Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 18:37
Behavioral task
behavioral1
Sample
16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe
-
Size
332KB
-
MD5
4b02ea9cc214e3ed7f37638b15b47cc0
-
SHA1
13c53723b273e70abceced1f509a3c99d820f932
-
SHA256
16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550
-
SHA512
478509377ce0297c15efe8b2b78621a5f028792609c9ea2a12a00945c400b497609c3457d8ea72a38a1ecd3ff0b6d1e4e66d59c82ab96f859dbdd17eb24c771b
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbew/:R4wFHoSHYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3336-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1080-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1964-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/672-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/348-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1348-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/712-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-616-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-621-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-651-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2796 frxlllf.exe 316 tthnht.exe 3948 1djvp.exe 3900 3rxxrrl.exe 3624 thbthh.exe 4672 djvpj.exe 2944 fxlfxrf.exe 4300 jddvp.exe 2360 lxlffxr.exe 3472 vvjjv.exe 1080 7flfffx.exe 1964 nhhnhh.exe 3476 frflxxf.exe 672 btnhtb.exe 464 vppvp.exe 4400 lxffllf.exe 1616 5nbtbb.exe 348 3rfxrxr.exe 4936 tntnhb.exe 1660 jddvj.exe 3300 tbbtnn.exe 8 jdjvj.exe 1220 9xxlxrx.exe 1348 ntbbtn.exe 4152 bbhbbb.exe 2192 dppjj.exe 2728 tbnhtt.exe 1712 tnhbnb.exe 624 vpvpv.exe 1068 5lfxrrr.exe 4180 hntnbb.exe 2088 dddvp.exe 4200 1xxxlfx.exe 3828 bhthtn.exe 768 ddvvp.exe 3172 1rxxrrl.exe 5052 7lfxfxf.exe 1184 5btntt.exe 3952 pjjpd.exe 1132 xrrlxxr.exe 4540 5xfxrlf.exe 5012 nhnhnn.exe 3412 bnthhh.exe 3748 jdddv.exe 2496 frrrffx.exe 4044 xlrlllr.exe 3488 ttttnt.exe 4252 bhttnh.exe 2900 pppvp.exe 2596 xxfxrll.exe 864 7tbnhb.exe 228 9btnhh.exe 4904 dpvpd.exe 4864 lfrrrrr.exe 640 lrxrrll.exe 1448 1btntt.exe 2892 5djdv.exe 3868 lrxlffx.exe 728 7nnhbb.exe 3136 hhhbnn.exe 1664 9vpjv.exe 4552 5vdvv.exe 3948 fxfxxrr.exe 3448 7bhbhh.exe -
resource yara_rule behavioral2/memory/3336-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b5a-3.dat upx behavioral2/memory/3336-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023c33-8.dat upx behavioral2/memory/316-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c45-11.dat upx behavioral2/memory/2796-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c46-18.dat upx behavioral2/memory/3948-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3900-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c47-23.dat upx behavioral2/files/0x0008000000023c48-27.dat upx behavioral2/memory/3624-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c49-33.dat upx behavioral2/memory/4672-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2944-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c4a-38.dat upx behavioral2/files/0x0008000000023c4b-43.dat upx behavioral2/memory/4300-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c4d-49.dat upx behavioral2/files/0x0007000000023c56-52.dat upx behavioral2/memory/1080-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c57-57.dat upx behavioral2/files/0x0007000000023c58-61.dat upx behavioral2/memory/1964-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c59-68.dat upx behavioral2/memory/3476-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/672-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c5a-71.dat upx behavioral2/memory/464-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c5b-76.dat upx behavioral2/files/0x0007000000023c5c-81.dat upx behavioral2/memory/4400-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c5d-86.dat upx behavioral2/memory/1616-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023c37-92.dat upx behavioral2/memory/348-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c5e-97.dat upx behavioral2/memory/4936-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c5f-101.dat upx behavioral2/files/0x0007000000023c60-105.dat upx behavioral2/files/0x0007000000023c61-109.dat upx behavioral2/memory/8-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c62-114.dat upx behavioral2/memory/1348-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c63-119.dat upx behavioral2/files/0x0007000000023c64-123.dat upx behavioral2/memory/4152-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c65-128.dat upx behavioral2/memory/2192-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c66-135.dat upx behavioral2/memory/2728-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c68-138.dat upx behavioral2/files/0x0007000000023c69-142.dat upx behavioral2/files/0x0007000000023c6a-146.dat upx behavioral2/memory/4180-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1068-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c6b-152.dat upx behavioral2/memory/2088-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3828-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/768-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3172-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5052-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1132-177-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3336 wrote to memory of 2796 3336 16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe 83 PID 3336 wrote to memory of 2796 3336 16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe 83 PID 3336 wrote to memory of 2796 3336 16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe 83 PID 2796 wrote to memory of 316 2796 frxlllf.exe 84 PID 2796 wrote to memory of 316 2796 frxlllf.exe 84 PID 2796 wrote to memory of 316 2796 frxlllf.exe 84 PID 316 wrote to memory of 3948 316 tthnht.exe 85 PID 316 wrote to memory of 3948 316 tthnht.exe 85 PID 316 wrote to memory of 3948 316 tthnht.exe 85 PID 3948 wrote to memory of 3900 3948 1djvp.exe 86 PID 3948 wrote to memory of 3900 3948 1djvp.exe 86 PID 3948 wrote to memory of 3900 3948 1djvp.exe 86 PID 3900 wrote to memory of 3624 3900 3rxxrrl.exe 87 PID 3900 wrote to memory of 3624 3900 3rxxrrl.exe 87 PID 3900 wrote to memory of 3624 3900 3rxxrrl.exe 87 PID 3624 wrote to memory of 4672 3624 thbthh.exe 88 PID 3624 wrote to memory of 4672 3624 thbthh.exe 88 PID 3624 wrote to memory of 4672 3624 thbthh.exe 88 PID 4672 wrote to memory of 2944 4672 djvpj.exe 89 PID 4672 wrote to memory of 2944 4672 djvpj.exe 89 PID 4672 wrote to memory of 2944 4672 djvpj.exe 89 PID 2944 wrote to memory of 4300 2944 fxlfxrf.exe 90 PID 2944 wrote to memory of 4300 2944 fxlfxrf.exe 90 PID 2944 wrote to memory of 4300 2944 fxlfxrf.exe 90 PID 4300 wrote to memory of 2360 4300 jddvp.exe 91 PID 4300 wrote to memory of 2360 4300 jddvp.exe 91 PID 4300 wrote to memory of 2360 4300 jddvp.exe 91 PID 2360 wrote to memory of 3472 2360 lxlffxr.exe 92 PID 2360 wrote to memory of 3472 2360 lxlffxr.exe 92 PID 2360 wrote to memory of 3472 2360 lxlffxr.exe 92 PID 3472 wrote to memory of 1080 3472 vvjjv.exe 93 PID 3472 wrote to memory of 1080 3472 vvjjv.exe 93 PID 3472 wrote to memory of 1080 3472 vvjjv.exe 93 PID 1080 wrote to memory of 1964 1080 7flfffx.exe 94 PID 1080 wrote to memory of 1964 1080 7flfffx.exe 94 PID 1080 wrote to memory of 1964 1080 7flfffx.exe 94 PID 1964 wrote to memory of 3476 1964 nhhnhh.exe 95 PID 1964 wrote to memory of 3476 1964 nhhnhh.exe 95 PID 1964 wrote to memory of 3476 1964 nhhnhh.exe 95 PID 3476 wrote to memory of 672 3476 frflxxf.exe 96 PID 3476 wrote to memory of 672 3476 frflxxf.exe 96 PID 3476 wrote to memory of 672 3476 frflxxf.exe 96 PID 672 wrote to memory of 464 672 btnhtb.exe 97 PID 672 wrote to memory of 464 672 btnhtb.exe 97 PID 672 wrote to memory of 464 672 btnhtb.exe 97 PID 464 wrote to memory of 4400 464 vppvp.exe 98 PID 464 wrote to memory of 4400 464 vppvp.exe 98 PID 464 wrote to memory of 4400 464 vppvp.exe 98 PID 4400 wrote to memory of 1616 4400 lxffllf.exe 99 PID 4400 wrote to memory of 1616 4400 lxffllf.exe 99 PID 4400 wrote to memory of 1616 4400 lxffllf.exe 99 PID 1616 wrote to memory of 348 1616 5nbtbb.exe 100 PID 1616 wrote to memory of 348 1616 5nbtbb.exe 100 PID 1616 wrote to memory of 348 1616 5nbtbb.exe 100 PID 348 wrote to memory of 4936 348 3rfxrxr.exe 101 PID 348 wrote to memory of 4936 348 3rfxrxr.exe 101 PID 348 wrote to memory of 4936 348 3rfxrxr.exe 101 PID 4936 wrote to memory of 1660 4936 tntnhb.exe 102 PID 4936 wrote to memory of 1660 4936 tntnhb.exe 102 PID 4936 wrote to memory of 1660 4936 tntnhb.exe 102 PID 1660 wrote to memory of 3300 1660 jddvj.exe 103 PID 1660 wrote to memory of 3300 1660 jddvj.exe 103 PID 1660 wrote to memory of 3300 1660 jddvj.exe 103 PID 3300 wrote to memory of 8 3300 tbbtnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe"C:\Users\Admin\AppData\Local\Temp\16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\frxlllf.exec:\frxlllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\tthnht.exec:\tthnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\1djvp.exec:\1djvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\3rxxrrl.exec:\3rxxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\thbthh.exec:\thbthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\djvpj.exec:\djvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\fxlfxrf.exec:\fxlfxrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jddvp.exec:\jddvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\lxlffxr.exec:\lxlffxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\vvjjv.exec:\vvjjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\7flfffx.exec:\7flfffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\nhhnhh.exec:\nhhnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\frflxxf.exec:\frflxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\btnhtb.exec:\btnhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\vppvp.exec:\vppvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\lxffllf.exec:\lxffllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\5nbtbb.exec:\5nbtbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\3rfxrxr.exec:\3rfxrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\tntnhb.exec:\tntnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\jddvj.exec:\jddvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\tbbtnn.exec:\tbbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\jdjvj.exec:\jdjvj.exe23⤵
- Executes dropped EXE
PID:8 -
\??\c:\9xxlxrx.exec:\9xxlxrx.exe24⤵
- Executes dropped EXE
PID:1220 -
\??\c:\ntbbtn.exec:\ntbbtn.exe25⤵
- Executes dropped EXE
PID:1348 -
\??\c:\bbhbbb.exec:\bbhbbb.exe26⤵
- Executes dropped EXE
PID:4152 -
\??\c:\dppjj.exec:\dppjj.exe27⤵
- Executes dropped EXE
PID:2192 -
\??\c:\tbnhtt.exec:\tbnhtt.exe28⤵
- Executes dropped EXE
PID:2728 -
\??\c:\tnhbnb.exec:\tnhbnb.exe29⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vpvpv.exec:\vpvpv.exe30⤵
- Executes dropped EXE
PID:624 -
\??\c:\5lfxrrr.exec:\5lfxrrr.exe31⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hntnbb.exec:\hntnbb.exe32⤵
- Executes dropped EXE
PID:4180 -
\??\c:\dddvp.exec:\dddvp.exe33⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1xxxlfx.exec:\1xxxlfx.exe34⤵
- Executes dropped EXE
PID:4200 -
\??\c:\bhthtn.exec:\bhthtn.exe35⤵
- Executes dropped EXE
PID:3828 -
\??\c:\ddvvp.exec:\ddvvp.exe36⤵
- Executes dropped EXE
PID:768 -
\??\c:\1rxxrrl.exec:\1rxxrrl.exe37⤵
- Executes dropped EXE
PID:3172 -
\??\c:\7lfxfxf.exec:\7lfxfxf.exe38⤵
- Executes dropped EXE
PID:5052 -
\??\c:\5btntt.exec:\5btntt.exe39⤵
- Executes dropped EXE
PID:1184 -
\??\c:\pjjpd.exec:\pjjpd.exe40⤵
- Executes dropped EXE
PID:3952 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe41⤵
- Executes dropped EXE
PID:1132 -
\??\c:\5xfxrlf.exec:\5xfxrlf.exe42⤵
- Executes dropped EXE
PID:4540 -
\??\c:\nhnhnn.exec:\nhnhnn.exe43⤵
- Executes dropped EXE
PID:5012 -
\??\c:\bnthhh.exec:\bnthhh.exe44⤵
- Executes dropped EXE
PID:3412 -
\??\c:\jdddv.exec:\jdddv.exe45⤵
- Executes dropped EXE
PID:3748 -
\??\c:\frrrffx.exec:\frrrffx.exe46⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xlrlllr.exec:\xlrlllr.exe47⤵
- Executes dropped EXE
PID:4044 -
\??\c:\ttttnt.exec:\ttttnt.exe48⤵
- Executes dropped EXE
PID:3488 -
\??\c:\bhttnh.exec:\bhttnh.exe49⤵
- Executes dropped EXE
PID:4252 -
\??\c:\pppvp.exec:\pppvp.exe50⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xxfxrll.exec:\xxfxrll.exe51⤵
- Executes dropped EXE
PID:2596 -
\??\c:\7tbnhb.exec:\7tbnhb.exe52⤵
- Executes dropped EXE
PID:864 -
\??\c:\9btnhh.exec:\9btnhh.exe53⤵
- Executes dropped EXE
PID:228 -
\??\c:\dpvpd.exec:\dpvpd.exe54⤵
- Executes dropped EXE
PID:4904 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe55⤵
- Executes dropped EXE
PID:4864 -
\??\c:\lrxrrll.exec:\lrxrrll.exe56⤵
- Executes dropped EXE
PID:640 -
\??\c:\1btntt.exec:\1btntt.exe57⤵
- Executes dropped EXE
PID:1448 -
\??\c:\5djdv.exec:\5djdv.exe58⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lrxlffx.exec:\lrxlffx.exe59⤵
- Executes dropped EXE
PID:3868 -
\??\c:\7nnhbb.exec:\7nnhbb.exe60⤵
- Executes dropped EXE
PID:728 -
\??\c:\hhhbnn.exec:\hhhbnn.exe61⤵
- Executes dropped EXE
PID:3136 -
\??\c:\9vpjv.exec:\9vpjv.exe62⤵
- Executes dropped EXE
PID:1664 -
\??\c:\5vdvv.exec:\5vdvv.exe63⤵
- Executes dropped EXE
PID:4552 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe64⤵
- Executes dropped EXE
PID:3948 -
\??\c:\7bhbhh.exec:\7bhbhh.exe65⤵
- Executes dropped EXE
PID:3448 -
\??\c:\bnnhbb.exec:\bnnhbb.exe66⤵PID:3900
-
\??\c:\dpvvj.exec:\dpvvj.exe67⤵PID:2940
-
\??\c:\hnhbtt.exec:\hnhbtt.exe68⤵PID:2000
-
\??\c:\bntnhb.exec:\bntnhb.exe69⤵PID:3512
-
\??\c:\1jvpp.exec:\1jvpp.exe70⤵PID:2576
-
\??\c:\pdjvj.exec:\pdjvj.exe71⤵PID:1020
-
\??\c:\1lllffx.exec:\1lllffx.exe72⤵PID:2928
-
\??\c:\3hbhbb.exec:\3hbhbb.exe73⤵PID:4908
-
\??\c:\9djdd.exec:\9djdd.exe74⤵PID:3596
-
\??\c:\9jjjv.exec:\9jjjv.exe75⤵
- System Location Discovery: System Language Discovery
PID:964 -
\??\c:\lxfllll.exec:\lxfllll.exe76⤵PID:4968
-
\??\c:\7fffffx.exec:\7fffffx.exe77⤵PID:1764
-
\??\c:\3thhnn.exec:\3thhnn.exe78⤵PID:3476
-
\??\c:\3pvjp.exec:\3pvjp.exe79⤵PID:4928
-
\??\c:\1ddpj.exec:\1ddpj.exe80⤵PID:3088
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe81⤵PID:464
-
\??\c:\xlfxffl.exec:\xlfxffl.exe82⤵PID:2660
-
\??\c:\tnnhbb.exec:\tnnhbb.exe83⤵PID:3068
-
\??\c:\jdddj.exec:\jdddj.exe84⤵PID:4932
-
\??\c:\dddvd.exec:\dddvd.exe85⤵PID:3764
-
\??\c:\5lxrrrl.exec:\5lxrrrl.exe86⤵PID:4608
-
\??\c:\nhhhbb.exec:\nhhhbb.exe87⤵PID:4616
-
\??\c:\1ppdp.exec:\1ppdp.exe88⤵PID:1500
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe89⤵PID:2628
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe90⤵PID:1324
-
\??\c:\nhnnnn.exec:\nhnnnn.exe91⤵PID:4748
-
\??\c:\9hnhnt.exec:\9hnhnt.exe92⤵PID:436
-
\??\c:\3ppjd.exec:\3ppjd.exe93⤵PID:712
-
\??\c:\llffrrr.exec:\llffrrr.exe94⤵PID:2188
-
\??\c:\llxrxxx.exec:\llxrxxx.exe95⤵PID:1816
-
\??\c:\nnnhbh.exec:\nnnhbh.exe96⤵PID:2612
-
\??\c:\vppjv.exec:\vppjv.exe97⤵PID:4896
-
\??\c:\jjjdp.exec:\jjjdp.exe98⤵PID:3356
-
\??\c:\lrrlxxl.exec:\lrrlxxl.exe99⤵PID:2988
-
\??\c:\htbttn.exec:\htbttn.exe100⤵PID:1712
-
\??\c:\5hbttt.exec:\5hbttt.exe101⤵PID:4416
-
\??\c:\dppjd.exec:\dppjd.exe102⤵PID:1872
-
\??\c:\3lfxrrl.exec:\3lfxrrl.exe103⤵PID:696
-
\??\c:\nhbtnh.exec:\nhbtnh.exe104⤵PID:3284
-
\??\c:\bnnnnn.exec:\bnnnnn.exe105⤵PID:4776
-
\??\c:\pjpjp.exec:\pjpjp.exe106⤵PID:2380
-
\??\c:\9xxrrrl.exec:\9xxrrrl.exe107⤵PID:4200
-
\??\c:\5fllfff.exec:\5fllfff.exe108⤵PID:4708
-
\??\c:\9ttnnn.exec:\9ttnnn.exe109⤵PID:3828
-
\??\c:\tbbbtt.exec:\tbbbtt.exe110⤵PID:768
-
\??\c:\llrllfl.exec:\llrllfl.exe111⤵PID:3172
-
\??\c:\lflfllf.exec:\lflfllf.exe112⤵PID:5052
-
\??\c:\nnhnhn.exec:\nnhnhn.exe113⤵PID:400
-
\??\c:\nhhhtt.exec:\nhhhtt.exe114⤵PID:3576
-
\??\c:\9djvj.exec:\9djvj.exe115⤵PID:1540
-
\??\c:\xllfxrr.exec:\xllfxrr.exe116⤵PID:3944
-
\??\c:\rxlrllf.exec:\rxlrllf.exe117⤵PID:4508
-
\??\c:\7nnnhb.exec:\7nnnhb.exe118⤵PID:3748
-
\??\c:\5pdvj.exec:\5pdvj.exe119⤵
- System Location Discovery: System Language Discovery
PID:1176 -
\??\c:\3rxxlfx.exec:\3rxxlfx.exe120⤵PID:2788
-
\??\c:\fxllffx.exec:\fxllffx.exe121⤵PID:3488
-
\??\c:\3bttnn.exec:\3bttnn.exe122⤵PID:5020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-