Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 06:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe
-
Size
454KB
-
MD5
adc3ad1c52a585c3b9baddbcbd136284
-
SHA1
d1e7d4839522c581ac5f5105e7d4f2d50426f0e0
-
SHA256
ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16
-
SHA512
df3b5b10b50f767073d118ede156d86539b9bd5774def1401b2908d1e645bb641788145634980e2b4e54b95ed453d8ef47da896acb34cacb4e3a911baa05e84f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbej:q7Tc2NYHUrAwfMp3CDj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3392-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2968 llxxxfl.exe 1468 rlfrlff.exe 4268 9hbbhn.exe 3332 jpddj.exe 4008 xxffflr.exe 1564 5hhhhn.exe 2604 fffxllx.exe 4040 nnthhn.exe 2164 xlfflrr.exe 4056 dpvvv.exe 3048 lfxlxfx.exe 5052 hnttnb.exe 5000 rxfllrr.exe 5036 1lrrrxx.exe 312 frxlfrf.exe 1552 hntttt.exe 1828 lrflrxl.exe 1492 nnttth.exe 452 rrflrxf.exe 3384 bnbbhb.exe 4580 jjvvd.exe 1584 rlfllfr.exe 1696 nhnttb.exe 4060 bttbbh.exe 1664 htthht.exe 456 rlfllxx.exe 4892 nnbbhn.exe 5016 flrrrxx.exe 1300 pdvjp.exe 4336 rrfllrx.exe 3352 nnttbh.exe 1632 pdppp.exe 3244 bttthb.exe 3220 rxrrrxf.exe 1376 nnbbtb.exe 5072 pvppj.exe 840 5pjpd.exe 2608 xfrxxfl.exe 2612 hthbhh.exe 1624 vppjd.exe 1984 xlxxxxx.exe 1240 bhnnnn.exe 3088 dpddd.exe 4072 jjpdd.exe 4292 3rrxflx.exe 2488 hbhbnn.exe 4116 tnhthn.exe 872 pvdjv.exe 2836 lxlrxff.exe 740 vjjjp.exe 3100 jdddv.exe 4352 rxfrxlx.exe 880 hhtbtb.exe 2096 vddjj.exe 3764 fflxxrr.exe 3944 tthntb.exe 2724 3vppv.exe 4584 dvjpd.exe 5064 5thnnb.exe 3332 bhnbtb.exe 1496 pvjjj.exe 4032 5xlrrxx.exe 2684 7bhhhn.exe 3816 htbhnn.exe -
resource yara_rule behavioral2/memory/3392-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-752-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3392 wrote to memory of 2968 3392 ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe 82 PID 3392 wrote to memory of 2968 3392 ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe 82 PID 3392 wrote to memory of 2968 3392 ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe 82 PID 2968 wrote to memory of 1468 2968 llxxxfl.exe 83 PID 2968 wrote to memory of 1468 2968 llxxxfl.exe 83 PID 2968 wrote to memory of 1468 2968 llxxxfl.exe 83 PID 1468 wrote to memory of 4268 1468 rlfrlff.exe 84 PID 1468 wrote to memory of 4268 1468 rlfrlff.exe 84 PID 1468 wrote to memory of 4268 1468 rlfrlff.exe 84 PID 4268 wrote to memory of 3332 4268 9hbbhn.exe 85 PID 4268 wrote to memory of 3332 4268 9hbbhn.exe 85 PID 4268 wrote to memory of 3332 4268 9hbbhn.exe 85 PID 3332 wrote to memory of 4008 3332 jpddj.exe 86 PID 3332 wrote to memory of 4008 3332 jpddj.exe 86 PID 3332 wrote to memory of 4008 3332 jpddj.exe 86 PID 4008 wrote to memory of 1564 4008 xxffflr.exe 87 PID 4008 wrote to memory of 1564 4008 xxffflr.exe 87 PID 4008 wrote to memory of 1564 4008 xxffflr.exe 87 PID 1564 wrote to memory of 2604 1564 5hhhhn.exe 88 PID 1564 wrote to memory of 2604 1564 5hhhhn.exe 88 PID 1564 wrote to memory of 2604 1564 5hhhhn.exe 88 PID 2604 wrote to memory of 4040 2604 fffxllx.exe 89 PID 2604 wrote to memory of 4040 2604 fffxllx.exe 89 PID 2604 wrote to memory of 4040 2604 fffxllx.exe 89 PID 4040 wrote to memory of 2164 4040 nnthhn.exe 90 PID 4040 wrote to memory of 2164 4040 nnthhn.exe 90 PID 4040 wrote to memory of 2164 4040 nnthhn.exe 90 PID 2164 wrote to memory of 4056 2164 xlfflrr.exe 91 PID 2164 wrote to memory of 4056 2164 xlfflrr.exe 91 PID 2164 wrote to memory of 4056 2164 xlfflrr.exe 91 PID 4056 wrote to memory of 3048 4056 dpvvv.exe 92 PID 4056 wrote to memory of 3048 4056 dpvvv.exe 92 PID 4056 wrote to memory of 3048 4056 dpvvv.exe 92 PID 3048 wrote to memory of 5052 3048 lfxlxfx.exe 93 PID 3048 wrote to memory of 5052 3048 lfxlxfx.exe 93 PID 3048 wrote to memory of 5052 3048 lfxlxfx.exe 93 PID 5052 wrote to memory of 5000 5052 hnttnb.exe 94 PID 5052 wrote to memory of 5000 5052 hnttnb.exe 94 PID 5052 wrote to memory of 5000 5052 hnttnb.exe 94 PID 5000 wrote to memory of 5036 5000 rxfllrr.exe 95 PID 5000 wrote to memory of 5036 5000 rxfllrr.exe 95 PID 5000 wrote to memory of 5036 5000 rxfllrr.exe 95 PID 5036 wrote to memory of 312 5036 1lrrrxx.exe 96 PID 5036 wrote to memory of 312 5036 1lrrrxx.exe 96 PID 5036 wrote to memory of 312 5036 1lrrrxx.exe 96 PID 312 wrote to memory of 1552 312 frxlfrf.exe 97 PID 312 wrote to memory of 1552 312 frxlfrf.exe 97 PID 312 wrote to memory of 1552 312 frxlfrf.exe 97 PID 1552 wrote to memory of 1828 1552 hntttt.exe 98 PID 1552 wrote to memory of 1828 1552 hntttt.exe 98 PID 1552 wrote to memory of 1828 1552 hntttt.exe 98 PID 1828 wrote to memory of 1492 1828 lrflrxl.exe 99 PID 1828 wrote to memory of 1492 1828 lrflrxl.exe 99 PID 1828 wrote to memory of 1492 1828 lrflrxl.exe 99 PID 1492 wrote to memory of 452 1492 nnttth.exe 100 PID 1492 wrote to memory of 452 1492 nnttth.exe 100 PID 1492 wrote to memory of 452 1492 nnttth.exe 100 PID 452 wrote to memory of 3384 452 rrflrxf.exe 101 PID 452 wrote to memory of 3384 452 rrflrxf.exe 101 PID 452 wrote to memory of 3384 452 rrflrxf.exe 101 PID 3384 wrote to memory of 4580 3384 bnbbhb.exe 102 PID 3384 wrote to memory of 4580 3384 bnbbhb.exe 102 PID 3384 wrote to memory of 4580 3384 bnbbhb.exe 102 PID 4580 wrote to memory of 1584 4580 jjvvd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe"C:\Users\Admin\AppData\Local\Temp\ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\llxxxfl.exec:\llxxxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rlfrlff.exec:\rlfrlff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\9hbbhn.exec:\9hbbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\jpddj.exec:\jpddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\xxffflr.exec:\xxffflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\5hhhhn.exec:\5hhhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\fffxllx.exec:\fffxllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nnthhn.exec:\nnthhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\xlfflrr.exec:\xlfflrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\dpvvv.exec:\dpvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\hnttnb.exec:\hnttnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\rxfllrr.exec:\rxfllrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\1lrrrxx.exec:\1lrrrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\frxlfrf.exec:\frxlfrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\hntttt.exec:\hntttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\lrflrxl.exec:\lrflrxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\nnttth.exec:\nnttth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\rrflrxf.exec:\rrflrxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\bnbbhb.exec:\bnbbhb.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\jjvvd.exec:\jjvvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\rlfllfr.exec:\rlfllfr.exe23⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nhnttb.exec:\nhnttb.exe24⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bttbbh.exec:\bttbbh.exe25⤵
- Executes dropped EXE
PID:4060 -
\??\c:\htthht.exec:\htthht.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rlfllxx.exec:\rlfllxx.exe27⤵
- Executes dropped EXE
PID:456 -
\??\c:\nnbbhn.exec:\nnbbhn.exe28⤵
- Executes dropped EXE
PID:4892 -
\??\c:\flrrrxx.exec:\flrrrxx.exe29⤵
- Executes dropped EXE
PID:5016 -
\??\c:\pdvjp.exec:\pdvjp.exe30⤵
- Executes dropped EXE
PID:1300 -
\??\c:\rrfllrx.exec:\rrfllrx.exe31⤵
- Executes dropped EXE
PID:4336 -
\??\c:\nnttbh.exec:\nnttbh.exe32⤵
- Executes dropped EXE
PID:3352 -
\??\c:\pdppp.exec:\pdppp.exe33⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bttthb.exec:\bttthb.exe34⤵
- Executes dropped EXE
PID:3244 -
\??\c:\rxrrrxf.exec:\rxrrrxf.exe35⤵
- Executes dropped EXE
PID:3220 -
\??\c:\nnbbtb.exec:\nnbbtb.exe36⤵
- Executes dropped EXE
PID:1376 -
\??\c:\pvppj.exec:\pvppj.exe37⤵
- Executes dropped EXE
PID:5072 -
\??\c:\5pjpd.exec:\5pjpd.exe38⤵
- Executes dropped EXE
PID:840 -
\??\c:\xfrxxfl.exec:\xfrxxfl.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hthbhh.exec:\hthbhh.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vppjd.exec:\vppjd.exe41⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe42⤵
- Executes dropped EXE
PID:1984 -
\??\c:\bhnnnn.exec:\bhnnnn.exe43⤵
- Executes dropped EXE
PID:1240 -
\??\c:\dpddd.exec:\dpddd.exe44⤵
- Executes dropped EXE
PID:3088 -
\??\c:\jjpdd.exec:\jjpdd.exe45⤵
- Executes dropped EXE
PID:4072 -
\??\c:\3rrxflx.exec:\3rrxflx.exe46⤵
- Executes dropped EXE
PID:4292 -
\??\c:\hbhbnn.exec:\hbhbnn.exe47⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tnhthn.exec:\tnhthn.exe48⤵
- Executes dropped EXE
PID:4116 -
\??\c:\pvdjv.exec:\pvdjv.exe49⤵
- Executes dropped EXE
PID:872 -
\??\c:\lxlrxff.exec:\lxlrxff.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vjjjp.exec:\vjjjp.exe51⤵
- Executes dropped EXE
PID:740 -
\??\c:\jdddv.exec:\jdddv.exe52⤵
- Executes dropped EXE
PID:3100 -
\??\c:\rxfrxlx.exec:\rxfrxlx.exe53⤵
- Executes dropped EXE
PID:4352 -
\??\c:\hhtbtb.exec:\hhtbtb.exe54⤵
- Executes dropped EXE
PID:880 -
\??\c:\vddjj.exec:\vddjj.exe55⤵
- Executes dropped EXE
PID:2096 -
\??\c:\fflxxrr.exec:\fflxxrr.exe56⤵
- Executes dropped EXE
PID:3764 -
\??\c:\tthntb.exec:\tthntb.exe57⤵
- Executes dropped EXE
PID:3944 -
\??\c:\3vppv.exec:\3vppv.exe58⤵
- Executes dropped EXE
PID:2724 -
\??\c:\dvjpd.exec:\dvjpd.exe59⤵
- Executes dropped EXE
PID:4584 -
\??\c:\5thnnb.exec:\5thnnb.exe60⤵
- Executes dropped EXE
PID:5064 -
\??\c:\bhnbtb.exec:\bhnbtb.exe61⤵
- Executes dropped EXE
PID:3332 -
\??\c:\pvjjj.exec:\pvjjj.exe62⤵
- Executes dropped EXE
PID:1496 -
\??\c:\5xlrrxx.exec:\5xlrrxx.exe63⤵
- Executes dropped EXE
PID:4032 -
\??\c:\7bhhhn.exec:\7bhhhn.exe64⤵
- Executes dropped EXE
PID:2684 -
\??\c:\htbhnn.exec:\htbhnn.exe65⤵
- Executes dropped EXE
PID:3816 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe66⤵PID:1412
-
\??\c:\ffxrffl.exec:\ffxrffl.exe67⤵PID:4972
-
\??\c:\bntbhn.exec:\bntbhn.exe68⤵PID:1216
-
\??\c:\jpvvd.exec:\jpvvd.exe69⤵PID:400
-
\??\c:\rxxffll.exec:\rxxffll.exe70⤵PID:3604
-
\??\c:\bhnbth.exec:\bhnbth.exe71⤵PID:4380
-
\??\c:\nhhttt.exec:\nhhttt.exe72⤵PID:3716
-
\??\c:\jvpvj.exec:\jvpvj.exe73⤵PID:2000
-
\??\c:\5flrrfr.exec:\5flrrfr.exe74⤵PID:2796
-
\??\c:\nthnnb.exec:\nthnnb.exe75⤵PID:116
-
\??\c:\jvjpp.exec:\jvjpp.exe76⤵PID:3608
-
\??\c:\flxrllx.exec:\flxrllx.exe77⤵PID:3056
-
\??\c:\flffxxx.exec:\flffxxx.exe78⤵PID:5048
-
\??\c:\hnntnt.exec:\hnntnt.exe79⤵PID:2060
-
\??\c:\dpvpp.exec:\dpvpp.exe80⤵PID:1836
-
\??\c:\5frffrr.exec:\5frffrr.exe81⤵PID:1844
-
\??\c:\hhhnnb.exec:\hhhnnb.exe82⤵PID:3484
-
\??\c:\3pddj.exec:\3pddj.exe83⤵PID:1012
-
\??\c:\jpppv.exec:\jpppv.exe84⤵PID:3492
-
\??\c:\hbbnhb.exec:\hbbnhb.exe85⤵PID:3068
-
\??\c:\djvdj.exec:\djvdj.exe86⤵PID:3708
-
\??\c:\rxlrxfr.exec:\rxlrxfr.exe87⤵PID:1584
-
\??\c:\frlrlrx.exec:\frlrlrx.exe88⤵PID:1364
-
\??\c:\tbhhbb.exec:\tbhhbb.exe89⤵PID:3568
-
\??\c:\vdjjp.exec:\vdjjp.exe90⤵PID:4872
-
\??\c:\rxrrrxx.exec:\rxrrrxx.exe91⤵PID:3156
-
\??\c:\ttbhhn.exec:\ttbhhn.exe92⤵PID:2092
-
\??\c:\1vjjp.exec:\1vjjp.exe93⤵PID:1480
-
\??\c:\rrlllrx.exec:\rrlllrx.exe94⤵PID:3284
-
\??\c:\bhnntn.exec:\bhnntn.exe95⤵PID:2344
-
\??\c:\vdvdp.exec:\vdvdp.exe96⤵PID:3972
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe97⤵PID:2012
-
\??\c:\bntnht.exec:\bntnht.exe98⤵PID:4844
-
\??\c:\hhbbhn.exec:\hhbbhn.exe99⤵PID:5004
-
\??\c:\vpddj.exec:\vpddj.exe100⤵PID:1008
-
\??\c:\lrfxrff.exec:\lrfxrff.exe101⤵PID:1164
-
\??\c:\bbhnnb.exec:\bbhnnb.exe102⤵PID:1764
-
\??\c:\djddv.exec:\djddv.exe103⤵PID:1648
-
\??\c:\dddpp.exec:\dddpp.exe104⤵PID:4176
-
\??\c:\rxfflrx.exec:\rxfflrx.exe105⤵PID:4676
-
\??\c:\hhtbnn.exec:\hhtbnn.exe106⤵PID:220
-
\??\c:\ffxxlrr.exec:\ffxxlrr.exe107⤵PID:2168
-
\??\c:\httthh.exec:\httthh.exe108⤵PID:1624
-
\??\c:\pvdpj.exec:\pvdpj.exe109⤵PID:4876
-
\??\c:\frrfxfr.exec:\frrfxfr.exe110⤵PID:4660
-
\??\c:\hbttht.exec:\hbttht.exe111⤵PID:2528
-
\??\c:\vdvjj.exec:\vdvjj.exe112⤵PID:2640
-
\??\c:\pvppj.exec:\pvppj.exe113⤵PID:2996
-
\??\c:\rxxfllf.exec:\rxxfllf.exe114⤵PID:1600
-
\??\c:\9tbbbn.exec:\9tbbbn.exe115⤵PID:872
-
\??\c:\vdjjd.exec:\vdjjd.exe116⤵PID:2836
-
\??\c:\pvvvp.exec:\pvvvp.exe117⤵PID:740
-
\??\c:\rrlfrxl.exec:\rrlfrxl.exe118⤵PID:4356
-
\??\c:\tbtbbh.exec:\tbtbbh.exe119⤵PID:4352
-
\??\c:\dvvpd.exec:\dvvpd.exe120⤵PID:4312
-
\??\c:\xxllrxl.exec:\xxllrxl.exe121⤵PID:4904
-
\??\c:\5nntbn.exec:\5nntbn.exe122⤵PID:3764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-