Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 05:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe
-
Size
453KB
-
MD5
c5d9399bdf4980b8ad641ab5d17d8a98
-
SHA1
50035fa797db18a83cabb3911c7394f0ca052c36
-
SHA256
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e
-
SHA512
30347dd145554dd1aed8a09b584542ea8b06e94ca8c7ef36fadd4793531f1fcbb95318e7a9974445e951b068e9b8e0eaf7393a6dad00c78da7b40edb9c77383a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetX:q7Tc2NYHUrAwfMp3CDtX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2936-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-811-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-947-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-1222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-1479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3020 lxffxxr.exe 1892 tntnhn.exe 2192 hbbnbb.exe 4856 jvpjd.exe 2348 5nbthn.exe 3388 hnnbtn.exe 1868 1dvjv.exe 1884 vpdpd.exe 5012 rffrlfx.exe 4940 nhtnbn.exe 2468 ddjvj.exe 4872 lxlflxl.exe 2604 hnhnbh.exe 1920 7xrlxxr.exe 3500 jvdjv.exe 2956 lfxrxrl.exe 1852 tttnbn.exe 2352 vpjvp.exe 1800 3rxrflf.exe 1784 tnnhbt.exe 3824 7vjdp.exe 4536 xrxrlrx.exe 4840 vpvpp.exe 2632 vpvpd.exe 3012 nbbnbb.exe 4688 tnnnhb.exe 2236 1tthbt.exe 676 fxrlxrl.exe 4460 jvpdp.exe 1440 lxxlxxl.exe 5044 3ddpd.exe 1436 bbbttt.exe 3344 pdddj.exe 2128 rffxrrf.exe 2336 3nttnh.exe 3780 dppvd.exe 1536 rrrfrlx.exe 4348 nbnbnh.exe 1940 hbnbnh.exe 4744 pjpdd.exe 460 flrlfxr.exe 1524 lfflfxl.exe 4472 thnhnt.exe 2388 jpjvj.exe 2464 xrlfrlx.exe 4328 fxxrfrl.exe 3132 7hhttn.exe 3440 ddpdd.exe 4636 xlllfxr.exe 2084 lffxflf.exe 1416 thhbbt.exe 1176 vjjjv.exe 2540 fxlfrrr.exe 1432 lrrfxrl.exe 3632 htbtnn.exe 5080 vdvvp.exe 2616 rxrrlff.exe 4516 5llxxxl.exe 2100 thhhtt.exe 2572 pdpjj.exe 4816 xlrlfxr.exe 2032 nhnnnn.exe 3600 djpjp.exe 3688 3lrrfxx.exe -
resource yara_rule behavioral2/memory/2936-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-811-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 3020 2936 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 85 PID 2936 wrote to memory of 3020 2936 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 85 PID 2936 wrote to memory of 3020 2936 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 85 PID 3020 wrote to memory of 1892 3020 lxffxxr.exe 86 PID 3020 wrote to memory of 1892 3020 lxffxxr.exe 86 PID 3020 wrote to memory of 1892 3020 lxffxxr.exe 86 PID 1892 wrote to memory of 2192 1892 tntnhn.exe 87 PID 1892 wrote to memory of 2192 1892 tntnhn.exe 87 PID 1892 wrote to memory of 2192 1892 tntnhn.exe 87 PID 2192 wrote to memory of 4856 2192 hbbnbb.exe 88 PID 2192 wrote to memory of 4856 2192 hbbnbb.exe 88 PID 2192 wrote to memory of 4856 2192 hbbnbb.exe 88 PID 4856 wrote to memory of 2348 4856 jvpjd.exe 89 PID 4856 wrote to memory of 2348 4856 jvpjd.exe 89 PID 4856 wrote to memory of 2348 4856 jvpjd.exe 89 PID 2348 wrote to memory of 3388 2348 5nbthn.exe 90 PID 2348 wrote to memory of 3388 2348 5nbthn.exe 90 PID 2348 wrote to memory of 3388 2348 5nbthn.exe 90 PID 3388 wrote to memory of 1868 3388 hnnbtn.exe 91 PID 3388 wrote to memory of 1868 3388 hnnbtn.exe 91 PID 3388 wrote to memory of 1868 3388 hnnbtn.exe 91 PID 1868 wrote to memory of 1884 1868 1dvjv.exe 92 PID 1868 wrote to memory of 1884 1868 1dvjv.exe 92 PID 1868 wrote to memory of 1884 1868 1dvjv.exe 92 PID 1884 wrote to memory of 5012 1884 vpdpd.exe 93 PID 1884 wrote to memory of 5012 1884 vpdpd.exe 93 PID 1884 wrote to memory of 5012 1884 vpdpd.exe 93 PID 5012 wrote to memory of 4940 5012 rffrlfx.exe 94 PID 5012 wrote to memory of 4940 5012 rffrlfx.exe 94 PID 5012 wrote to memory of 4940 5012 rffrlfx.exe 94 PID 4940 wrote to memory of 2468 4940 nhtnbn.exe 95 PID 4940 wrote to memory of 2468 4940 nhtnbn.exe 95 PID 4940 wrote to memory of 2468 4940 nhtnbn.exe 95 PID 2468 wrote to memory of 4872 2468 ddjvj.exe 96 PID 2468 wrote to memory of 4872 2468 ddjvj.exe 96 PID 2468 wrote to memory of 4872 2468 ddjvj.exe 96 PID 4872 wrote to memory of 2604 4872 lxlflxl.exe 97 PID 4872 wrote to memory of 2604 4872 lxlflxl.exe 97 PID 4872 wrote to memory of 2604 4872 lxlflxl.exe 97 PID 2604 wrote to memory of 1920 2604 hnhnbh.exe 98 PID 2604 wrote to memory of 1920 2604 hnhnbh.exe 98 PID 2604 wrote to memory of 1920 2604 hnhnbh.exe 98 PID 1920 wrote to memory of 3500 1920 7xrlxxr.exe 99 PID 1920 wrote to memory of 3500 1920 7xrlxxr.exe 99 PID 1920 wrote to memory of 3500 1920 7xrlxxr.exe 99 PID 3500 wrote to memory of 2956 3500 jvdjv.exe 100 PID 3500 wrote to memory of 2956 3500 jvdjv.exe 100 PID 3500 wrote to memory of 2956 3500 jvdjv.exe 100 PID 2956 wrote to memory of 1852 2956 lfxrxrl.exe 101 PID 2956 wrote to memory of 1852 2956 lfxrxrl.exe 101 PID 2956 wrote to memory of 1852 2956 lfxrxrl.exe 101 PID 1852 wrote to memory of 2352 1852 tttnbn.exe 102 PID 1852 wrote to memory of 2352 1852 tttnbn.exe 102 PID 1852 wrote to memory of 2352 1852 tttnbn.exe 102 PID 2352 wrote to memory of 1800 2352 vpjvp.exe 103 PID 2352 wrote to memory of 1800 2352 vpjvp.exe 103 PID 2352 wrote to memory of 1800 2352 vpjvp.exe 103 PID 1800 wrote to memory of 1784 1800 3rxrflf.exe 104 PID 1800 wrote to memory of 1784 1800 3rxrflf.exe 104 PID 1800 wrote to memory of 1784 1800 3rxrflf.exe 104 PID 1784 wrote to memory of 3824 1784 tnnhbt.exe 105 PID 1784 wrote to memory of 3824 1784 tnnhbt.exe 105 PID 1784 wrote to memory of 3824 1784 tnnhbt.exe 105 PID 3824 wrote to memory of 4536 3824 7vjdp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe"C:\Users\Admin\AppData\Local\Temp\efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lxffxxr.exec:\lxffxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\tntnhn.exec:\tntnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\hbbnbb.exec:\hbbnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\jvpjd.exec:\jvpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\5nbthn.exec:\5nbthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\hnnbtn.exec:\hnnbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\1dvjv.exec:\1dvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\vpdpd.exec:\vpdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\rffrlfx.exec:\rffrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\nhtnbn.exec:\nhtnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\ddjvj.exec:\ddjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\lxlflxl.exec:\lxlflxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\hnhnbh.exec:\hnhnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\7xrlxxr.exec:\7xrlxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\jvdjv.exec:\jvdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\lfxrxrl.exec:\lfxrxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\tttnbn.exec:\tttnbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\vpjvp.exec:\vpjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\3rxrflf.exec:\3rxrflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\tnnhbt.exec:\tnnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\7vjdp.exec:\7vjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\xrxrlrx.exec:\xrxrlrx.exe23⤵
- Executes dropped EXE
PID:4536 -
\??\c:\vpvpp.exec:\vpvpp.exe24⤵
- Executes dropped EXE
PID:4840 -
\??\c:\vpvpd.exec:\vpvpd.exe25⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nbbnbb.exec:\nbbnbb.exe26⤵
- Executes dropped EXE
PID:3012 -
\??\c:\tnnnhb.exec:\tnnnhb.exe27⤵
- Executes dropped EXE
PID:4688 -
\??\c:\1tthbt.exec:\1tthbt.exe28⤵
- Executes dropped EXE
PID:2236 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe29⤵
- Executes dropped EXE
PID:676 -
\??\c:\jvpdp.exec:\jvpdp.exe30⤵
- Executes dropped EXE
PID:4460 -
\??\c:\lxxlxxl.exec:\lxxlxxl.exe31⤵
- Executes dropped EXE
PID:1440 -
\??\c:\3ddpd.exec:\3ddpd.exe32⤵
- Executes dropped EXE
PID:5044 -
\??\c:\bbbttt.exec:\bbbttt.exe33⤵
- Executes dropped EXE
PID:1436 -
\??\c:\pdddj.exec:\pdddj.exe34⤵
- Executes dropped EXE
PID:3344 -
\??\c:\rffxrrf.exec:\rffxrrf.exe35⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3nttnh.exec:\3nttnh.exe36⤵
- Executes dropped EXE
PID:2336 -
\??\c:\dppvd.exec:\dppvd.exe37⤵
- Executes dropped EXE
PID:3780 -
\??\c:\rrrfrlx.exec:\rrrfrlx.exe38⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nbnbnh.exec:\nbnbnh.exe39⤵
- Executes dropped EXE
PID:4348 -
\??\c:\hbnbnh.exec:\hbnbnh.exe40⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pjpdd.exec:\pjpdd.exe41⤵
- Executes dropped EXE
PID:4744 -
\??\c:\flrlfxr.exec:\flrlfxr.exe42⤵
- Executes dropped EXE
PID:460 -
\??\c:\lfflfxl.exec:\lfflfxl.exe43⤵
- Executes dropped EXE
PID:1524 -
\??\c:\thnhnt.exec:\thnhnt.exe44⤵
- Executes dropped EXE
PID:4472 -
\??\c:\jpjvj.exec:\jpjvj.exe45⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xrlfrlx.exec:\xrlfrlx.exe46⤵
- Executes dropped EXE
PID:2464 -
\??\c:\fxxrfrl.exec:\fxxrfrl.exe47⤵
- Executes dropped EXE
PID:4328 -
\??\c:\7hhttn.exec:\7hhttn.exe48⤵
- Executes dropped EXE
PID:3132 -
\??\c:\ddpdd.exec:\ddpdd.exe49⤵
- Executes dropped EXE
PID:3440 -
\??\c:\xlllfxr.exec:\xlllfxr.exe50⤵
- Executes dropped EXE
PID:4636 -
\??\c:\lffxflf.exec:\lffxflf.exe51⤵
- Executes dropped EXE
PID:2084 -
\??\c:\thhbbt.exec:\thhbbt.exe52⤵
- Executes dropped EXE
PID:1416 -
\??\c:\vjjjv.exec:\vjjjv.exe53⤵
- Executes dropped EXE
PID:1176 -
\??\c:\fxlfrrr.exec:\fxlfrrr.exe54⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe55⤵
- Executes dropped EXE
PID:1432 -
\??\c:\htbtnn.exec:\htbtnn.exe56⤵
- Executes dropped EXE
PID:3632 -
\??\c:\vdvvp.exec:\vdvvp.exe57⤵
- Executes dropped EXE
PID:5080 -
\??\c:\rxrrlff.exec:\rxrrlff.exe58⤵
- Executes dropped EXE
PID:2616 -
\??\c:\5llxxxl.exec:\5llxxxl.exe59⤵
- Executes dropped EXE
PID:4516 -
\??\c:\thhhtt.exec:\thhhtt.exe60⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pdpjj.exec:\pdpjj.exe61⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe62⤵
- Executes dropped EXE
PID:4816 -
\??\c:\nhnnnn.exec:\nhnnnn.exe63⤵
- Executes dropped EXE
PID:2032 -
\??\c:\djpjp.exec:\djpjp.exe64⤵
- Executes dropped EXE
PID:3600 -
\??\c:\3lrrfxx.exec:\3lrrfxx.exe65⤵
- Executes dropped EXE
PID:3688 -
\??\c:\7xlfxxr.exec:\7xlfxxr.exe66⤵PID:3160
-
\??\c:\hbbnht.exec:\hbbnht.exe67⤵PID:2020
-
\??\c:\ddvpd.exec:\ddvpd.exe68⤵PID:4184
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe69⤵PID:4292
-
\??\c:\dvpvd.exec:\dvpvd.exe70⤵PID:764
-
\??\c:\llrlllf.exec:\llrlllf.exe71⤵PID:3420
-
\??\c:\xflfxxf.exec:\xflfxxf.exe72⤵PID:1204
-
\??\c:\btbtbb.exec:\btbtbb.exe73⤵PID:60
-
\??\c:\7dpjv.exec:\7dpjv.exe74⤵
- System Location Discovery: System Language Discovery
PID:1028 -
\??\c:\3ffrlfr.exec:\3ffrlfr.exe75⤵PID:4492
-
\??\c:\frfxrrr.exec:\frfxrrr.exe76⤵PID:3092
-
\??\c:\hbbntt.exec:\hbbntt.exe77⤵PID:2288
-
\??\c:\7pvpj.exec:\7pvpj.exe78⤵PID:876
-
\??\c:\rxfxrlx.exec:\rxfxrlx.exe79⤵PID:4840
-
\??\c:\bbhhhh.exec:\bbhhhh.exe80⤵PID:2484
-
\??\c:\vjjvd.exec:\vjjvd.exe81⤵PID:4936
-
\??\c:\xxfllll.exec:\xxfllll.exe82⤵PID:2188
-
\??\c:\btbbnn.exec:\btbbnn.exe83⤵PID:1528
-
\??\c:\5nhbtt.exec:\5nhbtt.exe84⤵PID:1692
-
\??\c:\jpvvp.exec:\jpvvp.exe85⤵PID:3180
-
\??\c:\7xlfrrl.exec:\7xlfrrl.exe86⤵PID:4188
-
\??\c:\htttnn.exec:\htttnn.exe87⤵PID:4848
-
\??\c:\1nbbtb.exec:\1nbbtb.exe88⤵PID:3948
-
\??\c:\vjjjv.exec:\vjjjv.exe89⤵PID:2868
-
\??\c:\7xrlxlf.exec:\7xrlxlf.exe90⤵PID:3928
-
\??\c:\nnnnhb.exec:\nnnnhb.exe91⤵PID:3652
-
\??\c:\5ppdj.exec:\5ppdj.exe92⤵PID:968
-
\??\c:\flrlxrl.exec:\flrlxrl.exe93⤵PID:2560
-
\??\c:\tnhbbt.exec:\tnhbbt.exe94⤵PID:2940
-
\??\c:\7jddv.exec:\7jddv.exe95⤵PID:4468
-
\??\c:\dvpjd.exec:\dvpjd.exe96⤵PID:2804
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe97⤵PID:4744
-
\??\c:\hhtbbt.exec:\hhtbbt.exe98⤵PID:1872
-
\??\c:\vjpjv.exec:\vjpjv.exe99⤵PID:4472
-
\??\c:\7djdd.exec:\7djdd.exe100⤵PID:4332
-
\??\c:\lffxrll.exec:\lffxrll.exe101⤵PID:2936
-
\??\c:\5nhhhh.exec:\5nhhhh.exe102⤵PID:3660
-
\??\c:\jddvd.exec:\jddvd.exe103⤵PID:2084
-
\??\c:\xrrrfxx.exec:\xrrrfxx.exe104⤵PID:3724
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe105⤵PID:4084
-
\??\c:\btnhtt.exec:\btnhtt.exe106⤵PID:4752
-
\??\c:\jdpvj.exec:\jdpvj.exe107⤵PID:2060
-
\??\c:\3ffffff.exec:\3ffffff.exe108⤵PID:4176
-
\??\c:\rxllfxf.exec:\rxllfxf.exe109⤵PID:864
-
\??\c:\thnhth.exec:\thnhth.exe110⤵PID:1884
-
\??\c:\ppdpv.exec:\ppdpv.exe111⤵PID:2264
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe112⤵PID:3588
-
\??\c:\nnhbth.exec:\nnhbth.exe113⤵PID:4940
-
\??\c:\hhttbh.exec:\hhttbh.exe114⤵PID:3940
-
\??\c:\jdddp.exec:\jdddp.exe115⤵PID:4652
-
\??\c:\fxfxlll.exec:\fxfxlll.exe116⤵PID:2020
-
\??\c:\nntnhh.exec:\nntnhh.exe117⤵PID:2604
-
\??\c:\ddjdj.exec:\ddjdj.exe118⤵PID:3752
-
\??\c:\ddjvp.exec:\ddjvp.exe119⤵PID:3196
-
\??\c:\lrfxffx.exec:\lrfxffx.exe120⤵PID:1956
-
\??\c:\bhnhhn.exec:\bhnhhn.exe121⤵PID:3420
-
\??\c:\jdvjv.exec:\jdvjv.exe122⤵PID:4964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-