Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 22:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe
-
Size
455KB
-
MD5
07a27ece8d4cc6fae2a4d852ebb5b890
-
SHA1
57b48568013b656d505d8affe4a97fc233390310
-
SHA256
e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241
-
SHA512
7db9af0aca7822b7ee6f87f85361429931df3552d130b052cd8cc47fef9597b6cd83473c8c6dd6f8b859db510e38bd2c913d53ba4b5017abb64813026d318e8c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2816-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-877-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-896-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-1269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-1534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4340 rxfrfxr.exe 4792 tnbtnh.exe 4020 djjdp.exe 3904 lflfxxf.exe 3572 vvvpd.exe 2052 1tthtn.exe 3928 pvvjp.exe 4396 bnhbtt.exe 2896 jvdpj.exe 3496 dvvjj.exe 112 btbtnh.exe 2520 3dpjv.exe 2872 lrxlxrf.exe 224 tbbthb.exe 3448 nbhtth.exe 4136 fxfrfxr.exe 4224 jdvpj.exe 4456 lxxrllf.exe 1664 hbtbtt.exe 4728 3ntnhb.exe 4600 djpdv.exe 4324 bbbthb.exe 4820 xrrrlff.exe 5076 frxrxlf.exe 2260 nbhbnh.exe 4164 9jjvp.exe 4440 xlfxrrl.exe 3480 jvvjv.exe 448 7pdvp.exe 940 jdjvj.exe 4076 rrrflff.exe 5096 jdpdj.exe 2644 bbbnth.exe 836 jvdvp.exe 1108 vvvvj.exe 1956 tbthbt.exe 2576 rflxllx.exe 3468 tthbbt.exe 4216 dddvp.exe 1868 rxxlxxr.exe 3676 xflfrrf.exe 4188 nbhhbb.exe 3624 9vjdp.exe 4016 fflxrlf.exe 4308 tnnbhh.exe 1676 nhbbnn.exe 1464 vvpdv.exe 4284 7fxfrlr.exe 4124 tthhtt.exe 4960 pjjdp.exe 5036 lffxlfx.exe 1668 nhnnhh.exe 4344 7bnhhn.exe 4376 7jjjd.exe 4280 lfxrxxl.exe 4388 btnhtn.exe 4752 bnnhhh.exe 868 9pdvd.exe 1304 fxffxll.exe 1068 nbhbtt.exe 2272 bnbttt.exe 620 jdjdj.exe 312 rfxrrrr.exe 1172 1thhbb.exe -
resource yara_rule behavioral2/memory/2816-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-896-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xflxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2816 wrote to memory of 4340 2816 e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe 83 PID 2816 wrote to memory of 4340 2816 e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe 83 PID 2816 wrote to memory of 4340 2816 e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe 83 PID 4340 wrote to memory of 4792 4340 rxfrfxr.exe 84 PID 4340 wrote to memory of 4792 4340 rxfrfxr.exe 84 PID 4340 wrote to memory of 4792 4340 rxfrfxr.exe 84 PID 4792 wrote to memory of 4020 4792 tnbtnh.exe 85 PID 4792 wrote to memory of 4020 4792 tnbtnh.exe 85 PID 4792 wrote to memory of 4020 4792 tnbtnh.exe 85 PID 4020 wrote to memory of 3904 4020 djjdp.exe 86 PID 4020 wrote to memory of 3904 4020 djjdp.exe 86 PID 4020 wrote to memory of 3904 4020 djjdp.exe 86 PID 3904 wrote to memory of 3572 3904 lflfxxf.exe 87 PID 3904 wrote to memory of 3572 3904 lflfxxf.exe 87 PID 3904 wrote to memory of 3572 3904 lflfxxf.exe 87 PID 3572 wrote to memory of 2052 3572 vvvpd.exe 88 PID 3572 wrote to memory of 2052 3572 vvvpd.exe 88 PID 3572 wrote to memory of 2052 3572 vvvpd.exe 88 PID 2052 wrote to memory of 3928 2052 1tthtn.exe 89 PID 2052 wrote to memory of 3928 2052 1tthtn.exe 89 PID 2052 wrote to memory of 3928 2052 1tthtn.exe 89 PID 3928 wrote to memory of 4396 3928 pvvjp.exe 90 PID 3928 wrote to memory of 4396 3928 pvvjp.exe 90 PID 3928 wrote to memory of 4396 3928 pvvjp.exe 90 PID 4396 wrote to memory of 2896 4396 bnhbtt.exe 91 PID 4396 wrote to memory of 2896 4396 bnhbtt.exe 91 PID 4396 wrote to memory of 2896 4396 bnhbtt.exe 91 PID 2896 wrote to memory of 3496 2896 jvdpj.exe 92 PID 2896 wrote to memory of 3496 2896 jvdpj.exe 92 PID 2896 wrote to memory of 3496 2896 jvdpj.exe 92 PID 3496 wrote to memory of 112 3496 dvvjj.exe 93 PID 3496 wrote to memory of 112 3496 dvvjj.exe 93 PID 3496 wrote to memory of 112 3496 dvvjj.exe 93 PID 112 wrote to memory of 2520 112 btbtnh.exe 94 PID 112 wrote to memory of 2520 112 btbtnh.exe 94 PID 112 wrote to memory of 2520 112 btbtnh.exe 94 PID 2520 wrote to memory of 2872 2520 3dpjv.exe 95 PID 2520 wrote to memory of 2872 2520 3dpjv.exe 95 PID 2520 wrote to memory of 2872 2520 3dpjv.exe 95 PID 2872 wrote to memory of 224 2872 lrxlxrf.exe 96 PID 2872 wrote to memory of 224 2872 lrxlxrf.exe 96 PID 2872 wrote to memory of 224 2872 lrxlxrf.exe 96 PID 224 wrote to memory of 3448 224 tbbthb.exe 97 PID 224 wrote to memory of 3448 224 tbbthb.exe 97 PID 224 wrote to memory of 3448 224 tbbthb.exe 97 PID 3448 wrote to memory of 4136 3448 nbhtth.exe 98 PID 3448 wrote to memory of 4136 3448 nbhtth.exe 98 PID 3448 wrote to memory of 4136 3448 nbhtth.exe 98 PID 4136 wrote to memory of 4224 4136 fxfrfxr.exe 99 PID 4136 wrote to memory of 4224 4136 fxfrfxr.exe 99 PID 4136 wrote to memory of 4224 4136 fxfrfxr.exe 99 PID 4224 wrote to memory of 4456 4224 jdvpj.exe 100 PID 4224 wrote to memory of 4456 4224 jdvpj.exe 100 PID 4224 wrote to memory of 4456 4224 jdvpj.exe 100 PID 4456 wrote to memory of 1664 4456 lxxrllf.exe 101 PID 4456 wrote to memory of 1664 4456 lxxrllf.exe 101 PID 4456 wrote to memory of 1664 4456 lxxrllf.exe 101 PID 1664 wrote to memory of 4728 1664 hbtbtt.exe 102 PID 1664 wrote to memory of 4728 1664 hbtbtt.exe 102 PID 1664 wrote to memory of 4728 1664 hbtbtt.exe 102 PID 4728 wrote to memory of 4600 4728 3ntnhb.exe 103 PID 4728 wrote to memory of 4600 4728 3ntnhb.exe 103 PID 4728 wrote to memory of 4600 4728 3ntnhb.exe 103 PID 4600 wrote to memory of 4324 4600 djpdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe"C:\Users\Admin\AppData\Local\Temp\e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rxfrfxr.exec:\rxfrfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\tnbtnh.exec:\tnbtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\djjdp.exec:\djjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\lflfxxf.exec:\lflfxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\vvvpd.exec:\vvvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\1tthtn.exec:\1tthtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\pvvjp.exec:\pvvjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\bnhbtt.exec:\bnhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\jvdpj.exec:\jvdpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\dvvjj.exec:\dvvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\btbtnh.exec:\btbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\3dpjv.exec:\3dpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\lrxlxrf.exec:\lrxlxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\tbbthb.exec:\tbbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\nbhtth.exec:\nbhtth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\fxfrfxr.exec:\fxfrfxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\jdvpj.exec:\jdvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\lxxrllf.exec:\lxxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\hbtbtt.exec:\hbtbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\3ntnhb.exec:\3ntnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\djpdv.exec:\djpdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\bbbthb.exec:\bbbthb.exe23⤵
- Executes dropped EXE
PID:4324 -
\??\c:\xrrrlff.exec:\xrrrlff.exe24⤵
- Executes dropped EXE
PID:4820 -
\??\c:\frxrxlf.exec:\frxrxlf.exe25⤵
- Executes dropped EXE
PID:5076 -
\??\c:\nbhbnh.exec:\nbhbnh.exe26⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9jjvp.exec:\9jjvp.exe27⤵
- Executes dropped EXE
PID:4164 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe28⤵
- Executes dropped EXE
PID:4440 -
\??\c:\jvvjv.exec:\jvvjv.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3480 -
\??\c:\7pdvp.exec:\7pdvp.exe30⤵
- Executes dropped EXE
PID:448 -
\??\c:\jdjvj.exec:\jdjvj.exe31⤵
- Executes dropped EXE
PID:940 -
\??\c:\rrrflff.exec:\rrrflff.exe32⤵
- Executes dropped EXE
PID:4076 -
\??\c:\jdpdj.exec:\jdpdj.exe33⤵
- Executes dropped EXE
PID:5096 -
\??\c:\bbbnth.exec:\bbbnth.exe34⤵
- Executes dropped EXE
PID:2644 -
\??\c:\jvdvp.exec:\jvdvp.exe35⤵
- Executes dropped EXE
PID:836 -
\??\c:\vvvvj.exec:\vvvvj.exe36⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tbthbt.exec:\tbthbt.exe37⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rflxllx.exec:\rflxllx.exe38⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tthbbt.exec:\tthbbt.exe39⤵
- Executes dropped EXE
PID:3468 -
\??\c:\dddvp.exec:\dddvp.exe40⤵
- Executes dropped EXE
PID:4216 -
\??\c:\rxxlxxr.exec:\rxxlxxr.exe41⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xflfrrf.exec:\xflfrrf.exe42⤵
- Executes dropped EXE
PID:3676 -
\??\c:\nbhhbb.exec:\nbhhbb.exe43⤵
- Executes dropped EXE
PID:4188 -
\??\c:\9vjdp.exec:\9vjdp.exe44⤵
- Executes dropped EXE
PID:3624 -
\??\c:\fflxrlf.exec:\fflxrlf.exe45⤵
- Executes dropped EXE
PID:4016 -
\??\c:\tnnbhh.exec:\tnnbhh.exe46⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nhbbnn.exec:\nhbbnn.exe47⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vvpdv.exec:\vvpdv.exe48⤵
- Executes dropped EXE
PID:1464 -
\??\c:\7fxfrlr.exec:\7fxfrlr.exe49⤵
- Executes dropped EXE
PID:4284 -
\??\c:\tthhtt.exec:\tthhtt.exe50⤵
- Executes dropped EXE
PID:4124 -
\??\c:\pjjdp.exec:\pjjdp.exe51⤵
- Executes dropped EXE
PID:4960 -
\??\c:\lffxlfx.exec:\lffxlfx.exe52⤵
- Executes dropped EXE
PID:5036 -
\??\c:\nhnnhh.exec:\nhnnhh.exe53⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7bnhhn.exec:\7bnhhn.exe54⤵
- Executes dropped EXE
PID:4344 -
\??\c:\7jjjd.exec:\7jjjd.exe55⤵
- Executes dropped EXE
PID:4376 -
\??\c:\lfxrxxl.exec:\lfxrxxl.exe56⤵
- Executes dropped EXE
PID:4280 -
\??\c:\btnhtn.exec:\btnhtn.exe57⤵
- Executes dropped EXE
PID:4388 -
\??\c:\bnnhhh.exec:\bnnhhh.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4752 -
\??\c:\9pdvd.exec:\9pdvd.exe59⤵
- Executes dropped EXE
PID:868 -
\??\c:\fxffxll.exec:\fxffxll.exe60⤵
- Executes dropped EXE
PID:1304 -
\??\c:\nbhbtt.exec:\nbhbtt.exe61⤵
- Executes dropped EXE
PID:1068 -
\??\c:\bnbttt.exec:\bnbttt.exe62⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jdjdj.exec:\jdjdj.exe63⤵
- Executes dropped EXE
PID:620 -
\??\c:\rfxrrrr.exec:\rfxrrrr.exe64⤵
- Executes dropped EXE
PID:312 -
\??\c:\1thhbb.exec:\1thhbb.exe65⤵
- Executes dropped EXE
PID:1172 -
\??\c:\tthhbh.exec:\tthhbh.exe66⤵PID:2072
-
\??\c:\ppppp.exec:\ppppp.exe67⤵PID:2872
-
\??\c:\1xrlffx.exec:\1xrlffx.exe68⤵PID:2440
-
\??\c:\ttttnn.exec:\ttttnn.exe69⤵PID:2496
-
\??\c:\pjpvp.exec:\pjpvp.exe70⤵PID:3776
-
\??\c:\vdpjd.exec:\vdpjd.exe71⤵PID:316
-
\??\c:\fxrlffx.exec:\fxrlffx.exe72⤵PID:4544
-
\??\c:\bhnnhh.exec:\bhnnhh.exe73⤵PID:3740
-
\??\c:\pjvjd.exec:\pjvjd.exe74⤵PID:2824
-
\??\c:\dvvvp.exec:\dvvvp.exe75⤵PID:2392
-
\??\c:\5xfxxxf.exec:\5xfxxxf.exe76⤵PID:3096
-
\??\c:\hnhhbn.exec:\hnhhbn.exe77⤵PID:2700
-
\??\c:\3dpvv.exec:\3dpvv.exe78⤵PID:1664
-
\??\c:\llrrfff.exec:\llrrfff.exe79⤵PID:4728
-
\??\c:\ttnnnn.exec:\ttnnnn.exe80⤵PID:4060
-
\??\c:\tbbnht.exec:\tbbnht.exe81⤵PID:5052
-
\??\c:\3djvp.exec:\3djvp.exe82⤵PID:3420
-
\??\c:\3rrxllr.exec:\3rrxllr.exe83⤵PID:624
-
\??\c:\tnnthn.exec:\tnnthn.exe84⤵PID:4112
-
\??\c:\pjdvj.exec:\pjdvj.exe85⤵PID:1528
-
\??\c:\1xxrlrl.exec:\1xxrlrl.exe86⤵PID:2624
-
\??\c:\nhtnnh.exec:\nhtnnh.exe87⤵PID:4164
-
\??\c:\nnttnn.exec:\nnttnn.exe88⤵PID:2492
-
\??\c:\9pvpd.exec:\9pvpd.exe89⤵PID:3380
-
\??\c:\lrlrrxf.exec:\lrlrrxf.exe90⤵PID:4688
-
\??\c:\thbthb.exec:\thbthb.exe91⤵PID:2236
-
\??\c:\tnnhbb.exec:\tnnhbb.exe92⤵PID:976
-
\??\c:\jvjvp.exec:\jvjvp.exe93⤵PID:3040
-
\??\c:\1rrxllf.exec:\1rrxllf.exe94⤵
- System Location Discovery: System Language Discovery
PID:1428 -
\??\c:\xxrlflf.exec:\xxrlflf.exe95⤵PID:3568
-
\??\c:\7nbthh.exec:\7nbthh.exe96⤵PID:3508
-
\??\c:\1vjdp.exec:\1vjdp.exe97⤵PID:1196
-
\??\c:\rrfxxfr.exec:\rrfxxfr.exe98⤵PID:2312
-
\??\c:\rfxfxfr.exec:\rfxfxfr.exe99⤵PID:2776
-
\??\c:\hhbttb.exec:\hhbttb.exe100⤵PID:1956
-
\??\c:\vpvpp.exec:\vpvpp.exe101⤵PID:1840
-
\??\c:\dpdvp.exec:\dpdvp.exe102⤵PID:3468
-
\??\c:\xlrlxlf.exec:\xlrlxlf.exe103⤵PID:4216
-
\??\c:\hbnhnn.exec:\hbnhnn.exe104⤵PID:4660
-
\??\c:\9jjvj.exec:\9jjvj.exe105⤵PID:3676
-
\??\c:\xrxrllf.exec:\xrxrllf.exe106⤵PID:4188
-
\??\c:\ttbtnn.exec:\ttbtnn.exe107⤵PID:1968
-
\??\c:\5dpdp.exec:\5dpdp.exe108⤵PID:1124
-
\??\c:\5jdpd.exec:\5jdpd.exe109⤵PID:3284
-
\??\c:\3xxrfxr.exec:\3xxrfxr.exe110⤵PID:1216
-
\??\c:\tthbnh.exec:\tthbnh.exe111⤵PID:4392
-
\??\c:\1pdvd.exec:\1pdvd.exe112⤵PID:4372
-
\??\c:\vddpv.exec:\vddpv.exe113⤵PID:4732
-
\??\c:\flrfxrr.exec:\flrfxrr.exe114⤵PID:4340
-
\??\c:\bhnbnt.exec:\bhnbnt.exe115⤵PID:4028
-
\??\c:\dpvvp.exec:\dpvvp.exe116⤵PID:1716
-
\??\c:\jvppd.exec:\jvppd.exe117⤵PID:3652
-
\??\c:\9lllxrl.exec:\9lllxrl.exe118⤵PID:3876
-
\??\c:\nhhbtt.exec:\nhhbtt.exe119⤵PID:536
-
\??\c:\jdjdd.exec:\jdjdd.exe120⤵PID:3516
-
\??\c:\rllfrrr.exec:\rllfrrr.exe121⤵PID:4752
-
\??\c:\tnhbhh.exec:\tnhbhh.exe122⤵PID:4304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-