560
-
\??\c:\tnhhhh.exec:\tnhhhh.exe108⤵PID:4112
-
\??\c:\pdppp.exec:\pdppp.exe109⤵PID:4924
-
\??\c:\lflflrl.exec:\lflflrl.exe110⤵PID:4548
-
\??\c:\htthhn.exec:\htthhn.exe111⤵PID:1648
-
\??\c:\vjpvv.exec:\vjpvv.exe112⤵PID:4352
-
\??\c:\rxxxrlf.exec:\rxxxrlf.exe113⤵PID:2508
-
\??\c:\vjdvv.exec:\vjdvv.exe114⤵PID:4292
-
\??\c:\rfxxllf.exec:\rfxxllf.exe115⤵PID:1336
-
\??\c:\btbnnn.exec:\btbnnn.exe116⤵PID:2200
-
\??\c:\jdvpj.exec:\jdvpj.exe117⤵PID:1784
-
\??\c:\rlxrrxx.exec:\rlxrrxx.exe118⤵PID:1656
-
\??\c:\httbtb.exec:\httbtb.exe119⤵PID:4396
-
\??\c:\vvdvp.exec:\vvdvp.exe120⤵PID:3068
-
\??\c:\rllrrfl.exec:\rllrrfl.exe121⤵PID:1468
-
\??\c:\hhtttb.exec:\hhtttb.exe122⤵PID:444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-