Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 09:36
Behavioral task
behavioral1
Sample
e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe
-
Size
81KB
-
MD5
d53da58204c8b5a79a7095497f705bd5
-
SHA1
3bfc90e1ca4f7f68bfd70b7448c8b790e64d2895
-
SHA256
e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7
-
SHA512
77a35d37a47a65b583980c98fd59cabdb88c5ab3650a42e57c9da42f478dfeaa6bb35d3de9624660b4bd4774700d602e0ac9646f88c6b50c44984f56d137e032
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7kepA:xhOmTsF93UYfwC6GIout03LzGF6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2080-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3008-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/656-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1668-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-622-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-702-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-709-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-761-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-765-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1076-817-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-978-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1352 3fllllf.exe 4992 3lllffx.exe 2644 nhhbbb.exe 4804 9dddp.exe 5008 flxrrrl.exe 3024 nbhhhb.exe 232 pvjdv.exe 3952 xflfxxr.exe 1624 ffxxrrr.exe 3516 bttnnt.exe 408 9jppp.exe 3704 xrrlllf.exe 2164 5tbtbb.exe 4184 hbbttn.exe 2064 djddv.exe 2672 rfllllf.exe 2352 hnnnhh.exe 3000 vvdvv.exe 3008 xrxfxff.exe 2268 hbtnht.exe 3480 pvppp.exe 4256 ppppj.exe 2292 btthnn.exe 1616 vpdvv.exe 5116 3djjd.exe 4744 1ffxfff.exe 4424 7tnnhh.exe 1184 5jvvv.exe 2932 rflfxfx.exe 1736 3thntb.exe 4508 nnhhnn.exe 656 jjjdd.exe 4308 vpppj.exe 4576 xxllrrx.exe 4156 nbttnh.exe 1544 7tbttt.exe 1732 jpdvj.exe 3036 fllffrl.exe 2708 ttthhn.exe 1868 htbbbb.exe 1668 jpjdv.exe 732 3lxlfrx.exe 4396 ntnttn.exe 2380 hhbbbb.exe 4700 pjddv.exe 3676 lfxffrr.exe 4028 7nbthh.exe 224 7bhhbh.exe 4804 9jdvp.exe 3476 ppvpv.exe 1664 fxxrrxr.exe 3972 ttnnbb.exe 1124 rllrfll.exe 4704 3bhbtt.exe 3636 9vpjp.exe 5012 9fffxxx.exe 1652 bbntbt.exe 3516 9bbbbb.exe 3720 vpdjp.exe 2776 9lrlfff.exe 1636 7btnhn.exe 2440 jvdjd.exe 4892 1vvpj.exe 4184 xlxxrrr.exe -
resource yara_rule behavioral2/memory/2080-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b21-3.dat upx behavioral2/memory/2080-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b76-9.dat upx behavioral2/memory/1352-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b77-12.dat upx behavioral2/memory/4992-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2644-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b78-22.dat upx behavioral2/memory/4804-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b79-27.dat upx behavioral2/memory/4804-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7a-33.dat upx behavioral2/memory/5008-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7b-38.dat upx behavioral2/memory/3024-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7c-46.dat upx behavioral2/files/0x000a000000023b7d-50.dat upx behavioral2/memory/1624-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/232-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3952-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7e-57.dat upx behavioral2/memory/3516-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7f-62.dat upx behavioral2/memory/408-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b80-67.dat upx behavioral2/files/0x000a000000023b81-72.dat upx behavioral2/memory/3704-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b82-78.dat upx behavioral2/memory/2164-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b83-84.dat upx behavioral2/memory/4184-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b84-90.dat upx behavioral2/memory/2064-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b85-96.dat upx behavioral2/memory/2672-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b87-104.dat upx behavioral2/memory/2352-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b88-108.dat upx behavioral2/memory/3000-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-114.dat upx behavioral2/memory/3008-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2268-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8a-120.dat upx behavioral2/memory/3480-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4256-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-129.dat upx behavioral2/files/0x000a000000023b8c-134.dat upx behavioral2/files/0x000a000000023b8d-138.dat upx behavioral2/files/0x000a000000023b8e-143.dat upx behavioral2/memory/2292-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-149.dat upx behavioral2/memory/4744-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b73-155.dat upx behavioral2/files/0x000a000000023b90-159.dat upx behavioral2/memory/1184-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-166.dat upx behavioral2/files/0x000a000000023b92-170.dat upx behavioral2/memory/2932-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b93-176.dat upx behavioral2/files/0x000a000000023b94-181.dat upx behavioral2/memory/4508-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/656-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4156-198-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1352 2080 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 83 PID 2080 wrote to memory of 1352 2080 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 83 PID 2080 wrote to memory of 1352 2080 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 83 PID 1352 wrote to memory of 4992 1352 3fllllf.exe 84 PID 1352 wrote to memory of 4992 1352 3fllllf.exe 84 PID 1352 wrote to memory of 4992 1352 3fllllf.exe 84 PID 4992 wrote to memory of 2644 4992 3lllffx.exe 85 PID 4992 wrote to memory of 2644 4992 3lllffx.exe 85 PID 4992 wrote to memory of 2644 4992 3lllffx.exe 85 PID 2644 wrote to memory of 4804 2644 nhhbbb.exe 86 PID 2644 wrote to memory of 4804 2644 nhhbbb.exe 86 PID 2644 wrote to memory of 4804 2644 nhhbbb.exe 86 PID 4804 wrote to memory of 5008 4804 9dddp.exe 87 PID 4804 wrote to memory of 5008 4804 9dddp.exe 87 PID 4804 wrote to memory of 5008 4804 9dddp.exe 87 PID 5008 wrote to memory of 3024 5008 flxrrrl.exe 88 PID 5008 wrote to memory of 3024 5008 flxrrrl.exe 88 PID 5008 wrote to memory of 3024 5008 flxrrrl.exe 88 PID 3024 wrote to memory of 232 3024 nbhhhb.exe 89 PID 3024 wrote to memory of 232 3024 nbhhhb.exe 89 PID 3024 wrote to memory of 232 3024 nbhhhb.exe 89 PID 232 wrote to memory of 3952 232 pvjdv.exe 90 PID 232 wrote to memory of 3952 232 pvjdv.exe 90 PID 232 wrote to memory of 3952 232 pvjdv.exe 90 PID 3952 wrote to memory of 1624 3952 xflfxxr.exe 91 PID 3952 wrote to memory of 1624 3952 xflfxxr.exe 91 PID 3952 wrote to memory of 1624 3952 xflfxxr.exe 91 PID 1624 wrote to memory of 3516 1624 ffxxrrr.exe 92 PID 1624 wrote to memory of 3516 1624 ffxxrrr.exe 92 PID 1624 wrote to memory of 3516 1624 ffxxrrr.exe 92 PID 3516 wrote to memory of 408 3516 bttnnt.exe 93 PID 3516 wrote to memory of 408 3516 bttnnt.exe 93 PID 3516 wrote to memory of 408 3516 bttnnt.exe 93 PID 408 wrote to memory of 3704 408 9jppp.exe 94 PID 408 wrote to memory of 3704 408 9jppp.exe 94 PID 408 wrote to memory of 3704 408 9jppp.exe 94 PID 3704 wrote to memory of 2164 3704 xrrlllf.exe 95 PID 3704 wrote to memory of 2164 3704 xrrlllf.exe 95 PID 3704 wrote to memory of 2164 3704 xrrlllf.exe 95 PID 2164 wrote to memory of 4184 2164 5tbtbb.exe 96 PID 2164 wrote to memory of 4184 2164 5tbtbb.exe 96 PID 2164 wrote to memory of 4184 2164 5tbtbb.exe 96 PID 4184 wrote to memory of 2064 4184 hbbttn.exe 97 PID 4184 wrote to memory of 2064 4184 hbbttn.exe 97 PID 4184 wrote to memory of 2064 4184 hbbttn.exe 97 PID 2064 wrote to memory of 2672 2064 djddv.exe 98 PID 2064 wrote to memory of 2672 2064 djddv.exe 98 PID 2064 wrote to memory of 2672 2064 djddv.exe 98 PID 2672 wrote to memory of 2352 2672 rfllllf.exe 99 PID 2672 wrote to memory of 2352 2672 rfllllf.exe 99 PID 2672 wrote to memory of 2352 2672 rfllllf.exe 99 PID 2352 wrote to memory of 3000 2352 hnnnhh.exe 100 PID 2352 wrote to memory of 3000 2352 hnnnhh.exe 100 PID 2352 wrote to memory of 3000 2352 hnnnhh.exe 100 PID 3000 wrote to memory of 3008 3000 vvdvv.exe 101 PID 3000 wrote to memory of 3008 3000 vvdvv.exe 101 PID 3000 wrote to memory of 3008 3000 vvdvv.exe 101 PID 3008 wrote to memory of 2268 3008 xrxfxff.exe 102 PID 3008 wrote to memory of 2268 3008 xrxfxff.exe 102 PID 3008 wrote to memory of 2268 3008 xrxfxff.exe 102 PID 2268 wrote to memory of 3480 2268 hbtnht.exe 103 PID 2268 wrote to memory of 3480 2268 hbtnht.exe 103 PID 2268 wrote to memory of 3480 2268 hbtnht.exe 103 PID 3480 wrote to memory of 4256 3480 pvppp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe"C:\Users\Admin\AppData\Local\Temp\e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\3fllllf.exec:\3fllllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\3lllffx.exec:\3lllffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\nhhbbb.exec:\nhhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\9dddp.exec:\9dddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\flxrrrl.exec:\flxrrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\nbhhhb.exec:\nbhhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\pvjdv.exec:\pvjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\xflfxxr.exec:\xflfxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\bttnnt.exec:\bttnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\9jppp.exec:\9jppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\xrrlllf.exec:\xrrlllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\5tbtbb.exec:\5tbtbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\hbbttn.exec:\hbbttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\djddv.exec:\djddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\rfllllf.exec:\rfllllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\hnnnhh.exec:\hnnnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\vvdvv.exec:\vvdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xrxfxff.exec:\xrxfxff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\hbtnht.exec:\hbtnht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\pvppp.exec:\pvppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\ppppj.exec:\ppppj.exe23⤵
- Executes dropped EXE
PID:4256 -
\??\c:\btthnn.exec:\btthnn.exe24⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vpdvv.exec:\vpdvv.exe25⤵
- Executes dropped EXE
PID:1616 -
\??\c:\3djjd.exec:\3djjd.exe26⤵
- Executes dropped EXE
PID:5116 -
\??\c:\1ffxfff.exec:\1ffxfff.exe27⤵
- Executes dropped EXE
PID:4744 -
\??\c:\7tnnhh.exec:\7tnnhh.exe28⤵
- Executes dropped EXE
PID:4424 -
\??\c:\5jvvv.exec:\5jvvv.exe29⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rflfxfx.exec:\rflfxfx.exe30⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3thntb.exec:\3thntb.exe31⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nnhhnn.exec:\nnhhnn.exe32⤵
- Executes dropped EXE
PID:4508 -
\??\c:\jjjdd.exec:\jjjdd.exe33⤵
- Executes dropped EXE
PID:656 -
\??\c:\vpppj.exec:\vpppj.exe34⤵
- Executes dropped EXE
PID:4308 -
\??\c:\xxllrrx.exec:\xxllrrx.exe35⤵
- Executes dropped EXE
PID:4576 -
\??\c:\nbttnh.exec:\nbttnh.exe36⤵
- Executes dropped EXE
PID:4156 -
\??\c:\7tbttt.exec:\7tbttt.exe37⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jpdvj.exec:\jpdvj.exe38⤵
- Executes dropped EXE
PID:1732 -
\??\c:\fllffrl.exec:\fllffrl.exe39⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ttthhn.exec:\ttthhn.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\htbbbb.exec:\htbbbb.exe41⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jpjdv.exec:\jpjdv.exe42⤵
- Executes dropped EXE
PID:1668 -
\??\c:\3lxlfrx.exec:\3lxlfrx.exe43⤵
- Executes dropped EXE
PID:732 -
\??\c:\ntnttn.exec:\ntnttn.exe44⤵
- Executes dropped EXE
PID:4396 -
\??\c:\hhbbbb.exec:\hhbbbb.exe45⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pjddv.exec:\pjddv.exe46⤵
- Executes dropped EXE
PID:4700 -
\??\c:\lfxffrr.exec:\lfxffrr.exe47⤵
- Executes dropped EXE
PID:3676 -
\??\c:\7nbthh.exec:\7nbthh.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4028 -
\??\c:\7bhhbh.exec:\7bhhbh.exe49⤵
- Executes dropped EXE
PID:224 -
\??\c:\9jdvp.exec:\9jdvp.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4804 -
\??\c:\ppvpv.exec:\ppvpv.exe51⤵
- Executes dropped EXE
PID:3476 -
\??\c:\fxxrrxr.exec:\fxxrrxr.exe52⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ttnnbb.exec:\ttnnbb.exe53⤵
- Executes dropped EXE
PID:3972 -
\??\c:\rllrfll.exec:\rllrfll.exe54⤵
- Executes dropped EXE
PID:1124 -
\??\c:\3bhbtt.exec:\3bhbtt.exe55⤵
- Executes dropped EXE
PID:4704 -
\??\c:\9vpjp.exec:\9vpjp.exe56⤵
- Executes dropped EXE
PID:3636 -
\??\c:\9fffxxx.exec:\9fffxxx.exe57⤵
- Executes dropped EXE
PID:5012 -
\??\c:\bbntbt.exec:\bbntbt.exe58⤵
- Executes dropped EXE
PID:1652 -
\??\c:\9bbbbb.exec:\9bbbbb.exe59⤵
- Executes dropped EXE
PID:3516 -
\??\c:\vpdjp.exec:\vpdjp.exe60⤵
- Executes dropped EXE
PID:3720 -
\??\c:\9lrlfff.exec:\9lrlfff.exe61⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7btnhn.exec:\7btnhn.exe62⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jvdjd.exec:\jvdjd.exe63⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1vvpj.exec:\1vvpj.exe64⤵
- Executes dropped EXE
PID:4892 -
\??\c:\xlxxrrr.exec:\xlxxrrr.exe65⤵
- Executes dropped EXE
PID:4184 -
\??\c:\frrlfrf.exec:\frrlfrf.exe66⤵PID:520
-
\??\c:\hbbttt.exec:\hbbttt.exe67⤵PID:1952
-
\??\c:\nbtbhn.exec:\nbtbhn.exe68⤵PID:2212
-
\??\c:\3jvpd.exec:\3jvpd.exe69⤵PID:2092
-
\??\c:\frxfxfl.exec:\frxfxfl.exe70⤵PID:2004
-
\??\c:\bbhhhh.exec:\bbhhhh.exe71⤵PID:2188
-
\??\c:\jddvv.exec:\jddvv.exe72⤵PID:3712
-
\??\c:\rfxrxxx.exec:\rfxrxxx.exe73⤵PID:4388
-
\??\c:\hthhhb.exec:\hthhhb.exe74⤵PID:3692
-
\??\c:\btbbbb.exec:\btbbbb.exe75⤵PID:2916
-
\??\c:\nbbbtn.exec:\nbbbtn.exe76⤵PID:4920
-
\??\c:\pdjjd.exec:\pdjjd.exe77⤵PID:4400
-
\??\c:\frlfxxx.exec:\frlfxxx.exe78⤵PID:2960
-
\??\c:\ttbtbb.exec:\ttbtbb.exe79⤵PID:1492
-
\??\c:\hhhhbh.exec:\hhhhbh.exe80⤵PID:1204
-
\??\c:\pjjjj.exec:\pjjjj.exe81⤵PID:1548
-
\??\c:\xxrlllf.exec:\xxrlllf.exe82⤵PID:1436
-
\??\c:\3bhhhh.exec:\3bhhhh.exe83⤵PID:544
-
\??\c:\tbbbbh.exec:\tbbbbh.exe84⤵PID:4148
-
\??\c:\vjddj.exec:\vjddj.exe85⤵PID:460
-
\??\c:\dvddp.exec:\dvddp.exe86⤵PID:4624
-
\??\c:\lfllfff.exec:\lfllfff.exe87⤵PID:4780
-
\??\c:\nttbhn.exec:\nttbhn.exe88⤵PID:656
-
\??\c:\7jvpj.exec:\7jvpj.exe89⤵PID:868
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe90⤵PID:4352
-
\??\c:\rlrrllx.exec:\rlrrllx.exe91⤵PID:4696
-
\??\c:\tbtnnn.exec:\tbtnnn.exe92⤵PID:4688
-
\??\c:\jddjd.exec:\jddjd.exe93⤵PID:1156
-
\??\c:\lflfllf.exec:\lflfllf.exe94⤵PID:5068
-
\??\c:\flfffrf.exec:\flfffrf.exe95⤵PID:5076
-
\??\c:\hntbtb.exec:\hntbtb.exe96⤵PID:4292
-
\??\c:\9jjvp.exec:\9jjvp.exe97⤵PID:3456
-
\??\c:\rxllfff.exec:\rxllfff.exe98⤵PID:4356
-
\??\c:\btnntb.exec:\btnntb.exe99⤵PID:3856
-
\??\c:\tnhbtt.exec:\tnhbtt.exe100⤵PID:2380
-
\??\c:\jppjd.exec:\jppjd.exe101⤵PID:4992
-
\??\c:\rxlffff.exec:\rxlffff.exe102⤵PID:3932
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe103⤵PID:4028
-
\??\c:\nhttht.exec:\nhttht.exe104⤵PID:3544
-
\??\c:\jjjdv.exec:\jjjdv.exe105⤵PID:1832
-
\??\c:\5lffxxr.exec:\5lffxxr.exe106⤵PID:2372
-
\??\c:\hbnbbh.exec:\hbnbbh.exe107⤵PID:3136
-
\??\c:\bhbttn.exec:\bhbttn.exe108⤵PID:2964
-
\??\c:\dppjd.exec:\dppjd.exe109⤵PID:3724
-
\??\c:\5ppjd.exec:\5ppjd.exe110⤵PID:3428
-
\??\c:\xlrlfff.exec:\xlrlfff.exe111⤵PID:1624
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe112⤵PID:5080
-
\??\c:\ttttnn.exec:\ttttnn.exe113⤵PID:1788
-
\??\c:\bnhbbt.exec:\bnhbbt.exe114⤵PID:3720
-
\??\c:\vjppj.exec:\vjppj.exe115⤵PID:3704
-
\??\c:\frllfxr.exec:\frllfxr.exe116⤵PID:4488
-
\??\c:\frfffrl.exec:\frfffrl.exe117⤵
- System Location Discovery: System Language Discovery
PID:4892 -
\??\c:\nbbttt.exec:\nbbttt.exe118⤵PID:4376
-
\??\c:\nhtnhb.exec:\nhtnhb.exe119⤵PID:1760
-
\??\c:\dvpjd.exec:\dvpjd.exe120⤵PID:4040
-
\??\c:\vdppv.exec:\vdppv.exe121⤵PID:392
-
\??\c:\frlfrrl.exec:\frlfrrl.exe122⤵PID:616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-