Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 07:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe
-
Size
454KB
-
MD5
75b45440c68a77a22eb034a20d23183c
-
SHA1
62bab74060808fc285ba0dbddfc00a9c98be90e2
-
SHA256
fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855
-
SHA512
5628817e192c2ab362f029dbcdf4ab7b434abec7e4dc0c8cfb0cfb3c654c0d3dd461e7e584a89653853a8be19548627e9ad6240c63012b84e505894991bcf556
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbee:q7Tc2NYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1316-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/328-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-878-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-993-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-1148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4660 xffxllx.exe 3324 lfxrllx.exe 4180 bnnthh.exe 1376 jjpvv.exe 4408 llrxxlf.exe 3604 tbhntb.exe 3892 rxxxrrr.exe 328 tnbbhh.exe 1940 ntnhhn.exe 3280 xlxxxff.exe 4004 3jjjd.exe 4720 bhtbbn.exe 4032 lfrlxxl.exe 1692 tbnbth.exe 1652 rxfxfxf.exe 1380 rxxxfll.exe 4532 thbbhh.exe 3368 jpjvd.exe 3552 9pjjp.exe 4728 rflfffx.exe 4796 tnttth.exe 3084 vjjjj.exe 3168 pdvvd.exe 4172 xfrrrxx.exe 3116 xfrxrxx.exe 1084 vvjpp.exe 1308 hhhhnt.exe 5072 5jjjj.exe 444 bhtttb.exe 4732 ppvvd.exe 4240 htbnhb.exe 1812 1nnhbb.exe 1944 vvjdd.exe 5036 pjjjj.exe 4484 nnttnn.exe 3596 jjvvv.exe 1068 rxxfllr.exe 3364 llrrlff.exe 928 nntnnn.exe 3420 ddjdd.exe 3460 7flxrxr.exe 640 tbtbnt.exe 3944 vvddv.exe 4792 xrfrlfx.exe 1992 hthnnt.exe 664 pjjdd.exe 4448 rlrlllr.exe 4932 bbhnnt.exe 4276 dddvd.exe 4256 1llfxxx.exe 2204 1xrxllx.exe 2260 hnnbbb.exe 2932 ppvpp.exe 4848 rrfllxx.exe 4432 vvddj.exe 3380 pdjdd.exe 1376 xfxxxfx.exe 3104 htbbbb.exe 3212 pvdvv.exe 3480 1lxxlxx.exe 436 1hhbtb.exe 3496 jjppp.exe 3136 flxxlxl.exe 1964 hhbhhn.exe -
resource yara_rule behavioral2/memory/1316-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/328-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-727-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnnt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1316 wrote to memory of 4660 1316 fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe 82 PID 1316 wrote to memory of 4660 1316 fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe 82 PID 1316 wrote to memory of 4660 1316 fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe 82 PID 4660 wrote to memory of 3324 4660 xffxllx.exe 83 PID 4660 wrote to memory of 3324 4660 xffxllx.exe 83 PID 4660 wrote to memory of 3324 4660 xffxllx.exe 83 PID 3324 wrote to memory of 4180 3324 lfxrllx.exe 84 PID 3324 wrote to memory of 4180 3324 lfxrllx.exe 84 PID 3324 wrote to memory of 4180 3324 lfxrllx.exe 84 PID 4180 wrote to memory of 1376 4180 bnnthh.exe 85 PID 4180 wrote to memory of 1376 4180 bnnthh.exe 85 PID 4180 wrote to memory of 1376 4180 bnnthh.exe 85 PID 1376 wrote to memory of 4408 1376 jjpvv.exe 86 PID 1376 wrote to memory of 4408 1376 jjpvv.exe 86 PID 1376 wrote to memory of 4408 1376 jjpvv.exe 86 PID 4408 wrote to memory of 3604 4408 llrxxlf.exe 87 PID 4408 wrote to memory of 3604 4408 llrxxlf.exe 87 PID 4408 wrote to memory of 3604 4408 llrxxlf.exe 87 PID 3604 wrote to memory of 3892 3604 tbhntb.exe 88 PID 3604 wrote to memory of 3892 3604 tbhntb.exe 88 PID 3604 wrote to memory of 3892 3604 tbhntb.exe 88 PID 3892 wrote to memory of 328 3892 rxxxrrr.exe 89 PID 3892 wrote to memory of 328 3892 rxxxrrr.exe 89 PID 3892 wrote to memory of 328 3892 rxxxrrr.exe 89 PID 328 wrote to memory of 1940 328 tnbbhh.exe 90 PID 328 wrote to memory of 1940 328 tnbbhh.exe 90 PID 328 wrote to memory of 1940 328 tnbbhh.exe 90 PID 1940 wrote to memory of 3280 1940 ntnhhn.exe 91 PID 1940 wrote to memory of 3280 1940 ntnhhn.exe 91 PID 1940 wrote to memory of 3280 1940 ntnhhn.exe 91 PID 3280 wrote to memory of 4004 3280 xlxxxff.exe 92 PID 3280 wrote to memory of 4004 3280 xlxxxff.exe 92 PID 3280 wrote to memory of 4004 3280 xlxxxff.exe 92 PID 4004 wrote to memory of 4720 4004 3jjjd.exe 93 PID 4004 wrote to memory of 4720 4004 3jjjd.exe 93 PID 4004 wrote to memory of 4720 4004 3jjjd.exe 93 PID 4720 wrote to memory of 4032 4720 bhtbbn.exe 94 PID 4720 wrote to memory of 4032 4720 bhtbbn.exe 94 PID 4720 wrote to memory of 4032 4720 bhtbbn.exe 94 PID 4032 wrote to memory of 1692 4032 lfrlxxl.exe 95 PID 4032 wrote to memory of 1692 4032 lfrlxxl.exe 95 PID 4032 wrote to memory of 1692 4032 lfrlxxl.exe 95 PID 1692 wrote to memory of 1652 1692 tbnbth.exe 96 PID 1692 wrote to memory of 1652 1692 tbnbth.exe 96 PID 1692 wrote to memory of 1652 1692 tbnbth.exe 96 PID 1652 wrote to memory of 1380 1652 rxfxfxf.exe 97 PID 1652 wrote to memory of 1380 1652 rxfxfxf.exe 97 PID 1652 wrote to memory of 1380 1652 rxfxfxf.exe 97 PID 1380 wrote to memory of 4532 1380 rxxxfll.exe 98 PID 1380 wrote to memory of 4532 1380 rxxxfll.exe 98 PID 1380 wrote to memory of 4532 1380 rxxxfll.exe 98 PID 4532 wrote to memory of 3368 4532 thbbhh.exe 99 PID 4532 wrote to memory of 3368 4532 thbbhh.exe 99 PID 4532 wrote to memory of 3368 4532 thbbhh.exe 99 PID 3368 wrote to memory of 3552 3368 jpjvd.exe 100 PID 3368 wrote to memory of 3552 3368 jpjvd.exe 100 PID 3368 wrote to memory of 3552 3368 jpjvd.exe 100 PID 3552 wrote to memory of 4728 3552 9pjjp.exe 101 PID 3552 wrote to memory of 4728 3552 9pjjp.exe 101 PID 3552 wrote to memory of 4728 3552 9pjjp.exe 101 PID 4728 wrote to memory of 4796 4728 rflfffx.exe 102 PID 4728 wrote to memory of 4796 4728 rflfffx.exe 102 PID 4728 wrote to memory of 4796 4728 rflfffx.exe 102 PID 4796 wrote to memory of 3084 4796 tnttth.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe"C:\Users\Admin\AppData\Local\Temp\fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\xffxllx.exec:\xffxllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\lfxrllx.exec:\lfxrllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\bnnthh.exec:\bnnthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\jjpvv.exec:\jjpvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\llrxxlf.exec:\llrxxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\tbhntb.exec:\tbhntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\tnbbhh.exec:\tnbbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\ntnhhn.exec:\ntnhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\xlxxxff.exec:\xlxxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\3jjjd.exec:\3jjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\bhtbbn.exec:\bhtbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\tbnbth.exec:\tbnbth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\rxfxfxf.exec:\rxfxfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\rxxxfll.exec:\rxxxfll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\thbbhh.exec:\thbbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\jpjvd.exec:\jpjvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\9pjjp.exec:\9pjjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\rflfffx.exec:\rflfffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\tnttth.exec:\tnttth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\vjjjj.exec:\vjjjj.exe23⤵
- Executes dropped EXE
PID:3084 -
\??\c:\pdvvd.exec:\pdvvd.exe24⤵
- Executes dropped EXE
PID:3168 -
\??\c:\xfrrrxx.exec:\xfrrrxx.exe25⤵
- Executes dropped EXE
PID:4172 -
\??\c:\xfrxrxx.exec:\xfrxrxx.exe26⤵
- Executes dropped EXE
PID:3116 -
\??\c:\vvjpp.exec:\vvjpp.exe27⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hhhhnt.exec:\hhhhnt.exe28⤵
- Executes dropped EXE
PID:1308 -
\??\c:\5jjjj.exec:\5jjjj.exe29⤵
- Executes dropped EXE
PID:5072 -
\??\c:\bhtttb.exec:\bhtttb.exe30⤵
- Executes dropped EXE
PID:444 -
\??\c:\ppvvd.exec:\ppvvd.exe31⤵
- Executes dropped EXE
PID:4732 -
\??\c:\htbnhb.exec:\htbnhb.exe32⤵
- Executes dropped EXE
PID:4240 -
\??\c:\1nnhbb.exec:\1nnhbb.exe33⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vvjdd.exec:\vvjdd.exe34⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pjjjj.exec:\pjjjj.exe35⤵
- Executes dropped EXE
PID:5036 -
\??\c:\nnttnn.exec:\nnttnn.exe36⤵
- Executes dropped EXE
PID:4484 -
\??\c:\jjvvv.exec:\jjvvv.exe37⤵
- Executes dropped EXE
PID:3596 -
\??\c:\rxxfllr.exec:\rxxfllr.exe38⤵
- Executes dropped EXE
PID:1068 -
\??\c:\llrrlff.exec:\llrrlff.exe39⤵
- Executes dropped EXE
PID:3364 -
\??\c:\nntnnn.exec:\nntnnn.exe40⤵
- Executes dropped EXE
PID:928 -
\??\c:\ddjdd.exec:\ddjdd.exe41⤵
- Executes dropped EXE
PID:3420 -
\??\c:\7flxrxr.exec:\7flxrxr.exe42⤵
- Executes dropped EXE
PID:3460 -
\??\c:\tbtbnt.exec:\tbtbnt.exe43⤵
- Executes dropped EXE
PID:640 -
\??\c:\vvddv.exec:\vvddv.exe44⤵
- Executes dropped EXE
PID:3944 -
\??\c:\xrfrlfx.exec:\xrfrlfx.exe45⤵
- Executes dropped EXE
PID:4792 -
\??\c:\hthnnt.exec:\hthnnt.exe46⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjjdd.exec:\pjjdd.exe47⤵
- Executes dropped EXE
PID:664 -
\??\c:\rlrlllr.exec:\rlrlllr.exe48⤵
- Executes dropped EXE
PID:4448 -
\??\c:\bbhnnt.exec:\bbhnnt.exe49⤵
- Executes dropped EXE
PID:4932 -
\??\c:\dddvd.exec:\dddvd.exe50⤵
- Executes dropped EXE
PID:4276 -
\??\c:\1llfxxx.exec:\1llfxxx.exe51⤵
- Executes dropped EXE
PID:4256 -
\??\c:\1xrxllx.exec:\1xrxllx.exe52⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hnnbbb.exec:\hnnbbb.exe53⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ppvpp.exec:\ppvpp.exe54⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rrfllxx.exec:\rrfllxx.exe55⤵
- Executes dropped EXE
PID:4848 -
\??\c:\vvddj.exec:\vvddj.exe56⤵
- Executes dropped EXE
PID:4432 -
\??\c:\pdjdd.exec:\pdjdd.exe57⤵
- Executes dropped EXE
PID:3380 -
\??\c:\xfxxxfx.exec:\xfxxxfx.exe58⤵
- Executes dropped EXE
PID:1376 -
\??\c:\htbbbb.exec:\htbbbb.exe59⤵
- Executes dropped EXE
PID:3104 -
\??\c:\pvdvv.exec:\pvdvv.exe60⤵
- Executes dropped EXE
PID:3212 -
\??\c:\1lxxlxx.exec:\1lxxlxx.exe61⤵
- Executes dropped EXE
PID:3480 -
\??\c:\1hhbtb.exec:\1hhbtb.exe62⤵
- Executes dropped EXE
PID:436 -
\??\c:\jjppp.exec:\jjppp.exe63⤵
- Executes dropped EXE
PID:3496 -
\??\c:\flxxlxl.exec:\flxxlxl.exe64⤵
- Executes dropped EXE
PID:3136 -
\??\c:\hhbhhn.exec:\hhbhhn.exe65⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vpppj.exec:\vpppj.exe66⤵PID:1940
-
\??\c:\fxllllr.exec:\fxllllr.exe67⤵PID:4680
-
\??\c:\ntbbtn.exec:\ntbbtn.exe68⤵PID:5104
-
\??\c:\ppvpj.exec:\ppvpj.exe69⤵PID:4864
-
\??\c:\vjjjd.exec:\vjjjd.exe70⤵PID:4936
-
\??\c:\1lrxxff.exec:\1lrxxff.exe71⤵PID:3044
-
\??\c:\tnttnt.exec:\tnttnt.exe72⤵PID:2560
-
\??\c:\3dppj.exec:\3dppj.exe73⤵PID:4264
-
\??\c:\vpddv.exec:\vpddv.exe74⤵PID:2088
-
\??\c:\hnbttn.exec:\hnbttn.exe75⤵
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\9nhhbn.exec:\9nhhbn.exe76⤵PID:1616
-
\??\c:\dddpv.exec:\dddpv.exe77⤵PID:548
-
\??\c:\fffffff.exec:\fffffff.exe78⤵PID:4044
-
\??\c:\thnbtt.exec:\thnbtt.exe79⤵PID:4956
-
\??\c:\3pvvp.exec:\3pvvp.exe80⤵PID:2564
-
\??\c:\llfffrx.exec:\llfffrx.exe81⤵PID:4508
-
\??\c:\9tnntb.exec:\9tnntb.exe82⤵PID:2556
-
\??\c:\pjjjp.exec:\pjjjp.exe83⤵PID:3376
-
\??\c:\7xllfll.exec:\7xllfll.exe84⤵PID:1924
-
\??\c:\nhhbbb.exec:\nhhbbb.exe85⤵PID:4772
-
\??\c:\pdjpv.exec:\pdjpv.exe86⤵PID:4840
-
\??\c:\ddvpp.exec:\ddvpp.exe87⤵PID:4172
-
\??\c:\lllxrll.exec:\lllxrll.exe88⤵PID:676
-
\??\c:\hntttb.exec:\hntttb.exe89⤵PID:4040
-
\??\c:\vvdjp.exec:\vvdjp.exe90⤵PID:1084
-
\??\c:\3fxfllf.exec:\3fxfllf.exe91⤵PID:3024
-
\??\c:\hbhnbt.exec:\hbhnbt.exe92⤵PID:5016
-
\??\c:\vpvvd.exec:\vpvvd.exe93⤵PID:1280
-
\??\c:\xrlllrr.exec:\xrlllrr.exe94⤵PID:112
-
\??\c:\bthbth.exec:\bthbth.exe95⤵PID:4656
-
\??\c:\dpddv.exec:\dpddv.exe96⤵PID:2020
-
\??\c:\rfllrxf.exec:\rfllrxf.exe97⤵PID:392
-
\??\c:\ttnnbh.exec:\ttnnbh.exe98⤵PID:1552
-
\??\c:\thnhbh.exec:\thnhbh.exe99⤵PID:4436
-
\??\c:\9jjpv.exec:\9jjpv.exe100⤵PID:1432
-
\??\c:\lllrffl.exec:\lllrffl.exe101⤵PID:3660
-
\??\c:\nnhbth.exec:\nnhbth.exe102⤵PID:4388
-
\??\c:\9vdvp.exec:\9vdvp.exe103⤵PID:4524
-
\??\c:\jjjjd.exec:\jjjjd.exe104⤵PID:860
-
\??\c:\bthhnn.exec:\bthhnn.exe105⤵PID:3612
-
\??\c:\bbbbbb.exec:\bbbbbb.exe106⤵PID:3420
-
\??\c:\dvjjj.exec:\dvjjj.exe107⤵PID:3460
-
\??\c:\lrxxffl.exec:\lrxxffl.exe108⤵PID:3968
-
\??\c:\thtttt.exec:\thtttt.exe109⤵PID:3944
-
\??\c:\ntbttt.exec:\ntbttt.exe110⤵PID:2872
-
\??\c:\9frfllr.exec:\9frfllr.exe111⤵PID:4760
-
\??\c:\ttthhh.exec:\ttthhh.exe112⤵PID:664
-
\??\c:\vdjjj.exec:\vdjjj.exe113⤵PID:4924
-
\??\c:\lrrrrrx.exec:\lrrrrrx.exe114⤵PID:432
-
\??\c:\ttnhhh.exec:\ttnhhh.exe115⤵PID:4928
-
\??\c:\bbnhth.exec:\bbnhth.exe116⤵PID:1008
-
\??\c:\dvjjd.exec:\dvjjd.exe117⤵PID:3880
-
\??\c:\fllfffx.exec:\fllfffx.exe118⤵PID:4660
-
\??\c:\tttnhn.exec:\tttnhn.exe119⤵PID:3616
-
\??\c:\dvvjv.exec:\dvvjv.exe120⤵PID:4372
-
\??\c:\rflllxr.exec:\rflllxr.exe121⤵PID:924
-
\??\c:\5ttbtt.exec:\5ttbtt.exe122⤵PID:5092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-