Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 20:20
Behavioral task
behavioral1
Sample
14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe
-
Size
332KB
-
MD5
e3dd7ebc883d19045f227aecce9b6ab0
-
SHA1
e1df6f7fd9b44688fc41ce7bfbc09815c68ad045
-
SHA256
14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7
-
SHA512
1911a2b81908e638bd16067b6d473e9c1cde03223902a80a54ba5dd84459ade1293b560d9fe925103483115417ce2fd43fba59d44ddcf6435a41be6ff01d16ee
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbev:R4wFHoSHYHUrAwfMp3CDv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5092-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/696-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1876-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1248-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2632-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-757-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 696 1tbbnn.exe 4456 vvjpv.exe 2824 jdvjj.exe 1876 frfxflr.exe 2188 5hnnbb.exe 740 7pjpv.exe 2252 3xlllxf.exe 3280 vpvjv.exe 1248 xrllfll.exe 3464 htnhhn.exe 2536 hnnnht.exe 2440 1dppj.exe 1628 ttttnt.exe 4788 vdvvv.exe 2832 bnhhhh.exe 4360 llrxxff.exe 2992 llrrrrx.exe 2632 3flllxx.exe 3604 hnthhn.exe 1804 vvdpv.exe 3908 lfxxxxf.exe 3328 hnbbhh.exe 3260 xxflrxf.exe 2312 htntth.exe 212 fxfffll.exe 4192 nnhbbb.exe 1224 xlflxxf.exe 3988 5lrrlll.exe 4352 bbtbnt.exe 4680 tnttnt.exe 1040 ppvvv.exe 388 llxfxxx.exe 2232 hhtbbh.exe 2840 9rffrxx.exe 3672 hbhhhh.exe 880 bntnbb.exe 3700 vvddd.exe 3200 nnnnbt.exe 3480 1hnnhn.exe 1812 5xfrrxx.exe 3644 ppddj.exe 1380 nnnnnb.exe 1420 frrrxff.exe 2860 ddppd.exe 2248 3xlflll.exe 1120 7tbbbb.exe 3780 ddjjd.exe 4716 jdvvd.exe 1836 frfffrr.exe 3488 3bhhnt.exe 3000 5jvpj.exe 3224 vvvvd.exe 2096 fxffxxf.exe 2656 bhbtnn.exe 1684 1jppp.exe 4424 xxxxxxr.exe 3924 9bbbbb.exe 4480 nttbth.exe 4900 jddvd.exe 1556 lrlrfrf.exe 2760 btbtnt.exe 3624 nnttbh.exe 3504 ppvdj.exe 2080 frxflrl.exe -
resource yara_rule behavioral2/memory/5092-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b20-4.dat upx behavioral2/files/0x000b000000023b7a-9.dat upx behavioral2/memory/5092-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/696-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7e-11.dat upx behavioral2/memory/4456-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b80-18.dat upx behavioral2/memory/2824-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b81-23.dat upx behavioral2/memory/1876-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2188-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b82-28.dat upx behavioral2/files/0x000a000000023b83-34.dat upx behavioral2/memory/740-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b84-38.dat upx behavioral2/memory/2252-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3280-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1248-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b85-45.dat upx behavioral2/files/0x000a000000023b86-50.dat upx behavioral2/memory/1248-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3464-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b87-55.dat upx behavioral2/memory/2536-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b88-59.dat upx behavioral2/files/0x000b000000023b7b-64.dat upx behavioral2/memory/2440-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-70.dat upx behavioral2/memory/1628-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4788-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8a-74.dat upx behavioral2/memory/2832-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-80.dat upx behavioral2/memory/4360-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-84.dat upx behavioral2/memory/2992-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-90.dat upx behavioral2/memory/2632-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8e-95.dat upx behavioral2/files/0x000a000000023b8f-99.dat upx behavioral2/memory/3604-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b90-105.dat upx behavioral2/memory/1804-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-109.dat upx behavioral2/memory/3908-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b93-114.dat upx behavioral2/memory/3328-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b94-119.dat upx behavioral2/files/0x000a000000023b95-124.dat upx behavioral2/memory/2312-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b96-128.dat upx behavioral2/memory/4192-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-133.dat upx behavioral2/files/0x000a000000023b98-138.dat upx behavioral2/files/0x000a000000023b99-141.dat upx behavioral2/memory/3988-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9a-147.dat upx behavioral2/files/0x000a000000023b9b-150.dat upx behavioral2/memory/1040-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-155.dat upx behavioral2/memory/880-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1812-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3644-179-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 696 5092 14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe 83 PID 5092 wrote to memory of 696 5092 14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe 83 PID 5092 wrote to memory of 696 5092 14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe 83 PID 696 wrote to memory of 4456 696 1tbbnn.exe 84 PID 696 wrote to memory of 4456 696 1tbbnn.exe 84 PID 696 wrote to memory of 4456 696 1tbbnn.exe 84 PID 4456 wrote to memory of 2824 4456 vvjpv.exe 85 PID 4456 wrote to memory of 2824 4456 vvjpv.exe 85 PID 4456 wrote to memory of 2824 4456 vvjpv.exe 85 PID 2824 wrote to memory of 1876 2824 jdvjj.exe 86 PID 2824 wrote to memory of 1876 2824 jdvjj.exe 86 PID 2824 wrote to memory of 1876 2824 jdvjj.exe 86 PID 1876 wrote to memory of 2188 1876 frfxflr.exe 87 PID 1876 wrote to memory of 2188 1876 frfxflr.exe 87 PID 1876 wrote to memory of 2188 1876 frfxflr.exe 87 PID 2188 wrote to memory of 740 2188 5hnnbb.exe 88 PID 2188 wrote to memory of 740 2188 5hnnbb.exe 88 PID 2188 wrote to memory of 740 2188 5hnnbb.exe 88 PID 740 wrote to memory of 2252 740 7pjpv.exe 89 PID 740 wrote to memory of 2252 740 7pjpv.exe 89 PID 740 wrote to memory of 2252 740 7pjpv.exe 89 PID 2252 wrote to memory of 3280 2252 3xlllxf.exe 90 PID 2252 wrote to memory of 3280 2252 3xlllxf.exe 90 PID 2252 wrote to memory of 3280 2252 3xlllxf.exe 90 PID 3280 wrote to memory of 1248 3280 vpvjv.exe 91 PID 3280 wrote to memory of 1248 3280 vpvjv.exe 91 PID 3280 wrote to memory of 1248 3280 vpvjv.exe 91 PID 1248 wrote to memory of 3464 1248 xrllfll.exe 92 PID 1248 wrote to memory of 3464 1248 xrllfll.exe 92 PID 1248 wrote to memory of 3464 1248 xrllfll.exe 92 PID 3464 wrote to memory of 2536 3464 htnhhn.exe 93 PID 3464 wrote to memory of 2536 3464 htnhhn.exe 93 PID 3464 wrote to memory of 2536 3464 htnhhn.exe 93 PID 2536 wrote to memory of 2440 2536 hnnnht.exe 94 PID 2536 wrote to memory of 2440 2536 hnnnht.exe 94 PID 2536 wrote to memory of 2440 2536 hnnnht.exe 94 PID 2440 wrote to memory of 1628 2440 1dppj.exe 95 PID 2440 wrote to memory of 1628 2440 1dppj.exe 95 PID 2440 wrote to memory of 1628 2440 1dppj.exe 95 PID 1628 wrote to memory of 4788 1628 ttttnt.exe 96 PID 1628 wrote to memory of 4788 1628 ttttnt.exe 96 PID 1628 wrote to memory of 4788 1628 ttttnt.exe 96 PID 4788 wrote to memory of 2832 4788 vdvvv.exe 97 PID 4788 wrote to memory of 2832 4788 vdvvv.exe 97 PID 4788 wrote to memory of 2832 4788 vdvvv.exe 97 PID 2832 wrote to memory of 4360 2832 bnhhhh.exe 98 PID 2832 wrote to memory of 4360 2832 bnhhhh.exe 98 PID 2832 wrote to memory of 4360 2832 bnhhhh.exe 98 PID 4360 wrote to memory of 2992 4360 llrxxff.exe 99 PID 4360 wrote to memory of 2992 4360 llrxxff.exe 99 PID 4360 wrote to memory of 2992 4360 llrxxff.exe 99 PID 2992 wrote to memory of 2632 2992 llrrrrx.exe 100 PID 2992 wrote to memory of 2632 2992 llrrrrx.exe 100 PID 2992 wrote to memory of 2632 2992 llrrrrx.exe 100 PID 2632 wrote to memory of 3604 2632 3flllxx.exe 101 PID 2632 wrote to memory of 3604 2632 3flllxx.exe 101 PID 2632 wrote to memory of 3604 2632 3flllxx.exe 101 PID 3604 wrote to memory of 1804 3604 hnthhn.exe 102 PID 3604 wrote to memory of 1804 3604 hnthhn.exe 102 PID 3604 wrote to memory of 1804 3604 hnthhn.exe 102 PID 1804 wrote to memory of 3908 1804 vvdpv.exe 103 PID 1804 wrote to memory of 3908 1804 vvdpv.exe 103 PID 1804 wrote to memory of 3908 1804 vvdpv.exe 103 PID 3908 wrote to memory of 3328 3908 lfxxxxf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe"C:\Users\Admin\AppData\Local\Temp\14b260df0be28178ad04cd8ba6f60e81d711dffe8ea9a6da602d98c96026f4d7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\1tbbnn.exec:\1tbbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\vvjpv.exec:\vvjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\jdvjj.exec:\jdvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\frfxflr.exec:\frfxflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\5hnnbb.exec:\5hnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\7pjpv.exec:\7pjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\3xlllxf.exec:\3xlllxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vpvjv.exec:\vpvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\xrllfll.exec:\xrllfll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\htnhhn.exec:\htnhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\hnnnht.exec:\hnnnht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1dppj.exec:\1dppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\ttttnt.exec:\ttttnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\vdvvv.exec:\vdvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\bnhhhh.exec:\bnhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\llrxxff.exec:\llrxxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\llrrrrx.exec:\llrrrrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\3flllxx.exec:\3flllxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hnthhn.exec:\hnthhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\vvdpv.exec:\vvdpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\hnbbhh.exec:\hnbbhh.exe23⤵
- Executes dropped EXE
PID:3328 -
\??\c:\xxflrxf.exec:\xxflrxf.exe24⤵
- Executes dropped EXE
PID:3260 -
\??\c:\htntth.exec:\htntth.exe25⤵
- Executes dropped EXE
PID:2312 -
\??\c:\fxfffll.exec:\fxfffll.exe26⤵
- Executes dropped EXE
PID:212 -
\??\c:\nnhbbb.exec:\nnhbbb.exe27⤵
- Executes dropped EXE
PID:4192 -
\??\c:\xlflxxf.exec:\xlflxxf.exe28⤵
- Executes dropped EXE
PID:1224 -
\??\c:\5lrrlll.exec:\5lrrlll.exe29⤵
- Executes dropped EXE
PID:3988 -
\??\c:\bbtbnt.exec:\bbtbnt.exe30⤵
- Executes dropped EXE
PID:4352 -
\??\c:\tnttnt.exec:\tnttnt.exe31⤵
- Executes dropped EXE
PID:4680 -
\??\c:\ppvvv.exec:\ppvvv.exe32⤵
- Executes dropped EXE
PID:1040 -
\??\c:\llxfxxx.exec:\llxfxxx.exe33⤵
- Executes dropped EXE
PID:388 -
\??\c:\hhtbbh.exec:\hhtbbh.exe34⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9rffrxx.exec:\9rffrxx.exe35⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hbhhhh.exec:\hbhhhh.exe36⤵
- Executes dropped EXE
PID:3672 -
\??\c:\bntnbb.exec:\bntnbb.exe37⤵
- Executes dropped EXE
PID:880 -
\??\c:\vvddd.exec:\vvddd.exe38⤵
- Executes dropped EXE
PID:3700 -
\??\c:\nnnnbt.exec:\nnnnbt.exe39⤵
- Executes dropped EXE
PID:3200 -
\??\c:\1hnnhn.exec:\1hnnhn.exe40⤵
- Executes dropped EXE
PID:3480 -
\??\c:\5xfrrxx.exec:\5xfrrxx.exe41⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ppddj.exec:\ppddj.exe42⤵
- Executes dropped EXE
PID:3644 -
\??\c:\nnnnnb.exec:\nnnnnb.exe43⤵
- Executes dropped EXE
PID:1380 -
\??\c:\frrrxff.exec:\frrrxff.exe44⤵
- Executes dropped EXE
PID:1420 -
\??\c:\ddppd.exec:\ddppd.exe45⤵
- Executes dropped EXE
PID:2860 -
\??\c:\3xlflll.exec:\3xlflll.exe46⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7tbbbb.exec:\7tbbbb.exe47⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ddjjd.exec:\ddjjd.exe48⤵
- Executes dropped EXE
PID:3780 -
\??\c:\jdvvd.exec:\jdvvd.exe49⤵
- Executes dropped EXE
PID:4716 -
\??\c:\frfffrr.exec:\frfffrr.exe50⤵
- Executes dropped EXE
PID:1836 -
\??\c:\3bhhnt.exec:\3bhhnt.exe51⤵
- Executes dropped EXE
PID:3488 -
\??\c:\5jvpj.exec:\5jvpj.exe52⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vvvvd.exec:\vvvvd.exe53⤵
- Executes dropped EXE
PID:3224 -
\??\c:\fxffxxf.exec:\fxffxxf.exe54⤵
- Executes dropped EXE
PID:2096 -
\??\c:\bhbtnn.exec:\bhbtnn.exe55⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1jppp.exec:\1jppp.exe56⤵
- Executes dropped EXE
PID:1684 -
\??\c:\xxxxxxr.exec:\xxxxxxr.exe57⤵
- Executes dropped EXE
PID:4424 -
\??\c:\9bbbbb.exec:\9bbbbb.exe58⤵
- Executes dropped EXE
PID:3924 -
\??\c:\nttbth.exec:\nttbth.exe59⤵
- Executes dropped EXE
PID:4480 -
\??\c:\jddvd.exec:\jddvd.exe60⤵
- Executes dropped EXE
PID:4900 -
\??\c:\lrlrfrf.exec:\lrlrfrf.exe61⤵
- Executes dropped EXE
PID:1556 -
\??\c:\btbtnt.exec:\btbtnt.exe62⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nnttbh.exec:\nnttbh.exe63⤵
- Executes dropped EXE
PID:3624 -
\??\c:\ppvdj.exec:\ppvdj.exe64⤵
- Executes dropped EXE
PID:3504 -
\??\c:\frxflrl.exec:\frxflrl.exe65⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ththhn.exec:\ththhn.exe66⤵PID:844
-
\??\c:\dvjjj.exec:\dvjjj.exe67⤵PID:4672
-
\??\c:\3xlllll.exec:\3xlllll.exe68⤵PID:540
-
\??\c:\tbbbhb.exec:\tbbbhb.exe69⤵PID:5032
-
\??\c:\nbnttb.exec:\nbnttb.exe70⤵PID:3280
-
\??\c:\jvjjj.exec:\jvjjj.exe71⤵PID:3364
-
\??\c:\llrrrxx.exec:\llrrrxx.exe72⤵PID:1672
-
\??\c:\llrrxxr.exec:\llrrxxr.exe73⤵PID:5084
-
\??\c:\5bttnt.exec:\5bttnt.exe74⤵PID:4264
-
\??\c:\jdppv.exec:\jdppv.exe75⤵PID:224
-
\??\c:\3lxfxlf.exec:\3lxfxlf.exe76⤵PID:2536
-
\??\c:\fxxlflx.exec:\fxxlflx.exe77⤵PID:1612
-
\??\c:\tthhhn.exec:\tthhhn.exe78⤵PID:4588
-
\??\c:\3vvpp.exec:\3vvpp.exe79⤵PID:1628
-
\??\c:\ppddd.exec:\ppddd.exe80⤵PID:3984
-
\??\c:\frfxrxx.exec:\frfxrxx.exe81⤵PID:5016
-
\??\c:\3hhhhn.exec:\3hhhhn.exe82⤵PID:1952
-
\??\c:\9pdpp.exec:\9pdpp.exe83⤵PID:2268
-
\??\c:\vvpdd.exec:\vvpdd.exe84⤵PID:2756
-
\??\c:\rxflxff.exec:\rxflxff.exe85⤵PID:2072
-
\??\c:\nbnhhb.exec:\nbnhhb.exe86⤵PID:2632
-
\??\c:\ppdvv.exec:\ppdvv.exe87⤵PID:532
-
\??\c:\rrxrlll.exec:\rrxrlll.exe88⤵PID:916
-
\??\c:\flrxfff.exec:\flrxfff.exe89⤵PID:1828
-
\??\c:\nhhnnt.exec:\nhhnnt.exe90⤵PID:3204
-
\??\c:\vvddd.exec:\vvddd.exe91⤵PID:3368
-
\??\c:\ppjjj.exec:\ppjjj.exe92⤵PID:3328
-
\??\c:\thhttb.exec:\thhttb.exe93⤵PID:3260
-
\??\c:\jpdpp.exec:\jpdpp.exe94⤵PID:5072
-
\??\c:\dvvjv.exec:\dvvjv.exe95⤵PID:1172
-
\??\c:\ffffffl.exec:\ffffffl.exe96⤵PID:1520
-
\??\c:\nnnnnt.exec:\nnnnnt.exe97⤵PID:2016
-
\??\c:\1thnnt.exec:\1thnnt.exe98⤵PID:2500
-
\??\c:\vjppd.exec:\vjppd.exe99⤵
- System Location Discovery: System Language Discovery
PID:5052 -
\??\c:\rffllrr.exec:\rffllrr.exe100⤵PID:1012
-
\??\c:\hhbnbb.exec:\hhbnbb.exe101⤵PID:5036
-
\??\c:\vpdvv.exec:\vpdvv.exe102⤵
- System Location Discovery: System Language Discovery
PID:4416 -
\??\c:\1ffffrr.exec:\1ffffrr.exe103⤵PID:1040
-
\??\c:\ntbhnt.exec:\ntbhnt.exe104⤵PID:4728
-
\??\c:\vppdv.exec:\vppdv.exe105⤵PID:4384
-
\??\c:\7djjd.exec:\7djjd.exe106⤵PID:692
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe107⤵PID:648
-
\??\c:\bbhnnh.exec:\bbhnnh.exe108⤵PID:2540
-
\??\c:\vvddp.exec:\vvddp.exe109⤵PID:1244
-
\??\c:\ddppp.exec:\ddppp.exe110⤵PID:4004
-
\??\c:\frrfffl.exec:\frrfffl.exe111⤵PID:1504
-
\??\c:\hhbbbh.exec:\hhbbbh.exe112⤵PID:3760
-
\??\c:\nthttb.exec:\nthttb.exe113⤵PID:1512
-
\??\c:\jjvpv.exec:\jjvpv.exe114⤵PID:4436
-
\??\c:\lrlfxlf.exec:\lrlfxlf.exe115⤵PID:4872
-
\??\c:\nhnbbb.exec:\nhnbbb.exe116⤵PID:2764
-
\??\c:\hnbhhh.exec:\hnbhhh.exe117⤵PID:4408
-
\??\c:\vvjvv.exec:\vvjvv.exe118⤵PID:1624
-
\??\c:\frllllr.exec:\frllllr.exe119⤵PID:3612
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe120⤵PID:3608
-
\??\c:\nbtnhh.exec:\nbtnhh.exe121⤵PID:1872
-
\??\c:\jvjpp.exec:\jvjpp.exe122⤵PID:228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-