Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 05:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe
-
Size
453KB
-
MD5
c5d9399bdf4980b8ad641ab5d17d8a98
-
SHA1
50035fa797db18a83cabb3911c7394f0ca052c36
-
SHA256
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e
-
SHA512
30347dd145554dd1aed8a09b584542ea8b06e94ca8c7ef36fadd4793531f1fcbb95318e7a9974445e951b068e9b8e0eaf7393a6dad00c78da7b40edb9c77383a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetX:q7Tc2NYHUrAwfMp3CDtX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3968-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-898-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-929-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-1063-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-1232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-1272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-1636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 frxrllf.exe 4496 1jjjv.exe 4136 vpvpd.exe 4664 htnhnh.exe 4764 rxrflxf.exe 4800 llrfllf.exe 4868 1jdvp.exe 3744 htnhbb.exe 2964 flllxxr.exe 2548 djjvp.exe 4396 nnbnbn.exe 2456 nntnnn.exe 2640 9fxrffx.exe 3028 pdjdp.exe 2720 nhhhbh.exe 3068 jddpp.exe 5024 5fxrllf.exe 4948 frllxxx.exe 1900 vpppj.exe 3428 xrrlfll.exe 2808 lflffff.exe 2380 7djdv.exe 5112 llffxff.exe 1928 tntnnh.exe 5052 1vvpd.exe 3988 xlfffxl.exe 3408 tnnnbb.exe 2976 hnbttb.exe 3996 jdvvv.exe 4824 bbnnbh.exe 3852 7nbhtn.exe 3472 dvdjp.exe 1600 5bbtnn.exe 3672 fxlfffx.exe 1112 1vvvv.exe 1608 jddvd.exe 972 btnhbh.exe 2220 hbhbtb.exe 3480 vdppd.exe 2696 3lrfffl.exe 2844 bnnhtn.exe 4560 tbnnhh.exe 3120 vvvvp.exe 3808 lllfxrl.exe 3360 tnnnhh.exe 1724 3hbtnn.exe 4364 7pjpp.exe 4372 1rllxfl.exe 1120 tttbbb.exe 1020 vjpjv.exe 1160 9lrlfxr.exe 624 nhhnht.exe 456 5jjjd.exe 4056 frrxlfx.exe 4820 lxrxflf.exe 4952 ddppd.exe 3980 3xfxfxl.exe 4592 xflfxlf.exe 804 1tnnhb.exe 4544 3vdvv.exe 2180 5rlfrrr.exe 4148 3rrlffx.exe 1924 5tbbtt.exe 3436 9ppvj.exe -
resource yara_rule behavioral2/memory/3968-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-898-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-929-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3968 wrote to memory of 2108 3968 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 82 PID 3968 wrote to memory of 2108 3968 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 82 PID 3968 wrote to memory of 2108 3968 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 82 PID 2108 wrote to memory of 4496 2108 frxrllf.exe 83 PID 2108 wrote to memory of 4496 2108 frxrllf.exe 83 PID 2108 wrote to memory of 4496 2108 frxrllf.exe 83 PID 4496 wrote to memory of 4136 4496 1jjjv.exe 84 PID 4496 wrote to memory of 4136 4496 1jjjv.exe 84 PID 4496 wrote to memory of 4136 4496 1jjjv.exe 84 PID 4136 wrote to memory of 4664 4136 vpvpd.exe 85 PID 4136 wrote to memory of 4664 4136 vpvpd.exe 85 PID 4136 wrote to memory of 4664 4136 vpvpd.exe 85 PID 4664 wrote to memory of 4764 4664 htnhnh.exe 86 PID 4664 wrote to memory of 4764 4664 htnhnh.exe 86 PID 4664 wrote to memory of 4764 4664 htnhnh.exe 86 PID 4764 wrote to memory of 4800 4764 rxrflxf.exe 87 PID 4764 wrote to memory of 4800 4764 rxrflxf.exe 87 PID 4764 wrote to memory of 4800 4764 rxrflxf.exe 87 PID 4800 wrote to memory of 4868 4800 llrfllf.exe 88 PID 4800 wrote to memory of 4868 4800 llrfllf.exe 88 PID 4800 wrote to memory of 4868 4800 llrfllf.exe 88 PID 4868 wrote to memory of 3744 4868 1jdvp.exe 89 PID 4868 wrote to memory of 3744 4868 1jdvp.exe 89 PID 4868 wrote to memory of 3744 4868 1jdvp.exe 89 PID 3744 wrote to memory of 2964 3744 htnhbb.exe 90 PID 3744 wrote to memory of 2964 3744 htnhbb.exe 90 PID 3744 wrote to memory of 2964 3744 htnhbb.exe 90 PID 2964 wrote to memory of 2548 2964 flllxxr.exe 91 PID 2964 wrote to memory of 2548 2964 flllxxr.exe 91 PID 2964 wrote to memory of 2548 2964 flllxxr.exe 91 PID 2548 wrote to memory of 4396 2548 djjvp.exe 92 PID 2548 wrote to memory of 4396 2548 djjvp.exe 92 PID 2548 wrote to memory of 4396 2548 djjvp.exe 92 PID 4396 wrote to memory of 2456 4396 nnbnbn.exe 93 PID 4396 wrote to memory of 2456 4396 nnbnbn.exe 93 PID 4396 wrote to memory of 2456 4396 nnbnbn.exe 93 PID 2456 wrote to memory of 2640 2456 nntnnn.exe 94 PID 2456 wrote to memory of 2640 2456 nntnnn.exe 94 PID 2456 wrote to memory of 2640 2456 nntnnn.exe 94 PID 2640 wrote to memory of 3028 2640 9fxrffx.exe 95 PID 2640 wrote to memory of 3028 2640 9fxrffx.exe 95 PID 2640 wrote to memory of 3028 2640 9fxrffx.exe 95 PID 3028 wrote to memory of 2720 3028 pdjdp.exe 96 PID 3028 wrote to memory of 2720 3028 pdjdp.exe 96 PID 3028 wrote to memory of 2720 3028 pdjdp.exe 96 PID 2720 wrote to memory of 3068 2720 nhhhbh.exe 97 PID 2720 wrote to memory of 3068 2720 nhhhbh.exe 97 PID 2720 wrote to memory of 3068 2720 nhhhbh.exe 97 PID 3068 wrote to memory of 5024 3068 jddpp.exe 98 PID 3068 wrote to memory of 5024 3068 jddpp.exe 98 PID 3068 wrote to memory of 5024 3068 jddpp.exe 98 PID 5024 wrote to memory of 4948 5024 5fxrllf.exe 99 PID 5024 wrote to memory of 4948 5024 5fxrllf.exe 99 PID 5024 wrote to memory of 4948 5024 5fxrllf.exe 99 PID 4948 wrote to memory of 1900 4948 frllxxx.exe 100 PID 4948 wrote to memory of 1900 4948 frllxxx.exe 100 PID 4948 wrote to memory of 1900 4948 frllxxx.exe 100 PID 1900 wrote to memory of 3428 1900 vpppj.exe 101 PID 1900 wrote to memory of 3428 1900 vpppj.exe 101 PID 1900 wrote to memory of 3428 1900 vpppj.exe 101 PID 3428 wrote to memory of 2808 3428 xrrlfll.exe 102 PID 3428 wrote to memory of 2808 3428 xrrlfll.exe 102 PID 3428 wrote to memory of 2808 3428 xrrlfll.exe 102 PID 2808 wrote to memory of 2380 2808 lflffff.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe"C:\Users\Admin\AppData\Local\Temp\efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\frxrllf.exec:\frxrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\1jjjv.exec:\1jjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\vpvpd.exec:\vpvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\htnhnh.exec:\htnhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\rxrflxf.exec:\rxrflxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\llrfllf.exec:\llrfllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\1jdvp.exec:\1jdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\htnhbb.exec:\htnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\flllxxr.exec:\flllxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\djjvp.exec:\djjvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\nnbnbn.exec:\nnbnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\nntnnn.exec:\nntnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\9fxrffx.exec:\9fxrffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\pdjdp.exec:\pdjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\nhhhbh.exec:\nhhhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jddpp.exec:\jddpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\5fxrllf.exec:\5fxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\frllxxx.exec:\frllxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\vpppj.exec:\vpppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\xrrlfll.exec:\xrrlfll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\lflffff.exec:\lflffff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\7djdv.exec:\7djdv.exe23⤵
- Executes dropped EXE
PID:2380 -
\??\c:\llffxff.exec:\llffxff.exe24⤵
- Executes dropped EXE
PID:5112 -
\??\c:\tntnnh.exec:\tntnnh.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1vvpd.exec:\1vvpd.exe26⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xlfffxl.exec:\xlfffxl.exe27⤵
- Executes dropped EXE
PID:3988 -
\??\c:\tnnnbb.exec:\tnnnbb.exe28⤵
- Executes dropped EXE
PID:3408 -
\??\c:\hnbttb.exec:\hnbttb.exe29⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jdvvv.exec:\jdvvv.exe30⤵
- Executes dropped EXE
PID:3996 -
\??\c:\bbnnbh.exec:\bbnnbh.exe31⤵
- Executes dropped EXE
PID:4824 -
\??\c:\7nbhtn.exec:\7nbhtn.exe32⤵
- Executes dropped EXE
PID:3852 -
\??\c:\dvdjp.exec:\dvdjp.exe33⤵
- Executes dropped EXE
PID:3472 -
\??\c:\5bbtnn.exec:\5bbtnn.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\fxlfffx.exec:\fxlfffx.exe35⤵
- Executes dropped EXE
PID:3672 -
\??\c:\1vvvv.exec:\1vvvv.exe36⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jddvd.exec:\jddvd.exe37⤵
- Executes dropped EXE
PID:1608 -
\??\c:\btnhbh.exec:\btnhbh.exe38⤵
- Executes dropped EXE
PID:972 -
\??\c:\hbhbtb.exec:\hbhbtb.exe39⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vdppd.exec:\vdppd.exe40⤵
- Executes dropped EXE
PID:3480 -
\??\c:\3lrfffl.exec:\3lrfffl.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bnnhtn.exec:\bnnhtn.exe42⤵
- Executes dropped EXE
PID:2844 -
\??\c:\tbnnhh.exec:\tbnnhh.exe43⤵
- Executes dropped EXE
PID:4560 -
\??\c:\vvvvp.exec:\vvvvp.exe44⤵
- Executes dropped EXE
PID:3120 -
\??\c:\lllfxrl.exec:\lllfxrl.exe45⤵
- Executes dropped EXE
PID:3808 -
\??\c:\tnnnhh.exec:\tnnnhh.exe46⤵
- Executes dropped EXE
PID:3360 -
\??\c:\3hbtnn.exec:\3hbtnn.exe47⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7pjpp.exec:\7pjpp.exe48⤵
- Executes dropped EXE
PID:4364 -
\??\c:\1rllxfl.exec:\1rllxfl.exe49⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tttbbb.exec:\tttbbb.exe50⤵
- Executes dropped EXE
PID:1120 -
\??\c:\vjpjv.exec:\vjpjv.exe51⤵
- Executes dropped EXE
PID:1020 -
\??\c:\9lrlfxr.exec:\9lrlfxr.exe52⤵
- Executes dropped EXE
PID:1160 -
\??\c:\nhhnht.exec:\nhhnht.exe53⤵
- Executes dropped EXE
PID:624 -
\??\c:\5jjjd.exec:\5jjjd.exe54⤵
- Executes dropped EXE
PID:456 -
\??\c:\frrxlfx.exec:\frrxlfx.exe55⤵
- Executes dropped EXE
PID:4056 -
\??\c:\lxrxflf.exec:\lxrxflf.exe56⤵
- Executes dropped EXE
PID:4820 -
\??\c:\ddppd.exec:\ddppd.exe57⤵
- Executes dropped EXE
PID:4952 -
\??\c:\3xfxfxl.exec:\3xfxfxl.exe58⤵
- Executes dropped EXE
PID:3980 -
\??\c:\xflfxlf.exec:\xflfxlf.exe59⤵
- Executes dropped EXE
PID:4592 -
\??\c:\1tnnhb.exec:\1tnnhb.exe60⤵
- Executes dropped EXE
PID:804 -
\??\c:\3vdvv.exec:\3vdvv.exe61⤵
- Executes dropped EXE
PID:4544 -
\??\c:\5rlfrrr.exec:\5rlfrrr.exe62⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3rrlffx.exec:\3rrlffx.exe63⤵
- Executes dropped EXE
PID:4148 -
\??\c:\5tbbtt.exec:\5tbbtt.exe64⤵
- Executes dropped EXE
PID:1924 -
\??\c:\9ppvj.exec:\9ppvj.exe65⤵
- Executes dropped EXE
PID:3436 -
\??\c:\lfrlxxf.exec:\lfrlxxf.exe66⤵PID:2944
-
\??\c:\tnntnb.exec:\tnntnb.exe67⤵PID:2148
-
\??\c:\hthhbb.exec:\hthhbb.exe68⤵PID:412
-
\??\c:\7pvpv.exec:\7pvpv.exe69⤵PID:4396
-
\??\c:\frfxlll.exec:\frfxlll.exe70⤵PID:532
-
\??\c:\htbtnt.exec:\htbtnt.exe71⤵PID:1512
-
\??\c:\dvvvp.exec:\dvvvp.exe72⤵PID:1368
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe73⤵PID:2472
-
\??\c:\flxrrrf.exec:\flxrrrf.exe74⤵PID:2756
-
\??\c:\pdvvp.exec:\pdvvp.exe75⤵PID:1972
-
\??\c:\vvppd.exec:\vvppd.exe76⤵PID:4564
-
\??\c:\flxxxff.exec:\flxxxff.exe77⤵PID:3432
-
\??\c:\1tbnbb.exec:\1tbnbb.exe78⤵PID:32
-
\??\c:\9vpjd.exec:\9vpjd.exe79⤵PID:1548
-
\??\c:\7lfffxx.exec:\7lfffxx.exe80⤵PID:2672
-
\??\c:\5llfxxx.exec:\5llfxxx.exe81⤵PID:1172
-
\??\c:\nbbtnn.exec:\nbbtnn.exe82⤵PID:1280
-
\??\c:\djpjd.exec:\djpjd.exe83⤵PID:4132
-
\??\c:\frfxlll.exec:\frfxlll.exe84⤵PID:4932
-
\??\c:\thtnnn.exec:\thtnnn.exe85⤵PID:2216
-
\??\c:\vdpvv.exec:\vdpvv.exe86⤵PID:640
-
\??\c:\7lrfxxr.exec:\7lrfxxr.exe87⤵PID:740
-
\??\c:\tttnhh.exec:\tttnhh.exe88⤵PID:3468
-
\??\c:\dvdvp.exec:\dvdvp.exe89⤵PID:3516
-
\??\c:\rllxrfx.exec:\rllxrfx.exe90⤵PID:1936
-
\??\c:\3bbtnn.exec:\3bbtnn.exe91⤵PID:3572
-
\??\c:\vppjd.exec:\vppjd.exe92⤵PID:2416
-
\??\c:\dpvpj.exec:\dpvpj.exe93⤵PID:1364
-
\??\c:\7rllxxr.exec:\7rllxxr.exe94⤵PID:3052
-
\??\c:\9nhbtt.exec:\9nhbtt.exe95⤵PID:4964
-
\??\c:\7vdvp.exec:\7vdvp.exe96⤵PID:4220
-
\??\c:\xrxfxxr.exec:\xrxfxxr.exe97⤵
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\lrxrffr.exec:\lrxrffr.exe98⤵PID:2740
-
\??\c:\7hnnnt.exec:\7hnnnt.exe99⤵PID:4292
-
\??\c:\pjpjd.exec:\pjpjd.exe100⤵PID:4520
-
\??\c:\5rxrllf.exec:\5rxrllf.exe101⤵PID:1676
-
\??\c:\hhbbhh.exec:\hhbbhh.exe102⤵PID:3976
-
\??\c:\3djjp.exec:\3djjp.exe103⤵PID:1864
-
\??\c:\pvvvp.exec:\pvvvp.exe104⤵PID:4416
-
\??\c:\9rrlffx.exec:\9rrlffx.exe105⤵PID:452
-
\??\c:\1hthnb.exec:\1hthnb.exe106⤵PID:2988
-
\??\c:\3ppdd.exec:\3ppdd.exe107⤵PID:4448
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe108⤵PID:912
-
\??\c:\frlrllr.exec:\frlrllr.exe109⤵PID:4112
-
\??\c:\ntbtnb.exec:\ntbtnb.exe110⤵PID:4400
-
\??\c:\xrfrrrl.exec:\xrfrrrl.exe111⤵PID:4496
-
\??\c:\fxxxrll.exec:\fxxxrll.exe112⤵PID:4580
-
\??\c:\hbbtbb.exec:\hbbtbb.exe113⤵PID:3088
-
\??\c:\vjdvp.exec:\vjdvp.exe114⤵PID:1988
-
\??\c:\3jpjj.exec:\3jpjj.exe115⤵PID:720
-
\??\c:\ntnntn.exec:\ntnntn.exe116⤵PID:4528
-
\??\c:\bttnbb.exec:\bttnbb.exe117⤵PID:612
-
\??\c:\ddjvp.exec:\ddjvp.exe118⤵PID:2260
-
\??\c:\fffxllf.exec:\fffxllf.exe119⤵PID:4708
-
\??\c:\hhbhnb.exec:\hhbhnb.exe120⤵PID:2568
-
\??\c:\bnbttn.exec:\bnbttn.exe121⤵PID:4468
-
\??\c:\pdjdp.exec:\pdjdp.exe122⤵PID:4728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-