Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe
-
Size
453KB
-
MD5
19d6aff5e48834c275d9eb0aa012a670
-
SHA1
ce5f94ddaf55771e633e772c4ca416547de91055
-
SHA256
faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960
-
SHA512
2f36360c4186557ee452a4421868964e47ec4eae7a1ee4f83b4820d16d082da1156b8a2076455ebd317c4b2a05cba1b10ee1f729a5c3d98899bcfb74c1f90194
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1544-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-891-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/588-1901-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4620 rlffxrl.exe 2812 lfffxxx.exe 4132 nhnhtt.exe 2888 nhnnhh.exe 3000 vjdvp.exe 1088 xlfxlxl.exe 3784 tnttth.exe 4668 hbnnhh.exe 4180 pvvvj.exe 2580 rrrllrx.exe 748 btbbbh.exe 220 nntnnt.exe 1016 9fffrxf.exe 3252 lllffxf.exe 4984 5bhbtb.exe 3248 jdddd.exe 2216 rrrrlrr.exe 1348 tbhhhh.exe 2552 lflffff.exe 2952 tnthbb.exe 3748 hthhht.exe 3500 pvddd.exe 5080 fxffxxx.exe 1760 ppppd.exe 368 bthbbb.exe 4440 tntttt.exe 4588 vdppv.exe 4920 frxfxxr.exe 404 lxfxlrx.exe 1228 nhttnt.exe 2880 pjpjp.exe 5044 nhtnnn.exe 5020 1jppv.exe 2936 hnnhhh.exe 2976 pdddv.exe 4080 xrfxrrr.exe 2604 hbhhhb.exe 1196 pjvdj.exe 5012 3fxxxxx.exe 2784 1lfffll.exe 1544 ttnnhh.exe 4068 pvjjp.exe 3724 pdjdd.exe 4428 llxxxxx.exe 3864 7tbbtb.exe 4872 jdjpd.exe 4132 1vddp.exe 4296 rrffxxx.exe 3480 bbhhnt.exe 2284 dvvpv.exe 3600 xxlllll.exe 1776 hthnhh.exe 2388 vdppd.exe 4432 vpvvp.exe 3144 lrflxrl.exe 1584 nhnhhh.exe 448 vvdvp.exe 3180 rxfxxxx.exe 912 nbhntb.exe 224 ddddv.exe 2876 7xxfxxr.exe 4040 lrxrlll.exe 3756 btbnnh.exe 4792 dpdvv.exe -
resource yara_rule behavioral2/memory/4620-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-636-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1544 wrote to memory of 4620 1544 faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe 83 PID 1544 wrote to memory of 4620 1544 faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe 83 PID 1544 wrote to memory of 4620 1544 faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe 83 PID 4620 wrote to memory of 2812 4620 rlffxrl.exe 84 PID 4620 wrote to memory of 2812 4620 rlffxrl.exe 84 PID 4620 wrote to memory of 2812 4620 rlffxrl.exe 84 PID 2812 wrote to memory of 4132 2812 lfffxxx.exe 85 PID 2812 wrote to memory of 4132 2812 lfffxxx.exe 85 PID 2812 wrote to memory of 4132 2812 lfffxxx.exe 85 PID 4132 wrote to memory of 2888 4132 nhnhtt.exe 86 PID 4132 wrote to memory of 2888 4132 nhnhtt.exe 86 PID 4132 wrote to memory of 2888 4132 nhnhtt.exe 86 PID 2888 wrote to memory of 3000 2888 nhnnhh.exe 87 PID 2888 wrote to memory of 3000 2888 nhnnhh.exe 87 PID 2888 wrote to memory of 3000 2888 nhnnhh.exe 87 PID 3000 wrote to memory of 1088 3000 vjdvp.exe 88 PID 3000 wrote to memory of 1088 3000 vjdvp.exe 88 PID 3000 wrote to memory of 1088 3000 vjdvp.exe 88 PID 1088 wrote to memory of 3784 1088 xlfxlxl.exe 89 PID 1088 wrote to memory of 3784 1088 xlfxlxl.exe 89 PID 1088 wrote to memory of 3784 1088 xlfxlxl.exe 89 PID 3784 wrote to memory of 4668 3784 tnttth.exe 90 PID 3784 wrote to memory of 4668 3784 tnttth.exe 90 PID 3784 wrote to memory of 4668 3784 tnttth.exe 90 PID 4668 wrote to memory of 4180 4668 hbnnhh.exe 91 PID 4668 wrote to memory of 4180 4668 hbnnhh.exe 91 PID 4668 wrote to memory of 4180 4668 hbnnhh.exe 91 PID 4180 wrote to memory of 2580 4180 pvvvj.exe 92 PID 4180 wrote to memory of 2580 4180 pvvvj.exe 92 PID 4180 wrote to memory of 2580 4180 pvvvj.exe 92 PID 2580 wrote to memory of 748 2580 rrrllrx.exe 93 PID 2580 wrote to memory of 748 2580 rrrllrx.exe 93 PID 2580 wrote to memory of 748 2580 rrrllrx.exe 93 PID 748 wrote to memory of 220 748 btbbbh.exe 94 PID 748 wrote to memory of 220 748 btbbbh.exe 94 PID 748 wrote to memory of 220 748 btbbbh.exe 94 PID 220 wrote to memory of 1016 220 nntnnt.exe 95 PID 220 wrote to memory of 1016 220 nntnnt.exe 95 PID 220 wrote to memory of 1016 220 nntnnt.exe 95 PID 1016 wrote to memory of 3252 1016 9fffrxf.exe 96 PID 1016 wrote to memory of 3252 1016 9fffrxf.exe 96 PID 1016 wrote to memory of 3252 1016 9fffrxf.exe 96 PID 3252 wrote to memory of 4984 3252 lllffxf.exe 97 PID 3252 wrote to memory of 4984 3252 lllffxf.exe 97 PID 3252 wrote to memory of 4984 3252 lllffxf.exe 97 PID 4984 wrote to memory of 3248 4984 5bhbtb.exe 98 PID 4984 wrote to memory of 3248 4984 5bhbtb.exe 98 PID 4984 wrote to memory of 3248 4984 5bhbtb.exe 98 PID 3248 wrote to memory of 2216 3248 jdddd.exe 99 PID 3248 wrote to memory of 2216 3248 jdddd.exe 99 PID 3248 wrote to memory of 2216 3248 jdddd.exe 99 PID 2216 wrote to memory of 1348 2216 rrrrlrr.exe 100 PID 2216 wrote to memory of 1348 2216 rrrrlrr.exe 100 PID 2216 wrote to memory of 1348 2216 rrrrlrr.exe 100 PID 1348 wrote to memory of 2552 1348 tbhhhh.exe 101 PID 1348 wrote to memory of 2552 1348 tbhhhh.exe 101 PID 1348 wrote to memory of 2552 1348 tbhhhh.exe 101 PID 2552 wrote to memory of 2952 2552 lflffff.exe 102 PID 2552 wrote to memory of 2952 2552 lflffff.exe 102 PID 2552 wrote to memory of 2952 2552 lflffff.exe 102 PID 2952 wrote to memory of 3748 2952 tnthbb.exe 103 PID 2952 wrote to memory of 3748 2952 tnthbb.exe 103 PID 2952 wrote to memory of 3748 2952 tnthbb.exe 103 PID 3748 wrote to memory of 3500 3748 hthhht.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe"C:\Users\Admin\AppData\Local\Temp\faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\rlffxrl.exec:\rlffxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\lfffxxx.exec:\lfffxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\nhnhtt.exec:\nhnhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\nhnnhh.exec:\nhnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vjdvp.exec:\vjdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xlfxlxl.exec:\xlfxlxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\tnttth.exec:\tnttth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\hbnnhh.exec:\hbnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\pvvvj.exec:\pvvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\rrrllrx.exec:\rrrllrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\btbbbh.exec:\btbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\nntnnt.exec:\nntnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\9fffrxf.exec:\9fffrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\lllffxf.exec:\lllffxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\5bhbtb.exec:\5bhbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\jdddd.exec:\jdddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\tbhhhh.exec:\tbhhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\lflffff.exec:\lflffff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\tnthbb.exec:\tnthbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hthhht.exec:\hthhht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\pvddd.exec:\pvddd.exe23⤵
- Executes dropped EXE
PID:3500 -
\??\c:\fxffxxx.exec:\fxffxxx.exe24⤵
- Executes dropped EXE
PID:5080 -
\??\c:\ppppd.exec:\ppppd.exe25⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bthbbb.exec:\bthbbb.exe26⤵
- Executes dropped EXE
PID:368 -
\??\c:\tntttt.exec:\tntttt.exe27⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vdppv.exec:\vdppv.exe28⤵
- Executes dropped EXE
PID:4588 -
\??\c:\frxfxxr.exec:\frxfxxr.exe29⤵
- Executes dropped EXE
PID:4920 -
\??\c:\lxfxlrx.exec:\lxfxlrx.exe30⤵
- Executes dropped EXE
PID:404 -
\??\c:\nhttnt.exec:\nhttnt.exe31⤵
- Executes dropped EXE
PID:1228 -
\??\c:\pjpjp.exec:\pjpjp.exe32⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nhtnnn.exec:\nhtnnn.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5044 -
\??\c:\1jppv.exec:\1jppv.exe34⤵
- Executes dropped EXE
PID:5020 -
\??\c:\hnnhhh.exec:\hnnhhh.exe35⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pdddv.exec:\pdddv.exe36⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe37⤵
- Executes dropped EXE
PID:4080 -
\??\c:\hbhhhb.exec:\hbhhhb.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pjvdj.exec:\pjvdj.exe39⤵
- Executes dropped EXE
PID:1196 -
\??\c:\3fxxxxx.exec:\3fxxxxx.exe40⤵
- Executes dropped EXE
PID:5012 -
\??\c:\1lfffll.exec:\1lfffll.exe41⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ttnnhh.exec:\ttnnhh.exe42⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pvjjp.exec:\pvjjp.exe43⤵
- Executes dropped EXE
PID:4068 -
\??\c:\pdjdd.exec:\pdjdd.exe44⤵
- Executes dropped EXE
PID:3724 -
\??\c:\llxxxxx.exec:\llxxxxx.exe45⤵
- Executes dropped EXE
PID:4428 -
\??\c:\7tbbtb.exec:\7tbbtb.exe46⤵
- Executes dropped EXE
PID:3864 -
\??\c:\jdjpd.exec:\jdjpd.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4872 -
\??\c:\1vddp.exec:\1vddp.exe48⤵
- Executes dropped EXE
PID:4132 -
\??\c:\rrffxxx.exec:\rrffxxx.exe49⤵
- Executes dropped EXE
PID:4296 -
\??\c:\bbhhnt.exec:\bbhhnt.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3480 -
\??\c:\dvvpv.exec:\dvvpv.exe51⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xxlllll.exec:\xxlllll.exe52⤵
- Executes dropped EXE
PID:3600 -
\??\c:\hthnhh.exec:\hthnhh.exe53⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vdppd.exec:\vdppd.exe54⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vpvvp.exec:\vpvvp.exe55⤵
- Executes dropped EXE
PID:4432 -
\??\c:\lrflxrl.exec:\lrflxrl.exe56⤵
- Executes dropped EXE
PID:3144 -
\??\c:\nhnhhh.exec:\nhnhhh.exe57⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vvdvp.exec:\vvdvp.exe58⤵
- Executes dropped EXE
PID:448 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe59⤵
- Executes dropped EXE
PID:3180 -
\??\c:\nbhntb.exec:\nbhntb.exe60⤵
- Executes dropped EXE
PID:912 -
\??\c:\ddddv.exec:\ddddv.exe61⤵
- Executes dropped EXE
PID:224 -
\??\c:\7xxfxxr.exec:\7xxfxxr.exe62⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lrxrlll.exec:\lrxrlll.exe63⤵
- Executes dropped EXE
PID:4040 -
\??\c:\btbnnh.exec:\btbnnh.exe64⤵
- Executes dropped EXE
PID:3756 -
\??\c:\dpdvv.exec:\dpdvv.exe65⤵
- Executes dropped EXE
PID:4792 -
\??\c:\xxxxxxf.exec:\xxxxxxf.exe66⤵PID:1400
-
\??\c:\btnnnh.exec:\btnnnh.exe67⤵PID:4604
-
\??\c:\tnbbhn.exec:\tnbbhn.exe68⤵PID:1352
-
\??\c:\pjjjd.exec:\pjjjd.exe69⤵PID:2552
-
\??\c:\7lrlffx.exec:\7lrlffx.exe70⤵PID:3368
-
\??\c:\ttttbh.exec:\ttttbh.exe71⤵PID:2100
-
\??\c:\dvjdv.exec:\dvjdv.exe72⤵PID:1440
-
\??\c:\jjjdj.exec:\jjjdj.exe73⤵PID:2176
-
\??\c:\rllfflf.exec:\rllfflf.exe74⤵PID:5080
-
\??\c:\hnnnnn.exec:\hnnnnn.exe75⤵PID:3044
-
\??\c:\pdjjd.exec:\pdjjd.exe76⤵PID:668
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe77⤵PID:936
-
\??\c:\1rrrxxr.exec:\1rrrxxr.exe78⤵PID:4880
-
\??\c:\nhttbt.exec:\nhttbt.exe79⤵PID:2460
-
\??\c:\dvpjp.exec:\dvpjp.exe80⤵PID:1036
-
\??\c:\9lxrxff.exec:\9lxrxff.exe81⤵PID:2088
-
\??\c:\hbbbtt.exec:\hbbbtt.exe82⤵PID:1224
-
\??\c:\hthttt.exec:\hthttt.exe83⤵PID:5060
-
\??\c:\vppjv.exec:\vppjv.exe84⤵PID:3316
-
\??\c:\rlrllll.exec:\rlrllll.exe85⤵PID:652
-
\??\c:\bhtthh.exec:\bhtthh.exe86⤵PID:4608
-
\??\c:\dvvpp.exec:\dvvpp.exe87⤵PID:2496
-
\??\c:\fffxxrr.exec:\fffxxrr.exe88⤵PID:1496
-
\??\c:\lxlllrr.exec:\lxlllrr.exe89⤵PID:2976
-
\??\c:\nnbhnn.exec:\nnbhnn.exe90⤵PID:4080
-
\??\c:\vpvvv.exec:\vpvvv.exe91⤵PID:4936
-
\??\c:\rfrllll.exec:\rfrllll.exe92⤵PID:1340
-
\??\c:\3rxxllx.exec:\3rxxllx.exe93⤵PID:4516
-
\??\c:\thhhhh.exec:\thhhhh.exe94⤵PID:4288
-
\??\c:\jjvpd.exec:\jjvpd.exe95⤵PID:1004
-
\??\c:\7xxxrrr.exec:\7xxxrrr.exe96⤵PID:3092
-
\??\c:\bthbbh.exec:\bthbbh.exe97⤵PID:3508
-
\??\c:\nhnhhh.exec:\nhnhhh.exe98⤵PID:3712
-
\??\c:\5vdjp.exec:\5vdjp.exe99⤵PID:5008
-
\??\c:\lflrllf.exec:\lflrllf.exe100⤵PID:4900
-
\??\c:\nntnnh.exec:\nntnnh.exe101⤵PID:468
-
\??\c:\pppjv.exec:\pppjv.exe102⤵PID:4436
-
\??\c:\lfrxrlx.exec:\lfrxrlx.exe103⤵PID:4860
-
\??\c:\9rxrrxx.exec:\9rxrrxx.exe104⤵PID:2296
-
\??\c:\hbnnhn.exec:\hbnnhn.exe105⤵PID:3140
-
\??\c:\jjpjj.exec:\jjpjj.exe106⤵PID:2864
-
\??\c:\fxrrrff.exec:\fxrrrff.exe107⤵PID:1464
-
\??\c:\rxxlllf.exec:\rxxlllf.exe108⤵PID:4764
-
\??\c:\nnbhht.exec:\nnbhht.exe109⤵PID:3600
-
\??\c:\xllllrr.exec:\xllllrr.exe110⤵PID:2872
-
\??\c:\btbbtt.exec:\btbbtt.exe111⤵PID:2136
-
\??\c:\pjjvj.exec:\pjjvj.exe112⤵PID:2424
-
\??\c:\pjvpv.exec:\pjvpv.exe113⤵PID:4116
-
\??\c:\flfrlfr.exec:\flfrlfr.exe114⤵PID:3440
-
\??\c:\nnnntb.exec:\nnnntb.exe115⤵PID:3996
-
\??\c:\dddjj.exec:\dddjj.exe116⤵PID:2868
-
\??\c:\ppdjv.exec:\ppdjv.exe117⤵PID:3180
-
\??\c:\rflffll.exec:\rflffll.exe118⤵PID:912
-
\??\c:\bntnnn.exec:\bntnnn.exe119⤵PID:3384
-
\??\c:\dvdvd.exec:\dvdvd.exe120⤵PID:2884
-
\??\c:\rlrlffx.exec:\rlrlffx.exe121⤵PID:3820
-
\??\c:\ttbbbh.exec:\ttbbbh.exe122⤵PID:3756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-