Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:23
Behavioral task
behavioral1
Sample
64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe
-
Size
345KB
-
MD5
27717abaeb775b0f85cfddc392ce9ef1
-
SHA1
09485133b2e01b1d16648af9c465953970a5e4e6
-
SHA256
64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe
-
SHA512
6fb0b513f3d66c8c0b1e2c8622b241dc48cf8965c0a9109deb10384f034da4dedd5e46d56ad27a01a228ad188b99f150d24fdde22786aefe2a9bae6660bc4457
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYA2:R4wFHoS3WXZshJX2VGd2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3128-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2856-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-835-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-901-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-908-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-1023-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4928 xxlllll.exe 3844 hhhhbb.exe 4836 ffrllxl.exe 3076 pvppp.exe 2328 fflrlll.exe 4820 pppjd.exe 4260 xxlxlfx.exe 1468 jppdv.exe 2520 lffxrxx.exe 4604 ttnhtt.exe 1380 thnttn.exe 768 hnnhnn.exe 4484 lffxxrr.exe 5052 nhnhbb.exe 1760 1pjdv.exe 3708 bbthbt.exe 216 3dppd.exe 3888 nnhttn.exe 3344 1jdpj.exe 3952 fxrrffx.exe 2276 dvvpj.exe 4956 vdjdv.exe 3996 nnbbtt.exe 2852 nnnnnn.exe 1324 3vdvj.exe 5108 rrfxrrl.exe 2348 jvvpd.exe 4972 frllfrx.exe 1804 7ffxrlf.exe 424 jpjjd.exe 2964 rxllllf.exe 1168 1xrlfff.exe 4960 nnhbbt.exe 1688 lxrrlrr.exe 3260 ppjdd.exe 772 ffrrxfl.exe 1476 bhhbht.exe 1972 jpdpd.exe 1052 rfrxxrl.exe 1828 flrrrxr.exe 752 bnhhtb.exe 4752 pvppd.exe 4416 rrlllrl.exe 4884 ppvvj.exe 2856 vpjdv.exe 2624 rlrxrfr.exe 1792 htbntn.exe 2820 5vdvv.exe 1648 dpdvv.exe 1988 lflrxxl.exe 2996 nttntt.exe 3924 jdvpj.exe 4944 3djdp.exe 1528 fxffxfx.exe 5048 nnbtnt.exe 4372 dpvpv.exe 1340 vddjj.exe 4824 rllfllr.exe 1872 ntnhbt.exe 5104 dpjvp.exe 3428 lrfxxxf.exe 4244 xxxrrll.exe 3716 bnnhbb.exe 3076 5pddj.exe -
resource yara_rule behavioral2/memory/3128-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bf9-3.dat upx behavioral2/memory/3128-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cc0-8.dat upx behavioral2/memory/4928-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc4-11.dat upx behavioral2/memory/3844-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc6-18.dat upx behavioral2/memory/4836-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc7-23.dat upx behavioral2/memory/3076-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc8-28.dat upx behavioral2/files/0x0007000000023cc9-32.dat upx behavioral2/memory/4820-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4260-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cca-38.dat upx behavioral2/memory/4260-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1468-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccb-45.dat upx behavioral2/memory/2520-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccc-50.dat upx behavioral2/files/0x0007000000023ccd-53.dat upx behavioral2/memory/4604-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cce-58.dat upx behavioral2/memory/768-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccf-63.dat upx behavioral2/files/0x0007000000023cd0-67.dat upx behavioral2/memory/4484-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd2-72.dat upx behavioral2/memory/1760-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5052-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cc1-79.dat upx behavioral2/memory/3708-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd3-83.dat upx behavioral2/files/0x0007000000023cd4-87.dat upx behavioral2/files/0x0007000000023cd5-91.dat upx behavioral2/memory/3344-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd6-96.dat upx behavioral2/files/0x0007000000023cd7-100.dat upx behavioral2/memory/2276-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd8-106.dat upx behavioral2/memory/4956-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd9-109.dat upx behavioral2/files/0x0007000000023cda-114.dat upx behavioral2/memory/2852-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3996-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdb-120.dat upx behavioral2/files/0x0007000000023cdc-124.dat upx behavioral2/memory/1324-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdd-129.dat upx behavioral2/memory/5108-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cde-134.dat upx behavioral2/memory/4972-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdf-140.dat upx behavioral2/memory/1804-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce0-144.dat upx behavioral2/memory/424-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce1-149.dat upx behavioral2/files/0x0007000000023ce2-154.dat upx behavioral2/memory/1168-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1688-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1972-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2856-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1792-189-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3128 wrote to memory of 4928 3128 64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe 83 PID 3128 wrote to memory of 4928 3128 64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe 83 PID 3128 wrote to memory of 4928 3128 64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe 83 PID 4928 wrote to memory of 3844 4928 xxlllll.exe 84 PID 4928 wrote to memory of 3844 4928 xxlllll.exe 84 PID 4928 wrote to memory of 3844 4928 xxlllll.exe 84 PID 3844 wrote to memory of 4836 3844 hhhhbb.exe 85 PID 3844 wrote to memory of 4836 3844 hhhhbb.exe 85 PID 3844 wrote to memory of 4836 3844 hhhhbb.exe 85 PID 4836 wrote to memory of 3076 4836 ffrllxl.exe 86 PID 4836 wrote to memory of 3076 4836 ffrllxl.exe 86 PID 4836 wrote to memory of 3076 4836 ffrllxl.exe 86 PID 3076 wrote to memory of 2328 3076 pvppp.exe 87 PID 3076 wrote to memory of 2328 3076 pvppp.exe 87 PID 3076 wrote to memory of 2328 3076 pvppp.exe 87 PID 2328 wrote to memory of 4820 2328 fflrlll.exe 88 PID 2328 wrote to memory of 4820 2328 fflrlll.exe 88 PID 2328 wrote to memory of 4820 2328 fflrlll.exe 88 PID 4820 wrote to memory of 4260 4820 pppjd.exe 89 PID 4820 wrote to memory of 4260 4820 pppjd.exe 89 PID 4820 wrote to memory of 4260 4820 pppjd.exe 89 PID 4260 wrote to memory of 1468 4260 xxlxlfx.exe 90 PID 4260 wrote to memory of 1468 4260 xxlxlfx.exe 90 PID 4260 wrote to memory of 1468 4260 xxlxlfx.exe 90 PID 1468 wrote to memory of 2520 1468 jppdv.exe 91 PID 1468 wrote to memory of 2520 1468 jppdv.exe 91 PID 1468 wrote to memory of 2520 1468 jppdv.exe 91 PID 2520 wrote to memory of 4604 2520 lffxrxx.exe 92 PID 2520 wrote to memory of 4604 2520 lffxrxx.exe 92 PID 2520 wrote to memory of 4604 2520 lffxrxx.exe 92 PID 4604 wrote to memory of 1380 4604 ttnhtt.exe 93 PID 4604 wrote to memory of 1380 4604 ttnhtt.exe 93 PID 4604 wrote to memory of 1380 4604 ttnhtt.exe 93 PID 1380 wrote to memory of 768 1380 thnttn.exe 94 PID 1380 wrote to memory of 768 1380 thnttn.exe 94 PID 1380 wrote to memory of 768 1380 thnttn.exe 94 PID 768 wrote to memory of 4484 768 hnnhnn.exe 95 PID 768 wrote to memory of 4484 768 hnnhnn.exe 95 PID 768 wrote to memory of 4484 768 hnnhnn.exe 95 PID 4484 wrote to memory of 5052 4484 lffxxrr.exe 96 PID 4484 wrote to memory of 5052 4484 lffxxrr.exe 96 PID 4484 wrote to memory of 5052 4484 lffxxrr.exe 96 PID 5052 wrote to memory of 1760 5052 nhnhbb.exe 97 PID 5052 wrote to memory of 1760 5052 nhnhbb.exe 97 PID 5052 wrote to memory of 1760 5052 nhnhbb.exe 97 PID 1760 wrote to memory of 3708 1760 1pjdv.exe 98 PID 1760 wrote to memory of 3708 1760 1pjdv.exe 98 PID 1760 wrote to memory of 3708 1760 1pjdv.exe 98 PID 3708 wrote to memory of 216 3708 bbthbt.exe 99 PID 3708 wrote to memory of 216 3708 bbthbt.exe 99 PID 3708 wrote to memory of 216 3708 bbthbt.exe 99 PID 216 wrote to memory of 3888 216 3dppd.exe 100 PID 216 wrote to memory of 3888 216 3dppd.exe 100 PID 216 wrote to memory of 3888 216 3dppd.exe 100 PID 3888 wrote to memory of 3344 3888 nnhttn.exe 101 PID 3888 wrote to memory of 3344 3888 nnhttn.exe 101 PID 3888 wrote to memory of 3344 3888 nnhttn.exe 101 PID 3344 wrote to memory of 3952 3344 1jdpj.exe 102 PID 3344 wrote to memory of 3952 3344 1jdpj.exe 102 PID 3344 wrote to memory of 3952 3344 1jdpj.exe 102 PID 3952 wrote to memory of 2276 3952 fxrrffx.exe 103 PID 3952 wrote to memory of 2276 3952 fxrrffx.exe 103 PID 3952 wrote to memory of 2276 3952 fxrrffx.exe 103 PID 2276 wrote to memory of 4956 2276 dvvpj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe"C:\Users\Admin\AppData\Local\Temp\64c2a88c41053a2d17d28167fb6e869bcdfd935004ff731cd2d81b39718657fe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\xxlllll.exec:\xxlllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\hhhhbb.exec:\hhhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\ffrllxl.exec:\ffrllxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\pvppp.exec:\pvppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\fflrlll.exec:\fflrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pppjd.exec:\pppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\xxlxlfx.exec:\xxlxlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\jppdv.exec:\jppdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\lffxrxx.exec:\lffxrxx.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\ttnhtt.exec:\ttnhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\thnttn.exec:\thnttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\hnnhnn.exec:\hnnhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\lffxxrr.exec:\lffxxrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\nhnhbb.exec:\nhnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\1pjdv.exec:\1pjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\bbthbt.exec:\bbthbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\3dppd.exec:\3dppd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\nnhttn.exec:\nnhttn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\1jdpj.exec:\1jdpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\fxrrffx.exec:\fxrrffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\dvvpj.exec:\dvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\vdjdv.exec:\vdjdv.exe23⤵
- Executes dropped EXE
PID:4956 -
\??\c:\nnbbtt.exec:\nnbbtt.exe24⤵
- Executes dropped EXE
PID:3996 -
\??\c:\nnnnnn.exec:\nnnnnn.exe25⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3vdvj.exec:\3vdvj.exe26⤵
- Executes dropped EXE
PID:1324 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe27⤵
- Executes dropped EXE
PID:5108 -
\??\c:\jvvpd.exec:\jvvpd.exe28⤵
- Executes dropped EXE
PID:2348 -
\??\c:\frllfrx.exec:\frllfrx.exe29⤵
- Executes dropped EXE
PID:4972 -
\??\c:\7ffxrlf.exec:\7ffxrlf.exe30⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jpjjd.exec:\jpjjd.exe31⤵
- Executes dropped EXE
PID:424 -
\??\c:\rxllllf.exec:\rxllllf.exe32⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1xrlfff.exec:\1xrlfff.exe33⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nnhbbt.exec:\nnhbbt.exe34⤵
- Executes dropped EXE
PID:4960 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe35⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ppjdd.exec:\ppjdd.exe36⤵
- Executes dropped EXE
PID:3260 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe37⤵
- Executes dropped EXE
PID:772 -
\??\c:\bhhbht.exec:\bhhbht.exe38⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jpdpd.exec:\jpdpd.exe39⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rfrxxrl.exec:\rfrxxrl.exe40⤵
- Executes dropped EXE
PID:1052 -
\??\c:\flrrrxr.exec:\flrrrxr.exe41⤵
- Executes dropped EXE
PID:1828 -
\??\c:\bnhhtb.exec:\bnhhtb.exe42⤵
- Executes dropped EXE
PID:752 -
\??\c:\pvppd.exec:\pvppd.exe43⤵
- Executes dropped EXE
PID:4752 -
\??\c:\rrlllrl.exec:\rrlllrl.exe44⤵
- Executes dropped EXE
PID:4416 -
\??\c:\ppvvj.exec:\ppvvj.exe45⤵
- Executes dropped EXE
PID:4884 -
\??\c:\vpjdv.exec:\vpjdv.exe46⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rlrxrfr.exec:\rlrxrfr.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\htbntn.exec:\htbntn.exe48⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5vdvv.exec:\5vdvv.exe49⤵
- Executes dropped EXE
PID:2820 -
\??\c:\dpdvv.exec:\dpdvv.exe50⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lflrxxl.exec:\lflrxxl.exe51⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nttntt.exec:\nttntt.exe52⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jdvpj.exec:\jdvpj.exe53⤵
- Executes dropped EXE
PID:3924 -
\??\c:\3djdp.exec:\3djdp.exe54⤵
- Executes dropped EXE
PID:4944 -
\??\c:\fxffxfx.exec:\fxffxfx.exe55⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nnbtnt.exec:\nnbtnt.exe56⤵
- Executes dropped EXE
PID:5048 -
\??\c:\dpvpv.exec:\dpvpv.exe57⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vddjj.exec:\vddjj.exe58⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rllfllr.exec:\rllfllr.exe59⤵
- Executes dropped EXE
PID:4824 -
\??\c:\ntnhbt.exec:\ntnhbt.exe60⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dpjvp.exec:\dpjvp.exe61⤵
- Executes dropped EXE
PID:5104 -
\??\c:\lrfxxxf.exec:\lrfxxxf.exe62⤵
- Executes dropped EXE
PID:3428 -
\??\c:\xxxrrll.exec:\xxxrrll.exe63⤵
- Executes dropped EXE
PID:4244 -
\??\c:\bnnhbb.exec:\bnnhbb.exe64⤵
- Executes dropped EXE
PID:3716 -
\??\c:\5pddj.exec:\5pddj.exe65⤵
- Executes dropped EXE
PID:3076 -
\??\c:\xlfrlrr.exec:\xlfrlrr.exe66⤵PID:2136
-
\??\c:\tttthh.exec:\tttthh.exe67⤵PID:5068
-
\??\c:\pppdd.exec:\pppdd.exe68⤵PID:2892
-
\??\c:\7flffrx.exec:\7flffrx.exe69⤵PID:4612
-
\??\c:\7xfffff.exec:\7xfffff.exe70⤵PID:1192
-
\??\c:\3hnnnn.exec:\3hnnnn.exe71⤵PID:3688
-
\??\c:\jddvp.exec:\jddvp.exe72⤵PID:1932
-
\??\c:\pjjpj.exec:\pjjpj.exe73⤵PID:2828
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe74⤵PID:228
-
\??\c:\nhtnbb.exec:\nhtnbb.exe75⤵PID:2412
-
\??\c:\vddvv.exec:\vddvv.exe76⤵PID:3548
-
\??\c:\3xxxrrl.exec:\3xxxrrl.exe77⤵PID:1712
-
\??\c:\ntbhnn.exec:\ntbhnn.exe78⤵PID:5072
-
\??\c:\3ppjd.exec:\3ppjd.exe79⤵PID:4040
-
\??\c:\vdjjd.exec:\vdjjd.exe80⤵PID:4428
-
\??\c:\frfxlll.exec:\frfxlll.exe81⤵PID:5016
-
\??\c:\hnnttb.exec:\hnnttb.exe82⤵PID:3944
-
\??\c:\vdjdd.exec:\vdjdd.exe83⤵PID:2204
-
\??\c:\vpvvp.exec:\vpvvp.exe84⤵PID:4844
-
\??\c:\flxxrff.exec:\flxxrff.exe85⤵PID:4508
-
\??\c:\bbhhhh.exec:\bbhhhh.exe86⤵PID:4576
-
\??\c:\djvvj.exec:\djvvj.exe87⤵PID:3952
-
\??\c:\flxrllf.exec:\flxrllf.exe88⤵PID:3232
-
\??\c:\ffxxxxr.exec:\ffxxxxr.exe89⤵PID:2276
-
\??\c:\nnbbbb.exec:\nnbbbb.exe90⤵PID:4956
-
\??\c:\3dpjp.exec:\3dpjp.exe91⤵PID:4076
-
\??\c:\7dpdj.exec:\7dpdj.exe92⤵PID:2120
-
\??\c:\llxxfff.exec:\llxxfff.exe93⤵PID:2548
-
\??\c:\nntttb.exec:\nntttb.exe94⤵PID:600
-
\??\c:\ddjdd.exec:\ddjdd.exe95⤵
- System Location Discovery: System Language Discovery
PID:1240 -
\??\c:\xxrrrxx.exec:\xxrrrxx.exe96⤵PID:2208
-
\??\c:\7nttnt.exec:\7nttnt.exe97⤵PID:4568
-
\??\c:\djpvp.exec:\djpvp.exe98⤵PID:3212
-
\??\c:\pjjpj.exec:\pjjpj.exe99⤵PID:5100
-
\??\c:\xxxrlrl.exec:\xxxrlrl.exe100⤵PID:3400
-
\??\c:\hhbbtb.exec:\hhbbtb.exe101⤵PID:2280
-
\??\c:\jjjjd.exec:\jjjjd.exe102⤵PID:224
-
\??\c:\rxlfxrl.exec:\rxlfxrl.exe103⤵PID:4016
-
\??\c:\9lrlllf.exec:\9lrlllf.exe104⤵PID:1168
-
\??\c:\hbbtnh.exec:\hbbtnh.exe105⤵PID:4952
-
\??\c:\jddpp.exec:\jddpp.exe106⤵PID:1688
-
\??\c:\1rlxxrl.exec:\1rlxxrl.exe107⤵PID:2836
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe108⤵PID:2692
-
\??\c:\9tnbhh.exec:\9tnbhh.exe109⤵PID:2212
-
\??\c:\vdvdp.exec:\vdvdp.exe110⤵PID:2184
-
\??\c:\1fxffll.exec:\1fxffll.exe111⤵PID:3440
-
\??\c:\5tnnht.exec:\5tnnht.exe112⤵PID:4592
-
\??\c:\ppdpp.exec:\ppdpp.exe113⤵PID:3444
-
\??\c:\rlrrffr.exec:\rlrrffr.exe114⤵PID:2620
-
\??\c:\thtnbh.exec:\thtnbh.exe115⤵PID:4400
-
\??\c:\vpppp.exec:\vpppp.exe116⤵PID:1284
-
\??\c:\9jvvv.exec:\9jvvv.exe117⤵PID:1580
-
\??\c:\xrfxllr.exec:\xrfxllr.exe118⤵PID:2792
-
\??\c:\thtbnn.exec:\thtbnn.exe119⤵PID:4544
-
\??\c:\ddjpp.exec:\ddjpp.exe120⤵PID:3004
-
\??\c:\rrxfflr.exec:\rrxfflr.exe121⤵PID:4976
-
\??\c:\hhtttb.exec:\hhtttb.exe122⤵PID:1656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-