Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 05:37
Behavioral task
behavioral1
Sample
8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe
-
Size
332KB
-
MD5
ebaec7b68d5c44db39bbe1bb2fb62c80
-
SHA1
f0b9c0c0ab704c2b87736911785193b6dc4c5511
-
SHA256
8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376c
-
SHA512
75f7e101ba67fc4e662c546453a0c14901e112b4d9545fe243e1a9757f2c674cd450f91cb116fc232ae37cc1da1912be1aba4a7bbbb36bb79030ca9a3afa10ff
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tl:94wFHoStJdSjylh2b77BoTMA9gX59sTd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1640-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/380-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/380-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-581-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-1217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1640 jpjpp.exe 3724 rrfxrxr.exe 3088 vvjdj.exe 1448 xrlfflx.exe 2504 dpddp.exe 3760 bbnbtb.exe 1948 rlrlrfl.exe 3272 bbhthb.exe 2408 7vppp.exe 2124 bttnbb.exe 220 vvvpd.exe 1016 xllfxxr.exe 1952 thnnhn.exe 2868 vdppj.exe 1400 btnbbb.exe 4812 7ddjp.exe 4632 nhhbbb.exe 2096 dpvdd.exe 2952 bbhnnh.exe 4120 ppvpp.exe 1072 llxrfff.exe 2148 7vvvv.exe 4072 bhhhhh.exe 932 bbttbb.exe 3632 pdpvj.exe 2172 xlxxllf.exe 4420 hbhnnh.exe 4064 jpddd.exe 380 1xfrxrx.exe 4916 xxrxxlf.exe 1680 xfrllxl.exe 3532 pvjdd.exe 1688 frllrff.exe 1692 ddjdj.exe 4676 1lfxrrl.exe 5012 hbhnhb.exe 4480 ddjdp.exe 3092 vdvvv.exe 3904 fffrrrx.exe 3588 bhhbbh.exe 3564 pdvvj.exe 4424 xffxxxx.exe 4448 xffxxfl.exe 2296 tbhhbb.exe 2292 pvdvp.exe 2504 5fxlxxl.exe 2476 5rxxxxf.exe 5088 thhnnt.exe 1776 1pppp.exe 1916 lxllrxx.exe 3772 7hnnhn.exe 3272 7lffrrf.exe 2632 nnbbhn.exe 2848 tnhhhh.exe 3404 dvdpp.exe 2944 frfffll.exe 1840 ddjjj.exe 912 7lllrxf.exe 2876 hhnnnn.exe 4232 3dddv.exe 1180 xrxrrrr.exe 2092 rlxfffx.exe 4632 3pvvj.exe 2952 lfflxrx.exe -
resource yara_rule behavioral2/memory/3004-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b2b-3.dat upx behavioral2/memory/1640-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3004-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0032000000023b84-10.dat upx behavioral2/files/0x000a000000023b88-11.dat upx behavioral2/memory/3088-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3724-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8a-19.dat upx behavioral2/memory/3088-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-24.dat upx behavioral2/memory/1448-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-29.dat upx behavioral2/memory/2504-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-35.dat upx behavioral2/files/0x000a000000023b8e-38.dat upx behavioral2/memory/1948-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-43.dat upx behavioral2/memory/3272-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b90-48.dat upx behavioral2/memory/2408-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2124-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-60.dat upx behavioral2/memory/1016-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/220-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-53.dat upx behavioral2/files/0x0032000000023b85-65.dat upx behavioral2/memory/1952-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b94-69.dat upx behavioral2/files/0x000a000000023b97-84.dat upx behavioral2/memory/4632-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4812-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b96-80.dat upx behavioral2/files/0x000a000000023b98-90.dat upx behavioral2/files/0x000a000000023b99-95.dat upx behavioral2/files/0x000a000000023b9a-100.dat upx behavioral2/memory/4120-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2952-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2096-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1400-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9b-104.dat upx behavioral2/files/0x000a000000023b95-75.dat upx behavioral2/memory/2868-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-109.dat upx behavioral2/files/0x000a000000023b9d-112.dat upx behavioral2/files/0x000a000000023b9e-115.dat upx behavioral2/memory/4072-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9f-121.dat upx behavioral2/memory/3632-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/932-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba0-127.dat upx behavioral2/files/0x000a000000023ba1-131.dat upx behavioral2/memory/2172-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba2-136.dat upx behavioral2/files/0x000a000000023ba3-141.dat upx behavioral2/memory/4064-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba4-145.dat upx behavioral2/memory/4916-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba5-151.dat upx behavioral2/memory/380-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba6-155.dat upx behavioral2/memory/1680-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3532-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5012-168-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 1640 3004 8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe 83 PID 3004 wrote to memory of 1640 3004 8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe 83 PID 3004 wrote to memory of 1640 3004 8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe 83 PID 1640 wrote to memory of 3724 1640 jpjpp.exe 84 PID 1640 wrote to memory of 3724 1640 jpjpp.exe 84 PID 1640 wrote to memory of 3724 1640 jpjpp.exe 84 PID 3724 wrote to memory of 3088 3724 rrfxrxr.exe 85 PID 3724 wrote to memory of 3088 3724 rrfxrxr.exe 85 PID 3724 wrote to memory of 3088 3724 rrfxrxr.exe 85 PID 3088 wrote to memory of 1448 3088 vvjdj.exe 86 PID 3088 wrote to memory of 1448 3088 vvjdj.exe 86 PID 3088 wrote to memory of 1448 3088 vvjdj.exe 86 PID 1448 wrote to memory of 2504 1448 xrlfflx.exe 87 PID 1448 wrote to memory of 2504 1448 xrlfflx.exe 87 PID 1448 wrote to memory of 2504 1448 xrlfflx.exe 87 PID 2504 wrote to memory of 3760 2504 dpddp.exe 88 PID 2504 wrote to memory of 3760 2504 dpddp.exe 88 PID 2504 wrote to memory of 3760 2504 dpddp.exe 88 PID 3760 wrote to memory of 1948 3760 bbnbtb.exe 89 PID 3760 wrote to memory of 1948 3760 bbnbtb.exe 89 PID 3760 wrote to memory of 1948 3760 bbnbtb.exe 89 PID 1948 wrote to memory of 3272 1948 rlrlrfl.exe 90 PID 1948 wrote to memory of 3272 1948 rlrlrfl.exe 90 PID 1948 wrote to memory of 3272 1948 rlrlrfl.exe 90 PID 3272 wrote to memory of 2408 3272 bbhthb.exe 91 PID 3272 wrote to memory of 2408 3272 bbhthb.exe 91 PID 3272 wrote to memory of 2408 3272 bbhthb.exe 91 PID 2408 wrote to memory of 2124 2408 7vppp.exe 92 PID 2408 wrote to memory of 2124 2408 7vppp.exe 92 PID 2408 wrote to memory of 2124 2408 7vppp.exe 92 PID 2124 wrote to memory of 220 2124 bttnbb.exe 93 PID 2124 wrote to memory of 220 2124 bttnbb.exe 93 PID 2124 wrote to memory of 220 2124 bttnbb.exe 93 PID 220 wrote to memory of 1016 220 vvvpd.exe 94 PID 220 wrote to memory of 1016 220 vvvpd.exe 94 PID 220 wrote to memory of 1016 220 vvvpd.exe 94 PID 1016 wrote to memory of 1952 1016 xllfxxr.exe 95 PID 1016 wrote to memory of 1952 1016 xllfxxr.exe 95 PID 1016 wrote to memory of 1952 1016 xllfxxr.exe 95 PID 1952 wrote to memory of 2868 1952 thnnhn.exe 97 PID 1952 wrote to memory of 2868 1952 thnnhn.exe 97 PID 1952 wrote to memory of 2868 1952 thnnhn.exe 97 PID 2868 wrote to memory of 1400 2868 vdppj.exe 98 PID 2868 wrote to memory of 1400 2868 vdppj.exe 98 PID 2868 wrote to memory of 1400 2868 vdppj.exe 98 PID 1400 wrote to memory of 4812 1400 btnbbb.exe 99 PID 1400 wrote to memory of 4812 1400 btnbbb.exe 99 PID 1400 wrote to memory of 4812 1400 btnbbb.exe 99 PID 4812 wrote to memory of 4632 4812 7ddjp.exe 100 PID 4812 wrote to memory of 4632 4812 7ddjp.exe 100 PID 4812 wrote to memory of 4632 4812 7ddjp.exe 100 PID 4632 wrote to memory of 2096 4632 nhhbbb.exe 101 PID 4632 wrote to memory of 2096 4632 nhhbbb.exe 101 PID 4632 wrote to memory of 2096 4632 nhhbbb.exe 101 PID 2096 wrote to memory of 2952 2096 dpvdd.exe 102 PID 2096 wrote to memory of 2952 2096 dpvdd.exe 102 PID 2096 wrote to memory of 2952 2096 dpvdd.exe 102 PID 2952 wrote to memory of 4120 2952 bbhnnh.exe 103 PID 2952 wrote to memory of 4120 2952 bbhnnh.exe 103 PID 2952 wrote to memory of 4120 2952 bbhnnh.exe 103 PID 4120 wrote to memory of 1072 4120 ppvpp.exe 104 PID 4120 wrote to memory of 1072 4120 ppvpp.exe 104 PID 4120 wrote to memory of 1072 4120 ppvpp.exe 104 PID 1072 wrote to memory of 2148 1072 llxrfff.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe"C:\Users\Admin\AppData\Local\Temp\8d82561edfc1c0c2b81ec91eb16cfb77f153e760712a3df1bd6048fb586b376cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\jpjpp.exec:\jpjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\rrfxrxr.exec:\rrfxrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\vvjdj.exec:\vvjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\xrlfflx.exec:\xrlfflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\dpddp.exec:\dpddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\bbnbtb.exec:\bbnbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\rlrlrfl.exec:\rlrlrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\bbhthb.exec:\bbhthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\7vppp.exec:\7vppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\bttnbb.exec:\bttnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\vvvpd.exec:\vvvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\xllfxxr.exec:\xllfxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\thnnhn.exec:\thnnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\vdppj.exec:\vdppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\btnbbb.exec:\btnbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\7ddjp.exec:\7ddjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\nhhbbb.exec:\nhhbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\dpvdd.exec:\dpvdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\bbhnnh.exec:\bbhnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ppvpp.exec:\ppvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\llxrfff.exec:\llxrfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\7vvvv.exec:\7vvvv.exe23⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bhhhhh.exec:\bhhhhh.exe24⤵
- Executes dropped EXE
PID:4072 -
\??\c:\bbttbb.exec:\bbttbb.exe25⤵
- Executes dropped EXE
PID:932 -
\??\c:\pdpvj.exec:\pdpvj.exe26⤵
- Executes dropped EXE
PID:3632 -
\??\c:\xlxxllf.exec:\xlxxllf.exe27⤵
- Executes dropped EXE
PID:2172 -
\??\c:\hbhnnh.exec:\hbhnnh.exe28⤵
- Executes dropped EXE
PID:4420 -
\??\c:\jpddd.exec:\jpddd.exe29⤵
- Executes dropped EXE
PID:4064 -
\??\c:\1xfrxrx.exec:\1xfrxrx.exe30⤵
- Executes dropped EXE
PID:380 -
\??\c:\xxrxxlf.exec:\xxrxxlf.exe31⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xfrllxl.exec:\xfrllxl.exe32⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pvjdd.exec:\pvjdd.exe33⤵
- Executes dropped EXE
PID:3532 -
\??\c:\frllrff.exec:\frllrff.exe34⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ddjdj.exec:\ddjdj.exe35⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1lfxrrl.exec:\1lfxrrl.exe36⤵
- Executes dropped EXE
PID:4676 -
\??\c:\hbhnhb.exec:\hbhnhb.exe37⤵
- Executes dropped EXE
PID:5012 -
\??\c:\ddjdp.exec:\ddjdp.exe38⤵
- Executes dropped EXE
PID:4480 -
\??\c:\vdvvv.exec:\vdvvv.exe39⤵
- Executes dropped EXE
PID:3092 -
\??\c:\fffrrrx.exec:\fffrrrx.exe40⤵
- Executes dropped EXE
PID:3904 -
\??\c:\bhhbbh.exec:\bhhbbh.exe41⤵
- Executes dropped EXE
PID:3588 -
\??\c:\pdvvj.exec:\pdvvj.exe42⤵
- Executes dropped EXE
PID:3564 -
\??\c:\xffxxxx.exec:\xffxxxx.exe43⤵
- Executes dropped EXE
PID:4424 -
\??\c:\xffxxfl.exec:\xffxxfl.exe44⤵
- Executes dropped EXE
PID:4448 -
\??\c:\tbhhbb.exec:\tbhhbb.exe45⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pvdvp.exec:\pvdvp.exe46⤵
- Executes dropped EXE
PID:2292 -
\??\c:\5fxlxxl.exec:\5fxlxxl.exe47⤵
- Executes dropped EXE
PID:2504 -
\??\c:\5rxxxxf.exec:\5rxxxxf.exe48⤵
- Executes dropped EXE
PID:2476 -
\??\c:\thhnnt.exec:\thhnnt.exe49⤵
- Executes dropped EXE
PID:5088 -
\??\c:\1pppp.exec:\1pppp.exe50⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lxllrxx.exec:\lxllrxx.exe51⤵
- Executes dropped EXE
PID:1916 -
\??\c:\7hnnhn.exec:\7hnnhn.exe52⤵
- Executes dropped EXE
PID:3772 -
\??\c:\7lffrrf.exec:\7lffrrf.exe53⤵
- Executes dropped EXE
PID:3272 -
\??\c:\nnbbhn.exec:\nnbbhn.exe54⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tnhhhh.exec:\tnhhhh.exe55⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dvdpp.exec:\dvdpp.exe56⤵
- Executes dropped EXE
PID:3404 -
\??\c:\frfffll.exec:\frfffll.exe57⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ddjjj.exec:\ddjjj.exe58⤵
- Executes dropped EXE
PID:1840 -
\??\c:\7lllrxf.exec:\7lllrxf.exe59⤵
- Executes dropped EXE
PID:912 -
\??\c:\hhnnnn.exec:\hhnnnn.exe60⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3dddv.exec:\3dddv.exe61⤵
- Executes dropped EXE
PID:4232 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe62⤵
- Executes dropped EXE
PID:1180 -
\??\c:\rlxfffx.exec:\rlxfffx.exe63⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3pvvj.exec:\3pvvj.exe64⤵
- Executes dropped EXE
PID:4632 -
\??\c:\lfflxrx.exec:\lfflxrx.exe65⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tttnbn.exec:\tttnbn.exe66⤵PID:828
-
\??\c:\bhnnth.exec:\bhnnth.exe67⤵PID:2512
-
\??\c:\djppp.exec:\djppp.exe68⤵PID:4708
-
\??\c:\5xllfll.exec:\5xllfll.exe69⤵PID:1760
-
\??\c:\nbtnhh.exec:\nbtnhh.exe70⤵PID:2216
-
\??\c:\nbnhtn.exec:\nbnhtn.exe71⤵PID:1100
-
\??\c:\ddpvd.exec:\ddpvd.exe72⤵PID:3616
-
\??\c:\frxxxxx.exec:\frxxxxx.exe73⤵PID:3200
-
\??\c:\ntbhhh.exec:\ntbhhh.exe74⤵PID:4072
-
\??\c:\ppjpv.exec:\ppjpv.exe75⤵
- System Location Discovery: System Language Discovery
PID:932 -
\??\c:\3djpj.exec:\3djpj.exe76⤵PID:404
-
\??\c:\rxffrxx.exec:\rxffrxx.exe77⤵PID:2436
-
\??\c:\hhtttt.exec:\hhtttt.exe78⤵PID:2088
-
\??\c:\pvvvj.exec:\pvvvj.exe79⤵PID:4172
-
\??\c:\pdddv.exec:\pdddv.exe80⤵PID:2880
-
\??\c:\7rxxxfr.exec:\7rxxxfr.exe81⤵PID:4064
-
\??\c:\tntttt.exec:\tntttt.exe82⤵PID:380
-
\??\c:\1hhbtn.exec:\1hhbtn.exe83⤵PID:2936
-
\??\c:\ppvpj.exec:\ppvpj.exe84⤵PID:2496
-
\??\c:\5fffflr.exec:\5fffflr.exe85⤵PID:1680
-
\??\c:\hbhnnt.exec:\hbhnnt.exe86⤵PID:3240
-
\??\c:\jvvjp.exec:\jvvjp.exe87⤵PID:1200
-
\??\c:\1jvpd.exec:\1jvpd.exe88⤵PID:1648
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe89⤵PID:3880
-
\??\c:\nhhhhh.exec:\nhhhhh.exe90⤵PID:4516
-
\??\c:\tnnnnn.exec:\tnnnnn.exe91⤵PID:3092
-
\??\c:\ddpvd.exec:\ddpvd.exe92⤵PID:1640
-
\??\c:\rrfflll.exec:\rrfflll.exe93⤵PID:3564
-
\??\c:\lfflfrr.exec:\lfflfrr.exe94⤵PID:396
-
\??\c:\ntnnbh.exec:\ntnnbh.exe95⤵PID:2864
-
\??\c:\dpddv.exec:\dpddv.exe96⤵PID:2020
-
\??\c:\ppjvp.exec:\ppjvp.exe97⤵PID:216
-
\??\c:\hhtnht.exec:\hhtnht.exe98⤵PID:2424
-
\??\c:\3vddp.exec:\3vddp.exe99⤵PID:1008
-
\??\c:\dpjdd.exec:\dpjdd.exe100⤵PID:3872
-
\??\c:\frxxrrl.exec:\frxxrrl.exe101⤵PID:3184
-
\??\c:\nntntn.exec:\nntntn.exe102⤵PID:1384
-
\??\c:\jddvd.exec:\jddvd.exe103⤵PID:1192
-
\??\c:\dvvdp.exec:\dvvdp.exe104⤵PID:2124
-
\??\c:\rrxrrfr.exec:\rrxrrfr.exe105⤵PID:3440
-
\??\c:\nhnntn.exec:\nhnntn.exe106⤵PID:1328
-
\??\c:\dpvvd.exec:\dpvvd.exe107⤵PID:3180
-
\??\c:\xlxflfx.exec:\xlxflfx.exe108⤵PID:208
-
\??\c:\vvjvv.exec:\vvjvv.exe109⤵PID:4252
-
\??\c:\xllllff.exec:\xllllff.exe110⤵PID:3628
-
\??\c:\nbbttb.exec:\nbbttb.exe111⤵PID:4712
-
\??\c:\1hbbbh.exec:\1hbbbh.exe112⤵PID:1352
-
\??\c:\rrrlffx.exec:\rrrlffx.exe113⤵PID:4604
-
\??\c:\rllfxll.exec:\rllfxll.exe114⤵PID:3220
-
\??\c:\bnnhtt.exec:\bnnhtt.exe115⤵PID:4632
-
\??\c:\pvdvp.exec:\pvdvp.exe116⤵PID:2952
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe117⤵PID:3748
-
\??\c:\hbhttb.exec:\hbhttb.exe118⤵PID:2512
-
\??\c:\vpvpj.exec:\vpvpj.exe119⤵PID:3536
-
\??\c:\rrxrlll.exec:\rrxrlll.exe120⤵PID:4472
-
\??\c:\pvjpv.exec:\pvjpv.exe121⤵PID:1760
-
\??\c:\bbnhtt.exec:\bbnhtt.exe122⤵PID:3500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-