Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 08:28
Behavioral task
behavioral1
Sample
8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe
-
Size
79KB
-
MD5
d75f22ed0e55d80d165b2f5fa84e0140
-
SHA1
95c72aade635f75cae9c2f5a338f3570832913cd
-
SHA256
8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413c
-
SHA512
87e64fef79e8de3d4b4a64f7bf584e1ba4e3a4e173f231802ceaf52fd93a6d3ae9386cf1a4a85aa972a2072bcf33b6297e65f99d7a9db4785ddea4629794ef03
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2J:xhOmTsF93UYfwC6GIout03LzGFE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4840-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/416-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1396-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/716-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-629-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-679-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-740-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-768-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-781-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-824-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-945-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4212 fflfffx.exe 1012 btbhnh.exe 888 jvppp.exe 2416 lfxxxfr.exe 2148 fxxflxl.exe 4700 bbhbbb.exe 2392 ppppp.exe 4300 9xfxxlx.exe 416 tthhhn.exe 1148 ddvpv.exe 2172 flfxrxr.exe 2272 jvvdv.exe 2116 xrxxfff.exe 4088 lfxlrfl.exe 4708 bbbnht.exe 456 jvdvj.exe 2500 ppvdv.exe 3236 rxfxrrl.exe 4412 tbtnhh.exe 4712 ppjdj.exe 2000 lxrrlff.exe 100 nhtntt.exe 4696 djjdd.exe 1880 rrlrlrf.exe 3316 nnhthb.exe 2452 ntbbbh.exe 2844 dvvvp.exe 4176 xrrfxll.exe 2044 tbhhhn.exe 4788 7vppp.exe 5036 lllfrrf.exe 4008 hntntb.exe 3780 vppvv.exe 3672 fxrrrxx.exe 1396 vvjjj.exe 4144 xxxxxxf.exe 2040 nhnbbt.exe 4220 lrlfrlr.exe 4272 5htbbh.exe 1456 djjjj.exe 4236 tbbbhh.exe 5068 jdjdd.exe 4976 tttnnt.exe 1816 tnnnnn.exe 3140 djddd.exe 4604 rfrrrxf.exe 2240 hbhbtt.exe 2924 nbbbbb.exe 1032 jvvvv.exe 2616 9pvvp.exe 3980 flrrfxx.exe 3468 ttttbh.exe 1904 dvpjd.exe 1544 vvdpj.exe 4512 1xxxxxx.exe 2216 hthhbh.exe 2064 pppdd.exe 1944 rfrffxr.exe 3612 5bbbbn.exe 4736 nnttnn.exe 1224 dpdjv.exe 3644 lfrrffx.exe 4792 xxffxxl.exe 1152 9hhnnn.exe -
resource yara_rule behavioral2/memory/4840-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b42-3.dat upx behavioral2/memory/4840-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-9.dat upx behavioral2/memory/4212-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-12.dat upx behavioral2/memory/1012-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/888-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b99-21.dat upx behavioral2/files/0x000a000000023b9a-29.dat upx behavioral2/files/0x000a000000023b9b-36.dat upx behavioral2/memory/2148-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2416-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/888-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-39.dat upx behavioral2/memory/4700-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-45.dat upx behavioral2/memory/2392-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9e-50.dat upx behavioral2/memory/4300-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9f-55.dat upx behavioral2/memory/416-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba0-60.dat upx behavioral2/memory/1148-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba1-66.dat upx behavioral2/memory/2172-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba2-72.dat upx behavioral2/memory/2116-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba3-78.dat upx behavioral2/memory/4088-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba4-87.dat upx behavioral2/memory/4708-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba5-91.dat upx behavioral2/memory/4088-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba6-96.dat upx behavioral2/memory/456-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba7-102.dat upx behavioral2/memory/3236-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2500-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3236-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba8-109.dat upx behavioral2/files/0x000a000000023ba9-116.dat upx behavioral2/files/0x000a000000023baa-120.dat upx behavioral2/files/0x000a000000023bab-126.dat upx behavioral2/memory/100-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bac-132.dat upx behavioral2/files/0x000a000000023bad-135.dat upx behavioral2/memory/4696-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b94-142.dat upx behavioral2/files/0x000b000000023bae-147.dat upx behavioral2/files/0x000b000000023baf-154.dat upx behavioral2/memory/2452-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023bb0-158.dat upx behavioral2/memory/2844-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb8-164.dat upx behavioral2/files/0x000e000000023bbf-169.dat upx behavioral2/memory/2044-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bc8-175.dat upx behavioral2/memory/4788-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bcd-183.dat upx behavioral2/memory/5036-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4008-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3780-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1396-199-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fflfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4212 4840 8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe 84 PID 4840 wrote to memory of 4212 4840 8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe 84 PID 4840 wrote to memory of 4212 4840 8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe 84 PID 4212 wrote to memory of 1012 4212 fflfffx.exe 85 PID 4212 wrote to memory of 1012 4212 fflfffx.exe 85 PID 4212 wrote to memory of 1012 4212 fflfffx.exe 85 PID 1012 wrote to memory of 888 1012 btbhnh.exe 86 PID 1012 wrote to memory of 888 1012 btbhnh.exe 86 PID 1012 wrote to memory of 888 1012 btbhnh.exe 86 PID 888 wrote to memory of 2416 888 jvppp.exe 87 PID 888 wrote to memory of 2416 888 jvppp.exe 87 PID 888 wrote to memory of 2416 888 jvppp.exe 87 PID 2416 wrote to memory of 2148 2416 lfxxxfr.exe 88 PID 2416 wrote to memory of 2148 2416 lfxxxfr.exe 88 PID 2416 wrote to memory of 2148 2416 lfxxxfr.exe 88 PID 2148 wrote to memory of 4700 2148 fxxflxl.exe 89 PID 2148 wrote to memory of 4700 2148 fxxflxl.exe 89 PID 2148 wrote to memory of 4700 2148 fxxflxl.exe 89 PID 4700 wrote to memory of 2392 4700 bbhbbb.exe 90 PID 4700 wrote to memory of 2392 4700 bbhbbb.exe 90 PID 4700 wrote to memory of 2392 4700 bbhbbb.exe 90 PID 2392 wrote to memory of 4300 2392 ppppp.exe 91 PID 2392 wrote to memory of 4300 2392 ppppp.exe 91 PID 2392 wrote to memory of 4300 2392 ppppp.exe 91 PID 4300 wrote to memory of 416 4300 9xfxxlx.exe 92 PID 4300 wrote to memory of 416 4300 9xfxxlx.exe 92 PID 4300 wrote to memory of 416 4300 9xfxxlx.exe 92 PID 416 wrote to memory of 1148 416 tthhhn.exe 93 PID 416 wrote to memory of 1148 416 tthhhn.exe 93 PID 416 wrote to memory of 1148 416 tthhhn.exe 93 PID 1148 wrote to memory of 2172 1148 ddvpv.exe 94 PID 1148 wrote to memory of 2172 1148 ddvpv.exe 94 PID 1148 wrote to memory of 2172 1148 ddvpv.exe 94 PID 2172 wrote to memory of 2272 2172 flfxrxr.exe 95 PID 2172 wrote to memory of 2272 2172 flfxrxr.exe 95 PID 2172 wrote to memory of 2272 2172 flfxrxr.exe 95 PID 2272 wrote to memory of 2116 2272 jvvdv.exe 96 PID 2272 wrote to memory of 2116 2272 jvvdv.exe 96 PID 2272 wrote to memory of 2116 2272 jvvdv.exe 96 PID 2116 wrote to memory of 4088 2116 xrxxfff.exe 97 PID 2116 wrote to memory of 4088 2116 xrxxfff.exe 97 PID 2116 wrote to memory of 4088 2116 xrxxfff.exe 97 PID 4088 wrote to memory of 4708 4088 lfxlrfl.exe 98 PID 4088 wrote to memory of 4708 4088 lfxlrfl.exe 98 PID 4088 wrote to memory of 4708 4088 lfxlrfl.exe 98 PID 4708 wrote to memory of 456 4708 bbbnht.exe 99 PID 4708 wrote to memory of 456 4708 bbbnht.exe 99 PID 4708 wrote to memory of 456 4708 bbbnht.exe 99 PID 456 wrote to memory of 2500 456 jvdvj.exe 100 PID 456 wrote to memory of 2500 456 jvdvj.exe 100 PID 456 wrote to memory of 2500 456 jvdvj.exe 100 PID 2500 wrote to memory of 3236 2500 ppvdv.exe 101 PID 2500 wrote to memory of 3236 2500 ppvdv.exe 101 PID 2500 wrote to memory of 3236 2500 ppvdv.exe 101 PID 3236 wrote to memory of 4412 3236 rxfxrrl.exe 102 PID 3236 wrote to memory of 4412 3236 rxfxrrl.exe 102 PID 3236 wrote to memory of 4412 3236 rxfxrrl.exe 102 PID 4412 wrote to memory of 4712 4412 tbtnhh.exe 103 PID 4412 wrote to memory of 4712 4412 tbtnhh.exe 103 PID 4412 wrote to memory of 4712 4412 tbtnhh.exe 103 PID 4712 wrote to memory of 2000 4712 ppjdj.exe 104 PID 4712 wrote to memory of 2000 4712 ppjdj.exe 104 PID 4712 wrote to memory of 2000 4712 ppjdj.exe 104 PID 2000 wrote to memory of 100 2000 lxrrlff.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe"C:\Users\Admin\AppData\Local\Temp\8e1d724d57bde1a28d5fd163c96045ad3ce12fbe124ae209d49990a5db7b413cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\fflfffx.exec:\fflfffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\btbhnh.exec:\btbhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\jvppp.exec:\jvppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\lfxxxfr.exec:\lfxxxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\fxxflxl.exec:\fxxflxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\bbhbbb.exec:\bbhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\ppppp.exec:\ppppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\9xfxxlx.exec:\9xfxxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\tthhhn.exec:\tthhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\ddvpv.exec:\ddvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\flfxrxr.exec:\flfxrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\jvvdv.exec:\jvvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\xrxxfff.exec:\xrxxfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\lfxlrfl.exec:\lfxlrfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\bbbnht.exec:\bbbnht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\jvdvj.exec:\jvdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\ppvdv.exec:\ppvdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\tbtnhh.exec:\tbtnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\ppjdj.exec:\ppjdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\lxrrlff.exec:\lxrrlff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\nhtntt.exec:\nhtntt.exe23⤵
- Executes dropped EXE
PID:100 -
\??\c:\djjdd.exec:\djjdd.exe24⤵
- Executes dropped EXE
PID:4696 -
\??\c:\rrlrlrf.exec:\rrlrlrf.exe25⤵
- Executes dropped EXE
PID:1880 -
\??\c:\nnhthb.exec:\nnhthb.exe26⤵
- Executes dropped EXE
PID:3316 -
\??\c:\ntbbbh.exec:\ntbbbh.exe27⤵
- Executes dropped EXE
PID:2452 -
\??\c:\dvvvp.exec:\dvvvp.exe28⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xrrfxll.exec:\xrrfxll.exe29⤵
- Executes dropped EXE
PID:4176 -
\??\c:\tbhhhn.exec:\tbhhhn.exe30⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7vppp.exec:\7vppp.exe31⤵
- Executes dropped EXE
PID:4788 -
\??\c:\lllfrrf.exec:\lllfrrf.exe32⤵
- Executes dropped EXE
PID:5036 -
\??\c:\hntntb.exec:\hntntb.exe33⤵
- Executes dropped EXE
PID:4008 -
\??\c:\vppvv.exec:\vppvv.exe34⤵
- Executes dropped EXE
PID:3780 -
\??\c:\fxrrrxx.exec:\fxrrrxx.exe35⤵
- Executes dropped EXE
PID:3672 -
\??\c:\vvjjj.exec:\vvjjj.exe36⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xxxxxxf.exec:\xxxxxxf.exe37⤵
- Executes dropped EXE
PID:4144 -
\??\c:\nhnbbt.exec:\nhnbbt.exe38⤵
- Executes dropped EXE
PID:2040 -
\??\c:\lrlfrlr.exec:\lrlfrlr.exe39⤵
- Executes dropped EXE
PID:4220 -
\??\c:\5htbbh.exec:\5htbbh.exe40⤵
- Executes dropped EXE
PID:4272 -
\??\c:\djjjj.exec:\djjjj.exe41⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tbbbhh.exec:\tbbbhh.exe42⤵
- Executes dropped EXE
PID:4236 -
\??\c:\jdjdd.exec:\jdjdd.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5068 -
\??\c:\tttnnt.exec:\tttnnt.exe44⤵
- Executes dropped EXE
PID:4976 -
\??\c:\tnnnnn.exec:\tnnnnn.exe45⤵
- Executes dropped EXE
PID:1816 -
\??\c:\djddd.exec:\djddd.exe46⤵
- Executes dropped EXE
PID:3140 -
\??\c:\rfrrrxf.exec:\rfrrrxf.exe47⤵
- Executes dropped EXE
PID:4604 -
\??\c:\hbhbtt.exec:\hbhbtt.exe48⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nbbbbb.exec:\nbbbbb.exe49⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jvvvv.exec:\jvvvv.exe50⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9pvvp.exec:\9pvvp.exe51⤵
- Executes dropped EXE
PID:2616 -
\??\c:\flrrfxx.exec:\flrrfxx.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3980 -
\??\c:\ttttbh.exec:\ttttbh.exe53⤵
- Executes dropped EXE
PID:3468 -
\??\c:\dvpjd.exec:\dvpjd.exe54⤵
- Executes dropped EXE
PID:1904 -
\??\c:\vvdpj.exec:\vvdpj.exe55⤵
- Executes dropped EXE
PID:1544 -
\??\c:\1xxxxxx.exec:\1xxxxxx.exe56⤵
- Executes dropped EXE
PID:4512 -
\??\c:\hthhbh.exec:\hthhbh.exe57⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pppdd.exec:\pppdd.exe58⤵
- Executes dropped EXE
PID:2064 -
\??\c:\rfrffxr.exec:\rfrffxr.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\5bbbbn.exec:\5bbbbn.exe60⤵
- Executes dropped EXE
PID:3612 -
\??\c:\nnttnn.exec:\nnttnn.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4736 -
\??\c:\dpdjv.exec:\dpdjv.exe62⤵
- Executes dropped EXE
PID:1224 -
\??\c:\lfrrffx.exec:\lfrrffx.exe63⤵
- Executes dropped EXE
PID:3644 -
\??\c:\xxffxxl.exec:\xxffxxl.exe64⤵
- Executes dropped EXE
PID:4792 -
\??\c:\9hhnnn.exec:\9hhnnn.exe65⤵
- Executes dropped EXE
PID:1152 -
\??\c:\btbtbn.exec:\btbtbn.exe66⤵PID:744
-
\??\c:\5pppd.exec:\5pppd.exe67⤵PID:1040
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe68⤵PID:1676
-
\??\c:\xflfrxf.exec:\xflfrxf.exe69⤵PID:4504
-
\??\c:\ntthhh.exec:\ntthhh.exe70⤵PID:5056
-
\??\c:\bbnbnb.exec:\bbnbnb.exe71⤵PID:2800
-
\??\c:\jpdvv.exec:\jpdvv.exe72⤵PID:1744
-
\??\c:\xxfxffx.exec:\xxfxffx.exe73⤵PID:3588
-
\??\c:\rxfxrlx.exec:\rxfxrlx.exe74⤵PID:3344
-
\??\c:\bthbtb.exec:\bthbtb.exe75⤵PID:1956
-
\??\c:\vvpvj.exec:\vvpvj.exe76⤵PID:3524
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe77⤵PID:2640
-
\??\c:\rxflrxx.exec:\rxflrxx.exe78⤵PID:2276
-
\??\c:\hbnbnh.exec:\hbnbnh.exe79⤵PID:3636
-
\??\c:\vdjjp.exec:\vdjjp.exe80⤵PID:4484
-
\??\c:\pvvpd.exec:\pvvpd.exe81⤵PID:2828
-
\??\c:\xxrrfrx.exec:\xxrrfrx.exe82⤵PID:2152
-
\??\c:\flffxfr.exec:\flffxfr.exe83⤵PID:4696
-
\??\c:\9frllrr.exec:\9frllrr.exe84⤵PID:1880
-
\??\c:\bhhnhn.exec:\bhhnhn.exe85⤵PID:732
-
\??\c:\bthnhn.exec:\bthnhn.exe86⤵PID:3220
-
\??\c:\ppjjj.exec:\ppjjj.exe87⤵PID:2744
-
\??\c:\xrrlllr.exec:\xrrlllr.exe88⤵PID:2844
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe89⤵PID:3956
-
\??\c:\bhtnbb.exec:\bhtnbb.exe90⤵PID:4640
-
\??\c:\jjjdd.exec:\jjjdd.exe91⤵PID:4344
-
\??\c:\9jvpp.exec:\9jvpp.exe92⤵PID:4788
-
\??\c:\7frrflx.exec:\7frrflx.exe93⤵PID:4848
-
\??\c:\5ttttt.exec:\5ttttt.exe94⤵PID:4352
-
\??\c:\5bnnbb.exec:\5bnnbb.exe95⤵PID:392
-
\??\c:\vdjpj.exec:\vdjpj.exe96⤵PID:3780
-
\??\c:\vdpdp.exec:\vdpdp.exe97⤵PID:3672
-
\??\c:\1frrrxr.exec:\1frrrxr.exe98⤵PID:2084
-
\??\c:\nhhntb.exec:\nhhntb.exe99⤵PID:2236
-
\??\c:\ppppp.exec:\ppppp.exe100⤵PID:1368
-
\??\c:\flllxfx.exec:\flllxfx.exe101⤵PID:1580
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe102⤵PID:1812
-
\??\c:\hbbttb.exec:\hbbttb.exe103⤵PID:1456
-
\??\c:\dddpj.exec:\dddpj.exe104⤵PID:4236
-
\??\c:\rfrxrxx.exec:\rfrxrxx.exe105⤵PID:5068
-
\??\c:\lxflfll.exec:\lxflfll.exe106⤵PID:4976
-
\??\c:\hnnttb.exec:\hnnttb.exe107⤵PID:1816
-
\??\c:\bhbbhn.exec:\bhbbhn.exe108⤵PID:3140
-
\??\c:\ppjpj.exec:\ppjpj.exe109⤵PID:4308
-
\??\c:\frfxxxf.exec:\frfxxxf.exe110⤵PID:4296
-
\??\c:\rxxxxrr.exec:\rxxxxrr.exe111⤵PID:4528
-
\??\c:\hbbbbn.exec:\hbbbbn.exe112⤵PID:4840
-
\??\c:\pjvvv.exec:\pjvvv.exe113⤵PID:4780
-
\??\c:\5pjpp.exec:\5pjpp.exe114⤵PID:1012
-
\??\c:\5lrxrxf.exec:\5lrxrxf.exe115⤵PID:3448
-
\??\c:\3tnnht.exec:\3tnnht.exe116⤵PID:716
-
\??\c:\7nntnn.exec:\7nntnn.exe117⤵PID:2908
-
\??\c:\vdddj.exec:\vdddj.exe118⤵PID:2480
-
\??\c:\7xffrrr.exec:\7xffrrr.exe119⤵PID:2180
-
\??\c:\5xrrrxl.exec:\5xrrrxl.exe120⤵PID:4700
-
\??\c:\tnnhbb.exec:\tnnhbb.exe121⤵PID:3040
-
\??\c:\tnnnhn.exec:\tnnnhn.exe122⤵PID:212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-