Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d1f63fca869d18f89f09166421819a4218c974ae8fd08bc353aceec24e76ede7.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d1f63fca869d18f89f09166421819a4218c974ae8fd08bc353aceec24e76ede7.exe
-
Size
454KB
-
MD5
9aa9e31bb29f925325b8287e25d98215
-
SHA1
aac5aab2676ccc4dd3dd94b9c4a12c8ecef94fab
-
SHA256
d1f63fca869d18f89f09166421819a4218c974ae8fd08bc353aceec24e76ede7
-
SHA512
728cbd141fa718fdab45ac139591459cd2211cba2c240b28c37cd8030475f264b93a9c0840c0a2767bd15937a7e1e16ad6f16c37b040cad57e8d6530971ffda7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4656-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/508-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/828-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-968-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-1002-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-1028-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-1352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-1425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1544 bhnbnh.exe 3904 frxlfxr.exe 1200 jpdvv.exe 5000 bttnnn.exe 4876 fxfflll.exe 508 jvdvp.exe 4948 dvjdv.exe 1528 fxxrllf.exe 1852 xllfxrr.exe 4092 jvddv.exe 1148 hthbnb.exe 3012 vpjdv.exe 212 vppjj.exe 208 rrfxffx.exe 4968 rfllfxx.exe 1552 hnbbbh.exe 4304 ppvpj.exe 2828 rlrrllx.exe 1476 bhnhbt.exe 4676 dpjdd.exe 3728 ffxrlfr.exe 3236 vdjvp.exe 4704 pjpjp.exe 1308 lxlfxrl.exe 3864 djvpv.exe 1784 nnbtbb.exe 3156 xrlfrlf.exe 3684 dpjjj.exe 3016 rlxxrll.exe 3168 tnbttn.exe 2068 5ppdv.exe 4404 tnbbnt.exe 5068 pvddd.exe 2584 tnnnnn.exe 1996 rlrrrrr.exe 3288 ththbn.exe 5060 jdpdv.exe 2036 rlrllll.exe 4160 hntnbt.exe 2944 hbhnnb.exe 4460 7vjdv.exe 828 lxfxlfx.exe 2640 hhbnhb.exe 1992 htbttn.exe 4256 rxrxrlf.exe 3904 lfrflfx.exe 1480 hbhbtn.exe 824 vpjdv.exe 4284 ffllfxr.exe 2656 nbbnhh.exe 1404 5jjdv.exe 3992 djvjd.exe 4680 xxlfrlr.exe 4752 hnnbtn.exe 3060 vjjvp.exe 1816 llrfxlf.exe 1324 1bbthh.exe 228 btbnhh.exe 1468 pdpjj.exe 2768 xfrflxf.exe 3308 xlrlfff.exe 4888 thhbnh.exe 4684 pjpjd.exe 2444 xlrlfxx.exe -
resource yara_rule behavioral2/memory/4656-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/508-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/828-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-968-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-1352-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4656 wrote to memory of 1544 4656 d1f63fca869d18f89f09166421819a4218c974ae8fd08bc353aceec24e76ede7.exe 82 PID 4656 wrote to memory of 1544 4656 d1f63fca869d18f89f09166421819a4218c974ae8fd08bc353aceec24e76ede7.exe 82 PID 4656 wrote to memory of 1544 4656 d1f63fca869d18f89f09166421819a4218c974ae8fd08bc353aceec24e76ede7.exe 82 PID 1544 wrote to memory of 3904 1544 bhnbnh.exe 83 PID 1544 wrote to memory of 3904 1544 bhnbnh.exe 83 PID 1544 wrote to memory of 3904 1544 bhnbnh.exe 83 PID 3904 wrote to memory of 1200 3904 frxlfxr.exe 84 PID 3904 wrote to memory of 1200 3904 frxlfxr.exe 84 PID 3904 wrote to memory of 1200 3904 frxlfxr.exe 84 PID 1200 wrote to memory of 5000 1200 jpdvv.exe 85 PID 1200 wrote to memory of 5000 1200 jpdvv.exe 85 PID 1200 wrote to memory of 5000 1200 jpdvv.exe 85 PID 5000 wrote to memory of 4876 5000 bttnnn.exe 86 PID 5000 wrote to memory of 4876 5000 bttnnn.exe 86 PID 5000 wrote to memory of 4876 5000 bttnnn.exe 86 PID 4876 wrote to memory of 508 4876 fxfflll.exe 87 PID 4876 wrote to memory of 508 4876 fxfflll.exe 87 PID 4876 wrote to memory of 508 4876 fxfflll.exe 87 PID 508 wrote to memory of 4948 508 jvdvp.exe 88 PID 508 wrote to memory of 4948 508 jvdvp.exe 88 PID 508 wrote to memory of 4948 508 jvdvp.exe 88 PID 4948 wrote to memory of 1528 4948 dvjdv.exe 89 PID 4948 wrote to memory of 1528 4948 dvjdv.exe 89 PID 4948 wrote to memory of 1528 4948 dvjdv.exe 89 PID 1528 wrote to memory of 1852 1528 fxxrllf.exe 90 PID 1528 wrote to memory of 1852 1528 fxxrllf.exe 90 PID 1528 wrote to memory of 1852 1528 fxxrllf.exe 90 PID 1852 wrote to memory of 4092 1852 xllfxrr.exe 91 PID 1852 wrote to memory of 4092 1852 xllfxrr.exe 91 PID 1852 wrote to memory of 4092 1852 xllfxrr.exe 91 PID 4092 wrote to memory of 1148 4092 jvddv.exe 92 PID 4092 wrote to memory of 1148 4092 jvddv.exe 92 PID 4092 wrote to memory of 1148 4092 jvddv.exe 92 PID 1148 wrote to memory of 3012 1148 hthbnb.exe 93 PID 1148 wrote to memory of 3012 1148 hthbnb.exe 93 PID 1148 wrote to memory of 3012 1148 hthbnb.exe 93 PID 3012 wrote to memory of 212 3012 vpjdv.exe 94 PID 3012 wrote to memory of 212 3012 vpjdv.exe 94 PID 3012 wrote to memory of 212 3012 vpjdv.exe 94 PID 212 wrote to memory of 208 212 vppjj.exe 95 PID 212 wrote to memory of 208 212 vppjj.exe 95 PID 212 wrote to memory of 208 212 vppjj.exe 95 PID 208 wrote to memory of 4968 208 rrfxffx.exe 96 PID 208 wrote to memory of 4968 208 rrfxffx.exe 96 PID 208 wrote to memory of 4968 208 rrfxffx.exe 96 PID 4968 wrote to memory of 1552 4968 rfllfxx.exe 97 PID 4968 wrote to memory of 1552 4968 rfllfxx.exe 97 PID 4968 wrote to memory of 1552 4968 rfllfxx.exe 97 PID 1552 wrote to memory of 4304 1552 hnbbbh.exe 98 PID 1552 wrote to memory of 4304 1552 hnbbbh.exe 98 PID 1552 wrote to memory of 4304 1552 hnbbbh.exe 98 PID 4304 wrote to memory of 2828 4304 ppvpj.exe 99 PID 4304 wrote to memory of 2828 4304 ppvpj.exe 99 PID 4304 wrote to memory of 2828 4304 ppvpj.exe 99 PID 2828 wrote to memory of 1476 2828 rlrrllx.exe 100 PID 2828 wrote to memory of 1476 2828 rlrrllx.exe 100 PID 2828 wrote to memory of 1476 2828 rlrrllx.exe 100 PID 1476 wrote to memory of 4676 1476 bhnhbt.exe 101 PID 1476 wrote to memory of 4676 1476 bhnhbt.exe 101 PID 1476 wrote to memory of 4676 1476 bhnhbt.exe 101 PID 4676 wrote to memory of 3728 4676 dpjdd.exe 102 PID 4676 wrote to memory of 3728 4676 dpjdd.exe 102 PID 4676 wrote to memory of 3728 4676 dpjdd.exe 102 PID 3728 wrote to memory of 3236 3728 ffxrlfr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1f63fca869d18f89f09166421819a4218c974ae8fd08bc353aceec24e76ede7.exe"C:\Users\Admin\AppData\Local\Temp\d1f63fca869d18f89f09166421819a4218c974ae8fd08bc353aceec24e76ede7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\bhnbnh.exec:\bhnbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\frxlfxr.exec:\frxlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\jpdvv.exec:\jpdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\bttnnn.exec:\bttnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\fxfflll.exec:\fxfflll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\jvdvp.exec:\jvdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\dvjdv.exec:\dvjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\fxxrllf.exec:\fxxrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xllfxrr.exec:\xllfxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\jvddv.exec:\jvddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\hthbnb.exec:\hthbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\vpjdv.exec:\vpjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vppjj.exec:\vppjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\rrfxffx.exec:\rrfxffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\rfllfxx.exec:\rfllfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\hnbbbh.exec:\hnbbbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\ppvpj.exec:\ppvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\rlrrllx.exec:\rlrrllx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\bhnhbt.exec:\bhnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\dpjdd.exec:\dpjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\ffxrlfr.exec:\ffxrlfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\vdjvp.exec:\vdjvp.exe23⤵
- Executes dropped EXE
PID:3236 -
\??\c:\pjpjp.exec:\pjpjp.exe24⤵
- Executes dropped EXE
PID:4704 -
\??\c:\lxlfxrl.exec:\lxlfxrl.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\djvpv.exec:\djvpv.exe26⤵
- Executes dropped EXE
PID:3864 -
\??\c:\nnbtbb.exec:\nnbtbb.exe27⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe28⤵
- Executes dropped EXE
PID:3156 -
\??\c:\dpjjj.exec:\dpjjj.exe29⤵
- Executes dropped EXE
PID:3684 -
\??\c:\rlxxrll.exec:\rlxxrll.exe30⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tnbttn.exec:\tnbttn.exe31⤵
- Executes dropped EXE
PID:3168 -
\??\c:\5ppdv.exec:\5ppdv.exe32⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tnbbnt.exec:\tnbbnt.exe33⤵
- Executes dropped EXE
PID:4404 -
\??\c:\pvddd.exec:\pvddd.exe34⤵
- Executes dropped EXE
PID:5068 -
\??\c:\tnnnnn.exec:\tnnnnn.exe35⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe36⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ththbn.exec:\ththbn.exe37⤵
- Executes dropped EXE
PID:3288 -
\??\c:\jdpdv.exec:\jdpdv.exe38⤵
- Executes dropped EXE
PID:5060 -
\??\c:\rlrllll.exec:\rlrllll.exe39⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hntnbt.exec:\hntnbt.exe40⤵
- Executes dropped EXE
PID:4160 -
\??\c:\hbhnnb.exec:\hbhnnb.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7vjdv.exec:\7vjdv.exe42⤵
- Executes dropped EXE
PID:4460 -
\??\c:\lxfxlfx.exec:\lxfxlfx.exe43⤵
- Executes dropped EXE
PID:828 -
\??\c:\hhbnhb.exec:\hhbnhb.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\htbttn.exec:\htbttn.exe45⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rxrxrlf.exec:\rxrxrlf.exe46⤵
- Executes dropped EXE
PID:4256 -
\??\c:\lfrflfx.exec:\lfrflfx.exe47⤵
- Executes dropped EXE
PID:3904 -
\??\c:\hbhbtn.exec:\hbhbtn.exe48⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vpjdv.exec:\vpjdv.exe49⤵
- Executes dropped EXE
PID:824 -
\??\c:\ffllfxr.exec:\ffllfxr.exe50⤵
- Executes dropped EXE
PID:4284 -
\??\c:\nbbnhh.exec:\nbbnhh.exe51⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5jjdv.exec:\5jjdv.exe52⤵
- Executes dropped EXE
PID:1404 -
\??\c:\djvjd.exec:\djvjd.exe53⤵
- Executes dropped EXE
PID:3992 -
\??\c:\xxlfrlr.exec:\xxlfrlr.exe54⤵
- Executes dropped EXE
PID:4680 -
\??\c:\hnnbtn.exec:\hnnbtn.exe55⤵
- Executes dropped EXE
PID:4752 -
\??\c:\vjjvp.exec:\vjjvp.exe56⤵
- Executes dropped EXE
PID:3060 -
\??\c:\llrfxlf.exec:\llrfxlf.exe57⤵
- Executes dropped EXE
PID:1816 -
\??\c:\1bbthh.exec:\1bbthh.exe58⤵
- Executes dropped EXE
PID:1324 -
\??\c:\btbnhh.exec:\btbnhh.exe59⤵
- Executes dropped EXE
PID:228 -
\??\c:\pdpjj.exec:\pdpjj.exe60⤵
- Executes dropped EXE
PID:1468 -
\??\c:\xfrflxf.exec:\xfrflxf.exe61⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xlrlfff.exec:\xlrlfff.exe62⤵
- Executes dropped EXE
PID:3308 -
\??\c:\thhbnh.exec:\thhbnh.exe63⤵
- Executes dropped EXE
PID:4888 -
\??\c:\pjpjd.exec:\pjpjd.exe64⤵
- Executes dropped EXE
PID:4684 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe65⤵
- Executes dropped EXE
PID:2444 -
\??\c:\frxrlfl.exec:\frxrlfl.exe66⤵PID:4604
-
\??\c:\bhhbnn.exec:\bhhbnn.exe67⤵PID:4244
-
\??\c:\jjpjv.exec:\jjpjv.exe68⤵PID:4748
-
\??\c:\9llfxxr.exec:\9llfxxr.exe69⤵PID:1944
-
\??\c:\rlxrrlx.exec:\rlxrrlx.exe70⤵PID:1844
-
\??\c:\hntnhb.exec:\hntnhb.exe71⤵PID:536
-
\??\c:\dvjdd.exec:\dvjdd.exe72⤵PID:4424
-
\??\c:\vddpj.exec:\vddpj.exe73⤵PID:4496
-
\??\c:\lflxxxl.exec:\lflxxxl.exe74⤵PID:1912
-
\??\c:\hbbnhn.exec:\hbbnhn.exe75⤵PID:220
-
\??\c:\1jpdp.exec:\1jpdp.exe76⤵PID:2968
-
\??\c:\jdppv.exec:\jdppv.exe77⤵PID:1916
-
\??\c:\5rlrlrf.exec:\5rlrlrf.exe78⤵PID:4064
-
\??\c:\bhhbtb.exec:\bhhbtb.exe79⤵PID:2508
-
\??\c:\pjppp.exec:\pjppp.exe80⤵PID:3656
-
\??\c:\vpvvd.exec:\vpvvd.exe81⤵PID:4992
-
\??\c:\5rxlfrf.exec:\5rxlfrf.exe82⤵PID:3364
-
\??\c:\tbbbnn.exec:\tbbbnn.exe83⤵PID:4720
-
\??\c:\jpvvv.exec:\jpvvv.exe84⤵PID:1632
-
\??\c:\rllfffx.exec:\rllfffx.exe85⤵PID:1772
-
\??\c:\9ttnbb.exec:\9ttnbb.exe86⤵PID:4912
-
\??\c:\hhttbb.exec:\hhttbb.exe87⤵PID:4708
-
\??\c:\vdppp.exec:\vdppp.exe88⤵PID:1636
-
\??\c:\rlffxxx.exec:\rlffxxx.exe89⤵PID:3388
-
\??\c:\llrxfff.exec:\llrxfff.exe90⤵PID:3784
-
\??\c:\9httbh.exec:\9httbh.exe91⤵PID:3424
-
\??\c:\1pjdp.exec:\1pjdp.exe92⤵PID:3820
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe93⤵PID:2964
-
\??\c:\hbhbtt.exec:\hbhbtt.exe94⤵PID:1532
-
\??\c:\vpvpp.exec:\vpvpp.exe95⤵PID:3168
-
\??\c:\jjvpv.exec:\jjvpv.exe96⤵PID:5088
-
\??\c:\lflfxrx.exec:\lflfxrx.exe97⤵PID:4412
-
\??\c:\bhtbbh.exec:\bhtbbh.exe98⤵PID:2716
-
\??\c:\nbhhtt.exec:\nbhhtt.exe99⤵PID:3176
-
\??\c:\vdpdv.exec:\vdpdv.exe100⤵PID:1320
-
\??\c:\xflfxff.exec:\xflfxff.exe101⤵PID:5052
-
\??\c:\bbtbnb.exec:\bbtbnb.exe102⤵PID:4816
-
\??\c:\jjvpv.exec:\jjvpv.exe103⤵PID:1996
-
\??\c:\3jddp.exec:\3jddp.exe104⤵PID:3288
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe105⤵PID:1884
-
\??\c:\7ttbth.exec:\7ttbth.exe106⤵PID:5020
-
\??\c:\jjddj.exec:\jjddj.exe107⤵PID:4880
-
\??\c:\1fffxxr.exec:\1fffxxr.exe108⤵PID:3708
-
\??\c:\rlxxxfx.exec:\rlxxxfx.exe109⤵PID:2500
-
\??\c:\nbhhtn.exec:\nbhhtn.exe110⤵PID:4656
-
\??\c:\jdjdj.exec:\jdjdj.exe111⤵PID:3376
-
\??\c:\lfrxffl.exec:\lfrxffl.exe112⤵PID:2640
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe113⤵PID:1992
-
\??\c:\nntttt.exec:\nntttt.exe114⤵PID:2428
-
\??\c:\vvjjd.exec:\vvjjd.exe115⤵PID:3904
-
\??\c:\lfxlfff.exec:\lfxlfff.exe116⤵PID:4840
-
\??\c:\bhhhbt.exec:\bhhhbt.exe117⤵PID:1200
-
\??\c:\jdddd.exec:\jdddd.exe118⤵PID:3324
-
\??\c:\jdjdv.exec:\jdjdv.exe119⤵PID:2600
-
\??\c:\xxfxfff.exec:\xxfxfff.exe120⤵PID:2320
-
\??\c:\nhtnhb.exec:\nhtnhb.exe121⤵PID:4232
-
\??\c:\ppddd.exec:\ppddd.exe122⤵PID:4964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-