Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 06:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe
-
Size
455KB
-
MD5
57c35dd5c7d4d634fca2a36d462aeae7
-
SHA1
e7c53a3840dd49a90f3e63ff8fcdbc43f7877c11
-
SHA256
ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410
-
SHA512
f5d7e2ed266661665200e02a6ffe6ad9c96c75ffb5c17974f12c78644ee8e3fc846bfab0f18fdcc63627bcd3fae8a469dceb55310fade1dae66233b39afc6271
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2932-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1596 hhttnn.exe 3368 rxrrxxx.exe 2168 80660.exe 1576 frrrlll.exe 4936 4602688.exe 4596 3jdvp.exe 3688 48482.exe 3540 rfrrlrl.exe 4692 htthtt.exe 4208 tntnth.exe 4240 68004.exe 2864 xrxrrrx.exe 1912 6464426.exe 3172 28684.exe 2036 pvjdj.exe 1728 rrxxxxx.exe 1768 rfrrxrf.exe 1984 w06482.exe 4768 488880.exe 4564 nnhbbb.exe 4912 e44048.exe 4900 2206048.exe 2868 882284.exe 3804 1jpjd.exe 3408 06260.exe 3904 862000.exe 3144 xxfrrrr.exe 2784 622048.exe 4908 04648.exe 1100 26226.exe 2668 622266.exe 4296 2846488.exe 688 hbnnbh.exe 3812 w66086.exe 232 xrrlllf.exe 1252 8608226.exe 3600 rfllfxr.exe 2508 660600.exe 2416 822622.exe 3924 0442004.exe 4992 604084.exe 3044 jdjdv.exe 3516 i066048.exe 3064 hhnhnn.exe 3876 5vdvd.exe 3776 6442622.exe 1364 084808.exe 1152 60826.exe 2124 e84488.exe 1260 dddvj.exe 1948 jjvvd.exe 212 ddddd.exe 2040 7rxrlrl.exe 1716 246662.exe 3252 pvpvv.exe 2316 fxxrxxr.exe 4288 tttttt.exe 100 1nhbnt.exe 3312 080062.exe 3860 lxflxlx.exe 1132 5jpjd.exe 3748 nbbnhb.exe 1148 4066004.exe 4180 fxfxrrl.exe -
resource yara_rule behavioral2/memory/2932-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-595-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i060888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 828822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e88860.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66820.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0448666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26060.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 284426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 1596 2932 ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe 83 PID 2932 wrote to memory of 1596 2932 ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe 83 PID 2932 wrote to memory of 1596 2932 ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe 83 PID 1596 wrote to memory of 3368 1596 hhttnn.exe 84 PID 1596 wrote to memory of 3368 1596 hhttnn.exe 84 PID 1596 wrote to memory of 3368 1596 hhttnn.exe 84 PID 3368 wrote to memory of 2168 3368 rxrrxxx.exe 85 PID 3368 wrote to memory of 2168 3368 rxrrxxx.exe 85 PID 3368 wrote to memory of 2168 3368 rxrrxxx.exe 85 PID 2168 wrote to memory of 1576 2168 80660.exe 86 PID 2168 wrote to memory of 1576 2168 80660.exe 86 PID 2168 wrote to memory of 1576 2168 80660.exe 86 PID 1576 wrote to memory of 4936 1576 frrrlll.exe 87 PID 1576 wrote to memory of 4936 1576 frrrlll.exe 87 PID 1576 wrote to memory of 4936 1576 frrrlll.exe 87 PID 4936 wrote to memory of 4596 4936 4602688.exe 88 PID 4936 wrote to memory of 4596 4936 4602688.exe 88 PID 4936 wrote to memory of 4596 4936 4602688.exe 88 PID 4596 wrote to memory of 3688 4596 3jdvp.exe 89 PID 4596 wrote to memory of 3688 4596 3jdvp.exe 89 PID 4596 wrote to memory of 3688 4596 3jdvp.exe 89 PID 3688 wrote to memory of 3540 3688 48482.exe 90 PID 3688 wrote to memory of 3540 3688 48482.exe 90 PID 3688 wrote to memory of 3540 3688 48482.exe 90 PID 3540 wrote to memory of 4692 3540 rfrrlrl.exe 91 PID 3540 wrote to memory of 4692 3540 rfrrlrl.exe 91 PID 3540 wrote to memory of 4692 3540 rfrrlrl.exe 91 PID 4692 wrote to memory of 4208 4692 htthtt.exe 92 PID 4692 wrote to memory of 4208 4692 htthtt.exe 92 PID 4692 wrote to memory of 4208 4692 htthtt.exe 92 PID 4208 wrote to memory of 4240 4208 tntnth.exe 93 PID 4208 wrote to memory of 4240 4208 tntnth.exe 93 PID 4208 wrote to memory of 4240 4208 tntnth.exe 93 PID 4240 wrote to memory of 2864 4240 68004.exe 94 PID 4240 wrote to memory of 2864 4240 68004.exe 94 PID 4240 wrote to memory of 2864 4240 68004.exe 94 PID 2864 wrote to memory of 1912 2864 xrxrrrx.exe 95 PID 2864 wrote to memory of 1912 2864 xrxrrrx.exe 95 PID 2864 wrote to memory of 1912 2864 xrxrrrx.exe 95 PID 1912 wrote to memory of 3172 1912 6464426.exe 96 PID 1912 wrote to memory of 3172 1912 6464426.exe 96 PID 1912 wrote to memory of 3172 1912 6464426.exe 96 PID 3172 wrote to memory of 2036 3172 28684.exe 97 PID 3172 wrote to memory of 2036 3172 28684.exe 97 PID 3172 wrote to memory of 2036 3172 28684.exe 97 PID 2036 wrote to memory of 1728 2036 pvjdj.exe 98 PID 2036 wrote to memory of 1728 2036 pvjdj.exe 98 PID 2036 wrote to memory of 1728 2036 pvjdj.exe 98 PID 1728 wrote to memory of 1768 1728 rrxxxxx.exe 99 PID 1728 wrote to memory of 1768 1728 rrxxxxx.exe 99 PID 1728 wrote to memory of 1768 1728 rrxxxxx.exe 99 PID 1768 wrote to memory of 1984 1768 rfrrxrf.exe 100 PID 1768 wrote to memory of 1984 1768 rfrrxrf.exe 100 PID 1768 wrote to memory of 1984 1768 rfrrxrf.exe 100 PID 1984 wrote to memory of 4768 1984 w06482.exe 101 PID 1984 wrote to memory of 4768 1984 w06482.exe 101 PID 1984 wrote to memory of 4768 1984 w06482.exe 101 PID 4768 wrote to memory of 4564 4768 488880.exe 102 PID 4768 wrote to memory of 4564 4768 488880.exe 102 PID 4768 wrote to memory of 4564 4768 488880.exe 102 PID 4564 wrote to memory of 4912 4564 nnhbbb.exe 103 PID 4564 wrote to memory of 4912 4564 nnhbbb.exe 103 PID 4564 wrote to memory of 4912 4564 nnhbbb.exe 103 PID 4912 wrote to memory of 4900 4912 e44048.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe"C:\Users\Admin\AppData\Local\Temp\ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\hhttnn.exec:\hhttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\rxrrxxx.exec:\rxrrxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\80660.exec:\80660.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\frrrlll.exec:\frrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\4602688.exec:\4602688.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\3jdvp.exec:\3jdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\48482.exec:\48482.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\rfrrlrl.exec:\rfrrlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\htthtt.exec:\htthtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\tntnth.exec:\tntnth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\68004.exec:\68004.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\6464426.exec:\6464426.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\28684.exec:\28684.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\pvjdj.exec:\pvjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\rfrrxrf.exec:\rfrrxrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\w06482.exec:\w06482.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\488880.exec:\488880.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\nnhbbb.exec:\nnhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\e44048.exec:\e44048.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\2206048.exec:\2206048.exe23⤵
- Executes dropped EXE
PID:4900 -
\??\c:\882284.exec:\882284.exe24⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1jpjd.exec:\1jpjd.exe25⤵
- Executes dropped EXE
PID:3804 -
\??\c:\06260.exec:\06260.exe26⤵
- Executes dropped EXE
PID:3408 -
\??\c:\862000.exec:\862000.exe27⤵
- Executes dropped EXE
PID:3904 -
\??\c:\xxfrrrr.exec:\xxfrrrr.exe28⤵
- Executes dropped EXE
PID:3144 -
\??\c:\622048.exec:\622048.exe29⤵
- Executes dropped EXE
PID:2784 -
\??\c:\04648.exec:\04648.exe30⤵
- Executes dropped EXE
PID:4908 -
\??\c:\26226.exec:\26226.exe31⤵
- Executes dropped EXE
PID:1100 -
\??\c:\622266.exec:\622266.exe32⤵
- Executes dropped EXE
PID:2668 -
\??\c:\2846488.exec:\2846488.exe33⤵
- Executes dropped EXE
PID:4296 -
\??\c:\hbnnbh.exec:\hbnnbh.exe34⤵
- Executes dropped EXE
PID:688 -
\??\c:\w66086.exec:\w66086.exe35⤵
- Executes dropped EXE
PID:3812 -
\??\c:\xrrlllf.exec:\xrrlllf.exe36⤵
- Executes dropped EXE
PID:232 -
\??\c:\8608226.exec:\8608226.exe37⤵
- Executes dropped EXE
PID:1252 -
\??\c:\rfllfxr.exec:\rfllfxr.exe38⤵
- Executes dropped EXE
PID:3600 -
\??\c:\660600.exec:\660600.exe39⤵
- Executes dropped EXE
PID:2508 -
\??\c:\822622.exec:\822622.exe40⤵
- Executes dropped EXE
PID:2416 -
\??\c:\0442004.exec:\0442004.exe41⤵
- Executes dropped EXE
PID:3924 -
\??\c:\604084.exec:\604084.exe42⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jdjdv.exec:\jdjdv.exe43⤵
- Executes dropped EXE
PID:3044 -
\??\c:\i066048.exec:\i066048.exe44⤵
- Executes dropped EXE
PID:3516 -
\??\c:\hhnhnn.exec:\hhnhnn.exe45⤵
- Executes dropped EXE
PID:3064 -
\??\c:\5vdvd.exec:\5vdvd.exe46⤵
- Executes dropped EXE
PID:3876 -
\??\c:\6442622.exec:\6442622.exe47⤵
- Executes dropped EXE
PID:3776 -
\??\c:\084808.exec:\084808.exe48⤵
- Executes dropped EXE
PID:1364 -
\??\c:\60826.exec:\60826.exe49⤵
- Executes dropped EXE
PID:1152 -
\??\c:\e84488.exec:\e84488.exe50⤵
- Executes dropped EXE
PID:2124 -
\??\c:\dddvj.exec:\dddvj.exe51⤵
- Executes dropped EXE
PID:1260 -
\??\c:\jjvvd.exec:\jjvvd.exe52⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ddddd.exec:\ddddd.exe53⤵
- Executes dropped EXE
PID:212 -
\??\c:\7rxrlrl.exec:\7rxrlrl.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\246662.exec:\246662.exe55⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pvpvv.exec:\pvpvv.exe56⤵
- Executes dropped EXE
PID:3252 -
\??\c:\fxxrxxr.exec:\fxxrxxr.exe57⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tttttt.exec:\tttttt.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4288 -
\??\c:\1nhbnt.exec:\1nhbnt.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:100 -
\??\c:\080062.exec:\080062.exe60⤵
- Executes dropped EXE
PID:3312 -
\??\c:\lxflxlx.exec:\lxflxlx.exe61⤵
- Executes dropped EXE
PID:3860 -
\??\c:\5jpjd.exec:\5jpjd.exe62⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nbbnhb.exec:\nbbnhb.exe63⤵
- Executes dropped EXE
PID:3748 -
\??\c:\4066004.exec:\4066004.exe64⤵
- Executes dropped EXE
PID:1148 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe65⤵
- Executes dropped EXE
PID:4180 -
\??\c:\442642.exec:\442642.exe66⤵PID:3480
-
\??\c:\2426004.exec:\2426004.exe67⤵PID:2908
-
\??\c:\xxffxfr.exec:\xxffxfr.exe68⤵PID:4156
-
\??\c:\9llfxrl.exec:\9llfxrl.exe69⤵PID:60
-
\??\c:\ddpjp.exec:\ddpjp.exe70⤵PID:5080
-
\??\c:\9xfxlxx.exec:\9xfxlxx.exe71⤵PID:4768
-
\??\c:\ntbttt.exec:\ntbttt.exe72⤵PID:116
-
\??\c:\vjjjp.exec:\vjjjp.exe73⤵PID:4912
-
\??\c:\2682240.exec:\2682240.exe74⤵PID:5100
-
\??\c:\djpjd.exec:\djpjd.exe75⤵PID:4080
-
\??\c:\jvvjv.exec:\jvvjv.exe76⤵PID:4092
-
\??\c:\jpjjd.exec:\jpjjd.exe77⤵PID:2524
-
\??\c:\80826.exec:\80826.exe78⤵PID:4104
-
\??\c:\9xxrflx.exec:\9xxrflx.exe79⤵PID:460
-
\??\c:\tnnhbb.exec:\tnnhbb.exe80⤵PID:4560
-
\??\c:\6848062.exec:\6848062.exe81⤵PID:2372
-
\??\c:\ddvdv.exec:\ddvdv.exe82⤵PID:4456
-
\??\c:\btthtt.exec:\btthtt.exe83⤵PID:1460
-
\??\c:\rfrxffr.exec:\rfrxffr.exe84⤵PID:4904
-
\??\c:\rffxllf.exec:\rffxllf.exe85⤵PID:4680
-
\??\c:\28262.exec:\28262.exe86⤵PID:4896
-
\??\c:\86048.exec:\86048.exe87⤵PID:5104
-
\??\c:\0844040.exec:\0844040.exe88⤵PID:4160
-
\??\c:\bhhhbt.exec:\bhhhbt.exe89⤵PID:4832
-
\??\c:\lffxlfx.exec:\lffxlfx.exe90⤵PID:1960
-
\??\c:\hnnhbb.exec:\hnnhbb.exe91⤵PID:3732
-
\??\c:\lflxrlf.exec:\lflxrlf.exe92⤵PID:4600
-
\??\c:\a8042.exec:\a8042.exe93⤵PID:3220
-
\??\c:\5dvjj.exec:\5dvjj.exe94⤵PID:3016
-
\??\c:\jjpjp.exec:\jjpjp.exe95⤵PID:3572
-
\??\c:\9bthtn.exec:\9bthtn.exe96⤵PID:4452
-
\??\c:\frrlrlf.exec:\frrlrlf.exe97⤵PID:3692
-
\??\c:\7llfrrf.exec:\7llfrrf.exe98⤵PID:2360
-
\??\c:\46480.exec:\46480.exe99⤵PID:2476
-
\??\c:\jdpjj.exec:\jdpjj.exe100⤵PID:1864
-
\??\c:\bnthtt.exec:\bnthtt.exe101⤵PID:1084
-
\??\c:\46422.exec:\46422.exe102⤵PID:3368
-
\??\c:\hnthnb.exec:\hnthnb.exe103⤵PID:2364
-
\??\c:\868288.exec:\868288.exe104⤵PID:4496
-
\??\c:\tnhtn6.exec:\tnhtn6.exe105⤵PID:2600
-
\??\c:\0444844.exec:\0444844.exe106⤵PID:2044
-
\??\c:\tnnbnn.exec:\tnnbnn.exe107⤵PID:3524
-
\??\c:\1fxrllf.exec:\1fxrllf.exe108⤵PID:4828
-
\??\c:\464444.exec:\464444.exe109⤵PID:3688
-
\??\c:\5xllrxf.exec:\5xllrxf.exe110⤵PID:1184
-
\??\c:\28880.exec:\28880.exe111⤵PID:1544
-
\??\c:\066660.exec:\066660.exe112⤵PID:2188
-
\??\c:\m2848.exec:\m2848.exe113⤵PID:4800
-
\??\c:\tnnntt.exec:\tnnntt.exe114⤵PID:4688
-
\??\c:\dvjjd.exec:\dvjjd.exe115⤵PID:3280
-
\??\c:\llfrfrx.exec:\llfrfrx.exe116⤵PID:3404
-
\??\c:\4804006.exec:\4804006.exe117⤵PID:1564
-
\??\c:\0448666.exec:\0448666.exe118⤵
- System Location Discovery: System Language Discovery
PID:5052 -
\??\c:\28600.exec:\28600.exe119⤵PID:4224
-
\??\c:\4602682.exec:\4602682.exe120⤵PID:3716
-
\??\c:\nthntb.exec:\nthntb.exe121⤵PID:1312
-
\??\c:\820486.exec:\820486.exe122⤵PID:3444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-