Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 22:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe
-
Size
453KB
-
MD5
94da7d64bbcaa3d3eac8984cc2c7131d
-
SHA1
7012e588c2711449d5658246a2d47049d9f47e02
-
SHA256
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82
-
SHA512
703ee914dea5cc2c63a17079e1db7404f6deec62e65c5016bbe030b9a572151a4b59c36d3a27f2749df2a0529e7bf10bb68252709ea4aa8154971d524d09e520
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/1180-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-1132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-1131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-1594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2028 7xrrrxx.exe 1172 jjjdd.exe 3756 xrxrrlr.exe 2760 bttnnn.exe 2808 vvddd.exe 772 5llflrl.exe 2904 dpvpj.exe 3948 tbtnnt.exe 3592 rrxrxrr.exe 4836 htbtnn.exe 3520 vppjj.exe 2660 hbbtnh.exe 2220 7vvpp.exe 4496 hhhnnn.exe 4260 ddpjj.exe 1476 xxrllff.exe 4516 dvvvj.exe 3092 lfxxrrr.exe 1268 bbttbb.exe 2204 vvppp.exe 2476 nbhnnb.exe 5056 rllxrfr.exe 4856 nbnbth.exe 4604 jvjdv.exe 3536 pvjdd.exe 1196 xlxffxf.exe 2300 fxllfxx.exe 2160 xxfffff.exe 3980 dpppd.exe 1112 1bhbbn.exe 4820 pdjpj.exe 2792 hhhhbn.exe 2360 1jvpv.exe 1580 hhbtth.exe 3912 dvvvv.exe 2800 fxrxrlf.exe 1308 nnnbbh.exe 3412 jjddj.exe 2436 httnhh.exe 3588 3htnnt.exe 3360 llrxrrr.exe 4712 bbhhhh.exe 4532 jvjdp.exe 396 tbhbtn.exe 1980 vddpd.exe 4960 xlrffll.exe 3148 nnttnn.exe 3284 djjjv.exe 1696 vpvvp.exe 4352 xlrrxxr.exe 1472 ttbbhh.exe 856 1jvvv.exe 4740 rxllxfl.exe 1416 nbbtnh.exe 4304 dpjvv.exe 4784 rxxxxxr.exe 1124 bnbhhn.exe 2808 pdjvp.exe 2676 1rllrrl.exe 1492 hhnnbb.exe 4876 ppvvp.exe 4408 rlllfll.exe 2124 llxxlll.exe 1844 5pdvp.exe -
resource yara_rule behavioral2/memory/1180-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-1132-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1180 wrote to memory of 2028 1180 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 83 PID 1180 wrote to memory of 2028 1180 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 83 PID 1180 wrote to memory of 2028 1180 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 83 PID 2028 wrote to memory of 1172 2028 7xrrrxx.exe 84 PID 2028 wrote to memory of 1172 2028 7xrrrxx.exe 84 PID 2028 wrote to memory of 1172 2028 7xrrrxx.exe 84 PID 1172 wrote to memory of 3756 1172 jjjdd.exe 85 PID 1172 wrote to memory of 3756 1172 jjjdd.exe 85 PID 1172 wrote to memory of 3756 1172 jjjdd.exe 85 PID 3756 wrote to memory of 2760 3756 xrxrrlr.exe 86 PID 3756 wrote to memory of 2760 3756 xrxrrlr.exe 86 PID 3756 wrote to memory of 2760 3756 xrxrrlr.exe 86 PID 2760 wrote to memory of 2808 2760 bttnnn.exe 87 PID 2760 wrote to memory of 2808 2760 bttnnn.exe 87 PID 2760 wrote to memory of 2808 2760 bttnnn.exe 87 PID 2808 wrote to memory of 772 2808 vvddd.exe 88 PID 2808 wrote to memory of 772 2808 vvddd.exe 88 PID 2808 wrote to memory of 772 2808 vvddd.exe 88 PID 772 wrote to memory of 2904 772 5llflrl.exe 89 PID 772 wrote to memory of 2904 772 5llflrl.exe 89 PID 772 wrote to memory of 2904 772 5llflrl.exe 89 PID 2904 wrote to memory of 3948 2904 dpvpj.exe 90 PID 2904 wrote to memory of 3948 2904 dpvpj.exe 90 PID 2904 wrote to memory of 3948 2904 dpvpj.exe 90 PID 3948 wrote to memory of 3592 3948 tbtnnt.exe 91 PID 3948 wrote to memory of 3592 3948 tbtnnt.exe 91 PID 3948 wrote to memory of 3592 3948 tbtnnt.exe 91 PID 3592 wrote to memory of 4836 3592 rrxrxrr.exe 92 PID 3592 wrote to memory of 4836 3592 rrxrxrr.exe 92 PID 3592 wrote to memory of 4836 3592 rrxrxrr.exe 92 PID 4836 wrote to memory of 3520 4836 htbtnn.exe 93 PID 4836 wrote to memory of 3520 4836 htbtnn.exe 93 PID 4836 wrote to memory of 3520 4836 htbtnn.exe 93 PID 3520 wrote to memory of 2660 3520 vppjj.exe 94 PID 3520 wrote to memory of 2660 3520 vppjj.exe 94 PID 3520 wrote to memory of 2660 3520 vppjj.exe 94 PID 2660 wrote to memory of 2220 2660 hbbtnh.exe 95 PID 2660 wrote to memory of 2220 2660 hbbtnh.exe 95 PID 2660 wrote to memory of 2220 2660 hbbtnh.exe 95 PID 2220 wrote to memory of 4496 2220 7vvpp.exe 96 PID 2220 wrote to memory of 4496 2220 7vvpp.exe 96 PID 2220 wrote to memory of 4496 2220 7vvpp.exe 96 PID 4496 wrote to memory of 4260 4496 hhhnnn.exe 97 PID 4496 wrote to memory of 4260 4496 hhhnnn.exe 97 PID 4496 wrote to memory of 4260 4496 hhhnnn.exe 97 PID 4260 wrote to memory of 1476 4260 ddpjj.exe 98 PID 4260 wrote to memory of 1476 4260 ddpjj.exe 98 PID 4260 wrote to memory of 1476 4260 ddpjj.exe 98 PID 1476 wrote to memory of 4516 1476 xxrllff.exe 99 PID 1476 wrote to memory of 4516 1476 xxrllff.exe 99 PID 1476 wrote to memory of 4516 1476 xxrllff.exe 99 PID 4516 wrote to memory of 3092 4516 dvvvj.exe 100 PID 4516 wrote to memory of 3092 4516 dvvvj.exe 100 PID 4516 wrote to memory of 3092 4516 dvvvj.exe 100 PID 3092 wrote to memory of 1268 3092 lfxxrrr.exe 101 PID 3092 wrote to memory of 1268 3092 lfxxrrr.exe 101 PID 3092 wrote to memory of 1268 3092 lfxxrrr.exe 101 PID 1268 wrote to memory of 2204 1268 bbttbb.exe 102 PID 1268 wrote to memory of 2204 1268 bbttbb.exe 102 PID 1268 wrote to memory of 2204 1268 bbttbb.exe 102 PID 2204 wrote to memory of 2476 2204 vvppp.exe 103 PID 2204 wrote to memory of 2476 2204 vvppp.exe 103 PID 2204 wrote to memory of 2476 2204 vvppp.exe 103 PID 2476 wrote to memory of 5056 2476 nbhnnb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe"C:\Users\Admin\AppData\Local\Temp\42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\7xrrrxx.exec:\7xrrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\jjjdd.exec:\jjjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\xrxrrlr.exec:\xrxrrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\bttnnn.exec:\bttnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vvddd.exec:\vvddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\5llflrl.exec:\5llflrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\dpvpj.exec:\dpvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\tbtnnt.exec:\tbtnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\rrxrxrr.exec:\rrxrxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\htbtnn.exec:\htbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\vppjj.exec:\vppjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\hbbtnh.exec:\hbbtnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\7vvpp.exec:\7vvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\hhhnnn.exec:\hhhnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\ddpjj.exec:\ddpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\xxrllff.exec:\xxrllff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\dvvvj.exec:\dvvvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\bbttbb.exec:\bbttbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\vvppp.exec:\vvppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\nbhnnb.exec:\nbhnnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rllxrfr.exec:\rllxrfr.exe23⤵
- Executes dropped EXE
PID:5056 -
\??\c:\nbnbth.exec:\nbnbth.exe24⤵
- Executes dropped EXE
PID:4856 -
\??\c:\jvjdv.exec:\jvjdv.exe25⤵
- Executes dropped EXE
PID:4604 -
\??\c:\pvjdd.exec:\pvjdd.exe26⤵
- Executes dropped EXE
PID:3536 -
\??\c:\xlxffxf.exec:\xlxffxf.exe27⤵
- Executes dropped EXE
PID:1196 -
\??\c:\fxllfxx.exec:\fxllfxx.exe28⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xxfffff.exec:\xxfffff.exe29⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dpppd.exec:\dpppd.exe30⤵
- Executes dropped EXE
PID:3980 -
\??\c:\1bhbbn.exec:\1bhbbn.exe31⤵
- Executes dropped EXE
PID:1112 -
\??\c:\pdjpj.exec:\pdjpj.exe32⤵
- Executes dropped EXE
PID:4820 -
\??\c:\hhhhbn.exec:\hhhhbn.exe33⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1jvpv.exec:\1jvpv.exe34⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hhbtth.exec:\hhbtth.exe35⤵
- Executes dropped EXE
PID:1580 -
\??\c:\dvvvv.exec:\dvvvv.exe36⤵
- Executes dropped EXE
PID:3912 -
\??\c:\fxrxrlf.exec:\fxrxrlf.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nnnbbh.exec:\nnnbbh.exe38⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jjddj.exec:\jjddj.exe39⤵
- Executes dropped EXE
PID:3412 -
\??\c:\httnhh.exec:\httnhh.exe40⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3htnnt.exec:\3htnnt.exe41⤵
- Executes dropped EXE
PID:3588 -
\??\c:\llrxrrr.exec:\llrxrrr.exe42⤵
- Executes dropped EXE
PID:3360 -
\??\c:\bbhhhh.exec:\bbhhhh.exe43⤵
- Executes dropped EXE
PID:4712 -
\??\c:\jvjdp.exec:\jvjdp.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4532 -
\??\c:\tbhbtn.exec:\tbhbtn.exe45⤵
- Executes dropped EXE
PID:396 -
\??\c:\vddpd.exec:\vddpd.exe46⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xlrffll.exec:\xlrffll.exe47⤵
- Executes dropped EXE
PID:4960 -
\??\c:\nnttnn.exec:\nnttnn.exe48⤵
- Executes dropped EXE
PID:3148 -
\??\c:\djjjv.exec:\djjjv.exe49⤵
- Executes dropped EXE
PID:3284 -
\??\c:\vpvvp.exec:\vpvvp.exe50⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xlrrxxr.exec:\xlrrxxr.exe51⤵
- Executes dropped EXE
PID:4352 -
\??\c:\ttbbhh.exec:\ttbbhh.exe52⤵
- Executes dropped EXE
PID:1472 -
\??\c:\1jvvv.exec:\1jvvv.exe53⤵
- Executes dropped EXE
PID:856 -
\??\c:\rxllxfl.exec:\rxllxfl.exe54⤵
- Executes dropped EXE
PID:4740 -
\??\c:\nbbtnh.exec:\nbbtnh.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1416 -
\??\c:\dpjvv.exec:\dpjvv.exe56⤵
- Executes dropped EXE
PID:4304 -
\??\c:\rxxxxxr.exec:\rxxxxxr.exe57⤵
- Executes dropped EXE
PID:4784 -
\??\c:\bnbhhn.exec:\bnbhhn.exe58⤵
- Executes dropped EXE
PID:1124 -
\??\c:\pdjvp.exec:\pdjvp.exe59⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1rllrrl.exec:\1rllrrl.exe60⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hhnnbb.exec:\hhnnbb.exe61⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ppvvp.exec:\ppvvp.exe62⤵
- Executes dropped EXE
PID:4876 -
\??\c:\rlllfll.exec:\rlllfll.exe63⤵
- Executes dropped EXE
PID:4408 -
\??\c:\llxxlll.exec:\llxxlll.exe64⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5pdvp.exec:\5pdvp.exe65⤵
- Executes dropped EXE
PID:1844 -
\??\c:\lllxrxr.exec:\lllxrxr.exe66⤵PID:3732
-
\??\c:\flrrfrl.exec:\flrrfrl.exe67⤵PID:116
-
\??\c:\9hbttt.exec:\9hbttt.exe68⤵PID:4464
-
\??\c:\jdvpp.exec:\jdvpp.exe69⤵PID:2952
-
\??\c:\lllfffx.exec:\lllfffx.exe70⤵PID:4760
-
\??\c:\thhnbb.exec:\thhnbb.exe71⤵PID:4932
-
\??\c:\ppppv.exec:\ppppv.exe72⤵PID:2280
-
\??\c:\lxxrfrl.exec:\lxxrfrl.exe73⤵PID:4928
-
\??\c:\llfffrr.exec:\llfffrr.exe74⤵PID:4776
-
\??\c:\htnttb.exec:\htnttb.exe75⤵PID:3448
-
\??\c:\nbhnht.exec:\nbhnht.exe76⤵PID:3112
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe77⤵PID:3640
-
\??\c:\ttthbt.exec:\ttthbt.exe78⤵PID:4772
-
\??\c:\dpdvp.exec:\dpdvp.exe79⤵PID:4032
-
\??\c:\jdjvv.exec:\jdjvv.exe80⤵PID:2640
-
\??\c:\lrlfrxf.exec:\lrlfrxf.exe81⤵PID:5056
-
\??\c:\nbbhhn.exec:\nbbhhn.exe82⤵PID:4580
-
\??\c:\vppdd.exec:\vppdd.exe83⤵PID:5092
-
\??\c:\llllfll.exec:\llllfll.exe84⤵PID:2120
-
\??\c:\btbttt.exec:\btbttt.exe85⤵PID:4220
-
\??\c:\thhhhh.exec:\thhhhh.exe86⤵PID:2684
-
\??\c:\jpppj.exec:\jpppj.exe87⤵PID:1196
-
\??\c:\lllllll.exec:\lllllll.exe88⤵PID:4828
-
\??\c:\5nnnnn.exec:\5nnnnn.exe89⤵PID:4440
-
\??\c:\ththbb.exec:\ththbb.exe90⤵PID:4768
-
\??\c:\jddvv.exec:\jddvv.exe91⤵PID:4936
-
\??\c:\rrfxllf.exec:\rrfxllf.exe92⤵PID:1456
-
\??\c:\nnntnn.exec:\nnntnn.exe93⤵PID:4436
-
\??\c:\hhhbnt.exec:\hhhbnt.exe94⤵PID:1092
-
\??\c:\xrrfxrr.exec:\xrrfxrr.exe95⤵PID:2556
-
\??\c:\ffrfrrf.exec:\ffrfrrf.exe96⤵PID:4088
-
\??\c:\tthbhh.exec:\tthbhh.exe97⤵PID:4492
-
\??\c:\1pppp.exec:\1pppp.exe98⤵PID:3912
-
\??\c:\pvjjd.exec:\pvjjd.exe99⤵PID:1068
-
\??\c:\lrffxxx.exec:\lrffxxx.exe100⤵PID:448
-
\??\c:\3tnnnt.exec:\3tnnnt.exe101⤵PID:2492
-
\??\c:\ppppp.exec:\ppppp.exe102⤵PID:1048
-
\??\c:\xlxrlff.exec:\xlxrlff.exe103⤵PID:4140
-
\??\c:\hhbnbt.exec:\hhbnbt.exe104⤵PID:1836
-
\??\c:\7pvvv.exec:\7pvvv.exe105⤵PID:5064
-
\??\c:\9dpjv.exec:\9dpjv.exe106⤵PID:4152
-
\??\c:\rrxxxff.exec:\rrxxxff.exe107⤵PID:4556
-
\??\c:\jvjdv.exec:\jvjdv.exe108⤵PID:1800
-
\??\c:\vvjpp.exec:\vvjpp.exe109⤵PID:736
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe110⤵PID:3464
-
\??\c:\thtnhb.exec:\thtnhb.exe111⤵PID:4328
-
\??\c:\1ppjd.exec:\1ppjd.exe112⤵PID:3920
-
\??\c:\fxllrfr.exec:\fxllrfr.exe113⤵PID:2288
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe114⤵PID:1384
-
\??\c:\7hhbtt.exec:\7hhbtt.exe115⤵PID:2016
-
\??\c:\9jvvp.exec:\9jvvp.exe116⤵PID:1884
-
\??\c:\flxrlll.exec:\flxrlll.exe117⤵PID:3904
-
\??\c:\tbhhhh.exec:\tbhhhh.exe118⤵PID:3612
-
\??\c:\dvpjv.exec:\dvpjv.exe119⤵PID:2284
-
\??\c:\jjppp.exec:\jjppp.exe120⤵PID:3824
-
\??\c:\lxfffff.exec:\lxfffff.exe121⤵PID:1908
-
\??\c:\7bbttt.exec:\7bbttt.exe122⤵PID:772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-