Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 11:20
Behavioral task
behavioral1
Sample
d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe
-
Size
334KB
-
MD5
54d905d46ed09076a8632e47fce229c0
-
SHA1
44dabfef9df96c412e869799755c28383bfedb3c
-
SHA256
d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64
-
SHA512
e01c9703fd0585fe5ebd1cbaa5f0d255d2b126adf31d021d4f12f60757e0d4c5d62b0db687e8870e5fb24c7212d459198e64f6975d27fdb3145b43cf342e5116
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR4:R4wFHoSHYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4264-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1416-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/856-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3332-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/348-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1000-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2816-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-786-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-1179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1784 dvddd.exe 3924 nbbbbb.exe 4868 thnbtn.exe 1284 3vjdp.exe 4840 llxxrrl.exe 4244 vjvdd.exe 2852 1flfxrr.exe 3856 rlxxxxx.exe 4136 bbbnnb.exe 1416 7vvvp.exe 4824 frxflff.exe 856 lxlxfxf.exe 4320 hbhhhb.exe 4520 thhhbh.exe 3436 frffrlr.exe 4572 nbbtnn.exe 2320 1jvjd.exe 3692 fxlfllr.exe 3808 hbnnhb.exe 3332 jdjdd.exe 348 7nhhbb.exe 3720 pvvjj.exe 4428 bnhhbb.exe 1840 nnnhhh.exe 4856 xxfxllf.exe 1276 nbbtnn.exe 732 vddjv.exe 1604 fxrlflf.exe 2800 jjddd.exe 1476 flfrrlx.exe 4664 7nbbtb.exe 2232 pjpjd.exe 1008 lrlllfl.exe 2084 jpvpd.exe 1000 1pjdd.exe 1468 bthtbb.exe 1280 jpvvp.exe 372 1xrlxxr.exe 2172 ttnhbb.exe 2680 xlxllxf.exe 1780 xrrfxrf.exe 4012 fxrlflr.exe 3744 3tnnhh.exe 3564 pvddd.exe 4436 xflfrfl.exe 2264 7bbhtn.exe 2220 3vvdj.exe 1524 rrlrlxr.exe 3836 9xlrxfx.exe 2032 hhnhtn.exe 928 jjjjv.exe 4464 xxrlxrl.exe 2784 tbbnth.exe 1348 dvjdd.exe 4776 pvjdp.exe 1712 xffrrff.exe 1700 tbtnbn.exe 3668 5bbtnn.exe 4644 vpvpp.exe 4100 vvdvp.exe 4892 hnnhbt.exe 4244 bhhttn.exe 2852 7djdv.exe 2816 xxfffff.exe -
resource yara_rule behavioral2/memory/4264-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b08-3.dat upx behavioral2/memory/4264-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b59-8.dat upx behavioral2/memory/1784-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b63-11.dat upx behavioral2/memory/3924-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b64-18.dat upx behavioral2/memory/1284-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4868-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b66-24.dat upx behavioral2/memory/1284-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b67-29.dat upx behavioral2/memory/4840-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b68-36.dat upx behavioral2/memory/4244-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2852-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b69-40.dat upx behavioral2/memory/3856-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6a-45.dat upx behavioral2/files/0x000a000000023b6c-54.dat upx behavioral2/memory/1416-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6d-59.dat upx behavioral2/memory/4824-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4136-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6e-66.dat upx behavioral2/memory/856-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6b-50.dat upx behavioral2/files/0x000a000000023b6f-71.dat upx behavioral2/memory/4320-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4520-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b71-80.dat upx behavioral2/memory/3436-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b70-76.dat upx behavioral2/memory/4572-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b72-86.dat upx behavioral2/files/0x000a000000023b73-90.dat upx behavioral2/files/0x000a000000023b74-93.dat upx behavioral2/memory/3808-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3692-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b75-99.dat upx behavioral2/memory/3808-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3332-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b5a-104.dat upx behavioral2/files/0x000a000000023b76-109.dat upx behavioral2/memory/348-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b78-114.dat upx behavioral2/memory/3720-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b79-119.dat upx behavioral2/files/0x000a000000023b7a-124.dat upx behavioral2/memory/1840-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b71-128.dat upx behavioral2/memory/1276-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4856-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7b-135.dat upx behavioral2/files/0x000a000000023b7c-138.dat upx behavioral2/files/0x000a000000023b7d-142.dat upx behavioral2/files/0x000a000000023b7e-146.dat upx behavioral2/files/0x0031000000023b7f-151.dat upx behavioral2/memory/1476-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b80-155.dat upx behavioral2/memory/2232-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1008-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2084-165-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4264 wrote to memory of 1784 4264 d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe 82 PID 4264 wrote to memory of 1784 4264 d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe 82 PID 4264 wrote to memory of 1784 4264 d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe 82 PID 1784 wrote to memory of 3924 1784 dvddd.exe 83 PID 1784 wrote to memory of 3924 1784 dvddd.exe 83 PID 1784 wrote to memory of 3924 1784 dvddd.exe 83 PID 3924 wrote to memory of 4868 3924 nbbbbb.exe 84 PID 3924 wrote to memory of 4868 3924 nbbbbb.exe 84 PID 3924 wrote to memory of 4868 3924 nbbbbb.exe 84 PID 4868 wrote to memory of 1284 4868 thnbtn.exe 85 PID 4868 wrote to memory of 1284 4868 thnbtn.exe 85 PID 4868 wrote to memory of 1284 4868 thnbtn.exe 85 PID 1284 wrote to memory of 4840 1284 3vjdp.exe 86 PID 1284 wrote to memory of 4840 1284 3vjdp.exe 86 PID 1284 wrote to memory of 4840 1284 3vjdp.exe 86 PID 4840 wrote to memory of 4244 4840 llxxrrl.exe 87 PID 4840 wrote to memory of 4244 4840 llxxrrl.exe 87 PID 4840 wrote to memory of 4244 4840 llxxrrl.exe 87 PID 4244 wrote to memory of 2852 4244 vjvdd.exe 88 PID 4244 wrote to memory of 2852 4244 vjvdd.exe 88 PID 4244 wrote to memory of 2852 4244 vjvdd.exe 88 PID 2852 wrote to memory of 3856 2852 1flfxrr.exe 89 PID 2852 wrote to memory of 3856 2852 1flfxrr.exe 89 PID 2852 wrote to memory of 3856 2852 1flfxrr.exe 89 PID 3856 wrote to memory of 4136 3856 rlxxxxx.exe 90 PID 3856 wrote to memory of 4136 3856 rlxxxxx.exe 90 PID 3856 wrote to memory of 4136 3856 rlxxxxx.exe 90 PID 4136 wrote to memory of 1416 4136 bbbnnb.exe 91 PID 4136 wrote to memory of 1416 4136 bbbnnb.exe 91 PID 4136 wrote to memory of 1416 4136 bbbnnb.exe 91 PID 1416 wrote to memory of 4824 1416 7vvvp.exe 92 PID 1416 wrote to memory of 4824 1416 7vvvp.exe 92 PID 1416 wrote to memory of 4824 1416 7vvvp.exe 92 PID 4824 wrote to memory of 856 4824 frxflff.exe 93 PID 4824 wrote to memory of 856 4824 frxflff.exe 93 PID 4824 wrote to memory of 856 4824 frxflff.exe 93 PID 856 wrote to memory of 4320 856 lxlxfxf.exe 94 PID 856 wrote to memory of 4320 856 lxlxfxf.exe 94 PID 856 wrote to memory of 4320 856 lxlxfxf.exe 94 PID 4320 wrote to memory of 4520 4320 hbhhhb.exe 95 PID 4320 wrote to memory of 4520 4320 hbhhhb.exe 95 PID 4320 wrote to memory of 4520 4320 hbhhhb.exe 95 PID 4520 wrote to memory of 3436 4520 thhhbh.exe 96 PID 4520 wrote to memory of 3436 4520 thhhbh.exe 96 PID 4520 wrote to memory of 3436 4520 thhhbh.exe 96 PID 3436 wrote to memory of 4572 3436 frffrlr.exe 97 PID 3436 wrote to memory of 4572 3436 frffrlr.exe 97 PID 3436 wrote to memory of 4572 3436 frffrlr.exe 97 PID 4572 wrote to memory of 2320 4572 nbbtnn.exe 98 PID 4572 wrote to memory of 2320 4572 nbbtnn.exe 98 PID 4572 wrote to memory of 2320 4572 nbbtnn.exe 98 PID 2320 wrote to memory of 3692 2320 1jvjd.exe 99 PID 2320 wrote to memory of 3692 2320 1jvjd.exe 99 PID 2320 wrote to memory of 3692 2320 1jvjd.exe 99 PID 3692 wrote to memory of 3808 3692 fxlfllr.exe 100 PID 3692 wrote to memory of 3808 3692 fxlfllr.exe 100 PID 3692 wrote to memory of 3808 3692 fxlfllr.exe 100 PID 3808 wrote to memory of 3332 3808 hbnnhb.exe 101 PID 3808 wrote to memory of 3332 3808 hbnnhb.exe 101 PID 3808 wrote to memory of 3332 3808 hbnnhb.exe 101 PID 3332 wrote to memory of 348 3332 jdjdd.exe 102 PID 3332 wrote to memory of 348 3332 jdjdd.exe 102 PID 3332 wrote to memory of 348 3332 jdjdd.exe 102 PID 348 wrote to memory of 3720 348 7nhhbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe"C:\Users\Admin\AppData\Local\Temp\d9ae97aea400d2f76d367c17e8279375a35a48c88dc163bdabba02974ff2de64N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\dvddd.exec:\dvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\nbbbbb.exec:\nbbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\thnbtn.exec:\thnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\3vjdp.exec:\3vjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\llxxrrl.exec:\llxxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\vjvdd.exec:\vjvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\1flfxrr.exec:\1flfxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\bbbnnb.exec:\bbbnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\7vvvp.exec:\7vvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\frxflff.exec:\frxflff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\lxlxfxf.exec:\lxlxfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\hbhhhb.exec:\hbhhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\thhhbh.exec:\thhhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\frffrlr.exec:\frffrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\nbbtnn.exec:\nbbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\1jvjd.exec:\1jvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\fxlfllr.exec:\fxlfllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\hbnnhb.exec:\hbnnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\jdjdd.exec:\jdjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\7nhhbb.exec:\7nhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\pvvjj.exec:\pvvjj.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3720 -
\??\c:\bnhhbb.exec:\bnhhbb.exe24⤵
- Executes dropped EXE
PID:4428 -
\??\c:\nnnhhh.exec:\nnnhhh.exe25⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xxfxllf.exec:\xxfxllf.exe26⤵
- Executes dropped EXE
PID:4856 -
\??\c:\nbbtnn.exec:\nbbtnn.exe27⤵
- Executes dropped EXE
PID:1276 -
\??\c:\vddjv.exec:\vddjv.exe28⤵
- Executes dropped EXE
PID:732 -
\??\c:\fxrlflf.exec:\fxrlflf.exe29⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jjddd.exec:\jjddd.exe30⤵
- Executes dropped EXE
PID:2800 -
\??\c:\flfrrlx.exec:\flfrrlx.exe31⤵
- Executes dropped EXE
PID:1476 -
\??\c:\7nbbtb.exec:\7nbbtb.exe32⤵
- Executes dropped EXE
PID:4664 -
\??\c:\pjpjd.exec:\pjpjd.exe33⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lrlllfl.exec:\lrlllfl.exe34⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jpvpd.exec:\jpvpd.exe35⤵
- Executes dropped EXE
PID:2084 -
\??\c:\1pjdd.exec:\1pjdd.exe36⤵
- Executes dropped EXE
PID:1000 -
\??\c:\bthtbb.exec:\bthtbb.exe37⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jpvvp.exec:\jpvvp.exe38⤵
- Executes dropped EXE
PID:1280 -
\??\c:\1xrlxxr.exec:\1xrlxxr.exe39⤵
- Executes dropped EXE
PID:372 -
\??\c:\ttnhbb.exec:\ttnhbb.exe40⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xlxllxf.exec:\xlxllxf.exe41⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xrrfxrf.exec:\xrrfxrf.exe42⤵
- Executes dropped EXE
PID:1780 -
\??\c:\fxrlflr.exec:\fxrlflr.exe43⤵
- Executes dropped EXE
PID:4012 -
\??\c:\3tnnhh.exec:\3tnnhh.exe44⤵
- Executes dropped EXE
PID:3744 -
\??\c:\pvddd.exec:\pvddd.exe45⤵
- Executes dropped EXE
PID:3564 -
\??\c:\xflfrfl.exec:\xflfrfl.exe46⤵
- Executes dropped EXE
PID:4436 -
\??\c:\7bbhtn.exec:\7bbhtn.exe47⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3vvdj.exec:\3vvdj.exe48⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rrlrlxr.exec:\rrlrlxr.exe49⤵
- Executes dropped EXE
PID:1524 -
\??\c:\9xlrxfx.exec:\9xlrxfx.exe50⤵
- Executes dropped EXE
PID:3836 -
\??\c:\hhnhtn.exec:\hhnhtn.exe51⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jjjjv.exec:\jjjjv.exe52⤵
- Executes dropped EXE
PID:928 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe53⤵
- Executes dropped EXE
PID:4464 -
\??\c:\tbbnth.exec:\tbbnth.exe54⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dvjdd.exec:\dvjdd.exe55⤵
- Executes dropped EXE
PID:1348 -
\??\c:\pvjdp.exec:\pvjdp.exe56⤵
- Executes dropped EXE
PID:4776 -
\??\c:\xffrrff.exec:\xffrrff.exe57⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tbtnbn.exec:\tbtnbn.exe58⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5bbtnn.exec:\5bbtnn.exe59⤵
- Executes dropped EXE
PID:3668 -
\??\c:\vpvpp.exec:\vpvpp.exe60⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vvdvp.exec:\vvdvp.exe61⤵
- Executes dropped EXE
PID:4100 -
\??\c:\hnnhbt.exec:\hnnhbt.exe62⤵
- Executes dropped EXE
PID:4892 -
\??\c:\bhhttn.exec:\bhhttn.exe63⤵
- Executes dropped EXE
PID:4244 -
\??\c:\7djdv.exec:\7djdv.exe64⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xxfffff.exec:\xxfffff.exe65⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3hbhnn.exec:\3hbhnn.exe66⤵PID:4476
-
\??\c:\5hnhht.exec:\5hnhht.exe67⤵PID:1660
-
\??\c:\7vvpd.exec:\7vvpd.exe68⤵PID:2740
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe69⤵PID:2888
-
\??\c:\fxrrlff.exec:\fxrrlff.exe70⤵PID:1684
-
\??\c:\7tbttt.exec:\7tbttt.exe71⤵PID:1768
-
\??\c:\bntnnh.exec:\bntnnh.exe72⤵PID:1268
-
\??\c:\pjddj.exec:\pjddj.exe73⤵PID:4108
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe74⤵PID:4640
-
\??\c:\hhnnbb.exec:\hhnnbb.exe75⤵PID:3968
-
\??\c:\tnthnh.exec:\tnthnh.exe76⤵PID:4520
-
\??\c:\vdjvp.exec:\vdjvp.exe77⤵PID:4912
-
\??\c:\fxrrlrx.exec:\fxrrlrx.exe78⤵PID:1472
-
\??\c:\btbthb.exec:\btbthb.exe79⤵PID:2080
-
\??\c:\1tnhhh.exec:\1tnhhh.exe80⤵PID:3524
-
\??\c:\9vdpd.exec:\9vdpd.exe81⤵PID:1128
-
\??\c:\vpppv.exec:\vpppv.exe82⤵PID:2480
-
\??\c:\rrlfxxf.exec:\rrlfxxf.exe83⤵PID:3380
-
\??\c:\9hthbt.exec:\9hthbt.exe84⤵PID:3904
-
\??\c:\3djdj.exec:\3djdj.exe85⤵PID:784
-
\??\c:\3pppd.exec:\3pppd.exe86⤵PID:2136
-
\??\c:\rffxlfx.exec:\rffxlfx.exe87⤵PID:2432
-
\??\c:\7bhbnt.exec:\7bhbnt.exe88⤵PID:5012
-
\??\c:\5pvpd.exec:\5pvpd.exe89⤵PID:1244
-
\??\c:\jvddp.exec:\jvddp.exe90⤵PID:4112
-
\??\c:\llrrlll.exec:\llrrlll.exe91⤵PID:1840
-
\??\c:\5tbnbn.exec:\5tbnbn.exe92⤵PID:4856
-
\??\c:\jdpjj.exec:\jdpjj.exe93⤵PID:1752
-
\??\c:\pvvjd.exec:\pvvjd.exe94⤵PID:1276
-
\??\c:\5frlfff.exec:\5frlfff.exe95⤵PID:4344
-
\??\c:\tnhbtb.exec:\tnhbtb.exe96⤵PID:2212
-
\??\c:\vvpdv.exec:\vvpdv.exe97⤵PID:1324
-
\??\c:\pvpjv.exec:\pvpjv.exe98⤵PID:1632
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe99⤵PID:3156
-
\??\c:\nnttht.exec:\nnttht.exe100⤵PID:2388
-
\??\c:\jdpjv.exec:\jdpjv.exe101⤵
- System Location Discovery: System Language Discovery
PID:5016 -
\??\c:\vvddv.exec:\vvddv.exe102⤵PID:1432
-
\??\c:\rffxlfx.exec:\rffxlfx.exe103⤵PID:1008
-
\??\c:\xxllllr.exec:\xxllllr.exe104⤵PID:2084
-
\??\c:\7tnttt.exec:\7tnttt.exe105⤵
- System Location Discovery: System Language Discovery
PID:3012 -
\??\c:\ddvpj.exec:\ddvpj.exe106⤵PID:4416
-
\??\c:\lffxrrr.exec:\lffxrrr.exe107⤵PID:1232
-
\??\c:\lffxrrl.exec:\lffxrrl.exe108⤵PID:1480
-
\??\c:\hbtnhb.exec:\hbtnhb.exe109⤵PID:3272
-
\??\c:\vjvvv.exec:\vjvvv.exe110⤵PID:2908
-
\??\c:\pvpjd.exec:\pvpjd.exe111⤵PID:3996
-
\??\c:\3ffxxxr.exec:\3ffxxxr.exe112⤵PID:1236
-
\??\c:\5hhnhn.exec:\5hhnhn.exe113⤵PID:2448
-
\??\c:\jjpdp.exec:\jjpdp.exe114⤵PID:3880
-
\??\c:\lrxxflf.exec:\lrxxflf.exe115⤵PID:396
-
\??\c:\xrlfffx.exec:\xrlfffx.exe116⤵PID:2456
-
\??\c:\tbnbbh.exec:\tbnbbh.exe117⤵PID:2260
-
\??\c:\dpppv.exec:\dpppv.exe118⤵PID:2464
-
\??\c:\xxxrfff.exec:\xxxrfff.exe119⤵PID:4592
-
\??\c:\lfxlfxr.exec:\lfxlfxr.exe120⤵PID:752
-
\??\c:\tbnbhb.exec:\tbnbhb.exe121⤵PID:4524
-
\??\c:\hthtnh.exec:\hthtnh.exe122⤵PID:1672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-