Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 13:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe
-
Size
456KB
-
MD5
669a7fdaa663bd2910b413ebf632dcac
-
SHA1
92a9441d6ee37b2d30be1fde113328ecdce1c1b6
-
SHA256
cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31
-
SHA512
7a0705aef5ef878cd5f581cff54d1f041686eb944ab075a4922fee166907126ab0d9a499a35a31935b29669fd64d00a9a9583e451c6b8bb93b07443cf7150e9b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRW:q7Tc2NYHUrAwfMp3CDRW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1540-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/780-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-760-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-848-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-916-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-1459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-1893-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1540 20420.exe 5028 c220820.exe 4896 020802.exe 1132 xxrfrrf.exe 4720 840048.exe 4412 7jdvj.exe 1656 c626422.exe 1604 68882.exe 2540 vdpdp.exe 2576 266082.exe 2364 8220064.exe 2472 vvjdv.exe 4340 042648.exe 5064 a4224.exe 780 tthtbh.exe 1268 00420.exe 720 3jvjd.exe 3780 c404860.exe 5020 pvpjv.exe 2288 0042608.exe 928 9pdvj.exe 1148 q22082.exe 4324 888648.exe 1592 djdpj.exe 2456 o622042.exe 4144 a6200.exe 924 64428.exe 3172 8626842.exe 3216 08488.exe 1000 jpdvd.exe 4408 rrflrfl.exe 1956 686208.exe 748 0686426.exe 4176 xlfrfxr.exe 5068 q60420.exe 636 rllfrlx.exe 3304 4060826.exe 4008 xflxlrf.exe 4776 jjjvj.exe 436 7hthbn.exe 892 9pjdj.exe 2204 nnhbtt.exe 1776 7dpdp.exe 1128 vpdpd.exe 4948 0848248.exe 3064 llfrfxl.exe 4364 6486486.exe 2096 7xrlxrf.exe 4100 vjvpp.exe 4328 s0086.exe 4312 s8048.exe 2556 nhhbbb.exe 1540 nnbnbn.exe 3744 pvdvd.exe 3588 26008.exe 4536 dppjj.exe 3472 0268282.exe 3044 fllfrlf.exe 4456 62808.exe 2748 q00860.exe 3124 7tnhnh.exe 2588 82620.exe 4236 604804.exe 396 g0604.exe -
resource yara_rule behavioral2/memory/1540-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/780-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-848-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 224482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0820826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 802222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2820.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q80488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2600842.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 244444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w40204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2556 wrote to memory of 1540 2556 cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe 83 PID 2556 wrote to memory of 1540 2556 cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe 83 PID 2556 wrote to memory of 1540 2556 cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe 83 PID 1540 wrote to memory of 5028 1540 20420.exe 84 PID 1540 wrote to memory of 5028 1540 20420.exe 84 PID 1540 wrote to memory of 5028 1540 20420.exe 84 PID 5028 wrote to memory of 4896 5028 c220820.exe 85 PID 5028 wrote to memory of 4896 5028 c220820.exe 85 PID 5028 wrote to memory of 4896 5028 c220820.exe 85 PID 4896 wrote to memory of 1132 4896 020802.exe 86 PID 4896 wrote to memory of 1132 4896 020802.exe 86 PID 4896 wrote to memory of 1132 4896 020802.exe 86 PID 1132 wrote to memory of 4720 1132 xxrfrrf.exe 87 PID 1132 wrote to memory of 4720 1132 xxrfrrf.exe 87 PID 1132 wrote to memory of 4720 1132 xxrfrrf.exe 87 PID 4720 wrote to memory of 4412 4720 840048.exe 88 PID 4720 wrote to memory of 4412 4720 840048.exe 88 PID 4720 wrote to memory of 4412 4720 840048.exe 88 PID 4412 wrote to memory of 1656 4412 7jdvj.exe 89 PID 4412 wrote to memory of 1656 4412 7jdvj.exe 89 PID 4412 wrote to memory of 1656 4412 7jdvj.exe 89 PID 1656 wrote to memory of 1604 1656 c626422.exe 90 PID 1656 wrote to memory of 1604 1656 c626422.exe 90 PID 1656 wrote to memory of 1604 1656 c626422.exe 90 PID 1604 wrote to memory of 2540 1604 68882.exe 91 PID 1604 wrote to memory of 2540 1604 68882.exe 91 PID 1604 wrote to memory of 2540 1604 68882.exe 91 PID 2540 wrote to memory of 2576 2540 vdpdp.exe 92 PID 2540 wrote to memory of 2576 2540 vdpdp.exe 92 PID 2540 wrote to memory of 2576 2540 vdpdp.exe 92 PID 2576 wrote to memory of 2364 2576 266082.exe 93 PID 2576 wrote to memory of 2364 2576 266082.exe 93 PID 2576 wrote to memory of 2364 2576 266082.exe 93 PID 2364 wrote to memory of 2472 2364 8220064.exe 94 PID 2364 wrote to memory of 2472 2364 8220064.exe 94 PID 2364 wrote to memory of 2472 2364 8220064.exe 94 PID 2472 wrote to memory of 4340 2472 vvjdv.exe 95 PID 2472 wrote to memory of 4340 2472 vvjdv.exe 95 PID 2472 wrote to memory of 4340 2472 vvjdv.exe 95 PID 4340 wrote to memory of 5064 4340 042648.exe 96 PID 4340 wrote to memory of 5064 4340 042648.exe 96 PID 4340 wrote to memory of 5064 4340 042648.exe 96 PID 5064 wrote to memory of 780 5064 a4224.exe 97 PID 5064 wrote to memory of 780 5064 a4224.exe 97 PID 5064 wrote to memory of 780 5064 a4224.exe 97 PID 780 wrote to memory of 1268 780 tthtbh.exe 98 PID 780 wrote to memory of 1268 780 tthtbh.exe 98 PID 780 wrote to memory of 1268 780 tthtbh.exe 98 PID 1268 wrote to memory of 720 1268 00420.exe 99 PID 1268 wrote to memory of 720 1268 00420.exe 99 PID 1268 wrote to memory of 720 1268 00420.exe 99 PID 720 wrote to memory of 3780 720 3jvjd.exe 100 PID 720 wrote to memory of 3780 720 3jvjd.exe 100 PID 720 wrote to memory of 3780 720 3jvjd.exe 100 PID 3780 wrote to memory of 5020 3780 c404860.exe 101 PID 3780 wrote to memory of 5020 3780 c404860.exe 101 PID 3780 wrote to memory of 5020 3780 c404860.exe 101 PID 5020 wrote to memory of 2288 5020 pvpjv.exe 102 PID 5020 wrote to memory of 2288 5020 pvpjv.exe 102 PID 5020 wrote to memory of 2288 5020 pvpjv.exe 102 PID 2288 wrote to memory of 928 2288 0042608.exe 103 PID 2288 wrote to memory of 928 2288 0042608.exe 103 PID 2288 wrote to memory of 928 2288 0042608.exe 103 PID 928 wrote to memory of 1148 928 9pdvj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe"C:\Users\Admin\AppData\Local\Temp\cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\20420.exec:\20420.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\c220820.exec:\c220820.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\020802.exec:\020802.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\xxrfrrf.exec:\xxrfrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\840048.exec:\840048.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\7jdvj.exec:\7jdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\c626422.exec:\c626422.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\68882.exec:\68882.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\vdpdp.exec:\vdpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\266082.exec:\266082.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\8220064.exec:\8220064.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\vvjdv.exec:\vvjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\042648.exec:\042648.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\a4224.exec:\a4224.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\tthtbh.exec:\tthtbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\00420.exec:\00420.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\3jvjd.exec:\3jvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\c404860.exec:\c404860.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\pvpjv.exec:\pvpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\0042608.exec:\0042608.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\9pdvj.exec:\9pdvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\q22082.exec:\q22082.exe23⤵
- Executes dropped EXE
PID:1148 -
\??\c:\888648.exec:\888648.exe24⤵
- Executes dropped EXE
PID:4324 -
\??\c:\djdpj.exec:\djdpj.exe25⤵
- Executes dropped EXE
PID:1592 -
\??\c:\o622042.exec:\o622042.exe26⤵
- Executes dropped EXE
PID:2456 -
\??\c:\a6200.exec:\a6200.exe27⤵
- Executes dropped EXE
PID:4144 -
\??\c:\64428.exec:\64428.exe28⤵
- Executes dropped EXE
PID:924 -
\??\c:\8626842.exec:\8626842.exe29⤵
- Executes dropped EXE
PID:3172 -
\??\c:\08488.exec:\08488.exe30⤵
- Executes dropped EXE
PID:3216 -
\??\c:\jpdvd.exec:\jpdvd.exe31⤵
- Executes dropped EXE
PID:1000 -
\??\c:\rrflrfl.exec:\rrflrfl.exe32⤵
- Executes dropped EXE
PID:4408 -
\??\c:\686208.exec:\686208.exe33⤵
- Executes dropped EXE
PID:1956 -
\??\c:\0686426.exec:\0686426.exe34⤵
- Executes dropped EXE
PID:748 -
\??\c:\xlfrfxr.exec:\xlfrfxr.exe35⤵
- Executes dropped EXE
PID:4176 -
\??\c:\q60420.exec:\q60420.exe36⤵
- Executes dropped EXE
PID:5068 -
\??\c:\rllfrlx.exec:\rllfrlx.exe37⤵
- Executes dropped EXE
PID:636 -
\??\c:\4060826.exec:\4060826.exe38⤵
- Executes dropped EXE
PID:3304 -
\??\c:\xflxlrf.exec:\xflxlrf.exe39⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jjjvj.exec:\jjjvj.exe40⤵
- Executes dropped EXE
PID:4776 -
\??\c:\7hthbn.exec:\7hthbn.exe41⤵
- Executes dropped EXE
PID:436 -
\??\c:\9pjdj.exec:\9pjdj.exe42⤵
- Executes dropped EXE
PID:892 -
\??\c:\nnhbtt.exec:\nnhbtt.exe43⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7dpdp.exec:\7dpdp.exe44⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vpdpd.exec:\vpdpd.exe45⤵
- Executes dropped EXE
PID:1128 -
\??\c:\0848248.exec:\0848248.exe46⤵
- Executes dropped EXE
PID:4948 -
\??\c:\llfrfxl.exec:\llfrfxl.exe47⤵
- Executes dropped EXE
PID:3064 -
\??\c:\6486486.exec:\6486486.exe48⤵
- Executes dropped EXE
PID:4364 -
\??\c:\7xrlxrf.exec:\7xrlxrf.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vjvpp.exec:\vjvpp.exe50⤵
- Executes dropped EXE
PID:4100 -
\??\c:\s0086.exec:\s0086.exe51⤵
- Executes dropped EXE
PID:4328 -
\??\c:\s8048.exec:\s8048.exe52⤵
- Executes dropped EXE
PID:4312 -
\??\c:\nhhbbb.exec:\nhhbbb.exe53⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nnbnbn.exec:\nnbnbn.exe54⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pvdvd.exec:\pvdvd.exe55⤵
- Executes dropped EXE
PID:3744 -
\??\c:\26008.exec:\26008.exe56⤵
- Executes dropped EXE
PID:3588 -
\??\c:\dppjj.exec:\dppjj.exe57⤵
- Executes dropped EXE
PID:4536 -
\??\c:\0268282.exec:\0268282.exe58⤵
- Executes dropped EXE
PID:3472 -
\??\c:\fllfrlf.exec:\fllfrlf.exe59⤵
- Executes dropped EXE
PID:3044 -
\??\c:\62808.exec:\62808.exe60⤵
- Executes dropped EXE
PID:4456 -
\??\c:\q00860.exec:\q00860.exe61⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7tnhnh.exec:\7tnhnh.exe62⤵
- Executes dropped EXE
PID:3124 -
\??\c:\82620.exec:\82620.exe63⤵
- Executes dropped EXE
PID:2588 -
\??\c:\604804.exec:\604804.exe64⤵
- Executes dropped EXE
PID:4236 -
\??\c:\g0604.exec:\g0604.exe65⤵
- Executes dropped EXE
PID:396 -
\??\c:\bthhbh.exec:\bthhbh.exe66⤵PID:2540
-
\??\c:\vdpdp.exec:\vdpdp.exe67⤵PID:3244
-
\??\c:\htbnhb.exec:\htbnhb.exe68⤵PID:3820
-
\??\c:\8282048.exec:\8282048.exe69⤵PID:4744
-
\??\c:\i008608.exec:\i008608.exe70⤵PID:1060
-
\??\c:\08800.exec:\08800.exe71⤵PID:1680
-
\??\c:\2064888.exec:\2064888.exe72⤵PID:2424
-
\??\c:\86868.exec:\86868.exe73⤵PID:3444
-
\??\c:\bbbbnb.exec:\bbbbnb.exe74⤵PID:3372
-
\??\c:\xllxxrr.exec:\xllxxrr.exe75⤵PID:4908
-
\??\c:\s8642.exec:\s8642.exe76⤵PID:4968
-
\??\c:\a2820.exec:\a2820.exe77⤵
- System Location Discovery: System Language Discovery
PID:1828 -
\??\c:\htnhtn.exec:\htnhtn.exe78⤵PID:212
-
\??\c:\3ththt.exec:\3ththt.exe79⤵PID:3876
-
\??\c:\9nnnhn.exec:\9nnnhn.exe80⤵PID:2912
-
\??\c:\dppdp.exec:\dppdp.exe81⤵PID:1200
-
\??\c:\bbnbbb.exec:\bbnbbb.exe82⤵PID:3004
-
\??\c:\82264.exec:\82264.exe83⤵PID:4872
-
\??\c:\444864.exec:\444864.exe84⤵PID:4116
-
\??\c:\48086.exec:\48086.exe85⤵PID:64
-
\??\c:\1rxrlxr.exec:\1rxrlxr.exe86⤵PID:5012
-
\??\c:\bnbttn.exec:\bnbttn.exe87⤵PID:3344
-
\??\c:\xxrfrlr.exec:\xxrfrlr.exe88⤵PID:1976
-
\??\c:\7xflfff.exec:\7xflfff.exe89⤵PID:3980
-
\??\c:\lxrlxrr.exec:\lxrlxrr.exe90⤵PID:4024
-
\??\c:\u608608.exec:\u608608.exe91⤵PID:3612
-
\??\c:\vjjdd.exec:\vjjdd.exe92⤵PID:4764
-
\??\c:\c626600.exec:\c626600.exe93⤵PID:4532
-
\??\c:\806222.exec:\806222.exe94⤵PID:2264
-
\??\c:\644866.exec:\644866.exe95⤵PID:3248
-
\??\c:\tnthbt.exec:\tnthbt.exe96⤵PID:3900
-
\??\c:\i886486.exec:\i886486.exe97⤵PID:4304
-
\??\c:\jjpjv.exec:\jjpjv.exe98⤵PID:1956
-
\??\c:\dvvpj.exec:\dvvpj.exe99⤵PID:3856
-
\??\c:\pdvjp.exec:\pdvjp.exe100⤵PID:4980
-
\??\c:\28864.exec:\28864.exe101⤵PID:4732
-
\??\c:\422682.exec:\422682.exe102⤵PID:1516
-
\??\c:\8604226.exec:\8604226.exe103⤵PID:3320
-
\??\c:\pvvdd.exec:\pvvdd.exe104⤵PID:2068
-
\??\c:\bnnbtn.exec:\bnnbtn.exe105⤵PID:4540
-
\??\c:\vdjpp.exec:\vdjpp.exe106⤵PID:2028
-
\??\c:\9bbnbt.exec:\9bbnbt.exe107⤵PID:2196
-
\??\c:\m6660.exec:\m6660.exe108⤵PID:1036
-
\??\c:\s2442.exec:\s2442.exe109⤵PID:5108
-
\??\c:\q86604.exec:\q86604.exe110⤵PID:4284
-
\??\c:\g6882.exec:\g6882.exe111⤵PID:2268
-
\??\c:\4844882.exec:\4844882.exe112⤵PID:1056
-
\??\c:\dpddd.exec:\dpddd.exe113⤵PID:1908
-
\??\c:\5bbbbb.exec:\5bbbbb.exe114⤵PID:2324
-
\??\c:\68482.exec:\68482.exe115⤵PID:3908
-
\??\c:\g2260.exec:\g2260.exe116⤵PID:5096
-
\??\c:\68082.exec:\68082.exe117⤵PID:2556
-
\??\c:\nntnhh.exec:\nntnhh.exe118⤵PID:3932
-
\??\c:\jvddv.exec:\jvddv.exe119⤵PID:1064
-
\??\c:\nbhbbb.exec:\nbhbbb.exe120⤵PID:3236
-
\??\c:\rrxrfff.exec:\rrxrfff.exe121⤵PID:4120
-
\??\c:\jvddd.exec:\jvddd.exe122⤵PID:2604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-