Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2024, 05:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2a48936ca2a34f1fc7f2b907d2a3124d67df90d072d770a5e79bb0565d3a87f.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
e2a48936ca2a34f1fc7f2b907d2a3124d67df90d072d770a5e79bb0565d3a87f.exe
-
Size
452KB
-
MD5
8ebc281dda8e4158edff94fab78ebbb1
-
SHA1
c63499f6cde14cdf00a5d6bb1cb483e9de18e664
-
SHA256
e2a48936ca2a34f1fc7f2b907d2a3124d67df90d072d770a5e79bb0565d3a87f
-
SHA512
7802bd3a2f84bfc8bb177ec4656f98346b8565dc65e1ef103e537abfb703e39f8a61b9134329f460c992def21f57ac058836657d941feac694135d405e0f1da1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4768-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-757-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-779-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-1201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-1256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 rfxflxx.exe 3608 dvvvv.exe 3312 nnnnbh.exe 3688 hthbbt.exe 1664 jdpjj.exe 2448 vdjjj.exe 1116 lrxrxxf.exe 4804 bntttb.exe 5096 jvvjj.exe 2396 xfffxxx.exe 4364 dpdpd.exe 1144 vvdvp.exe 4184 htbtbt.exe 1656 vppjd.exe 632 5fxxxfx.exe 920 tthbhn.exe 2120 hthhtt.exe 1968 djvjp.exe 2256 nbthbn.exe 4116 rlrrrrx.exe 4552 1tnhhh.exe 1916 vjppp.exe 1400 xxllxrx.exe 4988 xxxfrfr.exe 3424 lfllrrr.exe 4932 tthbbb.exe 1688 xxrrlxr.exe 4416 1djdv.exe 1328 nbhbtb.exe 3044 xrxlrll.exe 2176 lfllxxx.exe 4888 xxrlrrr.exe 2672 ppjjj.exe 2016 rflrrxx.exe 2512 bhbbbn.exe 100 vvppj.exe 2112 rllllxf.exe 2156 djjdv.exe 1828 5vvjv.exe 208 tnnnnn.exe 4408 djppp.exe 1068 3jjdv.exe 4036 lllffll.exe 4592 bthhbb.exe 2616 pjpjj.exe 3312 xrxxxll.exe 4860 bnbbbt.exe 3408 flffrlx.exe 4284 lflrxxx.exe 3472 9httnn.exe 2180 vdjjd.exe 1300 tbnhnn.exe 968 vpdpj.exe 1860 nttbbh.exe 3992 vjdvp.exe 872 rrxxxff.exe 2056 hnbbhn.exe 4364 djpvv.exe 3648 frxrxxr.exe 1048 bthbnt.exe 1172 jjjdv.exe 3068 rlfffll.exe 2968 ffrxxxf.exe 5080 hbhbnt.exe -
resource yara_rule behavioral2/memory/4768-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-779-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2a48936ca2a34f1fc7f2b907d2a3124d67df90d072d770a5e79bb0565d3a87f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 1628 4768 e2a48936ca2a34f1fc7f2b907d2a3124d67df90d072d770a5e79bb0565d3a87f.exe 82 PID 4768 wrote to memory of 1628 4768 e2a48936ca2a34f1fc7f2b907d2a3124d67df90d072d770a5e79bb0565d3a87f.exe 82 PID 4768 wrote to memory of 1628 4768 e2a48936ca2a34f1fc7f2b907d2a3124d67df90d072d770a5e79bb0565d3a87f.exe 82 PID 1628 wrote to memory of 3608 1628 rfxflxx.exe 83 PID 1628 wrote to memory of 3608 1628 rfxflxx.exe 83 PID 1628 wrote to memory of 3608 1628 rfxflxx.exe 83 PID 3608 wrote to memory of 3312 3608 dvvvv.exe 84 PID 3608 wrote to memory of 3312 3608 dvvvv.exe 84 PID 3608 wrote to memory of 3312 3608 dvvvv.exe 84 PID 3312 wrote to memory of 3688 3312 nnnnbh.exe 85 PID 3312 wrote to memory of 3688 3312 nnnnbh.exe 85 PID 3312 wrote to memory of 3688 3312 nnnnbh.exe 85 PID 3688 wrote to memory of 1664 3688 hthbbt.exe 86 PID 3688 wrote to memory of 1664 3688 hthbbt.exe 86 PID 3688 wrote to memory of 1664 3688 hthbbt.exe 86 PID 1664 wrote to memory of 2448 1664 jdpjj.exe 87 PID 1664 wrote to memory of 2448 1664 jdpjj.exe 87 PID 1664 wrote to memory of 2448 1664 jdpjj.exe 87 PID 2448 wrote to memory of 1116 2448 vdjjj.exe 88 PID 2448 wrote to memory of 1116 2448 vdjjj.exe 88 PID 2448 wrote to memory of 1116 2448 vdjjj.exe 88 PID 1116 wrote to memory of 4804 1116 lrxrxxf.exe 89 PID 1116 wrote to memory of 4804 1116 lrxrxxf.exe 89 PID 1116 wrote to memory of 4804 1116 lrxrxxf.exe 89 PID 4804 wrote to memory of 5096 4804 bntttb.exe 90 PID 4804 wrote to memory of 5096 4804 bntttb.exe 90 PID 4804 wrote to memory of 5096 4804 bntttb.exe 90 PID 5096 wrote to memory of 2396 5096 jvvjj.exe 91 PID 5096 wrote to memory of 2396 5096 jvvjj.exe 91 PID 5096 wrote to memory of 2396 5096 jvvjj.exe 91 PID 2396 wrote to memory of 4364 2396 xfffxxx.exe 92 PID 2396 wrote to memory of 4364 2396 xfffxxx.exe 92 PID 2396 wrote to memory of 4364 2396 xfffxxx.exe 92 PID 4364 wrote to memory of 1144 4364 dpdpd.exe 93 PID 4364 wrote to memory of 1144 4364 dpdpd.exe 93 PID 4364 wrote to memory of 1144 4364 dpdpd.exe 93 PID 1144 wrote to memory of 4184 1144 vvdvp.exe 94 PID 1144 wrote to memory of 4184 1144 vvdvp.exe 94 PID 1144 wrote to memory of 4184 1144 vvdvp.exe 94 PID 4184 wrote to memory of 1656 4184 htbtbt.exe 95 PID 4184 wrote to memory of 1656 4184 htbtbt.exe 95 PID 4184 wrote to memory of 1656 4184 htbtbt.exe 95 PID 1656 wrote to memory of 632 1656 vppjd.exe 96 PID 1656 wrote to memory of 632 1656 vppjd.exe 96 PID 1656 wrote to memory of 632 1656 vppjd.exe 96 PID 632 wrote to memory of 920 632 5fxxxfx.exe 97 PID 632 wrote to memory of 920 632 5fxxxfx.exe 97 PID 632 wrote to memory of 920 632 5fxxxfx.exe 97 PID 920 wrote to memory of 2120 920 tthbhn.exe 98 PID 920 wrote to memory of 2120 920 tthbhn.exe 98 PID 920 wrote to memory of 2120 920 tthbhn.exe 98 PID 2120 wrote to memory of 1968 2120 hthhtt.exe 99 PID 2120 wrote to memory of 1968 2120 hthhtt.exe 99 PID 2120 wrote to memory of 1968 2120 hthhtt.exe 99 PID 1968 wrote to memory of 2256 1968 djvjp.exe 100 PID 1968 wrote to memory of 2256 1968 djvjp.exe 100 PID 1968 wrote to memory of 2256 1968 djvjp.exe 100 PID 2256 wrote to memory of 4116 2256 nbthbn.exe 101 PID 2256 wrote to memory of 4116 2256 nbthbn.exe 101 PID 2256 wrote to memory of 4116 2256 nbthbn.exe 101 PID 4116 wrote to memory of 4552 4116 rlrrrrx.exe 102 PID 4116 wrote to memory of 4552 4116 rlrrrrx.exe 102 PID 4116 wrote to memory of 4552 4116 rlrrrrx.exe 102 PID 4552 wrote to memory of 1916 4552 1tnhhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2a48936ca2a34f1fc7f2b907d2a3124d67df90d072d770a5e79bb0565d3a87f.exe"C:\Users\Admin\AppData\Local\Temp\e2a48936ca2a34f1fc7f2b907d2a3124d67df90d072d770a5e79bb0565d3a87f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\rfxflxx.exec:\rfxflxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\dvvvv.exec:\dvvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\nnnnbh.exec:\nnnnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\hthbbt.exec:\hthbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\jdpjj.exec:\jdpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\vdjjj.exec:\vdjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\lrxrxxf.exec:\lrxrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\bntttb.exec:\bntttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\jvvjj.exec:\jvvjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\xfffxxx.exec:\xfffxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\dpdpd.exec:\dpdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\vvdvp.exec:\vvdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\htbtbt.exec:\htbtbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\vppjd.exec:\vppjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\5fxxxfx.exec:\5fxxxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\tthbhn.exec:\tthbhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\hthhtt.exec:\hthhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\djvjp.exec:\djvjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\nbthbn.exec:\nbthbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\1tnhhh.exec:\1tnhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\vjppp.exec:\vjppp.exe23⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xxllxrx.exec:\xxllxrx.exe24⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xxxfrfr.exec:\xxxfrfr.exe25⤵
- Executes dropped EXE
PID:4988 -
\??\c:\lfllrrr.exec:\lfllrrr.exe26⤵
- Executes dropped EXE
PID:3424 -
\??\c:\tthbbb.exec:\tthbbb.exe27⤵
- Executes dropped EXE
PID:4932 -
\??\c:\xxrrlxr.exec:\xxrrlxr.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1djdv.exec:\1djdv.exe29⤵
- Executes dropped EXE
PID:4416 -
\??\c:\nbhbtb.exec:\nbhbtb.exe30⤵
- Executes dropped EXE
PID:1328 -
\??\c:\xrxlrll.exec:\xrxlrll.exe31⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lfllxxx.exec:\lfllxxx.exe32⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xxrlrrr.exec:\xxrlrrr.exe33⤵
- Executes dropped EXE
PID:4888 -
\??\c:\ppjjj.exec:\ppjjj.exe34⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rflrrxx.exec:\rflrrxx.exe35⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bhbbbn.exec:\bhbbbn.exe36⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vvppj.exec:\vvppj.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:100 -
\??\c:\rllllxf.exec:\rllllxf.exe38⤵
- Executes dropped EXE
PID:2112 -
\??\c:\djjdv.exec:\djjdv.exe39⤵
- Executes dropped EXE
PID:2156 -
\??\c:\5vvjv.exec:\5vvjv.exe40⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tnnnnn.exec:\tnnnnn.exe41⤵
- Executes dropped EXE
PID:208 -
\??\c:\djppp.exec:\djppp.exe42⤵
- Executes dropped EXE
PID:4408 -
\??\c:\3jjdv.exec:\3jjdv.exe43⤵
- Executes dropped EXE
PID:1068 -
\??\c:\lllffll.exec:\lllffll.exe44⤵
- Executes dropped EXE
PID:4036 -
\??\c:\bthhbb.exec:\bthhbb.exe45⤵
- Executes dropped EXE
PID:4592 -
\??\c:\pjpjj.exec:\pjpjj.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xrxxxll.exec:\xrxxxll.exe47⤵
- Executes dropped EXE
PID:3312 -
\??\c:\bnbbbt.exec:\bnbbbt.exe48⤵
- Executes dropped EXE
PID:4860 -
\??\c:\flffrlx.exec:\flffrlx.exe49⤵
- Executes dropped EXE
PID:3408 -
\??\c:\lflrxxx.exec:\lflrxxx.exe50⤵
- Executes dropped EXE
PID:4284 -
\??\c:\9httnn.exec:\9httnn.exe51⤵
- Executes dropped EXE
PID:3472 -
\??\c:\vdjjd.exec:\vdjjd.exe52⤵
- Executes dropped EXE
PID:2180 -
\??\c:\tbnhnn.exec:\tbnhnn.exe53⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vpdpj.exec:\vpdpj.exe54⤵
- Executes dropped EXE
PID:968 -
\??\c:\nttbbh.exec:\nttbbh.exe55⤵
- Executes dropped EXE
PID:1860 -
\??\c:\vjdvp.exec:\vjdvp.exe56⤵
- Executes dropped EXE
PID:3992 -
\??\c:\rrxxxff.exec:\rrxxxff.exe57⤵
- Executes dropped EXE
PID:872 -
\??\c:\hnbbhn.exec:\hnbbhn.exe58⤵
- Executes dropped EXE
PID:2056 -
\??\c:\djpvv.exec:\djpvv.exe59⤵
- Executes dropped EXE
PID:4364 -
\??\c:\frxrxxr.exec:\frxrxxr.exe60⤵
- Executes dropped EXE
PID:3648 -
\??\c:\bthbnt.exec:\bthbnt.exe61⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jjjdv.exec:\jjjdv.exe62⤵
- Executes dropped EXE
PID:1172 -
\??\c:\rlfffll.exec:\rlfffll.exe63⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ffrxxxf.exec:\ffrxxxf.exe64⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hbhbnt.exec:\hbhbnt.exe65⤵
- Executes dropped EXE
PID:5080 -
\??\c:\ddddd.exec:\ddddd.exe66⤵PID:3296
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe67⤵PID:2256
-
\??\c:\bhhnnb.exec:\bhhnnb.exe68⤵PID:2372
-
\??\c:\5dvvj.exec:\5dvvj.exe69⤵PID:3328
-
\??\c:\vvdjj.exec:\vvdjj.exe70⤵PID:1624
-
\??\c:\3xfxrrr.exec:\3xfxrrr.exe71⤵PID:2216
-
\??\c:\tttnnh.exec:\tttnnh.exe72⤵PID:4060
-
\??\c:\bbtbbh.exec:\bbtbbh.exe73⤵PID:4640
-
\??\c:\llllrrf.exec:\llllrrf.exe74⤵PID:3404
-
\??\c:\dpjpv.exec:\dpjpv.exe75⤵PID:3496
-
\??\c:\ppddd.exec:\ppddd.exe76⤵PID:4556
-
\??\c:\lxlllxf.exec:\lxlllxf.exe77⤵PID:2484
-
\??\c:\tthtbt.exec:\tthtbt.exe78⤵PID:2404
-
\??\c:\dpjdd.exec:\dpjdd.exe79⤵PID:3160
-
\??\c:\ffxxxfl.exec:\ffxxxfl.exe80⤵PID:2088
-
\??\c:\3nnnnt.exec:\3nnnnt.exe81⤵PID:724
-
\??\c:\pjppj.exec:\pjppj.exe82⤵PID:1192
-
\??\c:\xxxrrll.exec:\xxxrrll.exe83⤵
- System Location Discovery: System Language Discovery
PID:4568 -
\??\c:\1bnnhn.exec:\1bnnhn.exe84⤵PID:4924
-
\??\c:\vpvvv.exec:\vpvvv.exe85⤵PID:3716
-
\??\c:\xfrxfrx.exec:\xfrxfrx.exe86⤵PID:3736
-
\??\c:\ddjpp.exec:\ddjpp.exe87⤵PID:4824
-
\??\c:\pppjj.exec:\pppjj.exe88⤵PID:1964
-
\??\c:\5tnbnn.exec:\5tnbnn.exe89⤵PID:2340
-
\??\c:\jjjdj.exec:\jjjdj.exe90⤵PID:4288
-
\??\c:\rrlxrff.exec:\rrlxrff.exe91⤵PID:4656
-
\??\c:\nbnthn.exec:\nbnthn.exe92⤵PID:5052
-
\??\c:\ddjvj.exec:\ddjvj.exe93⤵PID:620
-
\??\c:\lrffxff.exec:\lrffxff.exe94⤵PID:1044
-
\??\c:\nhtttt.exec:\nhtttt.exe95⤵PID:3108
-
\??\c:\btbtnn.exec:\btbtnn.exe96⤵PID:4692
-
\??\c:\dpddp.exec:\dpddp.exe97⤵PID:1700
-
\??\c:\rrllxfr.exec:\rrllxfr.exe98⤵PID:2860
-
\??\c:\bttnhh.exec:\bttnhh.exe99⤵PID:208
-
\??\c:\ppppp.exec:\ppppp.exe100⤵PID:5024
-
\??\c:\rfrxlrf.exec:\rfrxlrf.exe101⤵PID:1068
-
\??\c:\lrxfxxx.exec:\lrxfxxx.exe102⤵PID:4868
-
\??\c:\hhtnhn.exec:\hhtnhn.exe103⤵PID:8
-
\??\c:\jjjpd.exec:\jjjpd.exe104⤵PID:1032
-
\??\c:\lffxxrx.exec:\lffxxrx.exe105⤵PID:3376
-
\??\c:\btbtbn.exec:\btbtbn.exe106⤵PID:812
-
\??\c:\7vjdp.exec:\7vjdp.exe107⤵PID:4448
-
\??\c:\xrrfxlf.exec:\xrrfxlf.exe108⤵PID:1120
-
\??\c:\5htnnb.exec:\5htnnb.exe109⤵PID:4344
-
\??\c:\htbtnn.exec:\htbtnn.exe110⤵PID:712
-
\??\c:\ddjpj.exec:\ddjpj.exe111⤵PID:1696
-
\??\c:\nnnhbb.exec:\nnnhbb.exe112⤵PID:1540
-
\??\c:\pdvdv.exec:\pdvdv.exe113⤵
- System Location Discovery: System Language Discovery
PID:3440 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe114⤵PID:1036
-
\??\c:\5bhntt.exec:\5bhntt.exe115⤵PID:1488
-
\??\c:\9pddp.exec:\9pddp.exe116⤵PID:1920
-
\??\c:\llflrxx.exec:\llflrxx.exe117⤵PID:4632
-
\??\c:\bhhttt.exec:\bhhttt.exe118⤵PID:1928
-
\??\c:\flrrrrr.exec:\flrrrrr.exe119⤵PID:3648
-
\??\c:\rffllll.exec:\rffllll.exe120⤵PID:4436
-
\??\c:\nbnhbh.exec:\nbnhbh.exe121⤵PID:3208
-
\??\c:\vvjdd.exec:\vvjdd.exe122⤵PID:632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-