Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 09:12
Behavioral task
behavioral1
Sample
73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe
Resource
win7-20240903-en
General
-
Target
73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe
-
Size
87KB
-
MD5
4b7f3720bb32bfbb1914aafd7419cdf0
-
SHA1
c0f28c08f8201d51e2ef53c04586785589249a79
-
SHA256
73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72
-
SHA512
01bfe54325acad87ed8a78f1ab2d1bd62adbc4c38d1ceb179be9e060f1e057b474068ae0d101f9c85b8e0d12fd58fdaad8db7b9257c137bcf24b321e4429f1eb
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzGeKuO+mqizpPubYDEzfY:xhOmTsF93UYfwC6GIout03LzuuOlzpPf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1572-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/652-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/320-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-621-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-674-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-726-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-763-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-806-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-1026-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-1063-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-1374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xlxfrfr.exe7bhbbb.exejdddd.exerrrlffr.exentbhnn.exethhhhh.exe5lrllxx.exetbnhhh.exevvvdj.exe3rrxrrr.exetnhbnb.exejddvv.exexxxlffr.exexllfxxr.exenhnnhn.exejpvvp.exe7xxfxlf.exepvdvv.exe5btnnn.exebnnhbn.exefxflfrr.exerrlfxrl.exehttnhh.exedpddj.exe1djjv.exerlrrflf.exenhttnn.exejjpdd.exeffrlxfr.exebttbbh.exe1djdd.exe7frrrrf.exenhbhtn.exe3ppjp.exellfrrxx.exetnhttb.exejdpjp.exejdjjd.exexrrllll.exebbnhbh.exejjdpj.exefrlrlll.exenntttn.exe1jvdv.exexxrxxrx.exe5thbnn.exevpdvp.exexfxxrxx.exehbbnnh.exevjvpd.exexxxxrrl.exethntnt.exelffxrrr.exentbnhh.exejdjpv.exenbtbnb.exepjjjd.exexrxrlrl.exerxxlxrr.exenhbbnn.exehnbtbt.exepvppj.exexrffflf.exehnnnnn.exepid process 2176 xlxfrfr.exe 3644 7bhbbb.exe 4996 jdddd.exe 1544 rrrlffr.exe 1492 ntbhnn.exe 3916 thhhhh.exe 844 5lrllxx.exe 2628 tbnhhh.exe 652 vvvdj.exe 320 3rrxrrr.exe 2552 tnhbnb.exe 2208 jddvv.exe 116 xxxlffr.exe 2288 xllfxxr.exe 5040 nhnnhn.exe 1624 jpvvp.exe 2088 7xxfxlf.exe 4148 pvdvv.exe 2748 5btnnn.exe 2460 bnnhbn.exe 4704 fxflfrr.exe 1652 rrlfxrl.exe 3636 httnhh.exe 2464 dpddj.exe 3460 1djjv.exe 1760 rlrrflf.exe 3384 nhttnn.exe 2584 jjpdd.exe 4444 ffrlxfr.exe 2004 bttbbh.exe 4548 1djdd.exe 1404 7frrrrf.exe 2248 nhbhtn.exe 1032 3ppjp.exe 4396 llfrrxx.exe 3376 tnhttb.exe 2608 jdpjp.exe 1040 jdjjd.exe 4904 xrrllll.exe 4760 bbnhbh.exe 4112 jjdpj.exe 4768 frlrlll.exe 2368 nntttn.exe 2520 1jvdv.exe 3612 xxrxxrx.exe 1588 5thbnn.exe 1464 vpdvp.exe 2440 xfxxrxx.exe 4776 hbbnnh.exe 4900 vjvpd.exe 2736 xxxxrrl.exe 3400 thntnt.exe 4200 lffxrrr.exe 2068 ntbnhh.exe 2020 jdjpv.exe 816 nbtbnb.exe 4124 pjjjd.exe 3920 xrxrlrl.exe 3016 rxxlxrr.exe 4800 nhbbnn.exe 1316 hnbtbt.exe 4828 pvppj.exe 4240 xrffflf.exe 220 hnnnnn.exe -
Processes:
resource yara_rule behavioral2/memory/1572-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxfrfr.exe upx behavioral2/memory/1572-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bhbbb.exe upx behavioral2/memory/2176-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdddd.exe upx behavioral2/memory/3644-15-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrlffr.exe upx behavioral2/memory/4996-21-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ntbhnn.exe upx behavioral2/memory/1544-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thhhhh.exe upx behavioral2/memory/1492-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lrllxx.exe upx behavioral2/memory/3916-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbnhhh.exe upx behavioral2/memory/844-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2628-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvdj.exe upx C:\3rrxrrr.exe upx behavioral2/memory/652-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhbnb.exe upx behavioral2/memory/320-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddvv.exe upx C:\xxxlffr.exe upx C:\xllfxxr.exe upx behavioral2/memory/116-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2288-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnnhn.exe upx C:\jpvvp.exe upx behavioral2/memory/1624-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7xxfxlf.exe upx behavioral2/memory/1624-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvdvv.exe upx behavioral2/memory/2088-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5btnnn.exe upx behavioral2/memory/4148-106-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnhbn.exe upx behavioral2/memory/2748-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2460-119-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxflfrr.exe upx C:\rrlfxrl.exe upx behavioral2/memory/1652-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\httnhh.exe upx behavioral2/memory/3636-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpddj.exe upx C:\1djjv.exe upx behavioral2/memory/3460-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrrflf.exe upx C:\nhttnn.exe upx C:\jjpdd.exe upx C:\ffrlxfr.exe upx behavioral2/memory/2584-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4444-169-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bttbbh.exe upx \??\c:\1djdd.exe upx C:\7frrrrf.exe upx behavioral2/memory/2248-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1032-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4396-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2608-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1040-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4904-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2368-223-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ttbbtt.exefrrrrxx.exehntnbb.exerlrrlff.exe7dppv.exetbbhhh.exepdppj.exevjjjd.exetbnttn.exehhbhnt.exepvvpj.exe9bhbbn.exetbbtbt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exexlxfrfr.exe7bhbbb.exejdddd.exerrrlffr.exentbhnn.exethhhhh.exe5lrllxx.exetbnhhh.exevvvdj.exe3rrxrrr.exetnhbnb.exejddvv.exexxxlffr.exexllfxxr.exenhnnhn.exejpvvp.exe7xxfxlf.exepvdvv.exe5btnnn.exebnnhbn.exefxflfrr.exedescription pid process target process PID 1572 wrote to memory of 2176 1572 73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe xlxfrfr.exe PID 1572 wrote to memory of 2176 1572 73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe xlxfrfr.exe PID 1572 wrote to memory of 2176 1572 73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe xlxfrfr.exe PID 2176 wrote to memory of 3644 2176 xlxfrfr.exe 7bhbbb.exe PID 2176 wrote to memory of 3644 2176 xlxfrfr.exe 7bhbbb.exe PID 2176 wrote to memory of 3644 2176 xlxfrfr.exe 7bhbbb.exe PID 3644 wrote to memory of 4996 3644 7bhbbb.exe jdddd.exe PID 3644 wrote to memory of 4996 3644 7bhbbb.exe jdddd.exe PID 3644 wrote to memory of 4996 3644 7bhbbb.exe jdddd.exe PID 4996 wrote to memory of 1544 4996 jdddd.exe rrrlffr.exe PID 4996 wrote to memory of 1544 4996 jdddd.exe rrrlffr.exe PID 4996 wrote to memory of 1544 4996 jdddd.exe rrrlffr.exe PID 1544 wrote to memory of 1492 1544 rrrlffr.exe ntbhnn.exe PID 1544 wrote to memory of 1492 1544 rrrlffr.exe ntbhnn.exe PID 1544 wrote to memory of 1492 1544 rrrlffr.exe ntbhnn.exe PID 1492 wrote to memory of 3916 1492 ntbhnn.exe thhhhh.exe PID 1492 wrote to memory of 3916 1492 ntbhnn.exe thhhhh.exe PID 1492 wrote to memory of 3916 1492 ntbhnn.exe thhhhh.exe PID 3916 wrote to memory of 844 3916 thhhhh.exe 5lrllxx.exe PID 3916 wrote to memory of 844 3916 thhhhh.exe 5lrllxx.exe PID 3916 wrote to memory of 844 3916 thhhhh.exe 5lrllxx.exe PID 844 wrote to memory of 2628 844 5lrllxx.exe tbnhhh.exe PID 844 wrote to memory of 2628 844 5lrllxx.exe tbnhhh.exe PID 844 wrote to memory of 2628 844 5lrllxx.exe tbnhhh.exe PID 2628 wrote to memory of 652 2628 tbnhhh.exe vvvdj.exe PID 2628 wrote to memory of 652 2628 tbnhhh.exe vvvdj.exe PID 2628 wrote to memory of 652 2628 tbnhhh.exe vvvdj.exe PID 652 wrote to memory of 320 652 vvvdj.exe 3rrxrrr.exe PID 652 wrote to memory of 320 652 vvvdj.exe 3rrxrrr.exe PID 652 wrote to memory of 320 652 vvvdj.exe 3rrxrrr.exe PID 320 wrote to memory of 2552 320 3rrxrrr.exe tnhbnb.exe PID 320 wrote to memory of 2552 320 3rrxrrr.exe tnhbnb.exe PID 320 wrote to memory of 2552 320 3rrxrrr.exe tnhbnb.exe PID 2552 wrote to memory of 2208 2552 tnhbnb.exe jddvv.exe PID 2552 wrote to memory of 2208 2552 tnhbnb.exe jddvv.exe PID 2552 wrote to memory of 2208 2552 tnhbnb.exe jddvv.exe PID 2208 wrote to memory of 116 2208 jddvv.exe xxxlffr.exe PID 2208 wrote to memory of 116 2208 jddvv.exe xxxlffr.exe PID 2208 wrote to memory of 116 2208 jddvv.exe xxxlffr.exe PID 116 wrote to memory of 2288 116 xxxlffr.exe xllfxxr.exe PID 116 wrote to memory of 2288 116 xxxlffr.exe xllfxxr.exe PID 116 wrote to memory of 2288 116 xxxlffr.exe xllfxxr.exe PID 2288 wrote to memory of 5040 2288 xllfxxr.exe nhnnhn.exe PID 2288 wrote to memory of 5040 2288 xllfxxr.exe nhnnhn.exe PID 2288 wrote to memory of 5040 2288 xllfxxr.exe nhnnhn.exe PID 5040 wrote to memory of 1624 5040 nhnnhn.exe jpvvp.exe PID 5040 wrote to memory of 1624 5040 nhnnhn.exe jpvvp.exe PID 5040 wrote to memory of 1624 5040 nhnnhn.exe jpvvp.exe PID 1624 wrote to memory of 2088 1624 jpvvp.exe 7xxfxlf.exe PID 1624 wrote to memory of 2088 1624 jpvvp.exe 7xxfxlf.exe PID 1624 wrote to memory of 2088 1624 jpvvp.exe 7xxfxlf.exe PID 2088 wrote to memory of 4148 2088 7xxfxlf.exe pvdvv.exe PID 2088 wrote to memory of 4148 2088 7xxfxlf.exe pvdvv.exe PID 2088 wrote to memory of 4148 2088 7xxfxlf.exe pvdvv.exe PID 4148 wrote to memory of 2748 4148 pvdvv.exe 5btnnn.exe PID 4148 wrote to memory of 2748 4148 pvdvv.exe 5btnnn.exe PID 4148 wrote to memory of 2748 4148 pvdvv.exe 5btnnn.exe PID 2748 wrote to memory of 2460 2748 5btnnn.exe bnnhbn.exe PID 2748 wrote to memory of 2460 2748 5btnnn.exe bnnhbn.exe PID 2748 wrote to memory of 2460 2748 5btnnn.exe bnnhbn.exe PID 2460 wrote to memory of 4704 2460 bnnhbn.exe fxflfrr.exe PID 2460 wrote to memory of 4704 2460 bnnhbn.exe fxflfrr.exe PID 2460 wrote to memory of 4704 2460 bnnhbn.exe fxflfrr.exe PID 4704 wrote to memory of 1652 4704 fxflfrr.exe rrlfxrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe"C:\Users\Admin\AppData\Local\Temp\73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\xlxfrfr.exec:\xlxfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\7bhbbb.exec:\7bhbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\jdddd.exec:\jdddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rrrlffr.exec:\rrrlffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\ntbhnn.exec:\ntbhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\thhhhh.exec:\thhhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\5lrllxx.exec:\5lrllxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\tbnhhh.exec:\tbnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vvvdj.exec:\vvvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\3rrxrrr.exec:\3rrxrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\tnhbnb.exec:\tnhbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\jddvv.exec:\jddvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xxxlffr.exec:\xxxlffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\xllfxxr.exec:\xllfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\nhnnhn.exec:\nhnnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\jpvvp.exec:\jpvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\7xxfxlf.exec:\7xxfxlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\pvdvv.exec:\pvdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\5btnnn.exec:\5btnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\bnnhbn.exec:\bnnhbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\fxflfrr.exec:\fxflfrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe23⤵
- Executes dropped EXE
PID:1652 -
\??\c:\httnhh.exec:\httnhh.exe24⤵
- Executes dropped EXE
PID:3636 -
\??\c:\dpddj.exec:\dpddj.exe25⤵
- Executes dropped EXE
PID:2464 -
\??\c:\1djjv.exec:\1djjv.exe26⤵
- Executes dropped EXE
PID:3460 -
\??\c:\rlrrflf.exec:\rlrrflf.exe27⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nhttnn.exec:\nhttnn.exe28⤵
- Executes dropped EXE
PID:3384 -
\??\c:\jjpdd.exec:\jjpdd.exe29⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ffrlxfr.exec:\ffrlxfr.exe30⤵
- Executes dropped EXE
PID:4444 -
\??\c:\bttbbh.exec:\bttbbh.exe31⤵
- Executes dropped EXE
PID:2004 -
\??\c:\1djdd.exec:\1djdd.exe32⤵
- Executes dropped EXE
PID:4548 -
\??\c:\7frrrrf.exec:\7frrrrf.exe33⤵
- Executes dropped EXE
PID:1404 -
\??\c:\nhbhtn.exec:\nhbhtn.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3ppjp.exec:\3ppjp.exe35⤵
- Executes dropped EXE
PID:1032 -
\??\c:\llfrrxx.exec:\llfrrxx.exe36⤵
- Executes dropped EXE
PID:4396 -
\??\c:\tnhttb.exec:\tnhttb.exe37⤵
- Executes dropped EXE
PID:3376 -
\??\c:\jdpjp.exec:\jdpjp.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jdjjd.exec:\jdjjd.exe39⤵
- Executes dropped EXE
PID:1040 -
\??\c:\xrrllll.exec:\xrrllll.exe40⤵
- Executes dropped EXE
PID:4904 -
\??\c:\bbnhbh.exec:\bbnhbh.exe41⤵
- Executes dropped EXE
PID:4760 -
\??\c:\jjdpj.exec:\jjdpj.exe42⤵
- Executes dropped EXE
PID:4112 -
\??\c:\frlrlll.exec:\frlrlll.exe43⤵
- Executes dropped EXE
PID:4768 -
\??\c:\nntttn.exec:\nntttn.exe44⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1jvdv.exec:\1jvdv.exe45⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xxrxxrx.exec:\xxrxxrx.exe46⤵
- Executes dropped EXE
PID:3612 -
\??\c:\5thbnn.exec:\5thbnn.exe47⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vpdvp.exec:\vpdvp.exe48⤵
- Executes dropped EXE
PID:1464 -
\??\c:\xfxxrxx.exec:\xfxxrxx.exe49⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hbbnnh.exec:\hbbnnh.exe50⤵
- Executes dropped EXE
PID:4776 -
\??\c:\vjvpd.exec:\vjvpd.exe51⤵
- Executes dropped EXE
PID:4900 -
\??\c:\ffrrffr.exec:\ffrrffr.exe52⤵PID:4448
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe53⤵
- Executes dropped EXE
PID:2736 -
\??\c:\thntnt.exec:\thntnt.exe54⤵
- Executes dropped EXE
PID:3400 -
\??\c:\lffxrrr.exec:\lffxrrr.exe55⤵
- Executes dropped EXE
PID:4200 -
\??\c:\ntbnhh.exec:\ntbnhh.exe56⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jdjpv.exec:\jdjpv.exe57⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nbtbnb.exec:\nbtbnb.exe58⤵
- Executes dropped EXE
PID:816 -
\??\c:\pjjjd.exec:\pjjjd.exe59⤵
- Executes dropped EXE
PID:4124 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe60⤵
- Executes dropped EXE
PID:3920 -
\??\c:\rxxlxrr.exec:\rxxlxrr.exe61⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nhbbnn.exec:\nhbbnn.exe62⤵
- Executes dropped EXE
PID:4800 -
\??\c:\hnbtbt.exec:\hnbtbt.exe63⤵
- Executes dropped EXE
PID:1316 -
\??\c:\pvppj.exec:\pvppj.exe64⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xrffflf.exec:\xrffflf.exe65⤵
- Executes dropped EXE
PID:4240 -
\??\c:\hnnnnn.exec:\hnnnnn.exe66⤵
- Executes dropped EXE
PID:220 -
\??\c:\7vjpv.exec:\7vjpv.exe67⤵PID:184
-
\??\c:\rlxxrxf.exec:\rlxxrxf.exe68⤵PID:216
-
\??\c:\llrxrfl.exec:\llrxrfl.exe69⤵PID:2208
-
\??\c:\nhtnhh.exec:\nhtnhh.exe70⤵PID:116
-
\??\c:\djjdd.exec:\djjdd.exe71⤵PID:3260
-
\??\c:\xfllfxx.exec:\xfllfxx.exe72⤵PID:4536
-
\??\c:\ttthbb.exec:\ttthbb.exe73⤵PID:4604
-
\??\c:\dpdvp.exec:\dpdvp.exe74⤵PID:5040
-
\??\c:\ppvvj.exec:\ppvvj.exe75⤵PID:4316
-
\??\c:\llffllf.exec:\llffllf.exe76⤵PID:3372
-
\??\c:\3bhnnt.exec:\3bhnnt.exe77⤵PID:1688
-
\??\c:\tbnnnb.exec:\tbnnnb.exe78⤵PID:2828
-
\??\c:\vvppd.exec:\vvppd.exe79⤵PID:1920
-
\??\c:\lrffxfl.exec:\lrffxfl.exe80⤵PID:4216
-
\??\c:\frxxxxx.exec:\frxxxxx.exe81⤵PID:1936
-
\??\c:\1tbbnt.exec:\1tbbnt.exe82⤵PID:1984
-
\??\c:\djdvd.exec:\djdvd.exe83⤵PID:3580
-
\??\c:\5rflfrr.exec:\5rflfrr.exe84⤵PID:2512
-
\??\c:\bbtnbb.exec:\bbtnbb.exe85⤵PID:4460
-
\??\c:\ttttnb.exec:\ttttnb.exe86⤵PID:3040
-
\??\c:\ppdjv.exec:\ppdjv.exe87⤵PID:564
-
\??\c:\rxrrffx.exec:\rxrrffx.exe88⤵PID:4032
-
\??\c:\httbtn.exec:\httbtn.exe89⤵PID:4784
-
\??\c:\jjjdj.exec:\jjjdj.exe90⤵PID:4808
-
\??\c:\xflxfrr.exec:\xflxfrr.exe91⤵PID:2316
-
\??\c:\hhbhbh.exec:\hhbhbh.exe92⤵PID:3256
-
\??\c:\nhhnnt.exec:\nhhnnt.exe93⤵PID:948
-
\??\c:\hhnnbh.exec:\hhnnbh.exe94⤵PID:2576
-
\??\c:\3frrrxx.exec:\3frrrxx.exe95⤵PID:1716
-
\??\c:\bbbhhh.exec:\bbbhhh.exe96⤵PID:1792
-
\??\c:\tnbttb.exec:\tnbttb.exe97⤵PID:4880
-
\??\c:\jjpvv.exec:\jjpvv.exe98⤵PID:1940
-
\??\c:\jppvv.exec:\jppvv.exe99⤵PID:1608
-
\??\c:\7xxrrrl.exec:\7xxrrrl.exe100⤵PID:3408
-
\??\c:\htnhbb.exec:\htnhbb.exe101⤵PID:3948
-
\??\c:\ttthbh.exec:\ttthbh.exe102⤵PID:2024
-
\??\c:\djjdp.exec:\djjdp.exe103⤵PID:4084
-
\??\c:\lrxrxxx.exec:\lrxrxxx.exe104⤵PID:4112
-
\??\c:\xrlfxlx.exec:\xrlfxlx.exe105⤵PID:3392
-
\??\c:\nnnnhb.exec:\nnnnhb.exe106⤵PID:3128
-
\??\c:\jjpdd.exec:\jjpdd.exe107⤵PID:4528
-
\??\c:\9lrrrfx.exec:\9lrrrfx.exe108⤵PID:368
-
\??\c:\xlrrfrl.exec:\xlrrfrl.exe109⤵PID:5020
-
\??\c:\ttbhhn.exec:\ttbhhn.exe110⤵PID:4588
-
\??\c:\thtttt.exec:\thtttt.exe111⤵PID:2016
-
\??\c:\ddpjp.exec:\ddpjp.exe112⤵PID:4448
-
\??\c:\3lrrfrl.exec:\3lrrfrl.exe113⤵PID:3400
-
\??\c:\xflxfrf.exec:\xflxfrf.exe114⤵PID:1320
-
\??\c:\httnnn.exec:\httnnn.exe115⤵PID:4976
-
\??\c:\7jppd.exec:\7jppd.exe116⤵PID:1820
-
\??\c:\pvddv.exec:\pvddv.exe117⤵PID:3616
-
\??\c:\rllllll.exec:\rllllll.exe118⤵PID:4312
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe119⤵PID:2196
-
\??\c:\bbbhhn.exec:\bbbhhn.exe120⤵PID:3716
-
\??\c:\tthhhh.exec:\tthhhh.exe121⤵PID:2912
-
\??\c:\9jvvp.exec:\9jvvp.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-