Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d0bd5e16984844f8b490e0bd86423e4e9488824f9de54df1ba24f556eb455709.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
d0bd5e16984844f8b490e0bd86423e4e9488824f9de54df1ba24f556eb455709.exe
-
Size
454KB
-
MD5
92ad6a72af4ffc6abd20c5129c27a52f
-
SHA1
b0d4e521db5851d42e1b23f1c30919f301d80cbd
-
SHA256
d0bd5e16984844f8b490e0bd86423e4e9488824f9de54df1ba24f556eb455709
-
SHA512
8d5bf88ad4f2b30024f0b989cfcd2ff56b61be85b7aec08e74eb002d02e5f25cd55e71607cfc8059710c2b551a1f62c67cd493508c613646f583bdb07a2a768d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1732-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/900-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/780-823-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-1043-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-1228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 xlrlffx.exe 1684 thhhbb.exe 1728 jjdvv.exe 4816 9jdvp.exe 2064 lffxrrl.exe 1380 hnnhhh.exe 1376 nbhbhh.exe 652 xfxfxrx.exe 3936 tbtnbt.exe 1444 hbbbnn.exe 2840 3xfrrxx.exe 3944 jdddj.exe 2060 xffllll.exe 5108 frxrffl.exe 2984 bbtttb.exe 4568 pdpjv.exe 2528 xfrxrxr.exe 4688 7dvvv.exe 5096 vpdvv.exe 5040 rxrlllf.exe 3604 tthhbb.exe 2464 rlflllx.exe 4980 btnntt.exe 2800 hntbtb.exe 4476 bhbtbn.exe 3248 fxlllll.exe 3408 5vdpp.exe 3992 vpppj.exe 1088 ddjpp.exe 2044 rxxxxxx.exe 4656 bbhhbb.exe 4364 nbbntn.exe 1180 rfllfll.exe 456 bbhhbh.exe 4588 djjdv.exe 560 9xxxxfx.exe 1968 bttnbb.exe 3268 jjdvd.exe 5084 fxxfxfx.exe 3800 thhbbb.exe 3016 1dddv.exe 1488 fflfffx.exe 828 7bhbnt.exe 4032 vdjvj.exe 868 9fxrxxx.exe 3660 fxffxxx.exe 4004 nhtbht.exe 2796 3vppj.exe 1248 rrffxfx.exe 2076 nbhhhn.exe 4188 dpdpd.exe 3936 lrrrlrl.exe 4384 btnnnh.exe 4904 hhhhhh.exe 1936 dvvvj.exe 4264 llxfxll.exe 4576 nntttb.exe 3976 vvppp.exe 2220 fxllfll.exe 2920 bbhntb.exe 3452 dpvvv.exe 5068 fflllrl.exe 4676 hhnntb.exe 2532 tnbttb.exe -
resource yara_rule behavioral2/memory/1732-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-768-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 1732 2720 d0bd5e16984844f8b490e0bd86423e4e9488824f9de54df1ba24f556eb455709.exe 83 PID 2720 wrote to memory of 1732 2720 d0bd5e16984844f8b490e0bd86423e4e9488824f9de54df1ba24f556eb455709.exe 83 PID 2720 wrote to memory of 1732 2720 d0bd5e16984844f8b490e0bd86423e4e9488824f9de54df1ba24f556eb455709.exe 83 PID 1732 wrote to memory of 1684 1732 xlrlffx.exe 84 PID 1732 wrote to memory of 1684 1732 xlrlffx.exe 84 PID 1732 wrote to memory of 1684 1732 xlrlffx.exe 84 PID 1684 wrote to memory of 1728 1684 thhhbb.exe 85 PID 1684 wrote to memory of 1728 1684 thhhbb.exe 85 PID 1684 wrote to memory of 1728 1684 thhhbb.exe 85 PID 1728 wrote to memory of 4816 1728 jjdvv.exe 86 PID 1728 wrote to memory of 4816 1728 jjdvv.exe 86 PID 1728 wrote to memory of 4816 1728 jjdvv.exe 86 PID 4816 wrote to memory of 2064 4816 9jdvp.exe 87 PID 4816 wrote to memory of 2064 4816 9jdvp.exe 87 PID 4816 wrote to memory of 2064 4816 9jdvp.exe 87 PID 2064 wrote to memory of 1380 2064 lffxrrl.exe 88 PID 2064 wrote to memory of 1380 2064 lffxrrl.exe 88 PID 2064 wrote to memory of 1380 2064 lffxrrl.exe 88 PID 1380 wrote to memory of 1376 1380 hnnhhh.exe 89 PID 1380 wrote to memory of 1376 1380 hnnhhh.exe 89 PID 1380 wrote to memory of 1376 1380 hnnhhh.exe 89 PID 1376 wrote to memory of 652 1376 nbhbhh.exe 90 PID 1376 wrote to memory of 652 1376 nbhbhh.exe 90 PID 1376 wrote to memory of 652 1376 nbhbhh.exe 90 PID 652 wrote to memory of 3936 652 xfxfxrx.exe 91 PID 652 wrote to memory of 3936 652 xfxfxrx.exe 91 PID 652 wrote to memory of 3936 652 xfxfxrx.exe 91 PID 3936 wrote to memory of 1444 3936 tbtnbt.exe 92 PID 3936 wrote to memory of 1444 3936 tbtnbt.exe 92 PID 3936 wrote to memory of 1444 3936 tbtnbt.exe 92 PID 1444 wrote to memory of 2840 1444 hbbbnn.exe 93 PID 1444 wrote to memory of 2840 1444 hbbbnn.exe 93 PID 1444 wrote to memory of 2840 1444 hbbbnn.exe 93 PID 2840 wrote to memory of 3944 2840 3xfrrxx.exe 94 PID 2840 wrote to memory of 3944 2840 3xfrrxx.exe 94 PID 2840 wrote to memory of 3944 2840 3xfrrxx.exe 94 PID 3944 wrote to memory of 2060 3944 jdddj.exe 95 PID 3944 wrote to memory of 2060 3944 jdddj.exe 95 PID 3944 wrote to memory of 2060 3944 jdddj.exe 95 PID 2060 wrote to memory of 5108 2060 xffllll.exe 96 PID 2060 wrote to memory of 5108 2060 xffllll.exe 96 PID 2060 wrote to memory of 5108 2060 xffllll.exe 96 PID 5108 wrote to memory of 2984 5108 frxrffl.exe 97 PID 5108 wrote to memory of 2984 5108 frxrffl.exe 97 PID 5108 wrote to memory of 2984 5108 frxrffl.exe 97 PID 2984 wrote to memory of 4568 2984 bbtttb.exe 98 PID 2984 wrote to memory of 4568 2984 bbtttb.exe 98 PID 2984 wrote to memory of 4568 2984 bbtttb.exe 98 PID 4568 wrote to memory of 2528 4568 pdpjv.exe 99 PID 4568 wrote to memory of 2528 4568 pdpjv.exe 99 PID 4568 wrote to memory of 2528 4568 pdpjv.exe 99 PID 2528 wrote to memory of 4688 2528 xfrxrxr.exe 100 PID 2528 wrote to memory of 4688 2528 xfrxrxr.exe 100 PID 2528 wrote to memory of 4688 2528 xfrxrxr.exe 100 PID 4688 wrote to memory of 5096 4688 7dvvv.exe 101 PID 4688 wrote to memory of 5096 4688 7dvvv.exe 101 PID 4688 wrote to memory of 5096 4688 7dvvv.exe 101 PID 5096 wrote to memory of 5040 5096 vpdvv.exe 102 PID 5096 wrote to memory of 5040 5096 vpdvv.exe 102 PID 5096 wrote to memory of 5040 5096 vpdvv.exe 102 PID 5040 wrote to memory of 3604 5040 rxrlllf.exe 103 PID 5040 wrote to memory of 3604 5040 rxrlllf.exe 103 PID 5040 wrote to memory of 3604 5040 rxrlllf.exe 103 PID 3604 wrote to memory of 2464 3604 tthhbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0bd5e16984844f8b490e0bd86423e4e9488824f9de54df1ba24f556eb455709.exe"C:\Users\Admin\AppData\Local\Temp\d0bd5e16984844f8b490e0bd86423e4e9488824f9de54df1ba24f556eb455709.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xlrlffx.exec:\xlrlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\thhhbb.exec:\thhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\jjdvv.exec:\jjdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\9jdvp.exec:\9jdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\lffxrrl.exec:\lffxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\hnnhhh.exec:\hnnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\nbhbhh.exec:\nbhbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\xfxfxrx.exec:\xfxfxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\tbtnbt.exec:\tbtnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\hbbbnn.exec:\hbbbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\3xfrrxx.exec:\3xfrrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\jdddj.exec:\jdddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\xffllll.exec:\xffllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\frxrffl.exec:\frxrffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\bbtttb.exec:\bbtttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\pdpjv.exec:\pdpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\xfrxrxr.exec:\xfrxrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\7dvvv.exec:\7dvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\vpdvv.exec:\vpdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\rxrlllf.exec:\rxrlllf.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\tthhbb.exec:\tthhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\rlflllx.exec:\rlflllx.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\btnntt.exec:\btnntt.exe24⤵
- Executes dropped EXE
PID:4980 -
\??\c:\hntbtb.exec:\hntbtb.exe25⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bhbtbn.exec:\bhbtbn.exe26⤵
- Executes dropped EXE
PID:4476 -
\??\c:\fxlllll.exec:\fxlllll.exe27⤵
- Executes dropped EXE
PID:3248 -
\??\c:\5vdpp.exec:\5vdpp.exe28⤵
- Executes dropped EXE
PID:3408 -
\??\c:\vpppj.exec:\vpppj.exe29⤵
- Executes dropped EXE
PID:3992 -
\??\c:\ddjpp.exec:\ddjpp.exe30⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe31⤵
- Executes dropped EXE
PID:2044 -
\??\c:\bbhhbb.exec:\bbhhbb.exe32⤵
- Executes dropped EXE
PID:4656 -
\??\c:\nbbntn.exec:\nbbntn.exe33⤵
- Executes dropped EXE
PID:4364 -
\??\c:\rfllfll.exec:\rfllfll.exe34⤵
- Executes dropped EXE
PID:1180 -
\??\c:\bbhhbh.exec:\bbhhbh.exe35⤵
- Executes dropped EXE
PID:456 -
\??\c:\djjdv.exec:\djjdv.exe36⤵
- Executes dropped EXE
PID:4588 -
\??\c:\9xxxxfx.exec:\9xxxxfx.exe37⤵
- Executes dropped EXE
PID:560 -
\??\c:\bttnbb.exec:\bttnbb.exe38⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jjdvd.exec:\jjdvd.exe39⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bnnnnn.exec:\bnnnnn.exe40⤵PID:4320
-
\??\c:\fxxfxfx.exec:\fxxfxfx.exe41⤵
- Executes dropped EXE
PID:5084 -
\??\c:\thhbbb.exec:\thhbbb.exe42⤵
- Executes dropped EXE
PID:3800 -
\??\c:\1dddv.exec:\1dddv.exe43⤵
- Executes dropped EXE
PID:3016 -
\??\c:\fflfffx.exec:\fflfffx.exe44⤵
- Executes dropped EXE
PID:1488 -
\??\c:\7bhbnt.exec:\7bhbnt.exe45⤵
- Executes dropped EXE
PID:828 -
\??\c:\vdjvj.exec:\vdjvj.exe46⤵
- Executes dropped EXE
PID:4032 -
\??\c:\9fxrxxx.exec:\9fxrxxx.exe47⤵
- Executes dropped EXE
PID:868 -
\??\c:\fxffxxx.exec:\fxffxxx.exe48⤵
- Executes dropped EXE
PID:3660 -
\??\c:\nhtbht.exec:\nhtbht.exe49⤵
- Executes dropped EXE
PID:4004 -
\??\c:\3vppj.exec:\3vppj.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rrffxfx.exec:\rrffxfx.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\nbhhhn.exec:\nbhhhn.exe52⤵
- Executes dropped EXE
PID:2076 -
\??\c:\dpdpd.exec:\dpdpd.exe53⤵
- Executes dropped EXE
PID:4188 -
\??\c:\lrrrlrl.exec:\lrrrlrl.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3936 -
\??\c:\btnnnh.exec:\btnnnh.exe55⤵
- Executes dropped EXE
PID:4384 -
\??\c:\hhhhhh.exec:\hhhhhh.exe56⤵
- Executes dropped EXE
PID:4904 -
\??\c:\dvvvj.exec:\dvvvj.exe57⤵
- Executes dropped EXE
PID:1936 -
\??\c:\llxfxll.exec:\llxfxll.exe58⤵
- Executes dropped EXE
PID:4264 -
\??\c:\nntttb.exec:\nntttb.exe59⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vvppp.exec:\vvppp.exe60⤵
- Executes dropped EXE
PID:3976 -
\??\c:\fxllfll.exec:\fxllfll.exe61⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bbhntb.exec:\bbhntb.exe62⤵
- Executes dropped EXE
PID:2920 -
\??\c:\dpvvv.exec:\dpvvv.exe63⤵
- Executes dropped EXE
PID:3452 -
\??\c:\fflllrl.exec:\fflllrl.exe64⤵
- Executes dropped EXE
PID:5068 -
\??\c:\hhnntb.exec:\hhnntb.exe65⤵
- Executes dropped EXE
PID:4676 -
\??\c:\tnbttb.exec:\tnbttb.exe66⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vppdd.exec:\vppdd.exe67⤵PID:4452
-
\??\c:\xfflllr.exec:\xfflllr.exe68⤵PID:4180
-
\??\c:\nhnhbh.exec:\nhnhbh.exe69⤵PID:2568
-
\??\c:\hnhbtn.exec:\hnhbtn.exe70⤵PID:2472
-
\??\c:\1djdj.exec:\1djdj.exe71⤵PID:2868
-
\??\c:\lrlllll.exec:\lrlllll.exe72⤵PID:1548
-
\??\c:\nhtnnt.exec:\nhtnnt.exe73⤵PID:2628
-
\??\c:\vvppv.exec:\vvppv.exe74⤵PID:5064
-
\??\c:\dpdpp.exec:\dpdpp.exe75⤵PID:2516
-
\??\c:\rxxrflf.exec:\rxxrflf.exe76⤵PID:2612
-
\??\c:\htbbhn.exec:\htbbhn.exe77⤵PID:4200
-
\??\c:\vdjjj.exec:\vdjjj.exe78⤵PID:2656
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe79⤵PID:3920
-
\??\c:\7tbbhn.exec:\7tbbhn.exe80⤵PID:4496
-
\??\c:\thnntb.exec:\thnntb.exe81⤵PID:4684
-
\??\c:\dvvdd.exec:\dvvdd.exe82⤵PID:3100
-
\??\c:\ffllrrr.exec:\ffllrrr.exe83⤵PID:3896
-
\??\c:\bnnnhh.exec:\bnnnhh.exe84⤵PID:1496
-
\??\c:\bbtttb.exec:\bbtttb.exe85⤵PID:2244
-
\??\c:\djppd.exec:\djppd.exe86⤵PID:3088
-
\??\c:\xflrrxx.exec:\xflrrxx.exe87⤵PID:2424
-
\??\c:\7bhhhb.exec:\7bhhhb.exe88⤵PID:4588
-
\??\c:\tbbbtb.exec:\tbbbtb.exe89⤵PID:2928
-
\??\c:\jpdvd.exec:\jpdvd.exe90⤵PID:4776
-
\??\c:\7lrrlrr.exec:\7lrrlrr.exe91⤵PID:2368
-
\??\c:\bthbbb.exec:\bthbbb.exe92⤵PID:2720
-
\??\c:\nhhtth.exec:\nhhtth.exe93⤵PID:4320
-
\??\c:\ppddv.exec:\ppddv.exe94⤵PID:2200
-
\??\c:\lflfffx.exec:\lflfffx.exe95⤵PID:3008
-
\??\c:\bhhhhh.exec:\bhhhhh.exe96⤵PID:3820
-
\??\c:\jvjdd.exec:\jvjdd.exe97⤵PID:5008
-
\??\c:\lxxxrxr.exec:\lxxxrxr.exe98⤵PID:1580
-
\??\c:\fxxxxff.exec:\fxxxxff.exe99⤵PID:4816
-
\??\c:\bttnhb.exec:\bttnhb.exe100⤵PID:336
-
\??\c:\ddddj.exec:\ddddj.exe101⤵PID:4448
-
\??\c:\llrxrxx.exec:\llrxrxx.exe102⤵PID:4760
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe103⤵PID:3824
-
\??\c:\tttttb.exec:\tttttb.exe104⤵PID:4976
-
\??\c:\jpjjj.exec:\jpjjj.exe105⤵PID:1752
-
\??\c:\7jjdv.exec:\7jjdv.exe106⤵PID:1492
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe107⤵PID:1248
-
\??\c:\hnhhnh.exec:\hnhhnh.exe108⤵PID:692
-
\??\c:\pdvdd.exec:\pdvdd.exe109⤵PID:4316
-
\??\c:\3rrrxff.exec:\3rrrxff.exe110⤵PID:1132
-
\??\c:\lffffff.exec:\lffffff.exe111⤵PID:4796
-
\??\c:\thhhhn.exec:\thhhhn.exe112⤵PID:3156
-
\??\c:\vjjjj.exec:\vjjjj.exe113⤵PID:3556
-
\??\c:\vpjjv.exec:\vpjjv.exe114⤵PID:2996
-
\??\c:\lxxxfff.exec:\lxxxfff.exe115⤵PID:2316
-
\??\c:\btbbbh.exec:\btbbbh.exe116⤵PID:2744
-
\??\c:\hhtnnt.exec:\hhtnnt.exe117⤵PID:4428
-
\??\c:\dvjvp.exec:\dvjvp.exe118⤵PID:1608
-
\??\c:\rxxllll.exec:\rxxllll.exe119⤵PID:2220
-
\??\c:\nthbbb.exec:\nthbbb.exe120⤵PID:444
-
\??\c:\1jpdv.exec:\1jpdv.exe121⤵PID:2904
-
\??\c:\vvppp.exec:\vvppp.exe122⤵PID:3428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-