Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 07:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe
-
Size
455KB
-
MD5
38ca51c1f67607323a862005e6101600
-
SHA1
09d31aa71a6c00ff9b735ba369ee1ec3ca031aab
-
SHA256
33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6
-
SHA512
bf2b1df7f48c5c6316f0c157b24599d143366e3cecbbe03560059e95d8d093b7f38efe52a61f80a2fc340e995397fa7c4a90f3e4917141ae8fc09ad86a1333ac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR2:q7Tc2NYHUrAwfMp3CDR2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3024-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/696-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-1028-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3248 3bbbbh.exe 4288 xxfllll.exe 3932 hhnnnn.exe 1528 1jvvj.exe 208 7llffrr.exe 4420 nbbbtb.exe 3652 5jppv.exe 4136 9rlllxx.exe 2596 ntnttb.exe 4960 lxxrrxr.exe 3976 jvdvj.exe 1096 lrlllll.exe 1480 hhnnnn.exe 3088 pddpv.exe 2216 7xfffff.exe 2136 bbbhnh.exe 696 7dpvp.exe 4924 xffxxrl.exe 2964 hbbtnn.exe 1408 ddjjj.exe 1164 pdpjd.exe 5064 lflrrrx.exe 3296 tbnhnt.exe 3228 vjpjj.exe 2584 rrfxrff.exe 5000 htbtbb.exe 2756 nnhnhb.exe 4780 5dvvv.exe 4756 lrlfflf.exe 396 xlrxrrl.exe 2268 ntttnn.exe 4932 jjpvp.exe 4856 xlfxxxx.exe 532 5llllrr.exe 4004 bhbtnt.exe 1232 pjpjd.exe 1828 5jjdd.exe 3856 3ffxxrr.exe 1888 3bnhhh.exe 3708 3pppv.exe 5028 djjjj.exe 1628 xlrrrrr.exe 3688 bhnnhh.exe 4820 7hbtnt.exe 4100 7dpjp.exe 4852 frxxrrl.exe 4172 btbbtb.exe 2968 3hbtnt.exe 3968 vvjjd.exe 3872 xflfxxf.exe 2904 lffxxxx.exe 4688 3hbbbt.exe 1188 dpvpv.exe 4696 7xxxxxr.exe 3440 rrxxllf.exe 3648 hbhbht.exe 4216 jvjdd.exe 3992 llxxrlf.exe 4872 5lrllrr.exe 1100 tbtnbn.exe 2140 ffrfxlr.exe 3728 ntbthn.exe 3716 rlflflf.exe 2136 thnhbb.exe -
resource yara_rule behavioral2/memory/3024-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-700-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnhb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 3248 3024 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe 83 PID 3024 wrote to memory of 3248 3024 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe 83 PID 3024 wrote to memory of 3248 3024 33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe 83 PID 3248 wrote to memory of 4288 3248 3bbbbh.exe 84 PID 3248 wrote to memory of 4288 3248 3bbbbh.exe 84 PID 3248 wrote to memory of 4288 3248 3bbbbh.exe 84 PID 4288 wrote to memory of 3932 4288 xxfllll.exe 85 PID 4288 wrote to memory of 3932 4288 xxfllll.exe 85 PID 4288 wrote to memory of 3932 4288 xxfllll.exe 85 PID 3932 wrote to memory of 1528 3932 hhnnnn.exe 86 PID 3932 wrote to memory of 1528 3932 hhnnnn.exe 86 PID 3932 wrote to memory of 1528 3932 hhnnnn.exe 86 PID 1528 wrote to memory of 208 1528 1jvvj.exe 87 PID 1528 wrote to memory of 208 1528 1jvvj.exe 87 PID 1528 wrote to memory of 208 1528 1jvvj.exe 87 PID 208 wrote to memory of 4420 208 7llffrr.exe 88 PID 208 wrote to memory of 4420 208 7llffrr.exe 88 PID 208 wrote to memory of 4420 208 7llffrr.exe 88 PID 4420 wrote to memory of 3652 4420 nbbbtb.exe 89 PID 4420 wrote to memory of 3652 4420 nbbbtb.exe 89 PID 4420 wrote to memory of 3652 4420 nbbbtb.exe 89 PID 3652 wrote to memory of 4136 3652 5jppv.exe 90 PID 3652 wrote to memory of 4136 3652 5jppv.exe 90 PID 3652 wrote to memory of 4136 3652 5jppv.exe 90 PID 4136 wrote to memory of 2596 4136 9rlllxx.exe 91 PID 4136 wrote to memory of 2596 4136 9rlllxx.exe 91 PID 4136 wrote to memory of 2596 4136 9rlllxx.exe 91 PID 2596 wrote to memory of 4960 2596 ntnttb.exe 92 PID 2596 wrote to memory of 4960 2596 ntnttb.exe 92 PID 2596 wrote to memory of 4960 2596 ntnttb.exe 92 PID 4960 wrote to memory of 3976 4960 lxxrrxr.exe 93 PID 4960 wrote to memory of 3976 4960 lxxrrxr.exe 93 PID 4960 wrote to memory of 3976 4960 lxxrrxr.exe 93 PID 3976 wrote to memory of 1096 3976 jvdvj.exe 94 PID 3976 wrote to memory of 1096 3976 jvdvj.exe 94 PID 3976 wrote to memory of 1096 3976 jvdvj.exe 94 PID 1096 wrote to memory of 1480 1096 lrlllll.exe 95 PID 1096 wrote to memory of 1480 1096 lrlllll.exe 95 PID 1096 wrote to memory of 1480 1096 lrlllll.exe 95 PID 1480 wrote to memory of 3088 1480 hhnnnn.exe 96 PID 1480 wrote to memory of 3088 1480 hhnnnn.exe 96 PID 1480 wrote to memory of 3088 1480 hhnnnn.exe 96 PID 3088 wrote to memory of 2216 3088 pddpv.exe 97 PID 3088 wrote to memory of 2216 3088 pddpv.exe 97 PID 3088 wrote to memory of 2216 3088 pddpv.exe 97 PID 2216 wrote to memory of 2136 2216 7xfffff.exe 146 PID 2216 wrote to memory of 2136 2216 7xfffff.exe 146 PID 2216 wrote to memory of 2136 2216 7xfffff.exe 146 PID 2136 wrote to memory of 696 2136 bbbhnh.exe 99 PID 2136 wrote to memory of 696 2136 bbbhnh.exe 99 PID 2136 wrote to memory of 696 2136 bbbhnh.exe 99 PID 696 wrote to memory of 4924 696 7dpvp.exe 100 PID 696 wrote to memory of 4924 696 7dpvp.exe 100 PID 696 wrote to memory of 4924 696 7dpvp.exe 100 PID 4924 wrote to memory of 2964 4924 xffxxrl.exe 101 PID 4924 wrote to memory of 2964 4924 xffxxrl.exe 101 PID 4924 wrote to memory of 2964 4924 xffxxrl.exe 101 PID 2964 wrote to memory of 1408 2964 hbbtnn.exe 102 PID 2964 wrote to memory of 1408 2964 hbbtnn.exe 102 PID 2964 wrote to memory of 1408 2964 hbbtnn.exe 102 PID 1408 wrote to memory of 1164 1408 ddjjj.exe 103 PID 1408 wrote to memory of 1164 1408 ddjjj.exe 103 PID 1408 wrote to memory of 1164 1408 ddjjj.exe 103 PID 1164 wrote to memory of 5064 1164 pdpjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe"C:\Users\Admin\AppData\Local\Temp\33845cea22f53a4b9927919fe836322681e4d1f55919ec83f8b1e4112990c9e6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\3bbbbh.exec:\3bbbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\xxfllll.exec:\xxfllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\hhnnnn.exec:\hhnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\1jvvj.exec:\1jvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\7llffrr.exec:\7llffrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\nbbbtb.exec:\nbbbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\5jppv.exec:\5jppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\9rlllxx.exec:\9rlllxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\ntnttb.exec:\ntnttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lxxrrxr.exec:\lxxrrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\jvdvj.exec:\jvdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\lrlllll.exec:\lrlllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\hhnnnn.exec:\hhnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\pddpv.exec:\pddpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\7xfffff.exec:\7xfffff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\bbbhnh.exec:\bbbhnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\7dpvp.exec:\7dpvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\xffxxrl.exec:\xffxxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\hbbtnn.exec:\hbbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ddjjj.exec:\ddjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\pdpjd.exec:\pdpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\lflrrrx.exec:\lflrrrx.exe23⤵
- Executes dropped EXE
PID:5064 -
\??\c:\tbnhnt.exec:\tbnhnt.exe24⤵
- Executes dropped EXE
PID:3296 -
\??\c:\vjpjj.exec:\vjpjj.exe25⤵
- Executes dropped EXE
PID:3228 -
\??\c:\rrfxrff.exec:\rrfxrff.exe26⤵
- Executes dropped EXE
PID:2584 -
\??\c:\htbtbb.exec:\htbtbb.exe27⤵
- Executes dropped EXE
PID:5000 -
\??\c:\nnhnhb.exec:\nnhnhb.exe28⤵
- Executes dropped EXE
PID:2756 -
\??\c:\5dvvv.exec:\5dvvv.exe29⤵
- Executes dropped EXE
PID:4780 -
\??\c:\lrlfflf.exec:\lrlfflf.exe30⤵
- Executes dropped EXE
PID:4756 -
\??\c:\xlrxrrl.exec:\xlrxrrl.exe31⤵
- Executes dropped EXE
PID:396 -
\??\c:\ntttnn.exec:\ntttnn.exe32⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jjpvp.exec:\jjpvp.exe33⤵
- Executes dropped EXE
PID:4932 -
\??\c:\xlfxxxx.exec:\xlfxxxx.exe34⤵
- Executes dropped EXE
PID:4856 -
\??\c:\5llllrr.exec:\5llllrr.exe35⤵
- Executes dropped EXE
PID:532 -
\??\c:\bhbtnt.exec:\bhbtnt.exe36⤵
- Executes dropped EXE
PID:4004 -
\??\c:\pjpjd.exec:\pjpjd.exe37⤵
- Executes dropped EXE
PID:1232 -
\??\c:\5jjdd.exec:\5jjdd.exe38⤵
- Executes dropped EXE
PID:1828 -
\??\c:\3ffxxrr.exec:\3ffxxrr.exe39⤵
- Executes dropped EXE
PID:3856 -
\??\c:\3bnhhh.exec:\3bnhhh.exe40⤵
- Executes dropped EXE
PID:1888 -
\??\c:\3pppv.exec:\3pppv.exe41⤵
- Executes dropped EXE
PID:3708 -
\??\c:\djjjj.exec:\djjjj.exe42⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe43⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bhnnhh.exec:\bhnnhh.exe44⤵
- Executes dropped EXE
PID:3688 -
\??\c:\7hbtnt.exec:\7hbtnt.exe45⤵
- Executes dropped EXE
PID:4820 -
\??\c:\7dpjp.exec:\7dpjp.exe46⤵
- Executes dropped EXE
PID:4100 -
\??\c:\frxxrrl.exec:\frxxrrl.exe47⤵
- Executes dropped EXE
PID:4852 -
\??\c:\btbbtb.exec:\btbbtb.exe48⤵
- Executes dropped EXE
PID:4172 -
\??\c:\3hbtnt.exec:\3hbtnt.exe49⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vvjjd.exec:\vvjjd.exe50⤵
- Executes dropped EXE
PID:3968 -
\??\c:\xflfxxf.exec:\xflfxxf.exe51⤵
- Executes dropped EXE
PID:3872 -
\??\c:\lffxxxx.exec:\lffxxxx.exe52⤵
- Executes dropped EXE
PID:2904 -
\??\c:\3hbbbt.exec:\3hbbbt.exe53⤵
- Executes dropped EXE
PID:4688 -
\??\c:\dpvpv.exec:\dpvpv.exe54⤵
- Executes dropped EXE
PID:1188 -
\??\c:\7xxxxxr.exec:\7xxxxxr.exe55⤵
- Executes dropped EXE
PID:4696 -
\??\c:\rrxxllf.exec:\rrxxllf.exe56⤵
- Executes dropped EXE
PID:3440 -
\??\c:\hbhbht.exec:\hbhbht.exe57⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jvjdd.exec:\jvjdd.exe58⤵
- Executes dropped EXE
PID:4216 -
\??\c:\llxxrlf.exec:\llxxrlf.exe59⤵
- Executes dropped EXE
PID:3992 -
\??\c:\5lrllrr.exec:\5lrllrr.exe60⤵
- Executes dropped EXE
PID:4872 -
\??\c:\tbtnbn.exec:\tbtnbn.exe61⤵
- Executes dropped EXE
PID:1100 -
\??\c:\ffrfxlr.exec:\ffrfxlr.exe62⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ntbthn.exec:\ntbthn.exe63⤵
- Executes dropped EXE
PID:3728 -
\??\c:\rlflflf.exec:\rlflflf.exe64⤵
- Executes dropped EXE
PID:3716 -
\??\c:\thnhbb.exec:\thnhbb.exe65⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jdvvv.exec:\jdvvv.exe66⤵PID:100
-
\??\c:\3rrrrff.exec:\3rrrrff.exe67⤵
- System Location Discovery: System Language Discovery
PID:4956 -
\??\c:\bhhbnn.exec:\bhhbnn.exe68⤵PID:1816
-
\??\c:\djppj.exec:\djppj.exe69⤵PID:1172
-
\??\c:\rlffxxr.exec:\rlffxxr.exe70⤵PID:4840
-
\??\c:\hhhhbb.exec:\hhhhbb.exe71⤵PID:3216
-
\??\c:\xflrlfx.exec:\xflrlfx.exe72⤵PID:1892
-
\??\c:\1rlllrl.exec:\1rlllrl.exe73⤵PID:3228
-
\??\c:\jvppv.exec:\jvppv.exe74⤵PID:3128
-
\??\c:\jpjvj.exec:\jpjvj.exe75⤵PID:5000
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe76⤵PID:3524
-
\??\c:\jvpjd.exec:\jvpjd.exe77⤵PID:1072
-
\??\c:\jpjdd.exec:\jpjdd.exe78⤵PID:5092
-
\??\c:\bnnbbb.exec:\bnnbbb.exe79⤵PID:2168
-
\??\c:\rlflfrf.exec:\rlflfrf.exe80⤵PID:4932
-
\??\c:\fffrrll.exec:\fffrrll.exe81⤵PID:4212
-
\??\c:\hhhbnb.exec:\hhhbnb.exe82⤵PID:2896
-
\??\c:\vvvjd.exec:\vvvjd.exe83⤵PID:5016
-
\??\c:\frxrrrr.exec:\frxrrrr.exe84⤵PID:4476
-
\??\c:\7ttttt.exec:\7ttttt.exe85⤵PID:1544
-
\??\c:\pvppp.exec:\pvppp.exe86⤵PID:2696
-
\??\c:\frllllf.exec:\frllllf.exe87⤵PID:3712
-
\??\c:\7thbbh.exec:\7thbbh.exe88⤵PID:2760
-
\??\c:\ttbtbb.exec:\ttbtbb.exe89⤵PID:4432
-
\??\c:\djpjp.exec:\djpjp.exe90⤵PID:3688
-
\??\c:\lrlllll.exec:\lrlllll.exe91⤵PID:4396
-
\??\c:\bbbtbb.exec:\bbbtbb.exe92⤵PID:2424
-
\??\c:\vdjdv.exec:\vdjdv.exe93⤵PID:4268
-
\??\c:\bnnnnt.exec:\bnnnnt.exe94⤵PID:2720
-
\??\c:\bhhbtt.exec:\bhhbtt.exe95⤵PID:3312
-
\??\c:\pjppj.exec:\pjppj.exe96⤵PID:2196
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe97⤵PID:216
-
\??\c:\bbbbbh.exec:\bbbbbh.exe98⤵PID:4468
-
\??\c:\jvddv.exec:\jvddv.exe99⤵PID:4104
-
\??\c:\9xfxffl.exec:\9xfxffl.exe100⤵PID:1452
-
\??\c:\xxxffff.exec:\xxxffff.exe101⤵PID:5036
-
\??\c:\tnhtbt.exec:\tnhtbt.exe102⤵PID:4340
-
\??\c:\dvvvv.exec:\dvvvv.exe103⤵PID:3416
-
\??\c:\flffffx.exec:\flffffx.exe104⤵PID:4812
-
\??\c:\vvvvp.exec:\vvvvp.exe105⤵PID:1168
-
\??\c:\lrlllrr.exec:\lrlllrr.exe106⤵PID:4136
-
\??\c:\vdjpd.exec:\vdjpd.exe107⤵PID:4708
-
\??\c:\lxfrrxr.exec:\lxfrrxr.exe108⤵PID:1200
-
\??\c:\nnbbbb.exec:\nnbbbb.exe109⤵PID:2856
-
\??\c:\ddjpp.exec:\ddjpp.exe110⤵PID:4372
-
\??\c:\lfxrllf.exec:\lfxrllf.exe111⤵PID:4748
-
\??\c:\bbhttt.exec:\bbhttt.exe112⤵PID:2020
-
\??\c:\lrlxxlx.exec:\lrlxxlx.exe113⤵PID:1868
-
\??\c:\nhhttn.exec:\nhhttn.exe114⤵PID:4776
-
\??\c:\ddjjj.exec:\ddjjj.exe115⤵PID:3308
-
\??\c:\lrlllll.exec:\lrlllll.exe116⤵PID:3132
-
\??\c:\tbhbtt.exec:\tbhbtt.exe117⤵PID:3636
-
\??\c:\lrrrllr.exec:\lrrrllr.exe118⤵PID:2748
-
\??\c:\1bbbtb.exec:\1bbbtb.exe119⤵PID:4308
-
\??\c:\jvvvp.exec:\jvvvp.exe120⤵PID:2348
-
\??\c:\fllfrrf.exec:\fllfrrf.exe121⤵PID:1140
-
\??\c:\rffxxxx.exec:\rffxxxx.exe122⤵PID:3728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-