Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 03:41
Static task
static1
Behavioral task
behavioral1
Sample
cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe
Resource
win7-20241010-en
General
-
Target
cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe
-
Size
333KB
-
MD5
03aafbcad47f175b49a9f4f1df0dd63a
-
SHA1
aeda57fa3ab1098bc00297adb1bf9be06bf37e21
-
SHA256
cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700
-
SHA512
fa8e5ada0db2a5c0b1dc01c57f9701be216942ec6f80a1a751d44d712f6e5d693caa197092e7d6595f45a0ddea49a3ea3f09cb06632619ea123be39cd7eef0e1
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhC:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3132-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/796-851-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-907-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-1209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5036 pdddd.exe 4796 xrfrrxr.exe 1440 1nthhn.exe 2456 djjjd.exe 4200 fxffxxr.exe 1128 5lllllr.exe 4324 rfxxxff.exe 3136 rrrflrr.exe 2260 hbbbtt.exe 4516 dpvvv.exe 1520 xllxlrr.exe 3628 1httbh.exe 4260 lxxxrrr.exe 4576 jjpdd.exe 4688 rffxrrl.exe 4476 bbnttb.exe 4620 5pddd.exe 684 xrxfflf.exe 1884 nntttb.exe 3152 rllllrr.exe 3076 bnbtbn.exe 4092 dvpvp.exe 1700 tnntnb.exe 892 rrrrrxx.exe 4528 3ppjp.exe 2016 vjjdd.exe 2324 rlrfffr.exe 220 vvvvv.exe 4024 rxxlrrr.exe 1232 1ddvp.exe 3956 tbhbbh.exe 4184 pdpjv.exe 636 lxxrrrl.exe 3748 pvppj.exe 1932 rrrrlrr.exe 2348 nntttb.exe 3772 vpvdd.exe 3700 fxlllrr.exe 2176 bhntbb.exe 1616 ppvdd.exe 3268 rrxfxfl.exe 1200 hhnhbb.exe 5104 dpddd.exe 1860 5ffrrrr.exe 4540 tbhtnn.exe 2652 djvvj.exe 4048 rfrxflx.exe 2312 ntnhbb.exe 1420 vvddj.exe 3132 jjvvv.exe 3932 rxfflfr.exe 2360 bnhbhn.exe 512 1pddd.exe 3796 5frxlxr.exe 2296 tnbhtt.exe 2352 vvjjj.exe 2648 1lfffrr.exe 3108 bbhtnt.exe 3936 xfxxxxf.exe 1340 vvjjj.exe 4680 flxxxff.exe 3724 tnnntb.exe 3888 pvjjj.exe 4888 rrllrlr.exe -
resource yara_rule behavioral2/memory/3132-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-721-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3132 wrote to memory of 5036 3132 cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe 83 PID 3132 wrote to memory of 5036 3132 cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe 83 PID 3132 wrote to memory of 5036 3132 cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe 83 PID 5036 wrote to memory of 4796 5036 pdddd.exe 84 PID 5036 wrote to memory of 4796 5036 pdddd.exe 84 PID 5036 wrote to memory of 4796 5036 pdddd.exe 84 PID 4796 wrote to memory of 1440 4796 xrfrrxr.exe 85 PID 4796 wrote to memory of 1440 4796 xrfrrxr.exe 85 PID 4796 wrote to memory of 1440 4796 xrfrrxr.exe 85 PID 1440 wrote to memory of 2456 1440 1nthhn.exe 86 PID 1440 wrote to memory of 2456 1440 1nthhn.exe 86 PID 1440 wrote to memory of 2456 1440 1nthhn.exe 86 PID 2456 wrote to memory of 4200 2456 djjjd.exe 87 PID 2456 wrote to memory of 4200 2456 djjjd.exe 87 PID 2456 wrote to memory of 4200 2456 djjjd.exe 87 PID 4200 wrote to memory of 1128 4200 fxffxxr.exe 88 PID 4200 wrote to memory of 1128 4200 fxffxxr.exe 88 PID 4200 wrote to memory of 1128 4200 fxffxxr.exe 88 PID 1128 wrote to memory of 4324 1128 5lllllr.exe 89 PID 1128 wrote to memory of 4324 1128 5lllllr.exe 89 PID 1128 wrote to memory of 4324 1128 5lllllr.exe 89 PID 4324 wrote to memory of 3136 4324 rfxxxff.exe 90 PID 4324 wrote to memory of 3136 4324 rfxxxff.exe 90 PID 4324 wrote to memory of 3136 4324 rfxxxff.exe 90 PID 3136 wrote to memory of 2260 3136 rrrflrr.exe 91 PID 3136 wrote to memory of 2260 3136 rrrflrr.exe 91 PID 3136 wrote to memory of 2260 3136 rrrflrr.exe 91 PID 2260 wrote to memory of 4516 2260 hbbbtt.exe 92 PID 2260 wrote to memory of 4516 2260 hbbbtt.exe 92 PID 2260 wrote to memory of 4516 2260 hbbbtt.exe 92 PID 4516 wrote to memory of 1520 4516 dpvvv.exe 93 PID 4516 wrote to memory of 1520 4516 dpvvv.exe 93 PID 4516 wrote to memory of 1520 4516 dpvvv.exe 93 PID 1520 wrote to memory of 3628 1520 xllxlrr.exe 94 PID 1520 wrote to memory of 3628 1520 xllxlrr.exe 94 PID 1520 wrote to memory of 3628 1520 xllxlrr.exe 94 PID 3628 wrote to memory of 4260 3628 1httbh.exe 95 PID 3628 wrote to memory of 4260 3628 1httbh.exe 95 PID 3628 wrote to memory of 4260 3628 1httbh.exe 95 PID 4260 wrote to memory of 4576 4260 lxxxrrr.exe 96 PID 4260 wrote to memory of 4576 4260 lxxxrrr.exe 96 PID 4260 wrote to memory of 4576 4260 lxxxrrr.exe 96 PID 4576 wrote to memory of 4688 4576 jjpdd.exe 97 PID 4576 wrote to memory of 4688 4576 jjpdd.exe 97 PID 4576 wrote to memory of 4688 4576 jjpdd.exe 97 PID 4688 wrote to memory of 4476 4688 rffxrrl.exe 98 PID 4688 wrote to memory of 4476 4688 rffxrrl.exe 98 PID 4688 wrote to memory of 4476 4688 rffxrrl.exe 98 PID 4476 wrote to memory of 4620 4476 bbnttb.exe 99 PID 4476 wrote to memory of 4620 4476 bbnttb.exe 99 PID 4476 wrote to memory of 4620 4476 bbnttb.exe 99 PID 4620 wrote to memory of 684 4620 5pddd.exe 100 PID 4620 wrote to memory of 684 4620 5pddd.exe 100 PID 4620 wrote to memory of 684 4620 5pddd.exe 100 PID 684 wrote to memory of 1884 684 xrxfflf.exe 101 PID 684 wrote to memory of 1884 684 xrxfflf.exe 101 PID 684 wrote to memory of 1884 684 xrxfflf.exe 101 PID 1884 wrote to memory of 3152 1884 nntttb.exe 102 PID 1884 wrote to memory of 3152 1884 nntttb.exe 102 PID 1884 wrote to memory of 3152 1884 nntttb.exe 102 PID 3152 wrote to memory of 3076 3152 rllllrr.exe 103 PID 3152 wrote to memory of 3076 3152 rllllrr.exe 103 PID 3152 wrote to memory of 3076 3152 rllllrr.exe 103 PID 3076 wrote to memory of 4092 3076 bnbtbn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe"C:\Users\Admin\AppData\Local\Temp\cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\pdddd.exec:\pdddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\xrfrrxr.exec:\xrfrrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\1nthhn.exec:\1nthhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\djjjd.exec:\djjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\fxffxxr.exec:\fxffxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\5lllllr.exec:\5lllllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\rfxxxff.exec:\rfxxxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\rrrflrr.exec:\rrrflrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\hbbbtt.exec:\hbbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\dpvvv.exec:\dpvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\xllxlrr.exec:\xllxlrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\1httbh.exec:\1httbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\jjpdd.exec:\jjpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\rffxrrl.exec:\rffxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\bbnttb.exec:\bbnttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\5pddd.exec:\5pddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\xrxfflf.exec:\xrxfflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\nntttb.exec:\nntttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\rllllrr.exec:\rllllrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\bnbtbn.exec:\bnbtbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\dvpvp.exec:\dvpvp.exe23⤵
- Executes dropped EXE
PID:4092 -
\??\c:\tnntnb.exec:\tnntnb.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe25⤵
- Executes dropped EXE
PID:892 -
\??\c:\3ppjp.exec:\3ppjp.exe26⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vjjdd.exec:\vjjdd.exe27⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlrfffr.exec:\rlrfffr.exe28⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vvvvv.exec:\vvvvv.exe29⤵
- Executes dropped EXE
PID:220 -
\??\c:\rxxlrrr.exec:\rxxlrrr.exe30⤵
- Executes dropped EXE
PID:4024 -
\??\c:\1ddvp.exec:\1ddvp.exe31⤵
- Executes dropped EXE
PID:1232 -
\??\c:\tbhbbh.exec:\tbhbbh.exe32⤵
- Executes dropped EXE
PID:3956 -
\??\c:\pdpjv.exec:\pdpjv.exe33⤵
- Executes dropped EXE
PID:4184 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe34⤵
- Executes dropped EXE
PID:636 -
\??\c:\pvppj.exec:\pvppj.exe35⤵
- Executes dropped EXE
PID:3748 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe36⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nntttb.exec:\nntttb.exe37⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vpvdd.exec:\vpvdd.exe38⤵
- Executes dropped EXE
PID:3772 -
\??\c:\fxlllrr.exec:\fxlllrr.exe39⤵
- Executes dropped EXE
PID:3700 -
\??\c:\bhntbb.exec:\bhntbb.exe40⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ppvdd.exec:\ppvdd.exe41⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rrxfxfl.exec:\rrxfxfl.exe42⤵
- Executes dropped EXE
PID:3268 -
\??\c:\hhnhbb.exec:\hhnhbb.exe43⤵
- Executes dropped EXE
PID:1200 -
\??\c:\dpddd.exec:\dpddd.exe44⤵
- Executes dropped EXE
PID:5104 -
\??\c:\5ffrrrr.exec:\5ffrrrr.exe45⤵
- Executes dropped EXE
PID:1860 -
\??\c:\tbhtnn.exec:\tbhtnn.exe46⤵
- Executes dropped EXE
PID:4540 -
\??\c:\djvvj.exec:\djvvj.exe47⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rfrxflx.exec:\rfrxflx.exe48⤵
- Executes dropped EXE
PID:4048 -
\??\c:\ntnhbb.exec:\ntnhbb.exe49⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vvddj.exec:\vvddj.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jjvvv.exec:\jjvvv.exe51⤵
- Executes dropped EXE
PID:3132 -
\??\c:\rxfflfr.exec:\rxfflfr.exe52⤵
- Executes dropped EXE
PID:3932 -
\??\c:\bnhbhn.exec:\bnhbhn.exe53⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1pddd.exec:\1pddd.exe54⤵
- Executes dropped EXE
PID:512 -
\??\c:\5frxlxr.exec:\5frxlxr.exe55⤵
- Executes dropped EXE
PID:3796 -
\??\c:\tnbhtt.exec:\tnbhtt.exe56⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vvjjj.exec:\vvjjj.exe57⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1lfffrr.exec:\1lfffrr.exe58⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bbhtnt.exec:\bbhtnt.exe59⤵
- Executes dropped EXE
PID:3108 -
\??\c:\xfxxxxf.exec:\xfxxxxf.exe60⤵
- Executes dropped EXE
PID:3936 -
\??\c:\vvjjj.exec:\vvjjj.exe61⤵
- Executes dropped EXE
PID:1340 -
\??\c:\flxxxff.exec:\flxxxff.exe62⤵
- Executes dropped EXE
PID:4680 -
\??\c:\tnnntb.exec:\tnnntb.exe63⤵
- Executes dropped EXE
PID:3724 -
\??\c:\pvjjj.exec:\pvjjj.exe64⤵
- Executes dropped EXE
PID:3888 -
\??\c:\rrllrlr.exec:\rrllrlr.exe65⤵
- Executes dropped EXE
PID:4888 -
\??\c:\ttthhh.exec:\ttthhh.exe66⤵PID:3280
-
\??\c:\djdvp.exec:\djdvp.exe67⤵PID:2988
-
\??\c:\9ffxrrx.exec:\9ffxrrx.exe68⤵PID:4580
-
\??\c:\bthhhn.exec:\bthhhn.exe69⤵PID:964
-
\??\c:\btnbtt.exec:\btnbtt.exe70⤵PID:4912
-
\??\c:\rllxxxx.exec:\rllxxxx.exe71⤵PID:2880
-
\??\c:\nthhbn.exec:\nthhbn.exe72⤵PID:4620
-
\??\c:\hhbnhn.exec:\hhbnhn.exe73⤵PID:3404
-
\??\c:\dppvv.exec:\dppvv.exe74⤵PID:3228
-
\??\c:\rllxffl.exec:\rllxffl.exe75⤵PID:4384
-
\??\c:\ttnbnb.exec:\ttnbnb.exe76⤵PID:4480
-
\??\c:\bbhbbb.exec:\bbhbbb.exe77⤵PID:1388
-
\??\c:\ppppj.exec:\ppppj.exe78⤵PID:1712
-
\??\c:\xxlllrr.exec:\xxlllrr.exe79⤵PID:2300
-
\??\c:\rrffrlf.exec:\rrffrlf.exe80⤵PID:4168
-
\??\c:\1hhhhn.exec:\1hhhhn.exe81⤵PID:1224
-
\??\c:\vpvpj.exec:\vpvpj.exe82⤵PID:1048
-
\??\c:\pvdpv.exec:\pvdpv.exe83⤵PID:2024
-
\??\c:\lxllxxl.exec:\lxllxxl.exe84⤵PID:324
-
\??\c:\rffffll.exec:\rffffll.exe85⤵PID:3208
-
\??\c:\tbtbtb.exec:\tbtbtb.exe86⤵PID:736
-
\??\c:\7jvjv.exec:\7jvjv.exe87⤵PID:1232
-
\??\c:\vvpjj.exec:\vvpjj.exe88⤵PID:1648
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe89⤵PID:1156
-
\??\c:\tttttt.exec:\tttttt.exe90⤵PID:3196
-
\??\c:\7hbbtb.exec:\7hbbtb.exe91⤵PID:2056
-
\??\c:\jdvjj.exec:\jdvjj.exe92⤵PID:1504
-
\??\c:\xrffrxl.exec:\xrffrxl.exe93⤵PID:2572
-
\??\c:\vdjdv.exec:\vdjdv.exe94⤵PID:4716
-
\??\c:\llrrlll.exec:\llrrlll.exe95⤵PID:2952
-
\??\c:\bhhhhb.exec:\bhhhhb.exe96⤵PID:820
-
\??\c:\dpvvp.exec:\dpvvp.exe97⤵PID:1616
-
\??\c:\xflfrrx.exec:\xflfrrx.exe98⤵
- System Location Discovery: System Language Discovery
PID:2500 -
\??\c:\ddvdd.exec:\ddvdd.exe99⤵PID:1200
-
\??\c:\llfxxlr.exec:\llfxxlr.exe100⤵PID:5104
-
\??\c:\hhhnnn.exec:\hhhnnn.exe101⤵PID:3248
-
\??\c:\1vvvv.exec:\1vvvv.exe102⤵PID:3984
-
\??\c:\xrllllf.exec:\xrllllf.exe103⤵PID:4112
-
\??\c:\fllrfxx.exec:\fllrfxx.exe104⤵PID:2204
-
\??\c:\hnttbh.exec:\hnttbh.exe105⤵PID:2312
-
\??\c:\pdpjj.exec:\pdpjj.exe106⤵PID:1420
-
\??\c:\rxxxrfl.exec:\rxxxrfl.exe107⤵PID:732
-
\??\c:\nbbbtn.exec:\nbbbtn.exe108⤵PID:3088
-
\??\c:\jddjd.exec:\jddjd.exe109⤵PID:1880
-
\??\c:\jpppj.exec:\jpppj.exe110⤵PID:5028
-
\??\c:\ntnnhh.exec:\ntnnhh.exe111⤵PID:456
-
\??\c:\bntbbb.exec:\bntbbb.exe112⤵PID:4600
-
\??\c:\vpppp.exec:\vpppp.exe113⤵PID:4044
-
\??\c:\ffxllrr.exec:\ffxllrr.exe114⤵PID:3080
-
\??\c:\5nnnnt.exec:\5nnnnt.exe115⤵PID:3684
-
\??\c:\vvvdv.exec:\vvvdv.exe116⤵PID:5032
-
\??\c:\llxxxfx.exec:\llxxxfx.exe117⤵PID:4744
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe118⤵PID:3660
-
\??\c:\ntbbbb.exec:\ntbbbb.exe119⤵PID:2408
-
\??\c:\ppppj.exec:\ppppj.exe120⤵PID:2884
-
\??\c:\flrxllr.exec:\flrxllr.exe121⤵
- System Location Discovery: System Language Discovery
PID:4500 -
\??\c:\1hhtth.exec:\1hhtth.exe122⤵PID:3488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-