Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbe7f102d97e8ca4275d0dad97be9296150f3d0805aa40b9dbcf9b09347748d9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
cbe7f102d97e8ca4275d0dad97be9296150f3d0805aa40b9dbcf9b09347748d9.exe
-
Size
455KB
-
MD5
18ea8309a3cc695ac88b5b916e556070
-
SHA1
31ee1084ac6d99eeb7ed0dd989448422c684278d
-
SHA256
cbe7f102d97e8ca4275d0dad97be9296150f3d0805aa40b9dbcf9b09347748d9
-
SHA512
5d1d98b9583720d025af06fe4be97e39537575e7a48c01bb49407ec9e2fbf0f77b65d2cecc67b3eb72c87d48ee4e14fc47d2e0e059dd5389cd21ea2f04979be1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4768-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/784-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-827-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-828-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-898-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-944-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-1178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-1789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3080 xrfrfxl.exe 3580 bbthth.exe 400 fxxrlrf.exe 4840 jdvjv.exe 3136 5frffxx.exe 4940 pvjdj.exe 456 ffffxxr.exe 4596 btthbn.exe 2588 jjvpj.exe 2232 5fxxrlf.exe 3064 btnhtn.exe 3556 1nntnt.exe 1116 vjjdj.exe 2408 frxrllf.exe 224 nntnhh.exe 4544 jvdpp.exe 1524 rrlfxrl.exe 784 5fxlfxl.exe 1616 bhhthb.exe 2908 btthtt.exe 4004 thbttn.exe 3836 5ddpd.exe 1468 rlxlfrf.exe 1308 xrrlfxr.exe 3452 nbhtth.exe 1956 vpjdp.exe 852 dvvjv.exe 3436 1bthth.exe 2716 7vppj.exe 3480 jdvdp.exe 4484 frxfrlr.exe 2880 nhhtnh.exe 4356 5tbbnn.exe 2104 jdvjd.exe 3532 lrxflxr.exe 5096 7nnhtn.exe 1464 nnhtht.exe 4360 pjjvp.exe 3192 frlfxlx.exe 2848 bhtbht.exe 3448 hnhtbt.exe 5080 vjpdv.exe 1100 7llxlfl.exe 2600 bbhtbt.exe 3156 7hhbth.exe 2416 pjpjd.exe 4600 3dvjd.exe 1208 3rrrfxl.exe 4812 nhbnhh.exe 1460 hhbthb.exe 4172 jdpjv.exe 4268 dppjv.exe 4744 xfflxrf.exe 3336 9nhhtn.exe 3164 bhnbnb.exe 3580 vvjvj.exe 4604 lxxlxxl.exe 532 lfxrffx.exe 4452 tnbnbt.exe 4716 5nbnhb.exe 4248 pdpdp.exe 3112 dpvjp.exe 1840 rrlxrrl.exe 2020 nhbnhb.exe -
resource yara_rule behavioral2/memory/4768-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-681-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 3080 4768 cbe7f102d97e8ca4275d0dad97be9296150f3d0805aa40b9dbcf9b09347748d9.exe 82 PID 4768 wrote to memory of 3080 4768 cbe7f102d97e8ca4275d0dad97be9296150f3d0805aa40b9dbcf9b09347748d9.exe 82 PID 4768 wrote to memory of 3080 4768 cbe7f102d97e8ca4275d0dad97be9296150f3d0805aa40b9dbcf9b09347748d9.exe 82 PID 3080 wrote to memory of 3580 3080 xrfrfxl.exe 83 PID 3080 wrote to memory of 3580 3080 xrfrfxl.exe 83 PID 3080 wrote to memory of 3580 3080 xrfrfxl.exe 83 PID 3580 wrote to memory of 400 3580 bbthth.exe 84 PID 3580 wrote to memory of 400 3580 bbthth.exe 84 PID 3580 wrote to memory of 400 3580 bbthth.exe 84 PID 400 wrote to memory of 4840 400 fxxrlrf.exe 85 PID 400 wrote to memory of 4840 400 fxxrlrf.exe 85 PID 400 wrote to memory of 4840 400 fxxrlrf.exe 85 PID 4840 wrote to memory of 3136 4840 jdvjv.exe 86 PID 4840 wrote to memory of 3136 4840 jdvjv.exe 86 PID 4840 wrote to memory of 3136 4840 jdvjv.exe 86 PID 3136 wrote to memory of 4940 3136 5frffxx.exe 87 PID 3136 wrote to memory of 4940 3136 5frffxx.exe 87 PID 3136 wrote to memory of 4940 3136 5frffxx.exe 87 PID 4940 wrote to memory of 456 4940 pvjdj.exe 88 PID 4940 wrote to memory of 456 4940 pvjdj.exe 88 PID 4940 wrote to memory of 456 4940 pvjdj.exe 88 PID 456 wrote to memory of 4596 456 ffffxxr.exe 89 PID 456 wrote to memory of 4596 456 ffffxxr.exe 89 PID 456 wrote to memory of 4596 456 ffffxxr.exe 89 PID 4596 wrote to memory of 2588 4596 btthbn.exe 90 PID 4596 wrote to memory of 2588 4596 btthbn.exe 90 PID 4596 wrote to memory of 2588 4596 btthbn.exe 90 PID 2588 wrote to memory of 2232 2588 jjvpj.exe 91 PID 2588 wrote to memory of 2232 2588 jjvpj.exe 91 PID 2588 wrote to memory of 2232 2588 jjvpj.exe 91 PID 2232 wrote to memory of 3064 2232 5fxxrlf.exe 92 PID 2232 wrote to memory of 3064 2232 5fxxrlf.exe 92 PID 2232 wrote to memory of 3064 2232 5fxxrlf.exe 92 PID 3064 wrote to memory of 3556 3064 btnhtn.exe 93 PID 3064 wrote to memory of 3556 3064 btnhtn.exe 93 PID 3064 wrote to memory of 3556 3064 btnhtn.exe 93 PID 3556 wrote to memory of 1116 3556 1nntnt.exe 94 PID 3556 wrote to memory of 1116 3556 1nntnt.exe 94 PID 3556 wrote to memory of 1116 3556 1nntnt.exe 94 PID 1116 wrote to memory of 2408 1116 vjjdj.exe 95 PID 1116 wrote to memory of 2408 1116 vjjdj.exe 95 PID 1116 wrote to memory of 2408 1116 vjjdj.exe 95 PID 2408 wrote to memory of 224 2408 frxrllf.exe 96 PID 2408 wrote to memory of 224 2408 frxrllf.exe 96 PID 2408 wrote to memory of 224 2408 frxrllf.exe 96 PID 224 wrote to memory of 4544 224 nntnhh.exe 97 PID 224 wrote to memory of 4544 224 nntnhh.exe 97 PID 224 wrote to memory of 4544 224 nntnhh.exe 97 PID 4544 wrote to memory of 1524 4544 jvdpp.exe 98 PID 4544 wrote to memory of 1524 4544 jvdpp.exe 98 PID 4544 wrote to memory of 1524 4544 jvdpp.exe 98 PID 1524 wrote to memory of 784 1524 rrlfxrl.exe 99 PID 1524 wrote to memory of 784 1524 rrlfxrl.exe 99 PID 1524 wrote to memory of 784 1524 rrlfxrl.exe 99 PID 784 wrote to memory of 1616 784 5fxlfxl.exe 100 PID 784 wrote to memory of 1616 784 5fxlfxl.exe 100 PID 784 wrote to memory of 1616 784 5fxlfxl.exe 100 PID 1616 wrote to memory of 2908 1616 bhhthb.exe 101 PID 1616 wrote to memory of 2908 1616 bhhthb.exe 101 PID 1616 wrote to memory of 2908 1616 bhhthb.exe 101 PID 2908 wrote to memory of 4004 2908 btthtt.exe 102 PID 2908 wrote to memory of 4004 2908 btthtt.exe 102 PID 2908 wrote to memory of 4004 2908 btthtt.exe 102 PID 4004 wrote to memory of 3836 4004 thbttn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbe7f102d97e8ca4275d0dad97be9296150f3d0805aa40b9dbcf9b09347748d9.exe"C:\Users\Admin\AppData\Local\Temp\cbe7f102d97e8ca4275d0dad97be9296150f3d0805aa40b9dbcf9b09347748d9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\xrfrfxl.exec:\xrfrfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\bbthth.exec:\bbthth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\fxxrlrf.exec:\fxxrlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\jdvjv.exec:\jdvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\5frffxx.exec:\5frffxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\pvjdj.exec:\pvjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\ffffxxr.exec:\ffffxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\btthbn.exec:\btthbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\jjvpj.exec:\jjvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\5fxxrlf.exec:\5fxxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\btnhtn.exec:\btnhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\1nntnt.exec:\1nntnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\vjjdj.exec:\vjjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\frxrllf.exec:\frxrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\nntnhh.exec:\nntnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\jvdpp.exec:\jvdpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\5fxlfxl.exec:\5fxlfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\bhhthb.exec:\bhhthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\btthtt.exec:\btthtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\thbttn.exec:\thbttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\5ddpd.exec:\5ddpd.exe23⤵
- Executes dropped EXE
PID:3836 -
\??\c:\rlxlfrf.exec:\rlxlfrf.exe24⤵
- Executes dropped EXE
PID:1468 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\nbhtth.exec:\nbhtth.exe26⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vpjdp.exec:\vpjdp.exe27⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dvvjv.exec:\dvvjv.exe28⤵
- Executes dropped EXE
PID:852 -
\??\c:\1bthth.exec:\1bthth.exe29⤵
- Executes dropped EXE
PID:3436 -
\??\c:\7vppj.exec:\7vppj.exe30⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jdvdp.exec:\jdvdp.exe31⤵
- Executes dropped EXE
PID:3480 -
\??\c:\frxfrlr.exec:\frxfrlr.exe32⤵
- Executes dropped EXE
PID:4484 -
\??\c:\nhhtnh.exec:\nhhtnh.exe33⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5tbbnn.exec:\5tbbnn.exe34⤵
- Executes dropped EXE
PID:4356 -
\??\c:\jdvjd.exec:\jdvjd.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lrxflxr.exec:\lrxflxr.exe36⤵
- Executes dropped EXE
PID:3532 -
\??\c:\7nnhtn.exec:\7nnhtn.exe37⤵
- Executes dropped EXE
PID:5096 -
\??\c:\nnhtht.exec:\nnhtht.exe38⤵
- Executes dropped EXE
PID:1464 -
\??\c:\pjjvp.exec:\pjjvp.exe39⤵
- Executes dropped EXE
PID:4360 -
\??\c:\frlfxlx.exec:\frlfxlx.exe40⤵
- Executes dropped EXE
PID:3192 -
\??\c:\bhtbht.exec:\bhtbht.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hnhtbt.exec:\hnhtbt.exe42⤵
- Executes dropped EXE
PID:3448 -
\??\c:\vjpdv.exec:\vjpdv.exe43⤵
- Executes dropped EXE
PID:5080 -
\??\c:\7llxlfl.exec:\7llxlfl.exe44⤵
- Executes dropped EXE
PID:1100 -
\??\c:\bbhtbt.exec:\bbhtbt.exe45⤵
- Executes dropped EXE
PID:2600 -
\??\c:\7hhbth.exec:\7hhbth.exe46⤵
- Executes dropped EXE
PID:3156 -
\??\c:\pjpjd.exec:\pjpjd.exe47⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3dvjd.exec:\3dvjd.exe48⤵
- Executes dropped EXE
PID:4600 -
\??\c:\3rrrfxl.exec:\3rrrfxl.exe49⤵
- Executes dropped EXE
PID:1208 -
\??\c:\nhbnhh.exec:\nhbnhh.exe50⤵
- Executes dropped EXE
PID:4812 -
\??\c:\hhbthb.exec:\hhbthb.exe51⤵
- Executes dropped EXE
PID:1460 -
\??\c:\jdpjv.exec:\jdpjv.exe52⤵
- Executes dropped EXE
PID:4172 -
\??\c:\dppjv.exec:\dppjv.exe53⤵
- Executes dropped EXE
PID:4268 -
\??\c:\xfflxrf.exec:\xfflxrf.exe54⤵
- Executes dropped EXE
PID:4744 -
\??\c:\9nhhtn.exec:\9nhhtn.exe55⤵
- Executes dropped EXE
PID:3336 -
\??\c:\bhnbnb.exec:\bhnbnb.exe56⤵
- Executes dropped EXE
PID:3164 -
\??\c:\vvjvj.exec:\vvjvj.exe57⤵
- Executes dropped EXE
PID:3580 -
\??\c:\lxxlxxl.exec:\lxxlxxl.exe58⤵
- Executes dropped EXE
PID:4604 -
\??\c:\lfxrffx.exec:\lfxrffx.exe59⤵
- Executes dropped EXE
PID:532 -
\??\c:\tnbnbt.exec:\tnbnbt.exe60⤵
- Executes dropped EXE
PID:4452 -
\??\c:\5nbnhb.exec:\5nbnhb.exe61⤵
- Executes dropped EXE
PID:4716 -
\??\c:\pdpdp.exec:\pdpdp.exe62⤵
- Executes dropped EXE
PID:4248 -
\??\c:\dpvjp.exec:\dpvjp.exe63⤵
- Executes dropped EXE
PID:3112 -
\??\c:\rrlxrrl.exec:\rrlxrrl.exe64⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nhbnhb.exec:\nhbnhb.exe65⤵
- Executes dropped EXE
PID:2020 -
\??\c:\thhbtn.exec:\thhbtn.exe66⤵PID:976
-
\??\c:\vdjvj.exec:\vdjvj.exe67⤵PID:544
-
\??\c:\dvvvj.exec:\dvvvj.exe68⤵PID:708
-
\??\c:\fllxxlf.exec:\fllxxlf.exe69⤵PID:3808
-
\??\c:\lrffxrr.exec:\lrffxrr.exe70⤵PID:348
-
\??\c:\9pjdv.exec:\9pjdv.exe71⤵PID:4580
-
\??\c:\hhbtnh.exec:\hhbtnh.exe72⤵PID:232
-
\??\c:\xffxrlf.exec:\xffxrlf.exe73⤵PID:208
-
\??\c:\lflxfxx.exec:\lflxfxx.exe74⤵PID:3796
-
\??\c:\hhhbtn.exec:\hhhbtn.exe75⤵PID:3600
-
\??\c:\jpvvd.exec:\jpvvd.exe76⤵PID:2892
-
\??\c:\rffxlfr.exec:\rffxlfr.exe77⤵PID:516
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe78⤵PID:4916
-
\??\c:\nnnhbt.exec:\nnnhbt.exe79⤵PID:4284
-
\??\c:\pddpd.exec:\pddpd.exe80⤵PID:4404
-
\??\c:\vvvpp.exec:\vvvpp.exe81⤵PID:1616
-
\??\c:\xfrfxxr.exec:\xfrfxxr.exe82⤵PID:4732
-
\??\c:\ntbhnt.exec:\ntbhnt.exe83⤵PID:396
-
\??\c:\pjjdj.exec:\pjjdj.exe84⤵PID:4996
-
\??\c:\dpvpd.exec:\dpvpd.exe85⤵PID:2268
-
\??\c:\7xfrffx.exec:\7xfrffx.exe86⤵PID:3960
-
\??\c:\1pjdv.exec:\1pjdv.exe87⤵PID:4388
-
\??\c:\7dvpj.exec:\7dvpj.exe88⤵PID:1364
-
\??\c:\fllfrfx.exec:\fllfrfx.exe89⤵PID:4420
-
\??\c:\1thtnb.exec:\1thtnb.exe90⤵PID:1956
-
\??\c:\hbnnbh.exec:\hbnnbh.exe91⤵PID:3244
-
\??\c:\jvvjd.exec:\jvvjd.exe92⤵PID:4832
-
\??\c:\3rfxrrl.exec:\3rfxrrl.exe93⤵PID:4060
-
\??\c:\thnhhh.exec:\thnhhh.exe94⤵PID:2716
-
\??\c:\jpdvj.exec:\jpdvj.exe95⤵PID:4588
-
\??\c:\lxfxrlx.exec:\lxfxrlx.exe96⤵PID:4484
-
\??\c:\rxllfxr.exec:\rxllfxr.exe97⤵PID:1392
-
\??\c:\nhhbbt.exec:\nhhbbt.exe98⤵PID:428
-
\??\c:\dddvj.exec:\dddvj.exe99⤵PID:2116
-
\??\c:\xxrfxxr.exec:\xxrfxxr.exe100⤵PID:4272
-
\??\c:\rllxlfr.exec:\rllxlfr.exe101⤵PID:3532
-
\??\c:\ntthbn.exec:\ntthbn.exe102⤵PID:4612
-
\??\c:\pdjdd.exec:\pdjdd.exe103⤵PID:4468
-
\??\c:\rxxlxrf.exec:\rxxlxrf.exe104⤵PID:4440
-
\??\c:\hbbtnh.exec:\hbbtnh.exe105⤵PID:4304
-
\??\c:\7bhtnh.exec:\7bhtnh.exe106⤵PID:2572
-
\??\c:\jddpp.exec:\jddpp.exe107⤵PID:4376
-
\??\c:\xrxlrll.exec:\xrxlrll.exe108⤵PID:3076
-
\??\c:\bnthbt.exec:\bnthbt.exe109⤵PID:5080
-
\??\c:\btntnh.exec:\btntnh.exe110⤵PID:3236
-
\??\c:\dvvpd.exec:\dvvpd.exe111⤵PID:3264
-
\??\c:\rffrffx.exec:\rffrffx.exe112⤵PID:4528
-
\??\c:\bbbnht.exec:\bbbnht.exe113⤵
- System Location Discovery: System Language Discovery
PID:4548 -
\??\c:\9djdj.exec:\9djdj.exe114⤵PID:3032
-
\??\c:\dvvjd.exec:\dvvjd.exe115⤵PID:4028
-
\??\c:\fflxlfx.exec:\fflxlfx.exe116⤵PID:3256
-
\??\c:\bnhthb.exec:\bnhthb.exe117⤵PID:1460
-
\??\c:\nhhnhh.exec:\nhhnhh.exe118⤵PID:4300
-
\??\c:\pvvpd.exec:\pvvpd.exe119⤵PID:1704
-
\??\c:\9frlxfx.exec:\9frlxfx.exe120⤵PID:3036
-
\??\c:\7hnhbt.exec:\7hnhbt.exe121⤵PID:1572
-
\??\c:\vvvjd.exec:\vvvjd.exe122⤵PID:4628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-