Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 18:19
Behavioral task
behavioral1
Sample
26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe
Resource
win7-20240729-en
General
-
Target
26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe
-
Size
140KB
-
MD5
d560052cac2f8e5508bda4e34720ad8d
-
SHA1
d34a798a56601e4e456c1e4b14a397f4f06fef31
-
SHA256
26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62
-
SHA512
072e883d2b4f83f8d7f82ee03c464a44cdbf5732504269321ee312befc2fc8eba83766952e45c4b18710fc88d170aedcc1ae1f4e0077ff5a97652cf5bebbbc33
-
SSDEEP
3072:chOmTsF93UYfwC6GIout5pi8rY9AABa1U+a8+NTTyucqoX:ccm4FmowdHoS5ddWX+a/Nigm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2516-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/924-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2768-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1252-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3804-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2768-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-762-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-869-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-1083-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-1374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-1499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9rllflr.exehbttbb.exe3vjdd.exe5ntnhh.exedpdvj.exettnnnn.exerxffxxr.exetbntth.exelrxxxrr.exedjdjv.exelxlxxxx.exe1bbbbb.exejddvp.exe9lrlfff.exenbhhht.exerxlflff.exebtbbbb.exepdjdv.exepppjd.exefxxflxl.exehththb.exepppjd.exe9vddj.exebtbtnb.exeppjjd.exelxlrrxr.exe7thhnh.exedvjpv.exerlrlfff.exebhbnhh.exejjppv.exefxxrffx.exedpppv.exerrxrrrl.exelrxrlll.exetbhhhb.exevpjvj.exelxlffxx.exe9tbhhh.exevjdvj.exexxllrrf.exexlrlflf.exennhtnh.exevjjjd.exelrrxllr.exeflrrlll.exehbhbtb.exevpddj.exexrfxxxr.exe7ttthb.exe5pppv.exefrlrlxx.exenntbtb.exepddpd.exefxxxxll.exevjpdj.exeffrlrrf.exetbtnhh.exejjjpv.exevvvdv.exelrrrfxr.exetnhbnn.exepvdvj.exexrxxxfl.exepid process 2060 9rllflr.exe 2240 hbttbb.exe 2004 3vjdd.exe 2324 5ntnhh.exe 2436 dpdvj.exe 552 ttnnnn.exe 5004 rxffxxr.exe 3564 tbntth.exe 3352 lrxxxrr.exe 4956 djdjv.exe 4688 lxlxxxx.exe 3288 1bbbbb.exe 4680 jddvp.exe 920 9lrlfff.exe 4972 nbhhht.exe 3608 rxlflff.exe 4404 btbbbb.exe 2068 pdjdv.exe 752 pppjd.exe 3016 fxxflxl.exe 3432 hththb.exe 432 pppjd.exe 924 9vddj.exe 4400 btbtnb.exe 4820 ppjjd.exe 3792 lxlrrxr.exe 376 7thhnh.exe 4332 dvjpv.exe 3580 rlrlfff.exe 1964 bhbnhh.exe 2768 jjppv.exe 2756 fxxrffx.exe 4320 dpppv.exe 3060 rrxrrrl.exe 2828 lrxrlll.exe 1352 tbhhhb.exe 4996 vpjvj.exe 3892 lxlffxx.exe 4484 9tbhhh.exe 1684 vjdvj.exe 4540 xxllrrf.exe 1388 xlrlflf.exe 3620 nnhtnh.exe 2168 vjjjd.exe 2588 lrrxllr.exe 2788 flrrlll.exe 1252 hbhbtb.exe 4308 vpddj.exe 4776 xrfxxxr.exe 4472 7ttthb.exe 1728 5pppv.exe 2492 frlrlxx.exe 3556 nntbtb.exe 2132 pddpd.exe 3804 fxxxxll.exe 4632 vjpdj.exe 5092 ffrlrrf.exe 1760 tbtnhh.exe 1484 jjjpv.exe 4120 vvvdv.exe 4876 lrrrfxr.exe 3756 tnhbnn.exe 3196 pvdvj.exe 4956 xrxxxfl.exe -
Processes:
resource yara_rule behavioral2/memory/2516-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2516-6-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9rllflr.exe upx behavioral2/memory/2060-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2240-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2060-14-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbttbb.exe upx \??\c:\3vjdd.exe upx behavioral2/memory/2004-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2240-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2004-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ntnhh.exe upx C:\dpdvj.exe upx behavioral2/memory/2324-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttnnnn.exe upx behavioral2/memory/2436-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxffxxr.exe upx behavioral2/memory/552-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbntth.exe upx behavioral2/memory/5004-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3564-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrxxxrr.exe upx behavioral2/memory/3352-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djdjv.exe upx behavioral2/memory/3352-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxlxxxx.exe upx behavioral2/memory/4688-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1bbbbb.exe upx C:\jddvp.exe upx behavioral2/memory/3288-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9lrlfff.exe upx behavioral2/memory/4680-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbhhht.exe upx behavioral2/memory/920-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxlflff.exe upx behavioral2/memory/4972-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbbbb.exe upx behavioral2/memory/3608-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjdv.exe upx behavioral2/memory/4404-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pppjd.exe upx C:\fxxflxl.exe upx behavioral2/memory/3016-122-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hththb.exe upx C:\pppjd.exe upx behavioral2/memory/432-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vddj.exe upx behavioral2/memory/3432-133-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btbtnb.exe upx behavioral2/memory/4400-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/924-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjjd.exe upx behavioral2/memory/4820-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxlrrxr.exe upx \??\c:\7thhnh.exe upx C:\dvjpv.exe upx C:\rlrlfff.exe upx behavioral2/memory/376-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3792-160-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhbnhh.exe upx behavioral2/memory/3580-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjppv.exe upx C:\fxxrffx.exe upx behavioral2/memory/2768-188-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fllfxxx.exevdddd.exe7xrfxxx.exevpdvp.exeppjdd.exefxxlfff.exenhhnnt.exejjpvj.exexxlrfrr.exefxxrlfl.exehbnnnt.exe9rllflr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe9rllflr.exehbttbb.exe3vjdd.exe5ntnhh.exedpdvj.exettnnnn.exerxffxxr.exetbntth.exelrxxxrr.exedjdjv.exelxlxxxx.exe1bbbbb.exejddvp.exe9lrlfff.exenbhhht.exerxlflff.exebtbbbb.exepdjdv.exepppjd.exefxxflxl.exehththb.exedescription pid process target process PID 2516 wrote to memory of 2060 2516 26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe 9rllflr.exe PID 2516 wrote to memory of 2060 2516 26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe 9rllflr.exe PID 2516 wrote to memory of 2060 2516 26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe 9rllflr.exe PID 2060 wrote to memory of 2240 2060 9rllflr.exe hbttbb.exe PID 2060 wrote to memory of 2240 2060 9rllflr.exe hbttbb.exe PID 2060 wrote to memory of 2240 2060 9rllflr.exe hbttbb.exe PID 2240 wrote to memory of 2004 2240 hbttbb.exe 3vjdd.exe PID 2240 wrote to memory of 2004 2240 hbttbb.exe 3vjdd.exe PID 2240 wrote to memory of 2004 2240 hbttbb.exe 3vjdd.exe PID 2004 wrote to memory of 2324 2004 3vjdd.exe 5ntnhh.exe PID 2004 wrote to memory of 2324 2004 3vjdd.exe 5ntnhh.exe PID 2004 wrote to memory of 2324 2004 3vjdd.exe 5ntnhh.exe PID 2324 wrote to memory of 2436 2324 5ntnhh.exe dpdvj.exe PID 2324 wrote to memory of 2436 2324 5ntnhh.exe dpdvj.exe PID 2324 wrote to memory of 2436 2324 5ntnhh.exe dpdvj.exe PID 2436 wrote to memory of 552 2436 dpdvj.exe ttnnnn.exe PID 2436 wrote to memory of 552 2436 dpdvj.exe ttnnnn.exe PID 2436 wrote to memory of 552 2436 dpdvj.exe ttnnnn.exe PID 552 wrote to memory of 5004 552 ttnnnn.exe rxffxxr.exe PID 552 wrote to memory of 5004 552 ttnnnn.exe rxffxxr.exe PID 552 wrote to memory of 5004 552 ttnnnn.exe rxffxxr.exe PID 5004 wrote to memory of 3564 5004 rxffxxr.exe tbntth.exe PID 5004 wrote to memory of 3564 5004 rxffxxr.exe tbntth.exe PID 5004 wrote to memory of 3564 5004 rxffxxr.exe tbntth.exe PID 3564 wrote to memory of 3352 3564 tbntth.exe lrxxxrr.exe PID 3564 wrote to memory of 3352 3564 tbntth.exe lrxxxrr.exe PID 3564 wrote to memory of 3352 3564 tbntth.exe lrxxxrr.exe PID 3352 wrote to memory of 4956 3352 lrxxxrr.exe djdjv.exe PID 3352 wrote to memory of 4956 3352 lrxxxrr.exe djdjv.exe PID 3352 wrote to memory of 4956 3352 lrxxxrr.exe djdjv.exe PID 4956 wrote to memory of 4688 4956 djdjv.exe lxlxxxx.exe PID 4956 wrote to memory of 4688 4956 djdjv.exe lxlxxxx.exe PID 4956 wrote to memory of 4688 4956 djdjv.exe lxlxxxx.exe PID 4688 wrote to memory of 3288 4688 lxlxxxx.exe 1bbbbb.exe PID 4688 wrote to memory of 3288 4688 lxlxxxx.exe 1bbbbb.exe PID 4688 wrote to memory of 3288 4688 lxlxxxx.exe 1bbbbb.exe PID 3288 wrote to memory of 4680 3288 1bbbbb.exe jddvp.exe PID 3288 wrote to memory of 4680 3288 1bbbbb.exe jddvp.exe PID 3288 wrote to memory of 4680 3288 1bbbbb.exe jddvp.exe PID 4680 wrote to memory of 920 4680 jddvp.exe 9lrlfff.exe PID 4680 wrote to memory of 920 4680 jddvp.exe 9lrlfff.exe PID 4680 wrote to memory of 920 4680 jddvp.exe 9lrlfff.exe PID 920 wrote to memory of 4972 920 9lrlfff.exe nbhhht.exe PID 920 wrote to memory of 4972 920 9lrlfff.exe nbhhht.exe PID 920 wrote to memory of 4972 920 9lrlfff.exe nbhhht.exe PID 4972 wrote to memory of 3608 4972 nbhhht.exe rxlflff.exe PID 4972 wrote to memory of 3608 4972 nbhhht.exe rxlflff.exe PID 4972 wrote to memory of 3608 4972 nbhhht.exe rxlflff.exe PID 3608 wrote to memory of 4404 3608 rxlflff.exe btbbbb.exe PID 3608 wrote to memory of 4404 3608 rxlflff.exe btbbbb.exe PID 3608 wrote to memory of 4404 3608 rxlflff.exe btbbbb.exe PID 4404 wrote to memory of 2068 4404 btbbbb.exe pdjdv.exe PID 4404 wrote to memory of 2068 4404 btbbbb.exe pdjdv.exe PID 4404 wrote to memory of 2068 4404 btbbbb.exe pdjdv.exe PID 2068 wrote to memory of 752 2068 pdjdv.exe pppjd.exe PID 2068 wrote to memory of 752 2068 pdjdv.exe pppjd.exe PID 2068 wrote to memory of 752 2068 pdjdv.exe pppjd.exe PID 752 wrote to memory of 3016 752 pppjd.exe fxxflxl.exe PID 752 wrote to memory of 3016 752 pppjd.exe fxxflxl.exe PID 752 wrote to memory of 3016 752 pppjd.exe fxxflxl.exe PID 3016 wrote to memory of 3432 3016 fxxflxl.exe hththb.exe PID 3016 wrote to memory of 3432 3016 fxxflxl.exe hththb.exe PID 3016 wrote to memory of 3432 3016 fxxflxl.exe hththb.exe PID 3432 wrote to memory of 432 3432 hththb.exe pppjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe"C:\Users\Admin\AppData\Local\Temp\26171984aae9a16259694c934cd40e7a53e46214b3c1a55588461d10ec9a1f62.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\9rllflr.exec:\9rllflr.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\hbttbb.exec:\hbttbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\3vjdd.exec:\3vjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\5ntnhh.exec:\5ntnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\dpdvj.exec:\dpdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\ttnnnn.exec:\ttnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\rxffxxr.exec:\rxffxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\tbntth.exec:\tbntth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\lrxxxrr.exec:\lrxxxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\djdjv.exec:\djdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\lxlxxxx.exec:\lxlxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\1bbbbb.exec:\1bbbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\jddvp.exec:\jddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\9lrlfff.exec:\9lrlfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\nbhhht.exec:\nbhhht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\rxlflff.exec:\rxlflff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\btbbbb.exec:\btbbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\pdjdv.exec:\pdjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\pppjd.exec:\pppjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\fxxflxl.exec:\fxxflxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\hththb.exec:\hththb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\pppjd.exec:\pppjd.exe23⤵
- Executes dropped EXE
PID:432 -
\??\c:\9vddj.exec:\9vddj.exe24⤵
- Executes dropped EXE
PID:924 -
\??\c:\btbtnb.exec:\btbtnb.exe25⤵
- Executes dropped EXE
PID:4400 -
\??\c:\ppjjd.exec:\ppjjd.exe26⤵
- Executes dropped EXE
PID:4820 -
\??\c:\lxlrrxr.exec:\lxlrrxr.exe27⤵
- Executes dropped EXE
PID:3792 -
\??\c:\7thhnh.exec:\7thhnh.exe28⤵
- Executes dropped EXE
PID:376 -
\??\c:\dvjpv.exec:\dvjpv.exe29⤵
- Executes dropped EXE
PID:4332 -
\??\c:\rlrlfff.exec:\rlrlfff.exe30⤵
- Executes dropped EXE
PID:3580 -
\??\c:\bhbnhh.exec:\bhbnhh.exe31⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jjppv.exec:\jjppv.exe32⤵
- Executes dropped EXE
PID:2768 -
\??\c:\fxxrffx.exec:\fxxrffx.exe33⤵
- Executes dropped EXE
PID:2756 -
\??\c:\dpppv.exec:\dpppv.exe34⤵
- Executes dropped EXE
PID:4320 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe35⤵
- Executes dropped EXE
PID:3060 -
\??\c:\lrxrlll.exec:\lrxrlll.exe36⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tbhhhb.exec:\tbhhhb.exe37⤵
- Executes dropped EXE
PID:1352 -
\??\c:\vpjvj.exec:\vpjvj.exe38⤵
- Executes dropped EXE
PID:4996 -
\??\c:\lxlffxx.exec:\lxlffxx.exe39⤵
- Executes dropped EXE
PID:3892 -
\??\c:\9tbhhh.exec:\9tbhhh.exe40⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vjdvj.exec:\vjdvj.exe41⤵
- Executes dropped EXE
PID:1684 -
\??\c:\xxllrrf.exec:\xxllrrf.exe42⤵
- Executes dropped EXE
PID:4540 -
\??\c:\xlrlflf.exec:\xlrlflf.exe43⤵
- Executes dropped EXE
PID:1388 -
\??\c:\nnhtnh.exec:\nnhtnh.exe44⤵
- Executes dropped EXE
PID:3620 -
\??\c:\vjjjd.exec:\vjjjd.exe45⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lrrxllr.exec:\lrrxllr.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\flrrlll.exec:\flrrlll.exe47⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hbhbtb.exec:\hbhbtb.exe48⤵
- Executes dropped EXE
PID:1252 -
\??\c:\vpddj.exec:\vpddj.exe49⤵
- Executes dropped EXE
PID:4308 -
\??\c:\xrfxxxr.exec:\xrfxxxr.exe50⤵
- Executes dropped EXE
PID:4776 -
\??\c:\7ttthb.exec:\7ttthb.exe51⤵
- Executes dropped EXE
PID:4472 -
\??\c:\5pppv.exec:\5pppv.exe52⤵
- Executes dropped EXE
PID:1728 -
\??\c:\frlrlxx.exec:\frlrlxx.exe53⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nntbtb.exec:\nntbtb.exe54⤵
- Executes dropped EXE
PID:3556 -
\??\c:\pddpd.exec:\pddpd.exe55⤵
- Executes dropped EXE
PID:2132 -
\??\c:\fxxxxll.exec:\fxxxxll.exe56⤵
- Executes dropped EXE
PID:3804 -
\??\c:\vjpdj.exec:\vjpdj.exe57⤵
- Executes dropped EXE
PID:4632 -
\??\c:\ffrlrrf.exec:\ffrlrrf.exe58⤵
- Executes dropped EXE
PID:5092 -
\??\c:\tbtnhh.exec:\tbtnhh.exe59⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jjjpv.exec:\jjjpv.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vvvdv.exec:\vvvdv.exe61⤵
- Executes dropped EXE
PID:4120 -
\??\c:\lrrrfxr.exec:\lrrrfxr.exe62⤵
- Executes dropped EXE
PID:4876 -
\??\c:\tnhbnn.exec:\tnhbnn.exe63⤵
- Executes dropped EXE
PID:3756 -
\??\c:\pvdvj.exec:\pvdvj.exe64⤵
- Executes dropped EXE
PID:3196 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe65⤵
- Executes dropped EXE
PID:4956 -
\??\c:\5lfffff.exec:\5lfffff.exe66⤵PID:4688
-
\??\c:\3pppp.exec:\3pppp.exe67⤵PID:4704
-
\??\c:\fxlllrr.exec:\fxlllrr.exe68⤵PID:3272
-
\??\c:\nthhnt.exec:\nthhnt.exe69⤵PID:2900
-
\??\c:\vdjdv.exec:\vdjdv.exe70⤵PID:5116
-
\??\c:\pppvd.exec:\pppvd.exe71⤵PID:4972
-
\??\c:\rfxxrrx.exec:\rfxxrrx.exe72⤵PID:2220
-
\??\c:\bnnhnt.exec:\bnnhnt.exe73⤵PID:576
-
\??\c:\pdvvp.exec:\pdvvp.exe74⤵PID:3348
-
\??\c:\7rflxfr.exec:\7rflxfr.exe75⤵PID:2268
-
\??\c:\ffxxxfr.exec:\ffxxxfr.exe76⤵PID:4152
-
\??\c:\3vpdd.exec:\3vpdd.exe77⤵PID:1096
-
\??\c:\7llfflf.exec:\7llfflf.exe78⤵PID:1600
-
\??\c:\thnntb.exec:\thnntb.exe79⤵PID:3080
-
\??\c:\ppjjp.exec:\ppjjp.exe80⤵PID:3340
-
\??\c:\lfxlflr.exec:\lfxlflr.exe81⤵PID:924
-
\??\c:\fxrrrxl.exec:\fxrrrxl.exe82⤵PID:1196
-
\??\c:\hbttnn.exec:\hbttnn.exe83⤵PID:4400
-
\??\c:\hhhbnb.exec:\hhhbnb.exe84⤵PID:232
-
\??\c:\ppppp.exec:\ppppp.exe85⤵PID:4348
-
\??\c:\rrrllrf.exec:\rrrllrf.exe86⤵PID:4552
-
\??\c:\flxxxrr.exec:\flxxxrr.exe87⤵PID:4332
-
\??\c:\htthhh.exec:\htthhh.exe88⤵PID:3888
-
\??\c:\pdjvj.exec:\pdjvj.exe89⤵PID:3180
-
\??\c:\flxrrfr.exec:\flxrrfr.exe90⤵PID:2928
-
\??\c:\xrfrfrl.exec:\xrfrfrl.exe91⤵PID:1104
-
\??\c:\nhnhbb.exec:\nhnhbb.exe92⤵PID:2768
-
\??\c:\jdvpj.exec:\jdvpj.exe93⤵PID:3176
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe94⤵PID:4252
-
\??\c:\htttnn.exec:\htttnn.exe95⤵PID:3060
-
\??\c:\btnnbb.exec:\btnnbb.exe96⤵PID:1892
-
\??\c:\dvdvd.exec:\dvdvd.exe97⤵PID:2772
-
\??\c:\1rfrrxl.exec:\1rfrrxl.exe98⤵PID:3720
-
\??\c:\hbbhbb.exec:\hbbhbb.exe99⤵PID:4528
-
\??\c:\hnbbbh.exec:\hnbbbh.exe100⤵PID:2540
-
\??\c:\pdddj.exec:\pdddj.exe101⤵PID:4616
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe102⤵PID:2336
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe103⤵PID:3292
-
\??\c:\hbtnnn.exec:\hbtnnn.exe104⤵PID:2952
-
\??\c:\btbbbh.exec:\btbbbh.exe105⤵PID:2788
-
\??\c:\vvvpp.exec:\vvvpp.exe106⤵PID:4128
-
\??\c:\7flllrr.exec:\7flllrr.exe107⤵PID:4696
-
\??\c:\llxxlrf.exec:\llxxlrf.exe108⤵PID:1836
-
\??\c:\bhnhbt.exec:\bhnhbt.exe109⤵PID:1332
-
\??\c:\dpddp.exec:\dpddp.exe110⤵PID:1524
-
\??\c:\vjjjd.exec:\vjjjd.exe111⤵PID:4220
-
\??\c:\xflllll.exec:\xflllll.exe112⤵PID:2088
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe113⤵PID:2680
-
\??\c:\bhnnhn.exec:\bhnnhn.exe114⤵PID:4968
-
\??\c:\htnntn.exec:\htnntn.exe115⤵PID:2096
-
\??\c:\jpppd.exec:\jpppd.exe116⤵PID:1736
-
\??\c:\xflxrlf.exec:\xflxrlf.exe117⤵PID:3632
-
\??\c:\hntbhh.exec:\hntbhh.exe118⤵PID:3260
-
\??\c:\llrrrfx.exec:\llrrrfx.exe119⤵PID:1436
-
\??\c:\7htnhb.exec:\7htnhb.exe120⤵PID:2656
-
\??\c:\dpvdd.exec:\dpvdd.exe121⤵PID:4832
-
\??\c:\tbnnnt.exec:\tbnnnt.exe122⤵PID:1596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-