Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 02:33
Behavioral task
behavioral1
Sample
9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe
-
Size
332KB
-
MD5
4f001bc4c63a08351734145733b510fe
-
SHA1
4e1c3d7f0dab71dc6f9125de4d7d0ac35668cd3f
-
SHA256
9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765
-
SHA512
9d321b019eee1549c80bb21c31b902427be69f1ad0f913ce918c6d53ba3d347f3499fcff05dc869c0c1600a9410d05b70141b5bc68e6a215a5e10f3e0506e248
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tj:94wFHoStJdSjylh2b77BoTMA9gX59sT7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4132-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3332-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1144-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2896-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/992-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-1016-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3128-1387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4684 djppp.exe 1684 ffllxxx.exe 2224 tnhbbb.exe 2344 7tnnhh.exe 2032 dppjj.exe 4568 bnhhhh.exe 3916 jjdpj.exe 4740 rflxffl.exe 5024 ddddj.exe 3528 hbnnnn.exe 3992 jjpjj.exe 2960 bnbbtt.exe 3752 vdddd.exe 4780 lfrlllf.exe 3068 9jddj.exe 2524 pvpjp.exe 860 hbbnbb.exe 2836 tttttt.exe 4008 dvvvv.exe 3216 xfflflf.exe 3968 jvjjd.exe 4664 frrlfrx.exe 5068 nbhbtt.exe 4660 vvvvp.exe 3876 rxlfllr.exe 3332 bbbbhh.exe 3624 pjjdv.exe 1720 lxfxrrl.exe 2712 bbbbtt.exe 1724 7lllfff.exe 1144 5ttnhh.exe 1280 rlrlfff.exe 2416 thhbtt.exe 2496 dvddd.exe 2380 dpjdd.exe 3164 fffxrrl.exe 4916 hbbtnh.exe 744 nbbbtb.exe 2896 rrflrff.exe 5056 1nhhhh.exe 2296 djjdv.exe 4108 3pppj.exe 1648 fxllrxx.exe 632 tntbtt.exe 2184 nhtbtt.exe 5032 5vpjj.exe 4304 rffflll.exe 4288 rxfffll.exe 1264 nnttbb.exe 4500 bhhhbb.exe 1088 1vddv.exe 1684 9rxxrxf.exe 3132 bbnhhh.exe 3696 tnnnhh.exe 2044 9pvvp.exe 3304 rrrrlll.exe 2108 fffffff.exe 2804 bthhbb.exe 4024 bhnhbb.exe 4488 ppdvd.exe 2100 5flfxxx.exe 4932 lxfxxxx.exe 1124 tbhbhh.exe 2088 tbbtnt.exe -
resource yara_rule behavioral2/memory/4132-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023c93-3.dat upx behavioral2/memory/4132-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9b-9.dat upx behavioral2/memory/4684-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9c-11.dat upx behavioral2/memory/1684-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9d-18.dat upx behavioral2/memory/2224-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9e-23.dat upx behavioral2/memory/2344-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2032-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9f-28.dat upx behavioral2/files/0x0007000000023ca0-33.dat upx behavioral2/memory/3916-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4568-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca1-39.dat upx behavioral2/files/0x0007000000023ca2-43.dat upx behavioral2/memory/4740-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca3-48.dat upx behavioral2/memory/5024-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca4-54.dat upx behavioral2/memory/3528-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca5-58.dat upx behavioral2/memory/3992-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca6-63.dat upx behavioral2/memory/3752-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca7-68.dat upx behavioral2/files/0x0007000000023ca8-72.dat upx behavioral2/memory/3068-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca9-78.dat upx behavioral2/files/0x0007000000023caa-81.dat upx behavioral2/files/0x0007000000023cab-87.dat upx behavioral2/memory/2524-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/860-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cac-92.dat upx behavioral2/memory/4008-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cad-97.dat upx behavioral2/files/0x0007000000023cae-102.dat upx behavioral2/files/0x0007000000023caf-106.dat upx behavioral2/memory/4664-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3968-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3216-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb0-111.dat upx behavioral2/files/0x0007000000023cb1-116.dat upx behavioral2/memory/5068-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4660-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-122.dat upx behavioral2/memory/3876-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb3-127.dat upx behavioral2/memory/3876-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3332-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb4-132.dat upx behavioral2/files/0x0007000000023cb5-137.dat upx behavioral2/memory/3624-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb6-142.dat upx behavioral2/memory/1720-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb7-146.dat upx behavioral2/files/0x0007000000023cb8-151.dat upx behavioral2/memory/1724-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-154.dat upx behavioral2/memory/1144-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2416-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/744-173-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4132 wrote to memory of 4684 4132 9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe 83 PID 4132 wrote to memory of 4684 4132 9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe 83 PID 4132 wrote to memory of 4684 4132 9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe 83 PID 4684 wrote to memory of 1684 4684 djppp.exe 84 PID 4684 wrote to memory of 1684 4684 djppp.exe 84 PID 4684 wrote to memory of 1684 4684 djppp.exe 84 PID 1684 wrote to memory of 2224 1684 ffllxxx.exe 85 PID 1684 wrote to memory of 2224 1684 ffllxxx.exe 85 PID 1684 wrote to memory of 2224 1684 ffllxxx.exe 85 PID 2224 wrote to memory of 2344 2224 tnhbbb.exe 86 PID 2224 wrote to memory of 2344 2224 tnhbbb.exe 86 PID 2224 wrote to memory of 2344 2224 tnhbbb.exe 86 PID 2344 wrote to memory of 2032 2344 7tnnhh.exe 87 PID 2344 wrote to memory of 2032 2344 7tnnhh.exe 87 PID 2344 wrote to memory of 2032 2344 7tnnhh.exe 87 PID 2032 wrote to memory of 4568 2032 dppjj.exe 88 PID 2032 wrote to memory of 4568 2032 dppjj.exe 88 PID 2032 wrote to memory of 4568 2032 dppjj.exe 88 PID 4568 wrote to memory of 3916 4568 bnhhhh.exe 89 PID 4568 wrote to memory of 3916 4568 bnhhhh.exe 89 PID 4568 wrote to memory of 3916 4568 bnhhhh.exe 89 PID 3916 wrote to memory of 4740 3916 jjdpj.exe 90 PID 3916 wrote to memory of 4740 3916 jjdpj.exe 90 PID 3916 wrote to memory of 4740 3916 jjdpj.exe 90 PID 4740 wrote to memory of 5024 4740 rflxffl.exe 91 PID 4740 wrote to memory of 5024 4740 rflxffl.exe 91 PID 4740 wrote to memory of 5024 4740 rflxffl.exe 91 PID 5024 wrote to memory of 3528 5024 ddddj.exe 92 PID 5024 wrote to memory of 3528 5024 ddddj.exe 92 PID 5024 wrote to memory of 3528 5024 ddddj.exe 92 PID 3528 wrote to memory of 3992 3528 hbnnnn.exe 93 PID 3528 wrote to memory of 3992 3528 hbnnnn.exe 93 PID 3528 wrote to memory of 3992 3528 hbnnnn.exe 93 PID 3992 wrote to memory of 2960 3992 jjpjj.exe 94 PID 3992 wrote to memory of 2960 3992 jjpjj.exe 94 PID 3992 wrote to memory of 2960 3992 jjpjj.exe 94 PID 2960 wrote to memory of 3752 2960 bnbbtt.exe 95 PID 2960 wrote to memory of 3752 2960 bnbbtt.exe 95 PID 2960 wrote to memory of 3752 2960 bnbbtt.exe 95 PID 3752 wrote to memory of 4780 3752 vdddd.exe 96 PID 3752 wrote to memory of 4780 3752 vdddd.exe 96 PID 3752 wrote to memory of 4780 3752 vdddd.exe 96 PID 4780 wrote to memory of 3068 4780 lfrlllf.exe 97 PID 4780 wrote to memory of 3068 4780 lfrlllf.exe 97 PID 4780 wrote to memory of 3068 4780 lfrlllf.exe 97 PID 3068 wrote to memory of 2524 3068 9jddj.exe 98 PID 3068 wrote to memory of 2524 3068 9jddj.exe 98 PID 3068 wrote to memory of 2524 3068 9jddj.exe 98 PID 2524 wrote to memory of 860 2524 pvpjp.exe 99 PID 2524 wrote to memory of 860 2524 pvpjp.exe 99 PID 2524 wrote to memory of 860 2524 pvpjp.exe 99 PID 860 wrote to memory of 2836 860 hbbnbb.exe 100 PID 860 wrote to memory of 2836 860 hbbnbb.exe 100 PID 860 wrote to memory of 2836 860 hbbnbb.exe 100 PID 2836 wrote to memory of 4008 2836 tttttt.exe 101 PID 2836 wrote to memory of 4008 2836 tttttt.exe 101 PID 2836 wrote to memory of 4008 2836 tttttt.exe 101 PID 4008 wrote to memory of 3216 4008 dvvvv.exe 102 PID 4008 wrote to memory of 3216 4008 dvvvv.exe 102 PID 4008 wrote to memory of 3216 4008 dvvvv.exe 102 PID 3216 wrote to memory of 3968 3216 xfflflf.exe 103 PID 3216 wrote to memory of 3968 3216 xfflflf.exe 103 PID 3216 wrote to memory of 3968 3216 xfflflf.exe 103 PID 3968 wrote to memory of 4664 3968 jvjjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe"C:\Users\Admin\AppData\Local\Temp\9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\djppp.exec:\djppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\ffllxxx.exec:\ffllxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\tnhbbb.exec:\tnhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\7tnnhh.exec:\7tnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\dppjj.exec:\dppjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\bnhhhh.exec:\bnhhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\jjdpj.exec:\jjdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\rflxffl.exec:\rflxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\ddddj.exec:\ddddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\hbnnnn.exec:\hbnnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\jjpjj.exec:\jjpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\bnbbtt.exec:\bnbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\vdddd.exec:\vdddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\lfrlllf.exec:\lfrlllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\9jddj.exec:\9jddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\pvpjp.exec:\pvpjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hbbnbb.exec:\hbbnbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\tttttt.exec:\tttttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\dvvvv.exec:\dvvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\xfflflf.exec:\xfflflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\jvjjd.exec:\jvjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\frrlfrx.exec:\frrlfrx.exe23⤵
- Executes dropped EXE
PID:4664 -
\??\c:\nbhbtt.exec:\nbhbtt.exe24⤵
- Executes dropped EXE
PID:5068 -
\??\c:\vvvvp.exec:\vvvvp.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4660 -
\??\c:\rxlfllr.exec:\rxlfllr.exe26⤵
- Executes dropped EXE
PID:3876 -
\??\c:\bbbbhh.exec:\bbbbhh.exe27⤵
- Executes dropped EXE
PID:3332 -
\??\c:\pjjdv.exec:\pjjdv.exe28⤵
- Executes dropped EXE
PID:3624 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe29⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bbbbtt.exec:\bbbbtt.exe30⤵
- Executes dropped EXE
PID:2712 -
\??\c:\7lllfff.exec:\7lllfff.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5ttnhh.exec:\5ttnhh.exe32⤵
- Executes dropped EXE
PID:1144 -
\??\c:\rlrlfff.exec:\rlrlfff.exe33⤵
- Executes dropped EXE
PID:1280 -
\??\c:\thhbtt.exec:\thhbtt.exe34⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dvddd.exec:\dvddd.exe35⤵
- Executes dropped EXE
PID:2496 -
\??\c:\dpjdd.exec:\dpjdd.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fffxrrl.exec:\fffxrrl.exe37⤵
- Executes dropped EXE
PID:3164 -
\??\c:\hbbtnh.exec:\hbbtnh.exe38⤵
- Executes dropped EXE
PID:4916 -
\??\c:\nbbbtb.exec:\nbbbtb.exe39⤵
- Executes dropped EXE
PID:744 -
\??\c:\rrflrff.exec:\rrflrff.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1nhhhh.exec:\1nhhhh.exe41⤵
- Executes dropped EXE
PID:5056 -
\??\c:\djjdv.exec:\djjdv.exe42⤵
- Executes dropped EXE
PID:2296 -
\??\c:\3pppj.exec:\3pppj.exe43⤵
- Executes dropped EXE
PID:4108 -
\??\c:\fxllrxx.exec:\fxllrxx.exe44⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tntbtt.exec:\tntbtt.exe45⤵
- Executes dropped EXE
PID:632 -
\??\c:\nhtbtt.exec:\nhtbtt.exe46⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5vpjj.exec:\5vpjj.exe47⤵
- Executes dropped EXE
PID:5032 -
\??\c:\rffflll.exec:\rffflll.exe48⤵
- Executes dropped EXE
PID:4304 -
\??\c:\rxfffll.exec:\rxfffll.exe49⤵
- Executes dropped EXE
PID:4288 -
\??\c:\nnttbb.exec:\nnttbb.exe50⤵
- Executes dropped EXE
PID:1264 -
\??\c:\bhhhbb.exec:\bhhhbb.exe51⤵
- Executes dropped EXE
PID:4500 -
\??\c:\1vddv.exec:\1vddv.exe52⤵
- Executes dropped EXE
PID:1088 -
\??\c:\9rxxrxf.exec:\9rxxrxf.exe53⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bbnhhh.exec:\bbnhhh.exe54⤵
- Executes dropped EXE
PID:3132 -
\??\c:\tnnnhh.exec:\tnnnhh.exe55⤵
- Executes dropped EXE
PID:3696 -
\??\c:\9pvvp.exec:\9pvvp.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rrrrlll.exec:\rrrrlll.exe57⤵
- Executes dropped EXE
PID:3304 -
\??\c:\fffffff.exec:\fffffff.exe58⤵
- Executes dropped EXE
PID:2108 -
\??\c:\bthhbb.exec:\bthhbb.exe59⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bhnhbb.exec:\bhnhbb.exe60⤵
- Executes dropped EXE
PID:4024 -
\??\c:\ppdvd.exec:\ppdvd.exe61⤵
- Executes dropped EXE
PID:4488 -
\??\c:\5flfxxx.exec:\5flfxxx.exe62⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe63⤵
- Executes dropped EXE
PID:4932 -
\??\c:\tbhbhh.exec:\tbhbhh.exe64⤵
- Executes dropped EXE
PID:1124 -
\??\c:\tbbtnt.exec:\tbbtnt.exe65⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vvddv.exec:\vvddv.exe66⤵PID:3156
-
\??\c:\hhhbbb.exec:\hhhbbb.exe67⤵PID:1116
-
\??\c:\bbbtnn.exec:\bbbtnn.exe68⤵PID:2276
-
\??\c:\pdjjd.exec:\pdjjd.exe69⤵PID:1896
-
\??\c:\xxrlffx.exec:\xxrlffx.exe70⤵PID:3992
-
\??\c:\rffrrrl.exec:\rffrrrl.exe71⤵PID:1568
-
\??\c:\tbnhhh.exec:\tbnhhh.exe72⤵PID:4224
-
\??\c:\vvvpd.exec:\vvvpd.exe73⤵PID:4116
-
\??\c:\ffflfrl.exec:\ffflfrl.exe74⤵PID:3064
-
\??\c:\rxffxfx.exec:\rxffxfx.exe75⤵PID:3896
-
\??\c:\nnnhhh.exec:\nnnhhh.exe76⤵PID:2356
-
\??\c:\ddjvv.exec:\ddjvv.exe77⤵PID:1540
-
\??\c:\dddpj.exec:\dddpj.exe78⤵PID:2524
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe79⤵PID:4552
-
\??\c:\tttnhh.exec:\tttnhh.exe80⤵PID:4348
-
\??\c:\hhtnhh.exec:\hhtnhh.exe81⤵PID:224
-
\??\c:\vpvvv.exec:\vpvvv.exe82⤵PID:1188
-
\??\c:\xfflfff.exec:\xfflfff.exe83⤵PID:3216
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe84⤵PID:2348
-
\??\c:\bhhbbb.exec:\bhhbbb.exe85⤵PID:4528
-
\??\c:\9vdvd.exec:\9vdvd.exe86⤵PID:1784
-
\??\c:\vvjdv.exec:\vvjdv.exe87⤵PID:4800
-
\??\c:\lrrxrrl.exec:\lrrxrrl.exe88⤵PID:836
-
\??\c:\tnnhbb.exec:\tnnhbb.exe89⤵PID:3636
-
\??\c:\dpvvp.exec:\dpvvp.exe90⤵PID:3712
-
\??\c:\jpvvv.exec:\jpvvv.exe91⤵PID:2812
-
\??\c:\llllfff.exec:\llllfff.exe92⤵PID:2708
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe93⤵PID:2520
-
\??\c:\nthtnn.exec:\nthtnn.exe94⤵PID:2168
-
\??\c:\pjvvd.exec:\pjvvd.exe95⤵PID:1432
-
\??\c:\vdddd.exec:\vdddd.exe96⤵PID:2712
-
\??\c:\ffffllx.exec:\ffffllx.exe97⤵PID:3016
-
\??\c:\fffxxxx.exec:\fffxxxx.exe98⤵
- System Location Discovery: System Language Discovery
PID:3288 -
\??\c:\hbttnn.exec:\hbttnn.exe99⤵PID:4428
-
\??\c:\tbbtth.exec:\tbbtth.exe100⤵PID:4980
-
\??\c:\7vddv.exec:\7vddv.exe101⤵PID:1920
-
\??\c:\jvdpj.exec:\jvdpj.exe102⤵PID:3560
-
\??\c:\llllffx.exec:\llllffx.exe103⤵PID:744
-
\??\c:\bbbbtt.exec:\bbbbtt.exe104⤵PID:992
-
\??\c:\tthbbb.exec:\tthbbb.exe105⤵PID:4768
-
\??\c:\jddvv.exec:\jddvv.exe106⤵PID:1944
-
\??\c:\lllfxxx.exec:\lllfxxx.exe107⤵PID:2472
-
\??\c:\bnbtnh.exec:\bnbtnh.exe108⤵PID:3680
-
\??\c:\vvjjj.exec:\vvjjj.exe109⤵PID:1176
-
\??\c:\7xxxrrl.exec:\7xxxrrl.exe110⤵PID:4316
-
\??\c:\ttnnnn.exec:\ttnnnn.exe111⤵PID:5100
-
\??\c:\ppvpj.exec:\ppvpj.exe112⤵PID:4540
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe113⤵PID:3256
-
\??\c:\bnttnh.exec:\bnttnh.exe114⤵PID:4476
-
\??\c:\jdjdd.exec:\jdjdd.exe115⤵PID:1468
-
\??\c:\fxllfff.exec:\fxllfff.exe116⤵PID:2736
-
\??\c:\nnnnhh.exec:\nnnnhh.exe117⤵PID:3780
-
\??\c:\7hnnhh.exec:\7hnnhh.exe118⤵PID:2580
-
\??\c:\vjpvp.exec:\vjpvp.exe119⤵PID:4508
-
\??\c:\rrxrllr.exec:\rrxrllr.exe120⤵PID:2592
-
\??\c:\flxlxxr.exec:\flxlxxr.exe121⤵PID:1700
-
\??\c:\nntthn.exec:\nntthn.exe122⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-