Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 20:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe
-
Size
454KB
-
MD5
8f2590f52d13073458724f80ab4e4aa0
-
SHA1
081776eb25b2c1226da576343f34541d2a26bd0b
-
SHA256
1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917
-
SHA512
29e77601ee1400bd1816326ea17831d6fd5db479ff972d05936e04dbdb519b885cee58456d6e06fee67d6698d8a1edff2941fd04fa0abf5e4b1ea253374c831d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4484-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/820-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/420-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-880-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-1468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-1604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4484 vpvpj.exe 3180 rflllll.exe 5092 fxrrrrr.exe 820 htbtnh.exe 3892 7xlfxrl.exe 2904 ppjjd.exe 2200 vjpjj.exe 1012 pvvpp.exe 4388 frxrlfx.exe 208 fxfxfxl.exe 3008 nhhhbt.exe 4800 5ppjd.exe 2556 pvppp.exe 2284 tttnhb.exe 1456 5xrfxxl.exe 212 3nnhhh.exe 812 7xxlllf.exe 112 5nhbtt.exe 1512 jdjdv.exe 3700 xxrlfxr.exe 872 3hhbtt.exe 4784 xfffrrr.exe 2952 tthhht.exe 420 nttttt.exe 4120 jpdvj.exe 5068 bntnhn.exe 936 pddjv.exe 4372 frrlfxf.exe 4288 tnhhhb.exe 3976 nhhttn.exe 3792 jpvpj.exe 548 hhnhhn.exe 4048 xfxxrrx.exe 4272 hnbhbb.exe 1856 ddpjv.exe 2680 xxllrxr.exe 1484 nnnnnh.exe 3428 hnhthb.exe 2356 ddpjj.exe 3516 rlrflfl.exe 2888 9nttth.exe 1620 pjpjp.exe 2456 rrxlflf.exe 4452 frxrrll.exe 4460 1bhhnn.exe 2084 vppdv.exe 3732 flrfxrr.exe 3968 nhhhhn.exe 4732 jdjvp.exe 3996 lxrlfrr.exe 2408 tnntnb.exe 3180 9vdvp.exe 1588 rlrlfxr.exe 1584 5hbtnn.exe 4980 pjvvd.exe 3344 vjpjd.exe 1116 rrfrxrl.exe 972 vjdvj.exe 2200 vpddp.exe 2344 nbtbbt.exe 4928 jdddd.exe 1980 7lxflxf.exe 1836 rlllfff.exe 672 nhbhnt.exe -
resource yara_rule behavioral2/memory/4484-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/820-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/420-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-586-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 4484 2760 1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe 82 PID 2760 wrote to memory of 4484 2760 1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe 82 PID 2760 wrote to memory of 4484 2760 1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe 82 PID 4484 wrote to memory of 3180 4484 vpvpj.exe 83 PID 4484 wrote to memory of 3180 4484 vpvpj.exe 83 PID 4484 wrote to memory of 3180 4484 vpvpj.exe 83 PID 3180 wrote to memory of 5092 3180 rflllll.exe 84 PID 3180 wrote to memory of 5092 3180 rflllll.exe 84 PID 3180 wrote to memory of 5092 3180 rflllll.exe 84 PID 5092 wrote to memory of 820 5092 fxrrrrr.exe 85 PID 5092 wrote to memory of 820 5092 fxrrrrr.exe 85 PID 5092 wrote to memory of 820 5092 fxrrrrr.exe 85 PID 820 wrote to memory of 3892 820 htbtnh.exe 86 PID 820 wrote to memory of 3892 820 htbtnh.exe 86 PID 820 wrote to memory of 3892 820 htbtnh.exe 86 PID 3892 wrote to memory of 2904 3892 7xlfxrl.exe 87 PID 3892 wrote to memory of 2904 3892 7xlfxrl.exe 87 PID 3892 wrote to memory of 2904 3892 7xlfxrl.exe 87 PID 2904 wrote to memory of 2200 2904 ppjjd.exe 88 PID 2904 wrote to memory of 2200 2904 ppjjd.exe 88 PID 2904 wrote to memory of 2200 2904 ppjjd.exe 88 PID 2200 wrote to memory of 1012 2200 vjpjj.exe 89 PID 2200 wrote to memory of 1012 2200 vjpjj.exe 89 PID 2200 wrote to memory of 1012 2200 vjpjj.exe 89 PID 1012 wrote to memory of 4388 1012 pvvpp.exe 90 PID 1012 wrote to memory of 4388 1012 pvvpp.exe 90 PID 1012 wrote to memory of 4388 1012 pvvpp.exe 90 PID 4388 wrote to memory of 208 4388 frxrlfx.exe 91 PID 4388 wrote to memory of 208 4388 frxrlfx.exe 91 PID 4388 wrote to memory of 208 4388 frxrlfx.exe 91 PID 208 wrote to memory of 3008 208 fxfxfxl.exe 92 PID 208 wrote to memory of 3008 208 fxfxfxl.exe 92 PID 208 wrote to memory of 3008 208 fxfxfxl.exe 92 PID 3008 wrote to memory of 4800 3008 nhhhbt.exe 93 PID 3008 wrote to memory of 4800 3008 nhhhbt.exe 93 PID 3008 wrote to memory of 4800 3008 nhhhbt.exe 93 PID 4800 wrote to memory of 2556 4800 5ppjd.exe 94 PID 4800 wrote to memory of 2556 4800 5ppjd.exe 94 PID 4800 wrote to memory of 2556 4800 5ppjd.exe 94 PID 2556 wrote to memory of 2284 2556 pvppp.exe 95 PID 2556 wrote to memory of 2284 2556 pvppp.exe 95 PID 2556 wrote to memory of 2284 2556 pvppp.exe 95 PID 2284 wrote to memory of 1456 2284 tttnhb.exe 96 PID 2284 wrote to memory of 1456 2284 tttnhb.exe 96 PID 2284 wrote to memory of 1456 2284 tttnhb.exe 96 PID 1456 wrote to memory of 212 1456 5xrfxxl.exe 97 PID 1456 wrote to memory of 212 1456 5xrfxxl.exe 97 PID 1456 wrote to memory of 212 1456 5xrfxxl.exe 97 PID 212 wrote to memory of 812 212 3nnhhh.exe 98 PID 212 wrote to memory of 812 212 3nnhhh.exe 98 PID 212 wrote to memory of 812 212 3nnhhh.exe 98 PID 812 wrote to memory of 112 812 7xxlllf.exe 99 PID 812 wrote to memory of 112 812 7xxlllf.exe 99 PID 812 wrote to memory of 112 812 7xxlllf.exe 99 PID 112 wrote to memory of 1512 112 5nhbtt.exe 100 PID 112 wrote to memory of 1512 112 5nhbtt.exe 100 PID 112 wrote to memory of 1512 112 5nhbtt.exe 100 PID 1512 wrote to memory of 3700 1512 jdjdv.exe 101 PID 1512 wrote to memory of 3700 1512 jdjdv.exe 101 PID 1512 wrote to memory of 3700 1512 jdjdv.exe 101 PID 3700 wrote to memory of 872 3700 xxrlfxr.exe 102 PID 3700 wrote to memory of 872 3700 xxrlfxr.exe 102 PID 3700 wrote to memory of 872 3700 xxrlfxr.exe 102 PID 872 wrote to memory of 4784 872 3hhbtt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe"C:\Users\Admin\AppData\Local\Temp\1cdfb2b33ceb41e786ead2a34ebafba71c00679b6be1e7d35c96cada579c0917N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vpvpj.exec:\vpvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\rflllll.exec:\rflllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\htbtnh.exec:\htbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\7xlfxrl.exec:\7xlfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\ppjjd.exec:\ppjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vjpjj.exec:\vjpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\pvvpp.exec:\pvvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\frxrlfx.exec:\frxrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\fxfxfxl.exec:\fxfxfxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\nhhhbt.exec:\nhhhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\5ppjd.exec:\5ppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\pvppp.exec:\pvppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\tttnhb.exec:\tttnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\5xrfxxl.exec:\5xrfxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\3nnhhh.exec:\3nnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\7xxlllf.exec:\7xxlllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\5nhbtt.exec:\5nhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\jdjdv.exec:\jdjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\3hhbtt.exec:\3hhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\xfffrrr.exec:\xfffrrr.exe23⤵
- Executes dropped EXE
PID:4784 -
\??\c:\tthhht.exec:\tthhht.exe24⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nttttt.exec:\nttttt.exe25⤵
- Executes dropped EXE
PID:420 -
\??\c:\jpdvj.exec:\jpdvj.exe26⤵
- Executes dropped EXE
PID:4120 -
\??\c:\bntnhn.exec:\bntnhn.exe27⤵
- Executes dropped EXE
PID:5068 -
\??\c:\pddjv.exec:\pddjv.exe28⤵
- Executes dropped EXE
PID:936 -
\??\c:\frrlfxf.exec:\frrlfxf.exe29⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tnhhhb.exec:\tnhhhb.exe30⤵
- Executes dropped EXE
PID:4288 -
\??\c:\nhhttn.exec:\nhhttn.exe31⤵
- Executes dropped EXE
PID:3976 -
\??\c:\jpvpj.exec:\jpvpj.exe32⤵
- Executes dropped EXE
PID:3792 -
\??\c:\hhnhhn.exec:\hhnhhn.exe33⤵
- Executes dropped EXE
PID:548 -
\??\c:\xfxxrrx.exec:\xfxxrrx.exe34⤵
- Executes dropped EXE
PID:4048 -
\??\c:\hnbhbb.exec:\hnbhbb.exe35⤵
- Executes dropped EXE
PID:4272 -
\??\c:\ddpjv.exec:\ddpjv.exe36⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xxllrxr.exec:\xxllrxr.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nnnnnh.exec:\nnnnnh.exe38⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hnhthb.exec:\hnhthb.exe39⤵
- Executes dropped EXE
PID:3428 -
\??\c:\ddpjj.exec:\ddpjj.exe40⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rlrflfl.exec:\rlrflfl.exe41⤵
- Executes dropped EXE
PID:3516 -
\??\c:\9nttth.exec:\9nttth.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pjpjp.exec:\pjpjp.exe43⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rrxlflf.exec:\rrxlflf.exe44⤵
- Executes dropped EXE
PID:2456 -
\??\c:\frxrrll.exec:\frxrrll.exe45⤵
- Executes dropped EXE
PID:4452 -
\??\c:\1bhhnn.exec:\1bhhnn.exe46⤵
- Executes dropped EXE
PID:4460 -
\??\c:\vppdv.exec:\vppdv.exe47⤵
- Executes dropped EXE
PID:2084 -
\??\c:\flrfxrr.exec:\flrfxrr.exe48⤵
- Executes dropped EXE
PID:3732 -
\??\c:\nhhhhn.exec:\nhhhhn.exe49⤵
- Executes dropped EXE
PID:3968 -
\??\c:\jdjvp.exec:\jdjvp.exe50⤵
- Executes dropped EXE
PID:4732 -
\??\c:\lxrlfrr.exec:\lxrlfrr.exe51⤵
- Executes dropped EXE
PID:3996 -
\??\c:\tnntnb.exec:\tnntnb.exe52⤵
- Executes dropped EXE
PID:2408 -
\??\c:\9vdvp.exec:\9vdvp.exe53⤵
- Executes dropped EXE
PID:3180 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe54⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5hbtnn.exec:\5hbtnn.exe55⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pjvvd.exec:\pjvvd.exe56⤵
- Executes dropped EXE
PID:4980 -
\??\c:\vjpjd.exec:\vjpjd.exe57⤵
- Executes dropped EXE
PID:3344 -
\??\c:\rrfrxrl.exec:\rrfrxrl.exe58⤵
- Executes dropped EXE
PID:1116 -
\??\c:\vjdvj.exec:\vjdvj.exe59⤵
- Executes dropped EXE
PID:972 -
\??\c:\vpddp.exec:\vpddp.exe60⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nbtbbt.exec:\nbtbbt.exe61⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jdddd.exec:\jdddd.exe62⤵
- Executes dropped EXE
PID:4928 -
\??\c:\7lxflxf.exec:\7lxflxf.exe63⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rlllfff.exec:\rlllfff.exe64⤵
- Executes dropped EXE
PID:1836 -
\??\c:\nhbhnt.exec:\nhbhnt.exe65⤵
- Executes dropped EXE
PID:672 -
\??\c:\dvdvp.exec:\dvdvp.exe66⤵PID:3244
-
\??\c:\flfxlll.exec:\flfxlll.exe67⤵PID:3720
-
\??\c:\bhnhbb.exec:\bhnhbb.exe68⤵PID:5004
-
\??\c:\jdppv.exec:\jdppv.exe69⤵PID:4592
-
\??\c:\dddvp.exec:\dddvp.exe70⤵PID:4556
-
\??\c:\llllrrr.exec:\llllrrr.exe71⤵PID:2556
-
\??\c:\nhhtnt.exec:\nhhtnt.exe72⤵PID:4164
-
\??\c:\jpjjv.exec:\jpjjv.exe73⤵PID:1960
-
\??\c:\lxlxlxl.exec:\lxlxlxl.exe74⤵PID:3724
-
\??\c:\hbbbtt.exec:\hbbbtt.exe75⤵
- System Location Discovery: System Language Discovery
PID:3588 -
\??\c:\frxxrrl.exec:\frxxrrl.exe76⤵PID:1700
-
\??\c:\3tbttn.exec:\3tbttn.exe77⤵PID:1540
-
\??\c:\jvvpj.exec:\jvvpj.exe78⤵PID:4240
-
\??\c:\flrlfff.exec:\flrlfff.exe79⤵PID:112
-
\??\c:\nbtnnn.exec:\nbtnnn.exe80⤵PID:3360
-
\??\c:\pjvpp.exec:\pjvpp.exe81⤵PID:444
-
\??\c:\pjvpp.exec:\pjvpp.exe82⤵PID:676
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe83⤵PID:5008
-
\??\c:\hnhbbh.exec:\hnhbbh.exe84⤵PID:1424
-
\??\c:\vdppp.exec:\vdppp.exe85⤵PID:1476
-
\??\c:\rrxrrlf.exec:\rrxrrlf.exe86⤵PID:3048
-
\??\c:\nhttnn.exec:\nhttnn.exe87⤵PID:2488
-
\??\c:\pvdvp.exec:\pvdvp.exe88⤵PID:2792
-
\??\c:\pppjd.exec:\pppjd.exe89⤵PID:1628
-
\??\c:\7flfllr.exec:\7flfllr.exe90⤵PID:1976
-
\??\c:\nbhhbb.exec:\nbhhbb.exe91⤵PID:5068
-
\??\c:\pppjv.exec:\pppjv.exe92⤵PID:4400
-
\??\c:\lxfxrrf.exec:\lxfxrrf.exe93⤵PID:1892
-
\??\c:\nhttnn.exec:\nhttnn.exe94⤵PID:4372
-
\??\c:\nntbbh.exec:\nntbbh.exe95⤵PID:4540
-
\??\c:\dvvvp.exec:\dvvvp.exe96⤵PID:3220
-
\??\c:\lxfflfl.exec:\lxfflfl.exe97⤵PID:3572
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe98⤵PID:2568
-
\??\c:\nhnhhh.exec:\nhnhhh.exe99⤵PID:5028
-
\??\c:\jpdjv.exec:\jpdjv.exe100⤵PID:4128
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe101⤵PID:1220
-
\??\c:\nhhhbt.exec:\nhhhbt.exe102⤵PID:1748
-
\??\c:\bthbtt.exec:\bthbtt.exe103⤵PID:2080
-
\??\c:\jvddv.exec:\jvddv.exe104⤵PID:2680
-
\??\c:\rffxxxx.exec:\rffxxxx.exe105⤵PID:1392
-
\??\c:\tbthbt.exec:\tbthbt.exe106⤵PID:3428
-
\??\c:\jvdpj.exec:\jvdpj.exe107⤵PID:1496
-
\??\c:\fflfxrr.exec:\fflfxrr.exe108⤵PID:1208
-
\??\c:\3hhbtb.exec:\3hhbtb.exe109⤵PID:4568
-
\??\c:\3djvp.exec:\3djvp.exe110⤵PID:3448
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe111⤵PID:4564
-
\??\c:\thnnhh.exec:\thnnhh.exe112⤵PID:1052
-
\??\c:\nnnhhh.exec:\nnnhhh.exe113⤵PID:728
-
\??\c:\5dvdv.exec:\5dvdv.exe114⤵PID:3824
-
\??\c:\fxffxxx.exec:\fxffxxx.exe115⤵PID:4760
-
\??\c:\nbhtnb.exec:\nbhtnb.exe116⤵PID:868
-
\??\c:\jpvjp.exec:\jpvjp.exe117⤵PID:1844
-
\??\c:\1pjdv.exec:\1pjdv.exe118⤵PID:1608
-
\??\c:\rllfxxr.exec:\rllfxxr.exe119⤵PID:1848
-
\??\c:\hnbbtt.exec:\hnbbtt.exe120⤵
- System Location Discovery: System Language Discovery
PID:4484 -
\??\c:\9dvvp.exec:\9dvvp.exe121⤵PID:4356
-
\??\c:\rxrlrrl.exec:\rxrlrrl.exe122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-