Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2024, 01:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91fc09b286409c8dc6121094f926bfb0050334371e07afcf165c9e63521ed2b3.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
91fc09b286409c8dc6121094f926bfb0050334371e07afcf165c9e63521ed2b3.exe
-
Size
453KB
-
MD5
4fbda3e8226948b2d6806b186764b2d8
-
SHA1
336903eec00feeeb7baa1aa948655732f098e935
-
SHA256
91fc09b286409c8dc6121094f926bfb0050334371e07afcf165c9e63521ed2b3
-
SHA512
243a27c72485f324a1936898ae4eeb14c916a3f66cb2e741e60b4b4b69ff159235717b5665e8fc2ee691a17d9be27a0465ed86de35c47053dd48185fd28f2bf9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2112-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/608-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-740-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-960-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-1015-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-1150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-1238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-1260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-1270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-1373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3040 lfxxrll.exe 1932 lxxrrxr.exe 3884 tthhnb.exe 4104 hnhhhh.exe 3920 rrrfrrl.exe 116 dvvpp.exe 1528 rllllrl.exe 4212 xfffllr.exe 1992 nnnhhh.exe 808 jdpvv.exe 4792 tnnhhh.exe 3908 7vdvp.exe 1756 nhhhtb.exe 1564 dpppv.exe 1296 tbbtnn.exe 4540 tbnthn.exe 1792 xfxffff.exe 3928 ntbbnn.exe 220 pvpjd.exe 3020 bnbtnn.exe 2168 ppvvv.exe 3140 3tthhh.exe 2448 jpvdp.exe 2524 thbbbt.exe 2128 nnthbb.exe 4152 hnthhb.exe 3392 tnnhnb.exe 464 3vdvp.exe 3664 9tnnnt.exe 1888 rfflrrr.exe 1100 vpjdp.exe 4924 flrflfx.exe 4912 jvjdj.exe 5032 lllrrxf.exe 3064 bhhhbn.exe 4128 vdpdj.exe 4256 nntntn.exe 1692 1jpdj.exe 3432 rrlxllr.exe 3700 httbtb.exe 1328 pvddj.exe 3828 btthbt.exe 872 ddppp.exe 4028 rlfxrlf.exe 2308 7bnhbt.exe 5012 pjjvp.exe 2100 1lrlrxr.exe 3820 nbhbtt.exe 1336 jpvvd.exe 4364 lrlfxrr.exe 1396 hhhnhn.exe 1332 xrxxrxx.exe 2264 pvjdv.exe 2468 xlrlllf.exe 3980 tnnbtt.exe 1400 thbttt.exe 1688 ppjdv.exe 1664 xrxxrxr.exe 2732 tthbbh.exe 4064 1vvpj.exe 4332 rrfxxrr.exe 4900 hbhbtt.exe 3316 dvvjj.exe 608 vdvpp.exe -
resource yara_rule behavioral2/memory/2112-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/608-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-769-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 3040 2112 91fc09b286409c8dc6121094f926bfb0050334371e07afcf165c9e63521ed2b3.exe 83 PID 2112 wrote to memory of 3040 2112 91fc09b286409c8dc6121094f926bfb0050334371e07afcf165c9e63521ed2b3.exe 83 PID 2112 wrote to memory of 3040 2112 91fc09b286409c8dc6121094f926bfb0050334371e07afcf165c9e63521ed2b3.exe 83 PID 3040 wrote to memory of 1932 3040 lfxxrll.exe 84 PID 3040 wrote to memory of 1932 3040 lfxxrll.exe 84 PID 3040 wrote to memory of 1932 3040 lfxxrll.exe 84 PID 1932 wrote to memory of 3884 1932 lxxrrxr.exe 85 PID 1932 wrote to memory of 3884 1932 lxxrrxr.exe 85 PID 1932 wrote to memory of 3884 1932 lxxrrxr.exe 85 PID 3884 wrote to memory of 4104 3884 tthhnb.exe 86 PID 3884 wrote to memory of 4104 3884 tthhnb.exe 86 PID 3884 wrote to memory of 4104 3884 tthhnb.exe 86 PID 4104 wrote to memory of 3920 4104 hnhhhh.exe 87 PID 4104 wrote to memory of 3920 4104 hnhhhh.exe 87 PID 4104 wrote to memory of 3920 4104 hnhhhh.exe 87 PID 3920 wrote to memory of 116 3920 rrrfrrl.exe 88 PID 3920 wrote to memory of 116 3920 rrrfrrl.exe 88 PID 3920 wrote to memory of 116 3920 rrrfrrl.exe 88 PID 116 wrote to memory of 1528 116 dvvpp.exe 89 PID 116 wrote to memory of 1528 116 dvvpp.exe 89 PID 116 wrote to memory of 1528 116 dvvpp.exe 89 PID 1528 wrote to memory of 4212 1528 rllllrl.exe 90 PID 1528 wrote to memory of 4212 1528 rllllrl.exe 90 PID 1528 wrote to memory of 4212 1528 rllllrl.exe 90 PID 4212 wrote to memory of 1992 4212 xfffllr.exe 91 PID 4212 wrote to memory of 1992 4212 xfffllr.exe 91 PID 4212 wrote to memory of 1992 4212 xfffllr.exe 91 PID 1992 wrote to memory of 808 1992 nnnhhh.exe 92 PID 1992 wrote to memory of 808 1992 nnnhhh.exe 92 PID 1992 wrote to memory of 808 1992 nnnhhh.exe 92 PID 808 wrote to memory of 4792 808 jdpvv.exe 93 PID 808 wrote to memory of 4792 808 jdpvv.exe 93 PID 808 wrote to memory of 4792 808 jdpvv.exe 93 PID 4792 wrote to memory of 3908 4792 tnnhhh.exe 94 PID 4792 wrote to memory of 3908 4792 tnnhhh.exe 94 PID 4792 wrote to memory of 3908 4792 tnnhhh.exe 94 PID 3908 wrote to memory of 1756 3908 7vdvp.exe 95 PID 3908 wrote to memory of 1756 3908 7vdvp.exe 95 PID 3908 wrote to memory of 1756 3908 7vdvp.exe 95 PID 1756 wrote to memory of 1564 1756 nhhhtb.exe 96 PID 1756 wrote to memory of 1564 1756 nhhhtb.exe 96 PID 1756 wrote to memory of 1564 1756 nhhhtb.exe 96 PID 1564 wrote to memory of 1296 1564 dpppv.exe 97 PID 1564 wrote to memory of 1296 1564 dpppv.exe 97 PID 1564 wrote to memory of 1296 1564 dpppv.exe 97 PID 1296 wrote to memory of 4540 1296 tbbtnn.exe 98 PID 1296 wrote to memory of 4540 1296 tbbtnn.exe 98 PID 1296 wrote to memory of 4540 1296 tbbtnn.exe 98 PID 4540 wrote to memory of 1792 4540 tbnthn.exe 99 PID 4540 wrote to memory of 1792 4540 tbnthn.exe 99 PID 4540 wrote to memory of 1792 4540 tbnthn.exe 99 PID 1792 wrote to memory of 3928 1792 xfxffff.exe 100 PID 1792 wrote to memory of 3928 1792 xfxffff.exe 100 PID 1792 wrote to memory of 3928 1792 xfxffff.exe 100 PID 3928 wrote to memory of 220 3928 ntbbnn.exe 101 PID 3928 wrote to memory of 220 3928 ntbbnn.exe 101 PID 3928 wrote to memory of 220 3928 ntbbnn.exe 101 PID 220 wrote to memory of 3020 220 pvpjd.exe 102 PID 220 wrote to memory of 3020 220 pvpjd.exe 102 PID 220 wrote to memory of 3020 220 pvpjd.exe 102 PID 3020 wrote to memory of 2168 3020 bnbtnn.exe 103 PID 3020 wrote to memory of 2168 3020 bnbtnn.exe 103 PID 3020 wrote to memory of 2168 3020 bnbtnn.exe 103 PID 2168 wrote to memory of 3140 2168 ppvvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\91fc09b286409c8dc6121094f926bfb0050334371e07afcf165c9e63521ed2b3.exe"C:\Users\Admin\AppData\Local\Temp\91fc09b286409c8dc6121094f926bfb0050334371e07afcf165c9e63521ed2b3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\lfxxrll.exec:\lfxxrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\lxxrrxr.exec:\lxxrrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\tthhnb.exec:\tthhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\hnhhhh.exec:\hnhhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\rrrfrrl.exec:\rrrfrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\dvvpp.exec:\dvvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rllllrl.exec:\rllllrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xfffllr.exec:\xfffllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\nnnhhh.exec:\nnnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\jdpvv.exec:\jdpvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\tnnhhh.exec:\tnnhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\7vdvp.exec:\7vdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\nhhhtb.exec:\nhhhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\dpppv.exec:\dpppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\tbbtnn.exec:\tbbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\tbnthn.exec:\tbnthn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\xfxffff.exec:\xfxffff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\ntbbnn.exec:\ntbbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\pvpjd.exec:\pvpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\bnbtnn.exec:\bnbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\ppvvv.exec:\ppvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\3tthhh.exec:\3tthhh.exe23⤵
- Executes dropped EXE
PID:3140 -
\??\c:\jpvdp.exec:\jpvdp.exe24⤵
- Executes dropped EXE
PID:2448 -
\??\c:\thbbbt.exec:\thbbbt.exe25⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nnthbb.exec:\nnthbb.exe26⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hnthhb.exec:\hnthhb.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4152 -
\??\c:\tnnhnb.exec:\tnnhnb.exe28⤵
- Executes dropped EXE
PID:3392 -
\??\c:\3vdvp.exec:\3vdvp.exe29⤵
- Executes dropped EXE
PID:464 -
\??\c:\9tnnnt.exec:\9tnnnt.exe30⤵
- Executes dropped EXE
PID:3664 -
\??\c:\rfflrrr.exec:\rfflrrr.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vpjdp.exec:\vpjdp.exe32⤵
- Executes dropped EXE
PID:1100 -
\??\c:\flrflfx.exec:\flrflfx.exe33⤵
- Executes dropped EXE
PID:4924 -
\??\c:\jvjdj.exec:\jvjdj.exe34⤵
- Executes dropped EXE
PID:4912 -
\??\c:\lllrrxf.exec:\lllrrxf.exe35⤵
- Executes dropped EXE
PID:5032 -
\??\c:\bhhhbn.exec:\bhhhbn.exe36⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vdpdj.exec:\vdpdj.exe37⤵
- Executes dropped EXE
PID:4128 -
\??\c:\nntntn.exec:\nntntn.exe38⤵
- Executes dropped EXE
PID:4256 -
\??\c:\1jpdj.exec:\1jpdj.exe39⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rrlxllr.exec:\rrlxllr.exe40⤵
- Executes dropped EXE
PID:3432 -
\??\c:\httbtb.exec:\httbtb.exe41⤵
- Executes dropped EXE
PID:3700 -
\??\c:\pvddj.exec:\pvddj.exe42⤵
- Executes dropped EXE
PID:1328 -
\??\c:\btthbt.exec:\btthbt.exe43⤵
- Executes dropped EXE
PID:3828 -
\??\c:\ddppp.exec:\ddppp.exe44⤵
- Executes dropped EXE
PID:872 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe45⤵
- Executes dropped EXE
PID:4028 -
\??\c:\7bnhbt.exec:\7bnhbt.exe46⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pjjvp.exec:\pjjvp.exe47⤵
- Executes dropped EXE
PID:5012 -
\??\c:\1lrlrxr.exec:\1lrlrxr.exe48⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nbhbtt.exec:\nbhbtt.exe49⤵
- Executes dropped EXE
PID:3820 -
\??\c:\jpvvd.exec:\jpvvd.exe50⤵
- Executes dropped EXE
PID:1336 -
\??\c:\lrlfxrr.exec:\lrlfxrr.exe51⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hhhnhn.exec:\hhhnhn.exe52⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe53⤵
- Executes dropped EXE
PID:1332 -
\??\c:\pvjdv.exec:\pvjdv.exe54⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xlrlllf.exec:\xlrlllf.exe55⤵
- Executes dropped EXE
PID:2468 -
\??\c:\tnnbtt.exec:\tnnbtt.exe56⤵
- Executes dropped EXE
PID:3980 -
\??\c:\thbttt.exec:\thbttt.exe57⤵
- Executes dropped EXE
PID:1400 -
\??\c:\ppjdv.exec:\ppjdv.exe58⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe59⤵
- Executes dropped EXE
PID:1664 -
\??\c:\tthbbh.exec:\tthbbh.exe60⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1vvpj.exec:\1vvpj.exe61⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rrfxxrr.exec:\rrfxxrr.exe62⤵
- Executes dropped EXE
PID:4332 -
\??\c:\hbhbtt.exec:\hbhbtt.exe63⤵
- Executes dropped EXE
PID:4900 -
\??\c:\dvvjj.exec:\dvvjj.exe64⤵
- Executes dropped EXE
PID:3316 -
\??\c:\vdvpp.exec:\vdvpp.exe65⤵
- Executes dropped EXE
PID:608 -
\??\c:\xrrlfff.exec:\xrrlfff.exe66⤵
- System Location Discovery: System Language Discovery
PID:4884 -
\??\c:\3hnnht.exec:\3hnnht.exe67⤵PID:2176
-
\??\c:\vdvpj.exec:\vdvpj.exe68⤵PID:2116
-
\??\c:\fflfrrf.exec:\fflfrrf.exe69⤵PID:1500
-
\??\c:\nhhtnn.exec:\nhhtnn.exe70⤵PID:1756
-
\??\c:\dppjd.exec:\dppjd.exe71⤵PID:3416
-
\??\c:\5fllrrx.exec:\5fllrrx.exe72⤵PID:2780
-
\??\c:\nntbhn.exec:\nntbhn.exe73⤵PID:4572
-
\??\c:\vvvpj.exec:\vvvpj.exe74⤵PID:2364
-
\??\c:\1flffff.exec:\1flffff.exe75⤵PID:3764
-
\??\c:\thhhbb.exec:\thhhbb.exe76⤵PID:4480
-
\??\c:\nhbtbh.exec:\nhbtbh.exe77⤵PID:2152
-
\??\c:\vpvpd.exec:\vpvpd.exe78⤵PID:3688
-
\??\c:\fxrrlll.exec:\fxrrlll.exe79⤵PID:3044
-
\??\c:\hbhhnb.exec:\hbhhnb.exe80⤵PID:2448
-
\??\c:\hnbttb.exec:\hnbttb.exe81⤵PID:1316
-
\??\c:\vdvpp.exec:\vdvpp.exe82⤵PID:4216
-
\??\c:\9xfxrlf.exec:\9xfxrlf.exe83⤵PID:1752
-
\??\c:\btnbtn.exec:\btnbtn.exe84⤵PID:4976
-
\??\c:\ddjjj.exec:\ddjjj.exe85⤵PID:3664
-
\??\c:\9xxffff.exec:\9xxffff.exe86⤵PID:1584
-
\??\c:\bbhbht.exec:\bbhbht.exe87⤵PID:1848
-
\??\c:\5vvpp.exec:\5vvpp.exe88⤵PID:2864
-
\??\c:\rfxrllf.exec:\rfxrllf.exe89⤵PID:2140
-
\??\c:\ddpjv.exec:\ddpjv.exe90⤵PID:4640
-
\??\c:\rlxrrxf.exec:\rlxrrxf.exe91⤵PID:532
-
\??\c:\btbntn.exec:\btbntn.exe92⤵PID:760
-
\??\c:\ddddd.exec:\ddddd.exe93⤵PID:4832
-
\??\c:\frxrxlf.exec:\frxrxlf.exe94⤵PID:3388
-
\??\c:\ntnhbh.exec:\ntnhbh.exe95⤵PID:1656
-
\??\c:\5dvdv.exec:\5dvdv.exe96⤵PID:4916
-
\??\c:\xxrlllr.exec:\xxrlllr.exe97⤵PID:2996
-
\??\c:\tbhbtt.exec:\tbhbtt.exe98⤵PID:3608
-
\??\c:\vdpdj.exec:\vdpdj.exe99⤵PID:3124
-
\??\c:\lrxxrxl.exec:\lrxxrxl.exe100⤵PID:3544
-
\??\c:\nbnhbt.exec:\nbnhbt.exe101⤵PID:2440
-
\??\c:\tbhbtt.exec:\tbhbtt.exe102⤵PID:2588
-
\??\c:\3pvdj.exec:\3pvdj.exe103⤵PID:2292
-
\??\c:\xfllxxl.exec:\xfllxxl.exe104⤵PID:1976
-
\??\c:\tntnht.exec:\tntnht.exe105⤵PID:2412
-
\??\c:\vjpjp.exec:\vjpjp.exe106⤵PID:4488
-
\??\c:\lrxlfff.exec:\lrxlfff.exe107⤵PID:1480
-
\??\c:\9bbthh.exec:\9bbthh.exe108⤵PID:1988
-
\??\c:\vppdd.exec:\vppdd.exe109⤵
- System Location Discovery: System Language Discovery
PID:676 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe110⤵PID:4536
-
\??\c:\hbtttt.exec:\hbtttt.exe111⤵PID:3584
-
\??\c:\nnthbn.exec:\nnthbn.exe112⤵PID:4104
-
\??\c:\vvpjj.exec:\vvpjj.exe113⤵PID:3980
-
\??\c:\xxfxlfl.exec:\xxfxlfl.exe114⤵PID:212
-
\??\c:\hnnhhh.exec:\hnnhhh.exe115⤵PID:3576
-
\??\c:\dvdvp.exec:\dvdvp.exe116⤵PID:4032
-
\??\c:\lrfflfr.exec:\lrfflfr.exe117⤵PID:4960
-
\??\c:\hhbttt.exec:\hhbttt.exe118⤵PID:4204
-
\??\c:\dppvv.exec:\dppvv.exe119⤵PID:1992
-
\??\c:\ffrrxxr.exec:\ffrrxxr.exe120⤵PID:3412
-
\??\c:\7ntnhh.exec:\7ntnhh.exe121⤵PID:3812
-
\??\c:\bbbbbb.exec:\bbbbbb.exe122⤵PID:3536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-