Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 00:23
Static task
static1
Behavioral task
behavioral1
Sample
642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe
Resource
win7-20240903-en
General
-
Target
642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe
-
Size
453KB
-
MD5
43329281f879a335bbbfb81dae3dcc5f
-
SHA1
67ea86f7a992c3c7754e850ee448c66d57ad4d1f
-
SHA256
642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61
-
SHA512
4fe6cd4b4a93fcba6581035773876557a4d9818845809fd0b8c77d22859fccc92e487e7656c017efc04f2396f7a0f47211a31cf38e3b76d6ab43c9e91f02491f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
Processes:
resource yara_rule behavioral2/memory/2936-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/792-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/508-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-893-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-1315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-1409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fllrfxl.exejjvdp.exe5flxlfl.exexrxrlff.exejjjdj.exehntttb.exehttnhh.exe5hbbhh.exe5hhttn.exevvjpv.exe1tnhtt.exerffrllf.exe9vvjv.exeddpvp.exe3flxrlx.exe7nhhbb.exexrxrfxr.exedvpdj.exe1xxrfxr.exehhhtnh.exexxlxrxr.exerfrlxxx.exerrrrlll.exe3bhhhn.exevpjdv.exefllrfrf.exe3jppj.exebnbhhh.exe3nnhhh.exelllxlfr.exedddvp.exeffffxxr.exejvddv.exe1rxlfrl.exe9bhbbb.exe5pjdd.exe7llxllr.exenthbnb.exe5vjvp.exejdjvd.exerlrrrlf.exe1hbtnh.exejjvdd.exexrrlffx.exexlrlffx.exe9ttnht.exevvjjv.exerlxlrfx.exebthhbb.exejddvd.exeflrlxrl.exefxlfxxr.exehtbthh.exejvvpj.exellrflfl.exebhnnhb.exedjvpd.exejjppd.exe7xrlxxx.exetbhhhb.exe5ppjj.exedpjdv.exexxfxrxr.exehtbttn.exepid process 4708 fllrfxl.exe 5072 jjvdp.exe 4888 5flxlfl.exe 1660 xrxrlff.exe 3652 jjjdj.exe 3184 hntttb.exe 4800 httnhh.exe 4972 5hbbhh.exe 3948 5hhttn.exe 2940 vvjpv.exe 4760 1tnhtt.exe 4460 rffrllf.exe 3580 9vvjv.exe 4268 ddpvp.exe 5052 3flxrlx.exe 3200 7nhhbb.exe 3068 xrxrfxr.exe 3688 dvpdj.exe 3996 1xxrfxr.exe 4600 hhhtnh.exe 444 xxlxrxr.exe 848 rfrlxxx.exe 4304 rrrrlll.exe 876 3bhhhn.exe 376 vpjdv.exe 3172 fllrfrf.exe 760 3jppj.exe 2340 bnbhhh.exe 3904 3nnhhh.exe 3360 lllxlfr.exe 792 dddvp.exe 1776 ffffxxr.exe 2276 jvddv.exe 3348 1rxlfrl.exe 4048 9bhbbb.exe 3100 5pjdd.exe 1100 7llxllr.exe 1192 nthbnb.exe 3860 5vjvp.exe 1692 jdjvd.exe 4420 rlrrrlf.exe 3024 1hbtnh.exe 2740 jjvdd.exe 3992 xrrlffx.exe 4040 xlrlffx.exe 1012 9ttnht.exe 2796 vvjjv.exe 868 rlxlrfx.exe 3864 bthhbb.exe 3016 jddvd.exe 3496 flrlxrl.exe 1436 fxlfxxr.exe 3608 htbthh.exe 1344 jvvpj.exe 4916 llrflfl.exe 2260 bhnnhb.exe 4908 djvpd.exe 2964 jjppd.exe 1712 7xrlxxx.exe 3580 tbhhhb.exe 2788 5ppjj.exe 5052 dpjdv.exe 736 xxfxrxr.exe 3724 htbttn.exe -
Processes:
resource yara_rule behavioral2/memory/2936-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/792-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/508-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-804-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1vdpd.exepjvdd.exenbnntn.exevjjvj.exerrrrxrx.exerlrllll.exe5xlflll.exerffrxrr.exelxrllll.exe5httnn.exe3bhbtt.exetntntn.exe5hhttn.exebttnhh.exennthtn.exe7tntnn.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5httnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exefllrfxl.exejjvdp.exe5flxlfl.exexrxrlff.exejjjdj.exehntttb.exehttnhh.exe5hbbhh.exe5hhttn.exevvjpv.exe1tnhtt.exerffrllf.exe9vvjv.exeddpvp.exe3flxrlx.exe7nhhbb.exexrxrfxr.exedvpdj.exe1xxrfxr.exehhhtnh.exexxlxrxr.exedescription pid process target process PID 2936 wrote to memory of 4708 2936 642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe fllrfxl.exe PID 2936 wrote to memory of 4708 2936 642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe fllrfxl.exe PID 2936 wrote to memory of 4708 2936 642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe fllrfxl.exe PID 4708 wrote to memory of 5072 4708 fllrfxl.exe jjvdp.exe PID 4708 wrote to memory of 5072 4708 fllrfxl.exe jjvdp.exe PID 4708 wrote to memory of 5072 4708 fllrfxl.exe jjvdp.exe PID 5072 wrote to memory of 4888 5072 jjvdp.exe 5flxlfl.exe PID 5072 wrote to memory of 4888 5072 jjvdp.exe 5flxlfl.exe PID 5072 wrote to memory of 4888 5072 jjvdp.exe 5flxlfl.exe PID 4888 wrote to memory of 1660 4888 5flxlfl.exe xrxrlff.exe PID 4888 wrote to memory of 1660 4888 5flxlfl.exe xrxrlff.exe PID 4888 wrote to memory of 1660 4888 5flxlfl.exe xrxrlff.exe PID 1660 wrote to memory of 3652 1660 xrxrlff.exe jjjdj.exe PID 1660 wrote to memory of 3652 1660 xrxrlff.exe jjjdj.exe PID 1660 wrote to memory of 3652 1660 xrxrlff.exe jjjdj.exe PID 3652 wrote to memory of 3184 3652 jjjdj.exe hntttb.exe PID 3652 wrote to memory of 3184 3652 jjjdj.exe hntttb.exe PID 3652 wrote to memory of 3184 3652 jjjdj.exe hntttb.exe PID 3184 wrote to memory of 4800 3184 hntttb.exe httnhh.exe PID 3184 wrote to memory of 4800 3184 hntttb.exe httnhh.exe PID 3184 wrote to memory of 4800 3184 hntttb.exe httnhh.exe PID 4800 wrote to memory of 4972 4800 httnhh.exe 5hbbhh.exe PID 4800 wrote to memory of 4972 4800 httnhh.exe 5hbbhh.exe PID 4800 wrote to memory of 4972 4800 httnhh.exe 5hbbhh.exe PID 4972 wrote to memory of 3948 4972 5hbbhh.exe 5hhttn.exe PID 4972 wrote to memory of 3948 4972 5hbbhh.exe 5hhttn.exe PID 4972 wrote to memory of 3948 4972 5hbbhh.exe 5hhttn.exe PID 3948 wrote to memory of 2940 3948 5hhttn.exe vvjpv.exe PID 3948 wrote to memory of 2940 3948 5hhttn.exe vvjpv.exe PID 3948 wrote to memory of 2940 3948 5hhttn.exe vvjpv.exe PID 2940 wrote to memory of 4760 2940 vvjpv.exe 1tnhtt.exe PID 2940 wrote to memory of 4760 2940 vvjpv.exe 1tnhtt.exe PID 2940 wrote to memory of 4760 2940 vvjpv.exe 1tnhtt.exe PID 4760 wrote to memory of 4460 4760 1tnhtt.exe rffrllf.exe PID 4760 wrote to memory of 4460 4760 1tnhtt.exe rffrllf.exe PID 4760 wrote to memory of 4460 4760 1tnhtt.exe rffrllf.exe PID 4460 wrote to memory of 3580 4460 rffrllf.exe 9vvjv.exe PID 4460 wrote to memory of 3580 4460 rffrllf.exe 9vvjv.exe PID 4460 wrote to memory of 3580 4460 rffrllf.exe 9vvjv.exe PID 3580 wrote to memory of 4268 3580 9vvjv.exe ddpvp.exe PID 3580 wrote to memory of 4268 3580 9vvjv.exe ddpvp.exe PID 3580 wrote to memory of 4268 3580 9vvjv.exe ddpvp.exe PID 4268 wrote to memory of 5052 4268 ddpvp.exe 3flxrlx.exe PID 4268 wrote to memory of 5052 4268 ddpvp.exe 3flxrlx.exe PID 4268 wrote to memory of 5052 4268 ddpvp.exe 3flxrlx.exe PID 5052 wrote to memory of 3200 5052 3flxrlx.exe 7nhhbb.exe PID 5052 wrote to memory of 3200 5052 3flxrlx.exe 7nhhbb.exe PID 5052 wrote to memory of 3200 5052 3flxrlx.exe 7nhhbb.exe PID 3200 wrote to memory of 3068 3200 7nhhbb.exe xrxrfxr.exe PID 3200 wrote to memory of 3068 3200 7nhhbb.exe xrxrfxr.exe PID 3200 wrote to memory of 3068 3200 7nhhbb.exe xrxrfxr.exe PID 3068 wrote to memory of 3688 3068 xrxrfxr.exe dvpdj.exe PID 3068 wrote to memory of 3688 3068 xrxrfxr.exe dvpdj.exe PID 3068 wrote to memory of 3688 3068 xrxrfxr.exe dvpdj.exe PID 3688 wrote to memory of 3996 3688 dvpdj.exe 1xxrfxr.exe PID 3688 wrote to memory of 3996 3688 dvpdj.exe 1xxrfxr.exe PID 3688 wrote to memory of 3996 3688 dvpdj.exe 1xxrfxr.exe PID 3996 wrote to memory of 4600 3996 1xxrfxr.exe hhhtnh.exe PID 3996 wrote to memory of 4600 3996 1xxrfxr.exe hhhtnh.exe PID 3996 wrote to memory of 4600 3996 1xxrfxr.exe hhhtnh.exe PID 4600 wrote to memory of 444 4600 hhhtnh.exe xxlxrxr.exe PID 4600 wrote to memory of 444 4600 hhhtnh.exe xxlxrxr.exe PID 4600 wrote to memory of 444 4600 hhhtnh.exe xxlxrxr.exe PID 444 wrote to memory of 848 444 xxlxrxr.exe rfrlxxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe"C:\Users\Admin\AppData\Local\Temp\642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\fllrfxl.exec:\fllrfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\jjvdp.exec:\jjvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\5flxlfl.exec:\5flxlfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\xrxrlff.exec:\xrxrlff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\jjjdj.exec:\jjjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\hntttb.exec:\hntttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\httnhh.exec:\httnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\5hbbhh.exec:\5hbbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\5hhttn.exec:\5hhttn.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\vvjpv.exec:\vvjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\1tnhtt.exec:\1tnhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\rffrllf.exec:\rffrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\9vvjv.exec:\9vvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\ddpvp.exec:\ddpvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\3flxrlx.exec:\3flxrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\7nhhbb.exec:\7nhhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\xrxrfxr.exec:\xrxrfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\dvpdj.exec:\dvpdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\1xxrfxr.exec:\1xxrfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\hhhtnh.exec:\hhhtnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\xxlxrxr.exec:\xxlxrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\rfrlxxx.exec:\rfrlxxx.exe23⤵
- Executes dropped EXE
PID:848 -
\??\c:\rrrrlll.exec:\rrrrlll.exe24⤵
- Executes dropped EXE
PID:4304 -
\??\c:\3bhhhn.exec:\3bhhhn.exe25⤵
- Executes dropped EXE
PID:876 -
\??\c:\vpjdv.exec:\vpjdv.exe26⤵
- Executes dropped EXE
PID:376 -
\??\c:\fllrfrf.exec:\fllrfrf.exe27⤵
- Executes dropped EXE
PID:3172 -
\??\c:\3jppj.exec:\3jppj.exe28⤵
- Executes dropped EXE
PID:760 -
\??\c:\bnbhhh.exec:\bnbhhh.exe29⤵
- Executes dropped EXE
PID:2340 -
\??\c:\3nnhhh.exec:\3nnhhh.exe30⤵
- Executes dropped EXE
PID:3904 -
\??\c:\lllxlfr.exec:\lllxlfr.exe31⤵
- Executes dropped EXE
PID:3360 -
\??\c:\dddvp.exec:\dddvp.exe32⤵
- Executes dropped EXE
PID:792 -
\??\c:\ffffxxr.exec:\ffffxxr.exe33⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jvddv.exec:\jvddv.exe34⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1rxlfrl.exec:\1rxlfrl.exe35⤵
- Executes dropped EXE
PID:3348 -
\??\c:\9bhbbb.exec:\9bhbbb.exe36⤵
- Executes dropped EXE
PID:4048 -
\??\c:\5pjdd.exec:\5pjdd.exe37⤵
- Executes dropped EXE
PID:3100 -
\??\c:\7llxllr.exec:\7llxllr.exe38⤵
- Executes dropped EXE
PID:1100 -
\??\c:\nthbnb.exec:\nthbnb.exe39⤵
- Executes dropped EXE
PID:1192 -
\??\c:\5vjvp.exec:\5vjvp.exe40⤵
- Executes dropped EXE
PID:3860 -
\??\c:\jdjvd.exec:\jdjvd.exe41⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rlrrrlf.exec:\rlrrrlf.exe42⤵
- Executes dropped EXE
PID:4420 -
\??\c:\1hbtnh.exec:\1hbtnh.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jjvdd.exec:\jjvdd.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xrrlffx.exec:\xrrlffx.exe45⤵
- Executes dropped EXE
PID:3992 -
\??\c:\xlrlffx.exec:\xlrlffx.exe46⤵
- Executes dropped EXE
PID:4040 -
\??\c:\9ttnht.exec:\9ttnht.exe47⤵
- Executes dropped EXE
PID:1012 -
\??\c:\vvjjv.exec:\vvjjv.exe48⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rlxlrfx.exec:\rlxlrfx.exe49⤵
- Executes dropped EXE
PID:868 -
\??\c:\bthhbb.exec:\bthhbb.exe50⤵
- Executes dropped EXE
PID:3864 -
\??\c:\jddvd.exec:\jddvd.exe51⤵
- Executes dropped EXE
PID:3016 -
\??\c:\flrlxrl.exec:\flrlxrl.exe52⤵
- Executes dropped EXE
PID:3496 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe53⤵
- Executes dropped EXE
PID:1436 -
\??\c:\htbthh.exec:\htbthh.exe54⤵
- Executes dropped EXE
PID:3608 -
\??\c:\jvvpj.exec:\jvvpj.exe55⤵
- Executes dropped EXE
PID:1344 -
\??\c:\llrflfl.exec:\llrflfl.exe56⤵
- Executes dropped EXE
PID:4916 -
\??\c:\bhnnhb.exec:\bhnnhb.exe57⤵
- Executes dropped EXE
PID:2260 -
\??\c:\djvpd.exec:\djvpd.exe58⤵
- Executes dropped EXE
PID:4908 -
\??\c:\jjppd.exec:\jjppd.exe59⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7xrlxxx.exec:\7xrlxxx.exe60⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tbhhhb.exec:\tbhhhb.exe61⤵
- Executes dropped EXE
PID:3580 -
\??\c:\5ppjj.exec:\5ppjj.exe62⤵
- Executes dropped EXE
PID:2788 -
\??\c:\dpjdv.exec:\dpjdv.exe63⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xxfxrxr.exec:\xxfxrxr.exe64⤵
- Executes dropped EXE
PID:736 -
\??\c:\htbttn.exec:\htbttn.exe65⤵
- Executes dropped EXE
PID:3724 -
\??\c:\dvvvp.exec:\dvvvp.exe66⤵PID:5084
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe67⤵PID:3468
-
\??\c:\9htnbb.exec:\9htnbb.exe68⤵PID:2284
-
\??\c:\vppjd.exec:\vppjd.exe69⤵PID:4256
-
\??\c:\xxxrxrf.exec:\xxxrxrf.exe70⤵PID:4476
-
\??\c:\lrfrlfx.exec:\lrfrlfx.exe71⤵PID:4424
-
\??\c:\httnnn.exec:\httnnn.exe72⤵PID:1760
-
\??\c:\dvvdv.exec:\dvvdv.exe73⤵PID:3632
-
\??\c:\lfxlxrf.exec:\lfxlxrf.exe74⤵PID:3980
-
\??\c:\9bbhbb.exec:\9bbhbb.exe75⤵PID:1540
-
\??\c:\vdpvp.exec:\vdpvp.exe76⤵PID:3244
-
\??\c:\fllfxrl.exec:\fllfxrl.exe77⤵PID:1916
-
\??\c:\9xlfxrl.exec:\9xlfxrl.exe78⤵PID:5040
-
\??\c:\tnhthb.exec:\tnhthb.exe79⤵PID:2144
-
\??\c:\jpvpv.exec:\jpvpv.exe80⤵PID:4732
-
\??\c:\1xrxrlx.exec:\1xrxrlx.exe81⤵PID:4092
-
\??\c:\9ffxlrl.exec:\9ffxlrl.exe82⤵PID:4552
-
\??\c:\nnhbnh.exec:\nnhbnh.exe83⤵PID:376
-
\??\c:\hhhtnn.exec:\hhhtnn.exe84⤵PID:2724
-
\??\c:\1vjdv.exec:\1vjdv.exe85⤵PID:1240
-
\??\c:\9rfrfrf.exec:\9rfrfrf.exe86⤵PID:3816
-
\??\c:\5bttbt.exec:\5bttbt.exe87⤵PID:3448
-
\??\c:\3djdp.exec:\3djdp.exe88⤵PID:2340
-
\??\c:\dddvp.exec:\dddvp.exe89⤵PID:4540
-
\??\c:\1rxrflf.exec:\1rxrflf.exe90⤵PID:2360
-
\??\c:\nnnhtn.exec:\nnnhtn.exe91⤵PID:1804
-
\??\c:\pjjpj.exec:\pjjpj.exe92⤵PID:4588
-
\??\c:\vppvd.exec:\vppvd.exe93⤵PID:3368
-
\??\c:\1rllxrf.exec:\1rllxrf.exe94⤵PID:4696
-
\??\c:\tttnnn.exec:\tttnnn.exe95⤵PID:4412
-
\??\c:\pvvjv.exec:\pvvjv.exe96⤵PID:3384
-
\??\c:\rxxxfrf.exec:\rxxxfrf.exe97⤵PID:3940
-
\??\c:\rllflfx.exec:\rllflfx.exe98⤵PID:4352
-
\??\c:\nhhbtn.exec:\nhhbtn.exe99⤵PID:2936
-
\??\c:\9vjdp.exec:\9vjdp.exe100⤵PID:5072
-
\??\c:\fffxrrl.exec:\fffxrrl.exe101⤵PID:1504
-
\??\c:\xffxrfx.exec:\xffxrfx.exe102⤵PID:548
-
\??\c:\9bnhtt.exec:\9bnhtt.exe103⤵PID:2572
-
\??\c:\7ddvj.exec:\7ddvj.exe104⤵PID:3652
-
\??\c:\llrlxxx.exec:\llrlxxx.exe105⤵PID:3184
-
\??\c:\5fxrffx.exec:\5fxrffx.exe106⤵PID:4892
-
\??\c:\bbhbhb.exec:\bbhbhb.exe107⤵PID:2216
-
\??\c:\vdvjd.exec:\vdvjd.exe108⤵PID:960
-
\??\c:\rllfrlf.exec:\rllfrlf.exe109⤵PID:1412
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe110⤵PID:220
-
\??\c:\1hbtnh.exec:\1hbtnh.exe111⤵PID:2344
-
\??\c:\5tnbnh.exec:\5tnbnh.exe112⤵PID:1816
-
\??\c:\vvdvp.exec:\vvdvp.exe113⤵PID:1912
-
\??\c:\frxxrlf.exec:\frxxrlf.exe114⤵PID:2028
-
\??\c:\7nhhbb.exec:\7nhhbb.exe115⤵PID:4460
-
\??\c:\nnhbtt.exec:\nnhbtt.exe116⤵PID:5056
-
\??\c:\vjjvp.exec:\vjjvp.exe117⤵PID:4472
-
\??\c:\5rlxlfr.exec:\5rlxlfr.exe118⤵PID:2024
-
\??\c:\nnthtn.exec:\nnthtn.exe119⤵
- System Location Discovery: System Language Discovery
PID:2156 -
\??\c:\pdpdp.exec:\pdpdp.exe120⤵PID:736
-
\??\c:\pjjdp.exec:\pjjdp.exe121⤵PID:3724
-
\??\c:\7lxxllf.exec:\7lxxllf.exe122⤵PID:4904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-