Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe
-
Size
454KB
-
MD5
df831ba99c8fc23ee2f73ecd4f8c77d0
-
SHA1
af02e6c8c8cdb88692268a27274610cab6a0164c
-
SHA256
6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98
-
SHA512
9908c823edb8cc170bfb4f9f19720224c0963c87682e05aad5f2197770e651add995de1cab1a359148d0f2dc413bfc03b0766bf61e6f8949f7dbaa718dfdca62
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeQ:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4856-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-770-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-875-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-1014-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1668 pvpjj.exe 4612 flllrxx.exe 2196 ttbbbb.exe 3984 bhhhtb.exe 1092 7jddv.exe 4996 xrrrrxx.exe 2880 djpdp.exe 2180 vvjjj.exe 3916 llrrffx.exe 4216 hntnnn.exe 1256 lxxflrx.exe 952 hhntbh.exe 3404 vvddv.exe 2452 flflffr.exe 4480 tntthn.exe 4960 btbthh.exe 812 vdjpv.exe 2848 nttbbb.exe 548 ddpvd.exe 4844 xlfllrx.exe 1624 ddvdp.exe 3112 bbnnnt.exe 3060 nnnnnt.exe 3812 thnhhh.exe 1952 nnhnbh.exe 2320 ntnbnb.exe 3056 rllllll.exe 4440 flfrfrx.exe 1380 nttnhh.exe 1424 jpddv.exe 4940 rlxxrrr.exe 4384 bnhtbt.exe 3092 fxrlxxf.exe 956 btbbtn.exe 4872 vvpjd.exe 1384 nhnnhh.exe 2404 dvppv.exe 1768 jdjdj.exe 3076 7pvvv.exe 4776 fxrlrrx.exe 2892 3bbbtt.exe 2696 vjjdj.exe 3412 xfrlflx.exe 5092 thnttb.exe 5096 vpvpp.exe 3956 rrxlxrr.exe 2484 hthnhn.exe 4968 vpjdd.exe 2292 xfxrrxf.exe 3328 tbtnhh.exe 3756 tthntb.exe 1348 jdppv.exe 1280 xxllllr.exe 952 hbtnnt.exe 1908 tthhhh.exe 2812 1dddv.exe 2940 flxxxfl.exe 1392 hbhhhb.exe 2260 9jjjd.exe 3628 flflfrf.exe 5004 ttnhbh.exe 1548 5jpjj.exe 2540 9xxlflf.exe 880 hbhbbb.exe -
resource yara_rule behavioral2/memory/4856-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-724-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 1668 4856 6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe 82 PID 4856 wrote to memory of 1668 4856 6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe 82 PID 4856 wrote to memory of 1668 4856 6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe 82 PID 1668 wrote to memory of 4612 1668 pvpjj.exe 83 PID 1668 wrote to memory of 4612 1668 pvpjj.exe 83 PID 1668 wrote to memory of 4612 1668 pvpjj.exe 83 PID 4612 wrote to memory of 2196 4612 flllrxx.exe 84 PID 4612 wrote to memory of 2196 4612 flllrxx.exe 84 PID 4612 wrote to memory of 2196 4612 flllrxx.exe 84 PID 2196 wrote to memory of 3984 2196 ttbbbb.exe 85 PID 2196 wrote to memory of 3984 2196 ttbbbb.exe 85 PID 2196 wrote to memory of 3984 2196 ttbbbb.exe 85 PID 3984 wrote to memory of 1092 3984 bhhhtb.exe 86 PID 3984 wrote to memory of 1092 3984 bhhhtb.exe 86 PID 3984 wrote to memory of 1092 3984 bhhhtb.exe 86 PID 1092 wrote to memory of 4996 1092 7jddv.exe 87 PID 1092 wrote to memory of 4996 1092 7jddv.exe 87 PID 1092 wrote to memory of 4996 1092 7jddv.exe 87 PID 4996 wrote to memory of 2880 4996 xrrrrxx.exe 88 PID 4996 wrote to memory of 2880 4996 xrrrrxx.exe 88 PID 4996 wrote to memory of 2880 4996 xrrrrxx.exe 88 PID 2880 wrote to memory of 2180 2880 djpdp.exe 89 PID 2880 wrote to memory of 2180 2880 djpdp.exe 89 PID 2880 wrote to memory of 2180 2880 djpdp.exe 89 PID 2180 wrote to memory of 3916 2180 vvjjj.exe 90 PID 2180 wrote to memory of 3916 2180 vvjjj.exe 90 PID 2180 wrote to memory of 3916 2180 vvjjj.exe 90 PID 3916 wrote to memory of 4216 3916 llrrffx.exe 91 PID 3916 wrote to memory of 4216 3916 llrrffx.exe 91 PID 3916 wrote to memory of 4216 3916 llrrffx.exe 91 PID 4216 wrote to memory of 1256 4216 hntnnn.exe 92 PID 4216 wrote to memory of 1256 4216 hntnnn.exe 92 PID 4216 wrote to memory of 1256 4216 hntnnn.exe 92 PID 1256 wrote to memory of 952 1256 lxxflrx.exe 93 PID 1256 wrote to memory of 952 1256 lxxflrx.exe 93 PID 1256 wrote to memory of 952 1256 lxxflrx.exe 93 PID 952 wrote to memory of 3404 952 hhntbh.exe 94 PID 952 wrote to memory of 3404 952 hhntbh.exe 94 PID 952 wrote to memory of 3404 952 hhntbh.exe 94 PID 3404 wrote to memory of 2452 3404 vvddv.exe 95 PID 3404 wrote to memory of 2452 3404 vvddv.exe 95 PID 3404 wrote to memory of 2452 3404 vvddv.exe 95 PID 2452 wrote to memory of 4480 2452 flflffr.exe 96 PID 2452 wrote to memory of 4480 2452 flflffr.exe 96 PID 2452 wrote to memory of 4480 2452 flflffr.exe 96 PID 4480 wrote to memory of 4960 4480 tntthn.exe 97 PID 4480 wrote to memory of 4960 4480 tntthn.exe 97 PID 4480 wrote to memory of 4960 4480 tntthn.exe 97 PID 4960 wrote to memory of 812 4960 btbthh.exe 98 PID 4960 wrote to memory of 812 4960 btbthh.exe 98 PID 4960 wrote to memory of 812 4960 btbthh.exe 98 PID 812 wrote to memory of 2848 812 vdjpv.exe 99 PID 812 wrote to memory of 2848 812 vdjpv.exe 99 PID 812 wrote to memory of 2848 812 vdjpv.exe 99 PID 2848 wrote to memory of 548 2848 nttbbb.exe 100 PID 2848 wrote to memory of 548 2848 nttbbb.exe 100 PID 2848 wrote to memory of 548 2848 nttbbb.exe 100 PID 548 wrote to memory of 4844 548 ddpvd.exe 101 PID 548 wrote to memory of 4844 548 ddpvd.exe 101 PID 548 wrote to memory of 4844 548 ddpvd.exe 101 PID 4844 wrote to memory of 1624 4844 xlfllrx.exe 102 PID 4844 wrote to memory of 1624 4844 xlfllrx.exe 102 PID 4844 wrote to memory of 1624 4844 xlfllrx.exe 102 PID 1624 wrote to memory of 3112 1624 ddvdp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe"C:\Users\Admin\AppData\Local\Temp\6e784c8314d346cb5cd94be91703292d363170734da4d375b9b467d00cf3ee98N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\pvpjj.exec:\pvpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\flllrxx.exec:\flllrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\ttbbbb.exec:\ttbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\bhhhtb.exec:\bhhhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\7jddv.exec:\7jddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\djpdp.exec:\djpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\vvjjj.exec:\vvjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\llrrffx.exec:\llrrffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\hntnnn.exec:\hntnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\lxxflrx.exec:\lxxflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\hhntbh.exec:\hhntbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\vvddv.exec:\vvddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\flflffr.exec:\flflffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\tntthn.exec:\tntthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\btbthh.exec:\btbthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\vdjpv.exec:\vdjpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\nttbbb.exec:\nttbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\ddpvd.exec:\ddpvd.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\xlfllrx.exec:\xlfllrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\ddvdp.exec:\ddvdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\bbnnnt.exec:\bbnnnt.exe23⤵
- Executes dropped EXE
PID:3112 -
\??\c:\nnnnnt.exec:\nnnnnt.exe24⤵
- Executes dropped EXE
PID:3060 -
\??\c:\thnhhh.exec:\thnhhh.exe25⤵
- Executes dropped EXE
PID:3812 -
\??\c:\nnhnbh.exec:\nnhnbh.exe26⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ntnbnb.exec:\ntnbnb.exe27⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rllllll.exec:\rllllll.exe28⤵
- Executes dropped EXE
PID:3056 -
\??\c:\flfrfrx.exec:\flfrfrx.exe29⤵
- Executes dropped EXE
PID:4440 -
\??\c:\nttnhh.exec:\nttnhh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\jpddv.exec:\jpddv.exe31⤵
- Executes dropped EXE
PID:1424 -
\??\c:\rlxxrrr.exec:\rlxxrrr.exe32⤵
- Executes dropped EXE
PID:4940 -
\??\c:\bnhtbt.exec:\bnhtbt.exe33⤵
- Executes dropped EXE
PID:4384 -
\??\c:\fxrlxxf.exec:\fxrlxxf.exe34⤵
- Executes dropped EXE
PID:3092 -
\??\c:\btbbtn.exec:\btbbtn.exe35⤵
- Executes dropped EXE
PID:956 -
\??\c:\vvpjd.exec:\vvpjd.exe36⤵
- Executes dropped EXE
PID:4872 -
\??\c:\nhnnhh.exec:\nhnnhh.exe37⤵
- Executes dropped EXE
PID:1384 -
\??\c:\dvppv.exec:\dvppv.exe38⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jdjdj.exec:\jdjdj.exe39⤵
- Executes dropped EXE
PID:1768 -
\??\c:\7pvvv.exec:\7pvvv.exe40⤵
- Executes dropped EXE
PID:3076 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe41⤵
- Executes dropped EXE
PID:4776 -
\??\c:\3bbbtt.exec:\3bbbtt.exe42⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vjjdj.exec:\vjjdj.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xfrlflx.exec:\xfrlflx.exe44⤵
- Executes dropped EXE
PID:3412 -
\??\c:\thnttb.exec:\thnttb.exe45⤵
- Executes dropped EXE
PID:5092 -
\??\c:\vpvpp.exec:\vpvpp.exe46⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rrxlxrr.exec:\rrxlxrr.exe47⤵
- Executes dropped EXE
PID:3956 -
\??\c:\hthnhn.exec:\hthnhn.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpjdd.exec:\vpjdd.exe49⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xfxrrxf.exec:\xfxrrxf.exe50⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tbtnhh.exec:\tbtnhh.exe51⤵
- Executes dropped EXE
PID:3328 -
\??\c:\tthntb.exec:\tthntb.exe52⤵
- Executes dropped EXE
PID:3756 -
\??\c:\jdppv.exec:\jdppv.exe53⤵
- Executes dropped EXE
PID:1348 -
\??\c:\xxllllr.exec:\xxllllr.exe54⤵
- Executes dropped EXE
PID:1280 -
\??\c:\hbtnnt.exec:\hbtnnt.exe55⤵
- Executes dropped EXE
PID:952 -
\??\c:\tthhhh.exec:\tthhhh.exe56⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1dddv.exec:\1dddv.exe57⤵
- Executes dropped EXE
PID:2812 -
\??\c:\flxxxfl.exec:\flxxxfl.exe58⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hbhhhb.exec:\hbhhhb.exe59⤵
- Executes dropped EXE
PID:1392 -
\??\c:\9jjjd.exec:\9jjjd.exe60⤵
- Executes dropped EXE
PID:2260 -
\??\c:\flflfrf.exec:\flflfrf.exe61⤵
- Executes dropped EXE
PID:3628 -
\??\c:\ttnhbh.exec:\ttnhbh.exe62⤵
- Executes dropped EXE
PID:5004 -
\??\c:\5jpjj.exec:\5jpjj.exe63⤵
- Executes dropped EXE
PID:1548 -
\??\c:\9xxlflf.exec:\9xxlflf.exe64⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hbhbbb.exec:\hbhbbb.exe65⤵
- Executes dropped EXE
PID:880 -
\??\c:\jvdvv.exec:\jvdvv.exe66⤵PID:2124
-
\??\c:\xrfllrr.exec:\xrfllrr.exe67⤵PID:1648
-
\??\c:\thbbbh.exec:\thbbbh.exe68⤵PID:1624
-
\??\c:\7djvv.exec:\7djvv.exe69⤵PID:4420
-
\??\c:\xrlllxl.exec:\xrlllxl.exe70⤵PID:3140
-
\??\c:\bhnbnn.exec:\bhnbnn.exe71⤵PID:3760
-
\??\c:\tbnnnt.exec:\tbnnnt.exe72⤵PID:3444
-
\??\c:\1pddj.exec:\1pddj.exe73⤵PID:4972
-
\??\c:\llfflxf.exec:\llfflxf.exe74⤵PID:2036
-
\??\c:\tnhhhn.exec:\tnhhhn.exe75⤵PID:4456
-
\??\c:\jpjvp.exec:\jpjvp.exe76⤵PID:4060
-
\??\c:\5lfffrr.exec:\5lfffrr.exe77⤵PID:2768
-
\??\c:\tntnnn.exec:\tntnnn.exe78⤵PID:932
-
\??\c:\vdjpv.exec:\vdjpv.exe79⤵PID:3220
-
\??\c:\7jddd.exec:\7jddd.exe80⤵
- System Location Discovery: System Language Discovery
PID:4200 -
\??\c:\xffxrrl.exec:\xffxrrl.exe81⤵PID:2828
-
\??\c:\9bbbtt.exec:\9bbbtt.exe82⤵PID:4440
-
\??\c:\7dppv.exec:\7dppv.exe83⤵PID:3608
-
\??\c:\xxflllr.exec:\xxflllr.exe84⤵PID:3836
-
\??\c:\1nnnht.exec:\1nnnht.exe85⤵PID:3484
-
\??\c:\dpvvv.exec:\dpvvv.exe86⤵PID:4120
-
\??\c:\9pdjp.exec:\9pdjp.exe87⤵PID:4040
-
\??\c:\3tbhhn.exec:\3tbhhn.exe88⤵PID:3732
-
\??\c:\btnnnh.exec:\btnnnh.exe89⤵PID:1252
-
\??\c:\jdvdd.exec:\jdvdd.exe90⤵PID:2896
-
\??\c:\3dddj.exec:\3dddj.exe91⤵PID:1096
-
\??\c:\ttttnt.exec:\ttttnt.exe92⤵PID:1956
-
\??\c:\ntbbbn.exec:\ntbbbn.exe93⤵PID:2248
-
\??\c:\vvvpv.exec:\vvvpv.exe94⤵PID:1860
-
\??\c:\xrllfff.exec:\xrllfff.exe95⤵PID:4424
-
\??\c:\nhbbhh.exec:\nhbbhh.exe96⤵PID:3988
-
\??\c:\1jpjp.exec:\1jpjp.exe97⤵PID:3208
-
\??\c:\rxxrllf.exec:\rxxrllf.exe98⤵PID:4320
-
\??\c:\nhhbtn.exec:\nhhbtn.exe99⤵PID:4300
-
\??\c:\5nhntt.exec:\5nhntt.exe100⤵PID:1700
-
\??\c:\ppvpp.exec:\ppvpp.exe101⤵PID:2116
-
\??\c:\rlrrxrr.exec:\rlrrxrr.exe102⤵PID:1524
-
\??\c:\bbnhbb.exec:\bbnhbb.exe103⤵PID:4204
-
\??\c:\7pvpj.exec:\7pvpj.exe104⤵PID:4612
-
\??\c:\rfffxxr.exec:\rfffxxr.exe105⤵PID:1444
-
\??\c:\xxllxff.exec:\xxllxff.exe106⤵PID:3864
-
\??\c:\1ttnnn.exec:\1ttnnn.exe107⤵PID:4616
-
\??\c:\5vdvd.exec:\5vdvd.exe108⤵PID:3412
-
\??\c:\ffffxrl.exec:\ffffxrl.exe109⤵PID:3132
-
\??\c:\tthhnt.exec:\tthhnt.exe110⤵PID:1268
-
\??\c:\5djjd.exec:\5djjd.exe111⤵PID:732
-
\??\c:\7rxfxfx.exec:\7rxfxfx.exe112⤵PID:1696
-
\??\c:\lffxlll.exec:\lffxlll.exe113⤵PID:4764
-
\??\c:\hhnttb.exec:\hhnttb.exe114⤵PID:4632
-
\??\c:\9dpvv.exec:\9dpvv.exe115⤵PID:464
-
\??\c:\ppvvv.exec:\ppvvv.exe116⤵PID:5116
-
\??\c:\lfffflr.exec:\lfffflr.exe117⤵PID:2244
-
\??\c:\hnbhhh.exec:\hnbhhh.exe118⤵PID:2284
-
\??\c:\ttbnhb.exec:\ttbnhb.exe119⤵PID:748
-
\??\c:\jjpvv.exec:\jjpvv.exe120⤵PID:3700
-
\??\c:\llxfrxr.exec:\llxfrxr.exe121⤵PID:2800
-
\??\c:\nnbbbh.exec:\nnbbbh.exe122⤵PID:4560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-