Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 23:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe
-
Size
453KB
-
MD5
afefe191cfec1baabd209d2703abb81a
-
SHA1
5858b3c6b969b349839f60e270d866c8b22d53f9
-
SHA256
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87
-
SHA512
7dd47d17caa2f9d66150b49d02fddd182bb71207c5b9dbc08d7372b02dd26de526430aefd61555d45a6f526e9f96c4a58e4554b9fdaac83ad41bb65f979a7424
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1612-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/656-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-753-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-757-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2740 5vjdj.exe 3212 xlrllll.exe 2608 3xffflr.exe 2172 nbhhbn.exe 3236 xxxxflx.exe 4528 htbtnn.exe 2108 fllrfff.exe 3472 ddjdd.exe 1312 xxffffl.exe 516 vjpjv.exe 2052 xlrlrxf.exe 4724 bbtnnn.exe 972 vvdvv.exe 2964 llrxxlf.exe 2676 ttttnh.exe 656 dppjd.exe 5004 llrrllf.exe 2500 xrllfrr.exe 632 jdpvd.exe 1876 lllfflf.exe 2540 bthttn.exe 2772 nhnttt.exe 4452 5dvvj.exe 4204 tbnnbt.exe 3864 dppdv.exe 724 9lfflrr.exe 2792 hhhtbh.exe 4208 jpjdd.exe 3916 ppdpv.exe 4992 xrxrrxx.exe 3292 hbhbtb.exe 3852 vpvjv.exe 1908 frlrllr.exe 988 3btntn.exe 812 9tnnhh.exe 5008 5jdpj.exe 3664 lfffxll.exe 4832 nntntt.exe 1048 3hnnbb.exe 4856 fxxrffr.exe 3984 htnthn.exe 4032 pjpdd.exe 4360 xxxxxll.exe 3100 tnnnnh.exe 2852 flfffll.exe 1924 pdddv.exe 4024 frxxrrl.exe 2036 thhhhh.exe 2244 jdvjd.exe 3232 flrfxfl.exe 3300 ntnnhh.exe 3624 nthhhh.exe 5044 1jjdd.exe 2596 frxrrrr.exe 2320 tthbhh.exe 456 hbbttb.exe 4600 dpvvp.exe 3284 1ffxflf.exe 3652 frlflxf.exe 4292 3nthth.exe 3548 1vdvp.exe 2052 jpvpp.exe 3928 5xxxrfx.exe 3436 nnnnnn.exe -
resource yara_rule behavioral2/memory/1612-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/656-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-506-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2740 1612 4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe 83 PID 1612 wrote to memory of 2740 1612 4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe 83 PID 1612 wrote to memory of 2740 1612 4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe 83 PID 2740 wrote to memory of 3212 2740 5vjdj.exe 84 PID 2740 wrote to memory of 3212 2740 5vjdj.exe 84 PID 2740 wrote to memory of 3212 2740 5vjdj.exe 84 PID 3212 wrote to memory of 2608 3212 xlrllll.exe 85 PID 3212 wrote to memory of 2608 3212 xlrllll.exe 85 PID 3212 wrote to memory of 2608 3212 xlrllll.exe 85 PID 2608 wrote to memory of 2172 2608 3xffflr.exe 86 PID 2608 wrote to memory of 2172 2608 3xffflr.exe 86 PID 2608 wrote to memory of 2172 2608 3xffflr.exe 86 PID 2172 wrote to memory of 3236 2172 nbhhbn.exe 87 PID 2172 wrote to memory of 3236 2172 nbhhbn.exe 87 PID 2172 wrote to memory of 3236 2172 nbhhbn.exe 87 PID 3236 wrote to memory of 4528 3236 xxxxflx.exe 88 PID 3236 wrote to memory of 4528 3236 xxxxflx.exe 88 PID 3236 wrote to memory of 4528 3236 xxxxflx.exe 88 PID 4528 wrote to memory of 2108 4528 htbtnn.exe 89 PID 4528 wrote to memory of 2108 4528 htbtnn.exe 89 PID 4528 wrote to memory of 2108 4528 htbtnn.exe 89 PID 2108 wrote to memory of 3472 2108 fllrfff.exe 90 PID 2108 wrote to memory of 3472 2108 fllrfff.exe 90 PID 2108 wrote to memory of 3472 2108 fllrfff.exe 90 PID 3472 wrote to memory of 1312 3472 ddjdd.exe 91 PID 3472 wrote to memory of 1312 3472 ddjdd.exe 91 PID 3472 wrote to memory of 1312 3472 ddjdd.exe 91 PID 1312 wrote to memory of 516 1312 xxffffl.exe 92 PID 1312 wrote to memory of 516 1312 xxffffl.exe 92 PID 1312 wrote to memory of 516 1312 xxffffl.exe 92 PID 516 wrote to memory of 2052 516 vjpjv.exe 93 PID 516 wrote to memory of 2052 516 vjpjv.exe 93 PID 516 wrote to memory of 2052 516 vjpjv.exe 93 PID 2052 wrote to memory of 4724 2052 xlrlrxf.exe 94 PID 2052 wrote to memory of 4724 2052 xlrlrxf.exe 94 PID 2052 wrote to memory of 4724 2052 xlrlrxf.exe 94 PID 4724 wrote to memory of 972 4724 bbtnnn.exe 95 PID 4724 wrote to memory of 972 4724 bbtnnn.exe 95 PID 4724 wrote to memory of 972 4724 bbtnnn.exe 95 PID 972 wrote to memory of 2964 972 vvdvv.exe 96 PID 972 wrote to memory of 2964 972 vvdvv.exe 96 PID 972 wrote to memory of 2964 972 vvdvv.exe 96 PID 2964 wrote to memory of 2676 2964 llrxxlf.exe 97 PID 2964 wrote to memory of 2676 2964 llrxxlf.exe 97 PID 2964 wrote to memory of 2676 2964 llrxxlf.exe 97 PID 2676 wrote to memory of 656 2676 ttttnh.exe 98 PID 2676 wrote to memory of 656 2676 ttttnh.exe 98 PID 2676 wrote to memory of 656 2676 ttttnh.exe 98 PID 656 wrote to memory of 5004 656 dppjd.exe 99 PID 656 wrote to memory of 5004 656 dppjd.exe 99 PID 656 wrote to memory of 5004 656 dppjd.exe 99 PID 5004 wrote to memory of 2500 5004 llrrllf.exe 100 PID 5004 wrote to memory of 2500 5004 llrrllf.exe 100 PID 5004 wrote to memory of 2500 5004 llrrllf.exe 100 PID 2500 wrote to memory of 632 2500 xrllfrr.exe 101 PID 2500 wrote to memory of 632 2500 xrllfrr.exe 101 PID 2500 wrote to memory of 632 2500 xrllfrr.exe 101 PID 632 wrote to memory of 1876 632 jdpvd.exe 102 PID 632 wrote to memory of 1876 632 jdpvd.exe 102 PID 632 wrote to memory of 1876 632 jdpvd.exe 102 PID 1876 wrote to memory of 2540 1876 lllfflf.exe 157 PID 1876 wrote to memory of 2540 1876 lllfflf.exe 157 PID 1876 wrote to memory of 2540 1876 lllfflf.exe 157 PID 2540 wrote to memory of 2772 2540 bthttn.exe 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe"C:\Users\Admin\AppData\Local\Temp\4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\5vjdj.exec:\5vjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xlrllll.exec:\xlrllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\3xffflr.exec:\3xffflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nbhhbn.exec:\nbhhbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\xxxxflx.exec:\xxxxflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\htbtnn.exec:\htbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\fllrfff.exec:\fllrfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ddjdd.exec:\ddjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\xxffffl.exec:\xxffffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\vjpjv.exec:\vjpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\xlrlrxf.exec:\xlrlrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\bbtnnn.exec:\bbtnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\vvdvv.exec:\vvdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\llrxxlf.exec:\llrxxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ttttnh.exec:\ttttnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\dppjd.exec:\dppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\llrrllf.exec:\llrrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\xrllfrr.exec:\xrllfrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jdpvd.exec:\jdpvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\lllfflf.exec:\lllfflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\bthttn.exec:\bthttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nhnttt.exec:\nhnttt.exe23⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5dvvj.exec:\5dvvj.exe24⤵
- Executes dropped EXE
PID:4452 -
\??\c:\tbnnbt.exec:\tbnnbt.exe25⤵
- Executes dropped EXE
PID:4204 -
\??\c:\dppdv.exec:\dppdv.exe26⤵
- Executes dropped EXE
PID:3864 -
\??\c:\9lfflrr.exec:\9lfflrr.exe27⤵
- Executes dropped EXE
PID:724 -
\??\c:\hhhtbh.exec:\hhhtbh.exe28⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jpjdd.exec:\jpjdd.exe29⤵
- Executes dropped EXE
PID:4208 -
\??\c:\ppdpv.exec:\ppdpv.exe30⤵
- Executes dropped EXE
PID:3916 -
\??\c:\xrxrrxx.exec:\xrxrrxx.exe31⤵
- Executes dropped EXE
PID:4992 -
\??\c:\hbhbtb.exec:\hbhbtb.exe32⤵
- Executes dropped EXE
PID:3292 -
\??\c:\vpvjv.exec:\vpvjv.exe33⤵
- Executes dropped EXE
PID:3852 -
\??\c:\frlrllr.exec:\frlrllr.exe34⤵
- Executes dropped EXE
PID:1908 -
\??\c:\3btntn.exec:\3btntn.exe35⤵
- Executes dropped EXE
PID:988 -
\??\c:\9tnnhh.exec:\9tnnhh.exe36⤵
- Executes dropped EXE
PID:812 -
\??\c:\5jdpj.exec:\5jdpj.exe37⤵
- Executes dropped EXE
PID:5008 -
\??\c:\lfffxll.exec:\lfffxll.exe38⤵
- Executes dropped EXE
PID:3664 -
\??\c:\nntntt.exec:\nntntt.exe39⤵
- Executes dropped EXE
PID:4832 -
\??\c:\3hnnbb.exec:\3hnnbb.exe40⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vjvdj.exec:\vjvdj.exe41⤵PID:4420
-
\??\c:\fxxrffr.exec:\fxxrffr.exe42⤵
- Executes dropped EXE
PID:4856 -
\??\c:\htnthn.exec:\htnthn.exe43⤵
- Executes dropped EXE
PID:3984 -
\??\c:\pjpdd.exec:\pjpdd.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4032 -
\??\c:\xxxxxll.exec:\xxxxxll.exe45⤵
- Executes dropped EXE
PID:4360 -
\??\c:\tnnnnh.exec:\tnnnnh.exe46⤵
- Executes dropped EXE
PID:3100 -
\??\c:\flfffll.exec:\flfffll.exe47⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pdddv.exec:\pdddv.exe48⤵
- Executes dropped EXE
PID:1924 -
\??\c:\frxxrrl.exec:\frxxrrl.exe49⤵
- Executes dropped EXE
PID:4024 -
\??\c:\thhhhh.exec:\thhhhh.exe50⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jdvjd.exec:\jdvjd.exe51⤵
- Executes dropped EXE
PID:2244 -
\??\c:\flrfxfl.exec:\flrfxfl.exe52⤵
- Executes dropped EXE
PID:3232 -
\??\c:\ntnnhh.exec:\ntnnhh.exe53⤵
- Executes dropped EXE
PID:3300 -
\??\c:\nthhhh.exec:\nthhhh.exe54⤵
- Executes dropped EXE
PID:3624 -
\??\c:\1jjdd.exec:\1jjdd.exe55⤵
- Executes dropped EXE
PID:5044 -
\??\c:\frxrrrr.exec:\frxrrrr.exe56⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tthbhh.exec:\tthbhh.exe57⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hbbttb.exec:\hbbttb.exe58⤵
- Executes dropped EXE
PID:456 -
\??\c:\dpvvp.exec:\dpvvp.exe59⤵
- Executes dropped EXE
PID:4600 -
\??\c:\1ffxflf.exec:\1ffxflf.exe60⤵
- Executes dropped EXE
PID:3284 -
\??\c:\frlflxf.exec:\frlflxf.exe61⤵
- Executes dropped EXE
PID:3652 -
\??\c:\3nthth.exec:\3nthth.exe62⤵
- Executes dropped EXE
PID:4292 -
\??\c:\1vdvp.exec:\1vdvp.exe63⤵
- Executes dropped EXE
PID:3548 -
\??\c:\jpvpp.exec:\jpvpp.exe64⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5xxxrfx.exec:\5xxxrfx.exe65⤵
- Executes dropped EXE
PID:3928 -
\??\c:\nnnnnn.exec:\nnnnnn.exe66⤵
- Executes dropped EXE
PID:3436 -
\??\c:\djvvd.exec:\djvvd.exe67⤵PID:1816
-
\??\c:\ffrlllr.exec:\ffrlllr.exe68⤵PID:1284
-
\??\c:\7rrrlff.exec:\7rrrlff.exe69⤵PID:2692
-
\??\c:\bhthnt.exec:\bhthnt.exe70⤵
- System Location Discovery: System Language Discovery
PID:2420 -
\??\c:\vdjvd.exec:\vdjvd.exe71⤵PID:2444
-
\??\c:\5vppp.exec:\5vppp.exe72⤵PID:3076
-
\??\c:\fxfxfxr.exec:\fxfxfxr.exe73⤵PID:1696
-
\??\c:\ntbbbb.exec:\ntbbbb.exe74⤵PID:4416
-
\??\c:\hthbhh.exec:\hthbhh.exe75⤵PID:2744
-
\??\c:\dddjd.exec:\dddjd.exe76⤵PID:2540
-
\??\c:\3rlfffx.exec:\3rlfffx.exe77⤵PID:2772
-
\??\c:\hhttht.exec:\hhttht.exe78⤵PID:768
-
\??\c:\pdjdd.exec:\pdjdd.exe79⤵PID:5112
-
\??\c:\pdpdp.exec:\pdpdp.exe80⤵PID:4220
-
\??\c:\xrxlrrl.exec:\xrxlrrl.exe81⤵PID:2180
-
\??\c:\9bttnn.exec:\9bttnn.exe82⤵PID:2600
-
\??\c:\nhttnt.exec:\nhttnt.exe83⤵PID:1424
-
\??\c:\9dvpp.exec:\9dvpp.exe84⤵PID:3508
-
\??\c:\3lxxrrl.exec:\3lxxrrl.exe85⤵
- System Location Discovery: System Language Discovery
PID:1524 -
\??\c:\fllfxff.exec:\fllfxff.exe86⤵PID:2388
-
\??\c:\bbnhnh.exec:\bbnhnh.exe87⤵PID:2572
-
\??\c:\3jjdv.exec:\3jjdv.exe88⤵PID:4208
-
\??\c:\ffrrflx.exec:\ffrrflx.exe89⤵PID:3940
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe90⤵PID:3964
-
\??\c:\hbhntn.exec:\hbhntn.exe91⤵PID:3476
-
\??\c:\vdjpp.exec:\vdjpp.exe92⤵PID:2880
-
\??\c:\hbthnb.exec:\hbthnb.exe93⤵PID:4296
-
\??\c:\7vjjd.exec:\7vjjd.exe94⤵PID:3484
-
\??\c:\flrllll.exec:\flrllll.exe95⤵PID:1724
-
\??\c:\9bnhtt.exec:\9bnhtt.exe96⤵PID:812
-
\??\c:\jjvvv.exec:\jjvvv.exe97⤵PID:1404
-
\??\c:\lflfrlf.exec:\lflfrlf.exe98⤵PID:4492
-
\??\c:\hbbtnb.exec:\hbbtnb.exe99⤵PID:464
-
\??\c:\vvppd.exec:\vvppd.exe100⤵PID:1616
-
\??\c:\xxrlfll.exec:\xxrlfll.exe101⤵PID:2824
-
\??\c:\bbbbbh.exec:\bbbbbh.exe102⤵PID:1612
-
\??\c:\3xffxfx.exec:\3xffxfx.exe103⤵PID:1880
-
\??\c:\nbnhbb.exec:\nbnhbb.exe104⤵PID:1952
-
\??\c:\djddd.exec:\djddd.exe105⤵PID:1684
-
\??\c:\lxxxxxl.exec:\lxxxxxl.exe106⤵PID:2664
-
\??\c:\nnnhnt.exec:\nnnhnt.exe107⤵PID:3100
-
\??\c:\hhbbnt.exec:\hhbbnt.exe108⤵PID:5000
-
\??\c:\9vdvp.exec:\9vdvp.exe109⤵PID:3256
-
\??\c:\3ffflxl.exec:\3ffflxl.exe110⤵PID:1828
-
\??\c:\djvpv.exec:\djvpv.exe111⤵PID:4024
-
\??\c:\hthttt.exec:\hthttt.exe112⤵PID:4948
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe113⤵PID:4468
-
\??\c:\tntnbn.exec:\tntnbn.exe114⤵PID:4868
-
\??\c:\vvvpp.exec:\vvvpp.exe115⤵PID:1900
-
\??\c:\tbttnh.exec:\tbttnh.exe116⤵PID:4928
-
\??\c:\vjjjj.exec:\vjjjj.exe117⤵PID:5044
-
\??\c:\lrxrllf.exec:\lrxrllf.exe118⤵PID:2108
-
\??\c:\jjpvp.exec:\jjpvp.exe119⤵PID:1988
-
\??\c:\xfxfxlf.exec:\xfxfxlf.exe120⤵PID:456
-
\??\c:\rllfxxx.exec:\rllfxxx.exe121⤵PID:1312
-
\??\c:\thnnnt.exec:\thnnnt.exe122⤵PID:2028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-