Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 06:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe
-
Size
454KB
-
MD5
adc3ad1c52a585c3b9baddbcbd136284
-
SHA1
d1e7d4839522c581ac5f5105e7d4f2d50426f0e0
-
SHA256
ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16
-
SHA512
df3b5b10b50f767073d118ede156d86539b9bd5774def1401b2908d1e645bb641788145634980e2b4e54b95ed453d8ef47da896acb34cacb4e3a911baa05e84f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbej:q7Tc2NYHUrAwfMp3CDj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2876-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/692-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-923-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-1087-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-1187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-1271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-1372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2716 jjdjv.exe 4700 xxlrflx.exe 4820 thbhtt.exe 4748 nbbhhb.exe 1516 rrxfflr.exe 4128 tnbhht.exe 1496 lxrxlxl.exe 1644 htbttt.exe 764 vpjdp.exe 2700 lrffxll.exe 1888 hthhbh.exe 2020 xfxxfrf.exe 2860 lxllllf.exe 4572 5dvpv.exe 1240 5fffrrx.exe 1952 tntbbt.exe 2764 ppvpj.exe 1604 tnbnhh.exe 4360 dppdv.exe 1660 hbhnnn.exe 1904 vpvpp.exe 3100 bhbntt.exe 1412 jjvvd.exe 2388 fffxxxx.exe 4016 jvjvd.exe 4292 flffrlx.exe 2392 xrrlxrl.exe 4456 jdddd.exe 3668 3ttntb.exe 1292 rrfxlfl.exe 3592 thbhnn.exe 1652 vvjjj.exe 3212 tbbtbt.exe 2360 pdjpv.exe 3140 fffrxrl.exe 4996 vjjdv.exe 1760 5frrrxx.exe 3684 pvddd.exe 4244 lxrfrfx.exe 868 nnbbnt.exe 4544 ffllfll.exe 3084 pjddp.exe 1828 rlxfllr.exe 4288 vdppp.exe 5088 rxfxffl.exe 988 nnnnnn.exe 4032 vpvdd.exe 4740 rxrxrxf.exe 4420 nttbbt.exe 4976 ppdpp.exe 692 lrxflrx.exe 324 btbnbt.exe 3164 lxllfll.exe 1504 bhbbhn.exe 4936 pvppp.exe 4580 lfxlxrx.exe 1388 nnttth.exe 4820 jdjjj.exe 4528 xfffxff.exe 112 nttthb.exe 4804 1dpjv.exe 376 jpdvv.exe 4268 fflllll.exe 1976 7tnnnt.exe -
resource yara_rule behavioral2/memory/2876-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/988-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/692-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-923-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2716 2876 ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe 82 PID 2876 wrote to memory of 2716 2876 ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe 82 PID 2876 wrote to memory of 2716 2876 ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe 82 PID 2716 wrote to memory of 4700 2716 jjdjv.exe 83 PID 2716 wrote to memory of 4700 2716 jjdjv.exe 83 PID 2716 wrote to memory of 4700 2716 jjdjv.exe 83 PID 4700 wrote to memory of 4820 4700 xxlrflx.exe 84 PID 4700 wrote to memory of 4820 4700 xxlrflx.exe 84 PID 4700 wrote to memory of 4820 4700 xxlrflx.exe 84 PID 4820 wrote to memory of 4748 4820 thbhtt.exe 85 PID 4820 wrote to memory of 4748 4820 thbhtt.exe 85 PID 4820 wrote to memory of 4748 4820 thbhtt.exe 85 PID 4748 wrote to memory of 1516 4748 nbbhhb.exe 86 PID 4748 wrote to memory of 1516 4748 nbbhhb.exe 86 PID 4748 wrote to memory of 1516 4748 nbbhhb.exe 86 PID 1516 wrote to memory of 4128 1516 rrxfflr.exe 87 PID 1516 wrote to memory of 4128 1516 rrxfflr.exe 87 PID 1516 wrote to memory of 4128 1516 rrxfflr.exe 87 PID 4128 wrote to memory of 1496 4128 tnbhht.exe 88 PID 4128 wrote to memory of 1496 4128 tnbhht.exe 88 PID 4128 wrote to memory of 1496 4128 tnbhht.exe 88 PID 1496 wrote to memory of 1644 1496 lxrxlxl.exe 89 PID 1496 wrote to memory of 1644 1496 lxrxlxl.exe 89 PID 1496 wrote to memory of 1644 1496 lxrxlxl.exe 89 PID 1644 wrote to memory of 764 1644 htbttt.exe 90 PID 1644 wrote to memory of 764 1644 htbttt.exe 90 PID 1644 wrote to memory of 764 1644 htbttt.exe 90 PID 764 wrote to memory of 2700 764 vpjdp.exe 91 PID 764 wrote to memory of 2700 764 vpjdp.exe 91 PID 764 wrote to memory of 2700 764 vpjdp.exe 91 PID 2700 wrote to memory of 1888 2700 lrffxll.exe 92 PID 2700 wrote to memory of 1888 2700 lrffxll.exe 92 PID 2700 wrote to memory of 1888 2700 lrffxll.exe 92 PID 1888 wrote to memory of 2020 1888 hthhbh.exe 93 PID 1888 wrote to memory of 2020 1888 hthhbh.exe 93 PID 1888 wrote to memory of 2020 1888 hthhbh.exe 93 PID 2020 wrote to memory of 2860 2020 xfxxfrf.exe 94 PID 2020 wrote to memory of 2860 2020 xfxxfrf.exe 94 PID 2020 wrote to memory of 2860 2020 xfxxfrf.exe 94 PID 2860 wrote to memory of 4572 2860 lxllllf.exe 95 PID 2860 wrote to memory of 4572 2860 lxllllf.exe 95 PID 2860 wrote to memory of 4572 2860 lxllllf.exe 95 PID 4572 wrote to memory of 1240 4572 5dvpv.exe 96 PID 4572 wrote to memory of 1240 4572 5dvpv.exe 96 PID 4572 wrote to memory of 1240 4572 5dvpv.exe 96 PID 1240 wrote to memory of 1952 1240 5fffrrx.exe 97 PID 1240 wrote to memory of 1952 1240 5fffrrx.exe 97 PID 1240 wrote to memory of 1952 1240 5fffrrx.exe 97 PID 1952 wrote to memory of 2764 1952 tntbbt.exe 98 PID 1952 wrote to memory of 2764 1952 tntbbt.exe 98 PID 1952 wrote to memory of 2764 1952 tntbbt.exe 98 PID 2764 wrote to memory of 1604 2764 ppvpj.exe 99 PID 2764 wrote to memory of 1604 2764 ppvpj.exe 99 PID 2764 wrote to memory of 1604 2764 ppvpj.exe 99 PID 1604 wrote to memory of 4360 1604 tnbnhh.exe 100 PID 1604 wrote to memory of 4360 1604 tnbnhh.exe 100 PID 1604 wrote to memory of 4360 1604 tnbnhh.exe 100 PID 4360 wrote to memory of 1660 4360 dppdv.exe 101 PID 4360 wrote to memory of 1660 4360 dppdv.exe 101 PID 4360 wrote to memory of 1660 4360 dppdv.exe 101 PID 1660 wrote to memory of 1904 1660 hbhnnn.exe 102 PID 1660 wrote to memory of 1904 1660 hbhnnn.exe 102 PID 1660 wrote to memory of 1904 1660 hbhnnn.exe 102 PID 1904 wrote to memory of 3100 1904 vpvpp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe"C:\Users\Admin\AppData\Local\Temp\ed18b29348338d22084c5c454eaa0900b900994620810fcba266d153b16e3d16.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\jjdjv.exec:\jjdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xxlrflx.exec:\xxlrflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\thbhtt.exec:\thbhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\nbbhhb.exec:\nbbhhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\rrxfflr.exec:\rrxfflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\tnbhht.exec:\tnbhht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\lxrxlxl.exec:\lxrxlxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\htbttt.exec:\htbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\vpjdp.exec:\vpjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\lrffxll.exec:\lrffxll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\hthhbh.exec:\hthhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\xfxxfrf.exec:\xfxxfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\lxllllf.exec:\lxllllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\5dvpv.exec:\5dvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\5fffrrx.exec:\5fffrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\tntbbt.exec:\tntbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\ppvpj.exec:\ppvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\tnbnhh.exec:\tnbnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\dppdv.exec:\dppdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\hbhnnn.exec:\hbhnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\vpvpp.exec:\vpvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\bhbntt.exec:\bhbntt.exe23⤵
- Executes dropped EXE
PID:3100 -
\??\c:\jjvvd.exec:\jjvvd.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1412 -
\??\c:\fffxxxx.exec:\fffxxxx.exe25⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvjvd.exec:\jvjvd.exe26⤵
- Executes dropped EXE
PID:4016 -
\??\c:\flffrlx.exec:\flffrlx.exe27⤵
- Executes dropped EXE
PID:4292 -
\??\c:\xrrlxrl.exec:\xrrlxrl.exe28⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jdddd.exec:\jdddd.exe29⤵
- Executes dropped EXE
PID:4456 -
\??\c:\3ttntb.exec:\3ttntb.exe30⤵
- Executes dropped EXE
PID:3668 -
\??\c:\rrfxlfl.exec:\rrfxlfl.exe31⤵
- Executes dropped EXE
PID:1292 -
\??\c:\thbhnn.exec:\thbhnn.exe32⤵
- Executes dropped EXE
PID:3592 -
\??\c:\vvjjj.exec:\vvjjj.exe33⤵
- Executes dropped EXE
PID:1652 -
\??\c:\tbbtbt.exec:\tbbtbt.exe34⤵
- Executes dropped EXE
PID:3212 -
\??\c:\pdjpv.exec:\pdjpv.exe35⤵
- Executes dropped EXE
PID:2360 -
\??\c:\fffrxrl.exec:\fffrxrl.exe36⤵
- Executes dropped EXE
PID:3140 -
\??\c:\vjjdv.exec:\vjjdv.exe37⤵
- Executes dropped EXE
PID:4996 -
\??\c:\5frrrxx.exec:\5frrrxx.exe38⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pvddd.exec:\pvddd.exe39⤵
- Executes dropped EXE
PID:3684 -
\??\c:\lxrfrfx.exec:\lxrfrfx.exe40⤵
- Executes dropped EXE
PID:4244 -
\??\c:\nnbbnt.exec:\nnbbnt.exe41⤵
- Executes dropped EXE
PID:868 -
\??\c:\ffllfll.exec:\ffllfll.exe42⤵
- Executes dropped EXE
PID:4544 -
\??\c:\pjddp.exec:\pjddp.exe43⤵
- Executes dropped EXE
PID:3084 -
\??\c:\rlxfllr.exec:\rlxfllr.exe44⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vdppp.exec:\vdppp.exe45⤵
- Executes dropped EXE
PID:4288 -
\??\c:\rxfxffl.exec:\rxfxffl.exe46⤵
- Executes dropped EXE
PID:5088 -
\??\c:\nnnnnn.exec:\nnnnnn.exe47⤵
- Executes dropped EXE
PID:988 -
\??\c:\vpvdd.exec:\vpvdd.exe48⤵
- Executes dropped EXE
PID:4032 -
\??\c:\rxrxrxf.exec:\rxrxrxf.exe49⤵
- Executes dropped EXE
PID:4740 -
\??\c:\nttbbt.exec:\nttbbt.exe50⤵
- Executes dropped EXE
PID:4420 -
\??\c:\ppdpp.exec:\ppdpp.exe51⤵
- Executes dropped EXE
PID:4976 -
\??\c:\lrxflrx.exec:\lrxflrx.exe52⤵
- Executes dropped EXE
PID:692 -
\??\c:\btbnbt.exec:\btbnbt.exe53⤵
- Executes dropped EXE
PID:324 -
\??\c:\ppdjv.exec:\ppdjv.exe54⤵PID:2560
-
\??\c:\lxllfll.exec:\lxllfll.exe55⤵
- Executes dropped EXE
PID:3164 -
\??\c:\bhbbhn.exec:\bhbbhn.exe56⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pvppp.exec:\pvppp.exe57⤵
- Executes dropped EXE
PID:4936 -
\??\c:\lfxlxrx.exec:\lfxlxrx.exe58⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nnttth.exec:\nnttth.exe59⤵
- Executes dropped EXE
PID:1388 -
\??\c:\jdjjj.exec:\jdjjj.exe60⤵
- Executes dropped EXE
PID:4820 -
\??\c:\xfffxff.exec:\xfffxff.exe61⤵
- Executes dropped EXE
PID:4528 -
\??\c:\nttthb.exec:\nttthb.exe62⤵
- Executes dropped EXE
PID:112 -
\??\c:\1dpjv.exec:\1dpjv.exe63⤵
- Executes dropped EXE
PID:4804 -
\??\c:\jpdvv.exec:\jpdvv.exe64⤵
- Executes dropped EXE
PID:376 -
\??\c:\fflllll.exec:\fflllll.exe65⤵
- Executes dropped EXE
PID:4268 -
\??\c:\7tnnnt.exec:\7tnnnt.exe66⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vjvvv.exec:\vjvvv.exe67⤵PID:2472
-
\??\c:\rrfxlxx.exec:\rrfxlxx.exe68⤵PID:5048
-
\??\c:\fllrrff.exec:\fllrrff.exe69⤵PID:3060
-
\??\c:\vpvvj.exec:\vpvvj.exe70⤵PID:3396
-
\??\c:\5rflrxf.exec:\5rflrxf.exe71⤵PID:3556
-
\??\c:\ntbbtb.exec:\ntbbtb.exe72⤵PID:4348
-
\??\c:\vjppj.exec:\vjppj.exe73⤵PID:1264
-
\??\c:\djvdv.exec:\djvdv.exe74⤵PID:5080
-
\??\c:\llfxxrr.exec:\llfxxrr.exe75⤵PID:4812
-
\??\c:\nnhnbh.exec:\nnhnbh.exe76⤵PID:3928
-
\??\c:\pvvdp.exec:\pvvdp.exe77⤵PID:1240
-
\??\c:\flffllr.exec:\flffllr.exe78⤵PID:4276
-
\??\c:\rrfxfrf.exec:\rrfxfrf.exe79⤵PID:2764
-
\??\c:\thbbnt.exec:\thbbnt.exe80⤵PID:1512
-
\??\c:\5dpjd.exec:\5dpjd.exe81⤵PID:3612
-
\??\c:\rflrllx.exec:\rflrllx.exe82⤵PID:5004
-
\??\c:\thbhhn.exec:\thbhhn.exe83⤵PID:3292
-
\??\c:\jpjpd.exec:\jpjpd.exe84⤵PID:848
-
\??\c:\xlfrxfl.exec:\xlfrxfl.exe85⤵PID:2284
-
\??\c:\hbbhbh.exec:\hbbhbh.exe86⤵PID:3316
-
\??\c:\ddvvv.exec:\ddvvv.exe87⤵PID:892
-
\??\c:\xfxxxlr.exec:\xfxxxlr.exe88⤵PID:1248
-
\??\c:\nhnbbb.exec:\nhnbbb.exe89⤵PID:3008
-
\??\c:\jdvvv.exec:\jdvvv.exe90⤵PID:1820
-
\??\c:\5lxxfrx.exec:\5lxxfrx.exe91⤵PID:3052
-
\??\c:\bhhnnt.exec:\bhhnnt.exe92⤵PID:4644
-
\??\c:\1dppj.exec:\1dppj.exe93⤵PID:2692
-
\??\c:\xrxxxll.exec:\xrxxxll.exe94⤵PID:760
-
\??\c:\tbnbth.exec:\tbnbth.exe95⤵PID:3508
-
\??\c:\vvdpj.exec:\vvdpj.exe96⤵PID:3444
-
\??\c:\flfxxrl.exec:\flfxxrl.exe97⤵PID:2052
-
\??\c:\bthhhn.exec:\bthhhn.exe98⤵PID:5068
-
\??\c:\djpdv.exec:\djpdv.exe99⤵PID:980
-
\??\c:\fxlllll.exec:\fxlllll.exe100⤵PID:1652
-
\??\c:\bbttnt.exec:\bbttnt.exe101⤵PID:3212
-
\??\c:\ppddp.exec:\ppddp.exe102⤵PID:4020
-
\??\c:\pjvpd.exec:\pjvpd.exe103⤵PID:2468
-
\??\c:\nthhht.exec:\nthhht.exe104⤵PID:4996
-
\??\c:\ppdjv.exec:\ppdjv.exe105⤵PID:4648
-
\??\c:\rxxrxxr.exec:\rxxrxxr.exe106⤵PID:3964
-
\??\c:\ppdvv.exec:\ppdvv.exe107⤵PID:2712
-
\??\c:\lxffxrr.exec:\lxffxrr.exe108⤵PID:3412
-
\??\c:\5bhhht.exec:\5bhhht.exe109⤵PID:4660
-
\??\c:\ppjjp.exec:\ppjjp.exe110⤵PID:2308
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe111⤵PID:4928
-
\??\c:\7nbthb.exec:\7nbthb.exe112⤵PID:3472
-
\??\c:\lxflxxx.exec:\lxflxxx.exe113⤵PID:2112
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe114⤵PID:528
-
\??\c:\tnbbhh.exec:\tnbbhh.exe115⤵PID:1252
-
\??\c:\jpppj.exec:\jpppj.exe116⤵PID:3288
-
\??\c:\frfllrr.exec:\frfllrr.exe117⤵PID:1568
-
\??\c:\ttbbtn.exec:\ttbbtn.exe118⤵PID:1792
-
\??\c:\jpjpv.exec:\jpjpv.exe119⤵PID:1744
-
\??\c:\xrfflxf.exec:\xrfflxf.exe120⤵PID:4332
-
\??\c:\bbbtnn.exec:\bbbtnn.exe121⤵PID:3032
-
\??\c:\pjpjd.exec:\pjpjd.exe122⤵PID:3652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-