Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 23:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe
-
Size
453KB
-
MD5
94da7d64bbcaa3d3eac8984cc2c7131d
-
SHA1
7012e588c2711449d5658246a2d47049d9f47e02
-
SHA256
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82
-
SHA512
703ee914dea5cc2c63a17079e1db7404f6deec62e65c5016bbe030b9a572151a4b59c36d3a27f2749df2a0529e7bf10bb68252709ea4aa8154971d524d09e520
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2164-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-1029-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-1264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-1626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2164 rrlfxxr.exe 716 llxrlrl.exe 3992 hnnhbt.exe 3700 9nbtnn.exe 4828 ddpjv.exe 968 lffxxxx.exe 2628 pjvvp.exe 1604 hbnnbh.exe 2520 hhthhn.exe 3192 ffrllrr.exe 2964 tthhtt.exe 1168 ffffrrl.exe 2940 tntttt.exe 1304 dpppp.exe 4020 3httbh.exe 4700 dvpdv.exe 3116 nhttnt.exe 3016 9thhhn.exe 4772 pdvvd.exe 2744 ttnbtt.exe 2488 9tnnbb.exe 3776 vjjvv.exe 1372 rrxrrrx.exe 3364 rxfxxff.exe 8 hbhtnh.exe 4468 tnbbbt.exe 4400 flrrxff.exe 1824 bnttnt.exe 2056 dvvjj.exe 956 hnbbbb.exe 1400 1jdvj.exe 2900 htbbbh.exe 1804 htnbnh.exe 4076 jdpjp.exe 4884 9vpjd.exe 3244 rxxlfrl.exe 1140 nntthn.exe 3468 pdjvp.exe 1036 vvvpp.exe 4176 fxrlfff.exe 3432 1tttnb.exe 1208 jjddv.exe 4260 ffrrlrr.exe 4888 bbhbbh.exe 4368 5jppj.exe 908 flffrrf.exe 880 5ttttb.exe 1624 3dpdp.exe 3124 3jvvv.exe 4832 lfllfll.exe 1048 nhbbbh.exe 1520 3vvdv.exe 3284 5rxxfrl.exe 1984 llllxxf.exe 4184 1httnt.exe 4688 pjvvp.exe 2188 ppvvp.exe 1604 5hhhhh.exe 1708 bnbbbh.exe 3820 vpvpp.exe 3568 lrllxxx.exe 2988 thbbbb.exe 816 nnnnnn.exe 4108 vdddj.exe -
resource yara_rule behavioral2/memory/2164-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-757-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 2164 4376 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 82 PID 4376 wrote to memory of 2164 4376 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 82 PID 4376 wrote to memory of 2164 4376 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 82 PID 2164 wrote to memory of 716 2164 rrlfxxr.exe 83 PID 2164 wrote to memory of 716 2164 rrlfxxr.exe 83 PID 2164 wrote to memory of 716 2164 rrlfxxr.exe 83 PID 716 wrote to memory of 3992 716 llxrlrl.exe 84 PID 716 wrote to memory of 3992 716 llxrlrl.exe 84 PID 716 wrote to memory of 3992 716 llxrlrl.exe 84 PID 3992 wrote to memory of 3700 3992 hnnhbt.exe 85 PID 3992 wrote to memory of 3700 3992 hnnhbt.exe 85 PID 3992 wrote to memory of 3700 3992 hnnhbt.exe 85 PID 3700 wrote to memory of 4828 3700 9nbtnn.exe 86 PID 3700 wrote to memory of 4828 3700 9nbtnn.exe 86 PID 3700 wrote to memory of 4828 3700 9nbtnn.exe 86 PID 4828 wrote to memory of 968 4828 ddpjv.exe 87 PID 4828 wrote to memory of 968 4828 ddpjv.exe 87 PID 4828 wrote to memory of 968 4828 ddpjv.exe 87 PID 968 wrote to memory of 2628 968 lffxxxx.exe 88 PID 968 wrote to memory of 2628 968 lffxxxx.exe 88 PID 968 wrote to memory of 2628 968 lffxxxx.exe 88 PID 2628 wrote to memory of 1604 2628 pjvvp.exe 89 PID 2628 wrote to memory of 1604 2628 pjvvp.exe 89 PID 2628 wrote to memory of 1604 2628 pjvvp.exe 89 PID 1604 wrote to memory of 2520 1604 hbnnbh.exe 90 PID 1604 wrote to memory of 2520 1604 hbnnbh.exe 90 PID 1604 wrote to memory of 2520 1604 hbnnbh.exe 90 PID 2520 wrote to memory of 3192 2520 hhthhn.exe 91 PID 2520 wrote to memory of 3192 2520 hhthhn.exe 91 PID 2520 wrote to memory of 3192 2520 hhthhn.exe 91 PID 3192 wrote to memory of 2964 3192 ffrllrr.exe 92 PID 3192 wrote to memory of 2964 3192 ffrllrr.exe 92 PID 3192 wrote to memory of 2964 3192 ffrllrr.exe 92 PID 2964 wrote to memory of 1168 2964 tthhtt.exe 93 PID 2964 wrote to memory of 1168 2964 tthhtt.exe 93 PID 2964 wrote to memory of 1168 2964 tthhtt.exe 93 PID 1168 wrote to memory of 2940 1168 ffffrrl.exe 94 PID 1168 wrote to memory of 2940 1168 ffffrrl.exe 94 PID 1168 wrote to memory of 2940 1168 ffffrrl.exe 94 PID 2940 wrote to memory of 1304 2940 tntttt.exe 95 PID 2940 wrote to memory of 1304 2940 tntttt.exe 95 PID 2940 wrote to memory of 1304 2940 tntttt.exe 95 PID 1304 wrote to memory of 4020 1304 dpppp.exe 96 PID 1304 wrote to memory of 4020 1304 dpppp.exe 96 PID 1304 wrote to memory of 4020 1304 dpppp.exe 96 PID 4020 wrote to memory of 4700 4020 3httbh.exe 97 PID 4020 wrote to memory of 4700 4020 3httbh.exe 97 PID 4020 wrote to memory of 4700 4020 3httbh.exe 97 PID 4700 wrote to memory of 3116 4700 dvpdv.exe 98 PID 4700 wrote to memory of 3116 4700 dvpdv.exe 98 PID 4700 wrote to memory of 3116 4700 dvpdv.exe 98 PID 3116 wrote to memory of 3016 3116 nhttnt.exe 99 PID 3116 wrote to memory of 3016 3116 nhttnt.exe 99 PID 3116 wrote to memory of 3016 3116 nhttnt.exe 99 PID 3016 wrote to memory of 4772 3016 9thhhn.exe 100 PID 3016 wrote to memory of 4772 3016 9thhhn.exe 100 PID 3016 wrote to memory of 4772 3016 9thhhn.exe 100 PID 4772 wrote to memory of 2744 4772 pdvvd.exe 101 PID 4772 wrote to memory of 2744 4772 pdvvd.exe 101 PID 4772 wrote to memory of 2744 4772 pdvvd.exe 101 PID 2744 wrote to memory of 2488 2744 ttnbtt.exe 102 PID 2744 wrote to memory of 2488 2744 ttnbtt.exe 102 PID 2744 wrote to memory of 2488 2744 ttnbtt.exe 102 PID 2488 wrote to memory of 3776 2488 9tnnbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe"C:\Users\Admin\AppData\Local\Temp\42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\llxrlrl.exec:\llxrlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\hnnhbt.exec:\hnnhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\9nbtnn.exec:\9nbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\ddpjv.exec:\ddpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\lffxxxx.exec:\lffxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\pjvvp.exec:\pjvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\hbnnbh.exec:\hbnnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\hhthhn.exec:\hhthhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\ffrllrr.exec:\ffrllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\tthhtt.exec:\tthhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ffffrrl.exec:\ffffrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\tntttt.exec:\tntttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\dpppp.exec:\dpppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\3httbh.exec:\3httbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\dvpdv.exec:\dvpdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\nhttnt.exec:\nhttnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\9thhhn.exec:\9thhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\pdvvd.exec:\pdvvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\ttnbtt.exec:\ttnbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9tnnbb.exec:\9tnnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\vjjvv.exec:\vjjvv.exe23⤵
- Executes dropped EXE
PID:3776 -
\??\c:\rrxrrrx.exec:\rrxrrrx.exe24⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rxfxxff.exec:\rxfxxff.exe25⤵
- Executes dropped EXE
PID:3364 -
\??\c:\hbhtnh.exec:\hbhtnh.exe26⤵
- Executes dropped EXE
PID:8 -
\??\c:\tnbbbt.exec:\tnbbbt.exe27⤵
- Executes dropped EXE
PID:4468 -
\??\c:\flrrxff.exec:\flrrxff.exe28⤵
- Executes dropped EXE
PID:4400 -
\??\c:\bnttnt.exec:\bnttnt.exe29⤵
- Executes dropped EXE
PID:1824 -
\??\c:\dvvjj.exec:\dvvjj.exe30⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hnbbbb.exec:\hnbbbb.exe31⤵
- Executes dropped EXE
PID:956 -
\??\c:\1jdvj.exec:\1jdvj.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400 -
\??\c:\htbbbh.exec:\htbbbh.exe33⤵
- Executes dropped EXE
PID:2900 -
\??\c:\htnbnh.exec:\htnbnh.exe34⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jdpjp.exec:\jdpjp.exe35⤵
- Executes dropped EXE
PID:4076 -
\??\c:\9vpjd.exec:\9vpjd.exe36⤵
- Executes dropped EXE
PID:4884 -
\??\c:\rxxlfrl.exec:\rxxlfrl.exe37⤵
- Executes dropped EXE
PID:3244 -
\??\c:\nntthn.exec:\nntthn.exe38⤵
- Executes dropped EXE
PID:1140 -
\??\c:\pdjvp.exec:\pdjvp.exe39⤵
- Executes dropped EXE
PID:3468 -
\??\c:\vvvpp.exec:\vvvpp.exe40⤵
- Executes dropped EXE
PID:1036 -
\??\c:\fxrlfff.exec:\fxrlfff.exe41⤵
- Executes dropped EXE
PID:4176 -
\??\c:\1tttnb.exec:\1tttnb.exe42⤵
- Executes dropped EXE
PID:3432 -
\??\c:\jjddv.exec:\jjddv.exe43⤵
- Executes dropped EXE
PID:1208 -
\??\c:\ffrrlrr.exec:\ffrrlrr.exe44⤵
- Executes dropped EXE
PID:4260 -
\??\c:\bbhbbh.exec:\bbhbbh.exe45⤵
- Executes dropped EXE
PID:4888 -
\??\c:\5jppj.exec:\5jppj.exe46⤵
- Executes dropped EXE
PID:4368 -
\??\c:\flffrrf.exec:\flffrrf.exe47⤵
- Executes dropped EXE
PID:908 -
\??\c:\5ttttb.exec:\5ttttb.exe48⤵
- Executes dropped EXE
PID:880 -
\??\c:\3dpdp.exec:\3dpdp.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3jvvv.exec:\3jvvv.exe50⤵
- Executes dropped EXE
PID:3124 -
\??\c:\lfllfll.exec:\lfllfll.exe51⤵
- Executes dropped EXE
PID:4832 -
\??\c:\nhbbbh.exec:\nhbbbh.exe52⤵
- Executes dropped EXE
PID:1048 -
\??\c:\3vvdv.exec:\3vvdv.exe53⤵
- Executes dropped EXE
PID:1520 -
\??\c:\5rxxfrl.exec:\5rxxfrl.exe54⤵
- Executes dropped EXE
PID:3284 -
\??\c:\llllxxf.exec:\llllxxf.exe55⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1httnt.exec:\1httnt.exe56⤵
- Executes dropped EXE
PID:4184 -
\??\c:\pjvvp.exec:\pjvvp.exe57⤵
- Executes dropped EXE
PID:4688 -
\??\c:\ppvvp.exec:\ppvvp.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\5hhhhh.exec:\5hhhhh.exe59⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bnbbbh.exec:\bnbbbh.exe60⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vpvpp.exec:\vpvpp.exe61⤵
- Executes dropped EXE
PID:3820 -
\??\c:\lrllxxx.exec:\lrllxxx.exe62⤵
- Executes dropped EXE
PID:3568 -
\??\c:\thbbbb.exec:\thbbbb.exe63⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nnnnnn.exec:\nnnnnn.exe64⤵
- Executes dropped EXE
PID:816 -
\??\c:\vdddj.exec:\vdddj.exe65⤵
- Executes dropped EXE
PID:4108 -
\??\c:\xrlrxxx.exec:\xrlrxxx.exe66⤵PID:1744
-
\??\c:\nnbbtb.exec:\nnbbtb.exe67⤵PID:2008
-
\??\c:\jpvvv.exec:\jpvvv.exe68⤵PID:3640
-
\??\c:\vvjjj.exec:\vvjjj.exe69⤵PID:3080
-
\??\c:\llffrxr.exec:\llffrxr.exe70⤵PID:932
-
\??\c:\bnttbb.exec:\bnttbb.exe71⤵PID:4428
-
\??\c:\ddpvd.exec:\ddpvd.exe72⤵PID:2128
-
\??\c:\xxlrxxx.exec:\xxlrxxx.exe73⤵PID:4444
-
\??\c:\fllffll.exec:\fllffll.exe74⤵PID:232
-
\??\c:\9bnntb.exec:\9bnntb.exe75⤵PID:3132
-
\??\c:\pvdpv.exec:\pvdpv.exe76⤵PID:1956
-
\??\c:\lfrrflx.exec:\lfrrflx.exe77⤵PID:3776
-
\??\c:\hntbhn.exec:\hntbhn.exe78⤵PID:2488
-
\??\c:\bnbttt.exec:\bnbttt.exe79⤵PID:2372
-
\??\c:\1djjv.exec:\1djjv.exe80⤵PID:4424
-
\??\c:\rxfffff.exec:\rxfffff.exe81⤵PID:1864
-
\??\c:\tnbbtt.exec:\tnbbtt.exe82⤵PID:2216
-
\??\c:\9ddvv.exec:\9ddvv.exe83⤵PID:5112
-
\??\c:\fxffxxx.exec:\fxffxxx.exe84⤵PID:3864
-
\??\c:\nnbbth.exec:\nnbbth.exe85⤵PID:3308
-
\??\c:\tthhtb.exec:\tthhtb.exe86⤵
- System Location Discovery: System Language Discovery
PID:4936 -
\??\c:\vpvpp.exec:\vpvpp.exe87⤵PID:3984
-
\??\c:\llllflf.exec:\llllflf.exe88⤵PID:5076
-
\??\c:\1bhhhb.exec:\1bhhhb.exe89⤵PID:3460
-
\??\c:\ddddd.exec:\ddddd.exe90⤵PID:3332
-
\??\c:\1vddj.exec:\1vddj.exe91⤵PID:1400
-
\??\c:\frrllll.exec:\frrllll.exe92⤵PID:1116
-
\??\c:\bbhhbb.exec:\bbhhbb.exe93⤵PID:644
-
\??\c:\dpvjj.exec:\dpvjj.exe94⤵
- System Location Discovery: System Language Discovery
PID:4076 -
\??\c:\flllfxr.exec:\flllfxr.exe95⤵PID:4884
-
\??\c:\bnhhbb.exec:\bnhhbb.exe96⤵PID:3208
-
\??\c:\vjppj.exec:\vjppj.exe97⤵PID:4668
-
\??\c:\xxxffll.exec:\xxxffll.exe98⤵PID:2696
-
\??\c:\rxrrxxx.exec:\rxrrxxx.exe99⤵PID:1368
-
\??\c:\htbbbh.exec:\htbbbh.exe100⤵PID:4760
-
\??\c:\pvdjj.exec:\pvdjj.exe101⤵PID:3432
-
\??\c:\llffrff.exec:\llffrff.exe102⤵PID:3876
-
\??\c:\lxlllll.exec:\lxlllll.exe103⤵PID:1020
-
\??\c:\nntttt.exec:\nntttt.exe104⤵PID:4888
-
\??\c:\jpddd.exec:\jpddd.exe105⤵PID:772
-
\??\c:\vvjjj.exec:\vvjjj.exe106⤵PID:1800
-
\??\c:\xxrffll.exec:\xxrffll.exe107⤵PID:880
-
\??\c:\nhnttt.exec:\nhnttt.exe108⤵PID:884
-
\??\c:\tnbbbh.exec:\tnbbbh.exe109⤵PID:1452
-
\??\c:\ppddv.exec:\ppddv.exe110⤵PID:1724
-
\??\c:\frxxrxf.exec:\frxxrxf.exe111⤵PID:4540
-
\??\c:\xxrffrf.exec:\xxrffrf.exe112⤵PID:1924
-
\??\c:\htthbn.exec:\htthbn.exe113⤵PID:3996
-
\??\c:\9jvpv.exec:\9jvpv.exe114⤵PID:3284
-
\??\c:\fllllll.exec:\fllllll.exe115⤵PID:4788
-
\??\c:\hthbbb.exec:\hthbbb.exe116⤵PID:4184
-
\??\c:\tbtbtt.exec:\tbtbtt.exe117⤵PID:4688
-
\??\c:\djjjp.exec:\djjjp.exe118⤵
- System Location Discovery: System Language Discovery
PID:2188 -
\??\c:\flllxfr.exec:\flllxfr.exe119⤵PID:1604
-
\??\c:\nhtttt.exec:\nhtttt.exe120⤵PID:2728
-
\??\c:\tbtnnn.exec:\tbtnnn.exe121⤵PID:3820
-
\??\c:\vvddd.exec:\vvddd.exe122⤵PID:3968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-