Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 00:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe
-
Size
453KB
-
MD5
83b2872cd50c789c1c8ebd47bb626a60
-
SHA1
ec30260d69d7924c1ddcbd3d946f585b537558d7
-
SHA256
d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9
-
SHA512
4a338266ab5f668907725c7b1f04584bddb10905d1495ec3f7c2c902c7c92aa6c2f7f0a70ec9b5fd5e7f61e417c86e60bd644efc778a4073b919bc32d25c05be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3256-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1316-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-842-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-900-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-925-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-1070-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-1601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 60 xxlfxxf.exe 4600 9xxxfll.exe 4564 pdvvv.exe 4740 ntthbh.exe 3808 fflfxxl.exe 1296 frlllll.exe 3636 3nbbnt.exe 844 vdjjd.exe 4144 vddvd.exe 1032 flxrrlf.exe 4520 nhnnnt.exe 4724 llrlffx.exe 4972 hhttbb.exe 3772 lxflffx.exe 404 fxrrrrl.exe 4812 tbhhnn.exe 4992 5fxxfrx.exe 1872 vdpvv.exe 3304 bttttt.exe 636 thhhnt.exe 4976 llflxrf.exe 1380 dvvvv.exe 1500 7frlxrl.exe 4432 tbnhhh.exe 4604 7dpdp.exe 3488 jdjjd.exe 3148 dddpj.exe 3348 frrfrll.exe 4528 ppjdv.exe 1072 fxfxlfx.exe 3168 flfxrxx.exe 1316 rfxrrlf.exe 2596 ppjdd.exe 1044 bnbbnt.exe 3264 dvvpv.exe 4384 lrfxlxl.exe 3320 btnhhh.exe 4192 3vpjd.exe 1056 rxrrxfl.exe 2880 bttthb.exe 4072 rfxfrff.exe 4480 bhhbnb.exe 3188 vpjjv.exe 2784 lxffflr.exe 4948 bbbttb.exe 3052 9pppp.exe 3904 5fxxxff.exe 1192 nbbbbb.exe 4364 jpjvp.exe 1688 rrrrlll.exe 3256 hthhhn.exe 4284 jdvvp.exe 384 llffxxr.exe 516 ttnbtn.exe 392 ppjjj.exe 3220 lrffxxr.exe 2628 1hnhbb.exe 3808 jvpdd.exe 3580 lfffxrf.exe 1936 nnhbnn.exe 952 jdddv.exe 1180 1dpdp.exe 1976 ntnnnn.exe 2284 btnhbt.exe -
resource yara_rule behavioral2/memory/3256-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-729-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3256 wrote to memory of 60 3256 d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe 83 PID 3256 wrote to memory of 60 3256 d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe 83 PID 3256 wrote to memory of 60 3256 d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe 83 PID 60 wrote to memory of 4600 60 xxlfxxf.exe 84 PID 60 wrote to memory of 4600 60 xxlfxxf.exe 84 PID 60 wrote to memory of 4600 60 xxlfxxf.exe 84 PID 4600 wrote to memory of 4564 4600 9xxxfll.exe 85 PID 4600 wrote to memory of 4564 4600 9xxxfll.exe 85 PID 4600 wrote to memory of 4564 4600 9xxxfll.exe 85 PID 4564 wrote to memory of 4740 4564 pdvvv.exe 86 PID 4564 wrote to memory of 4740 4564 pdvvv.exe 86 PID 4564 wrote to memory of 4740 4564 pdvvv.exe 86 PID 4740 wrote to memory of 3808 4740 ntthbh.exe 87 PID 4740 wrote to memory of 3808 4740 ntthbh.exe 87 PID 4740 wrote to memory of 3808 4740 ntthbh.exe 87 PID 3808 wrote to memory of 1296 3808 fflfxxl.exe 88 PID 3808 wrote to memory of 1296 3808 fflfxxl.exe 88 PID 3808 wrote to memory of 1296 3808 fflfxxl.exe 88 PID 1296 wrote to memory of 3636 1296 frlllll.exe 89 PID 1296 wrote to memory of 3636 1296 frlllll.exe 89 PID 1296 wrote to memory of 3636 1296 frlllll.exe 89 PID 3636 wrote to memory of 844 3636 3nbbnt.exe 90 PID 3636 wrote to memory of 844 3636 3nbbnt.exe 90 PID 3636 wrote to memory of 844 3636 3nbbnt.exe 90 PID 844 wrote to memory of 4144 844 vdjjd.exe 91 PID 844 wrote to memory of 4144 844 vdjjd.exe 91 PID 844 wrote to memory of 4144 844 vdjjd.exe 91 PID 4144 wrote to memory of 1032 4144 vddvd.exe 92 PID 4144 wrote to memory of 1032 4144 vddvd.exe 92 PID 4144 wrote to memory of 1032 4144 vddvd.exe 92 PID 1032 wrote to memory of 4520 1032 flxrrlf.exe 93 PID 1032 wrote to memory of 4520 1032 flxrrlf.exe 93 PID 1032 wrote to memory of 4520 1032 flxrrlf.exe 93 PID 4520 wrote to memory of 4724 4520 nhnnnt.exe 94 PID 4520 wrote to memory of 4724 4520 nhnnnt.exe 94 PID 4520 wrote to memory of 4724 4520 nhnnnt.exe 94 PID 4724 wrote to memory of 4972 4724 llrlffx.exe 95 PID 4724 wrote to memory of 4972 4724 llrlffx.exe 95 PID 4724 wrote to memory of 4972 4724 llrlffx.exe 95 PID 4972 wrote to memory of 3772 4972 hhttbb.exe 96 PID 4972 wrote to memory of 3772 4972 hhttbb.exe 96 PID 4972 wrote to memory of 3772 4972 hhttbb.exe 96 PID 3772 wrote to memory of 404 3772 lxflffx.exe 97 PID 3772 wrote to memory of 404 3772 lxflffx.exe 97 PID 3772 wrote to memory of 404 3772 lxflffx.exe 97 PID 404 wrote to memory of 4812 404 fxrrrrl.exe 98 PID 404 wrote to memory of 4812 404 fxrrrrl.exe 98 PID 404 wrote to memory of 4812 404 fxrrrrl.exe 98 PID 4812 wrote to memory of 4992 4812 tbhhnn.exe 99 PID 4812 wrote to memory of 4992 4812 tbhhnn.exe 99 PID 4812 wrote to memory of 4992 4812 tbhhnn.exe 99 PID 4992 wrote to memory of 1872 4992 5fxxfrx.exe 100 PID 4992 wrote to memory of 1872 4992 5fxxfrx.exe 100 PID 4992 wrote to memory of 1872 4992 5fxxfrx.exe 100 PID 1872 wrote to memory of 3304 1872 vdpvv.exe 101 PID 1872 wrote to memory of 3304 1872 vdpvv.exe 101 PID 1872 wrote to memory of 3304 1872 vdpvv.exe 101 PID 3304 wrote to memory of 636 3304 bttttt.exe 102 PID 3304 wrote to memory of 636 3304 bttttt.exe 102 PID 3304 wrote to memory of 636 3304 bttttt.exe 102 PID 636 wrote to memory of 4976 636 thhhnt.exe 103 PID 636 wrote to memory of 4976 636 thhhnt.exe 103 PID 636 wrote to memory of 4976 636 thhhnt.exe 103 PID 4976 wrote to memory of 1380 4976 llflxrf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe"C:\Users\Admin\AppData\Local\Temp\d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\xxlfxxf.exec:\xxlfxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\9xxxfll.exec:\9xxxfll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\pdvvv.exec:\pdvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\ntthbh.exec:\ntthbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\fflfxxl.exec:\fflfxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\frlllll.exec:\frlllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\3nbbnt.exec:\3nbbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\vdjjd.exec:\vdjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\vddvd.exec:\vddvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\flxrrlf.exec:\flxrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\nhnnnt.exec:\nhnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\llrlffx.exec:\llrlffx.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\hhttbb.exec:\hhttbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\lxflffx.exec:\lxflffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\fxrrrrl.exec:\fxrrrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\tbhhnn.exec:\tbhhnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\5fxxfrx.exec:\5fxxfrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\vdpvv.exec:\vdpvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\bttttt.exec:\bttttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\thhhnt.exec:\thhhnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\llflxrf.exec:\llflxrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\dvvvv.exec:\dvvvv.exe23⤵
- Executes dropped EXE
PID:1380 -
\??\c:\7frlxrl.exec:\7frlxrl.exe24⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tbnhhh.exec:\tbnhhh.exe25⤵
- Executes dropped EXE
PID:4432 -
\??\c:\7dpdp.exec:\7dpdp.exe26⤵
- Executes dropped EXE
PID:4604 -
\??\c:\jdjjd.exec:\jdjjd.exe27⤵
- Executes dropped EXE
PID:3488 -
\??\c:\dddpj.exec:\dddpj.exe28⤵
- Executes dropped EXE
PID:3148 -
\??\c:\frrfrll.exec:\frrfrll.exe29⤵
- Executes dropped EXE
PID:3348 -
\??\c:\ppjdv.exec:\ppjdv.exe30⤵
- Executes dropped EXE
PID:4528 -
\??\c:\fxfxlfx.exec:\fxfxlfx.exe31⤵
- Executes dropped EXE
PID:1072 -
\??\c:\flfxrxx.exec:\flfxrxx.exe32⤵
- Executes dropped EXE
PID:3168 -
\??\c:\rfxrrlf.exec:\rfxrrlf.exe33⤵
- Executes dropped EXE
PID:1316 -
\??\c:\ppjdd.exec:\ppjdd.exe34⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bnbbnt.exec:\bnbbnt.exe35⤵
- Executes dropped EXE
PID:1044 -
\??\c:\dvvpv.exec:\dvvpv.exe36⤵
- Executes dropped EXE
PID:3264 -
\??\c:\lrfxlxl.exec:\lrfxlxl.exe37⤵
- Executes dropped EXE
PID:4384 -
\??\c:\btnhhh.exec:\btnhhh.exe38⤵
- Executes dropped EXE
PID:3320 -
\??\c:\3vpjd.exec:\3vpjd.exe39⤵
- Executes dropped EXE
PID:4192 -
\??\c:\rxrrxfl.exec:\rxrrxfl.exe40⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bttthb.exec:\bttthb.exe41⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rfxfrff.exec:\rfxfrff.exe42⤵
- Executes dropped EXE
PID:4072 -
\??\c:\bhhbnb.exec:\bhhbnb.exe43⤵
- Executes dropped EXE
PID:4480 -
\??\c:\vpjjv.exec:\vpjjv.exe44⤵
- Executes dropped EXE
PID:3188 -
\??\c:\lxffflr.exec:\lxffflr.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\bbbttb.exec:\bbbttb.exe46⤵
- Executes dropped EXE
PID:4948 -
\??\c:\9pppp.exec:\9pppp.exe47⤵
- Executes dropped EXE
PID:3052 -
\??\c:\5fxxxff.exec:\5fxxxff.exe48⤵
- Executes dropped EXE
PID:3904 -
\??\c:\nbbbbb.exec:\nbbbbb.exe49⤵
- Executes dropped EXE
PID:1192 -
\??\c:\jpjvp.exec:\jpjvp.exe50⤵
- Executes dropped EXE
PID:4364 -
\??\c:\rrrrlll.exec:\rrrrlll.exe51⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hthhhn.exec:\hthhhn.exe52⤵
- Executes dropped EXE
PID:3256 -
\??\c:\jdvvp.exec:\jdvvp.exe53⤵
- Executes dropped EXE
PID:4284 -
\??\c:\llffxxr.exec:\llffxxr.exe54⤵
- Executes dropped EXE
PID:384 -
\??\c:\ttnbtn.exec:\ttnbtn.exe55⤵
- Executes dropped EXE
PID:516 -
\??\c:\ppjjj.exec:\ppjjj.exe56⤵
- Executes dropped EXE
PID:392 -
\??\c:\lrffxxr.exec:\lrffxxr.exe57⤵
- Executes dropped EXE
PID:3220 -
\??\c:\1hnhbb.exec:\1hnhbb.exe58⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jvpdd.exec:\jvpdd.exe59⤵
- Executes dropped EXE
PID:3808 -
\??\c:\lfffxrf.exec:\lfffxrf.exe60⤵
- Executes dropped EXE
PID:3580 -
\??\c:\nnhbnn.exec:\nnhbnn.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jdddv.exec:\jdddv.exe62⤵
- Executes dropped EXE
PID:952 -
\??\c:\1dpdp.exec:\1dpdp.exe63⤵
- Executes dropped EXE
PID:1180 -
\??\c:\ntnnnn.exec:\ntnnnn.exe64⤵
- Executes dropped EXE
PID:1976 -
\??\c:\btnhbt.exec:\btnhbt.exe65⤵
- Executes dropped EXE
PID:2284 -
\??\c:\djjjd.exec:\djjjd.exe66⤵
- System Location Discovery: System Language Discovery
PID:2352 -
\??\c:\llrrrfr.exec:\llrrrfr.exe67⤵PID:4520
-
\??\c:\9thbtt.exec:\9thbtt.exe68⤵PID:1104
-
\??\c:\dpvpj.exec:\dpvpj.exe69⤵PID:3800
-
\??\c:\1xxxxxf.exec:\1xxxxxf.exe70⤵PID:2320
-
\??\c:\tnbbhn.exec:\tnbbhn.exe71⤵PID:2212
-
\??\c:\djpdj.exec:\djpdj.exe72⤵PID:5084
-
\??\c:\xrrfrrr.exec:\xrrfrrr.exe73⤵PID:4032
-
\??\c:\nbbtbt.exec:\nbbtbt.exe74⤵PID:2368
-
\??\c:\9xxllrr.exec:\9xxllrr.exe75⤵PID:4676
-
\??\c:\5ffffrf.exec:\5ffffrf.exe76⤵PID:2404
-
\??\c:\pjddd.exec:\pjddd.exe77⤵PID:212
-
\??\c:\vvvvv.exec:\vvvvv.exe78⤵PID:1784
-
\??\c:\flrllfr.exec:\flrllfr.exe79⤵PID:1588
-
\??\c:\jpppp.exec:\jpppp.exe80⤵PID:5104
-
\??\c:\frfffll.exec:\frfffll.exe81⤵PID:4692
-
\??\c:\ntthbb.exec:\ntthbb.exe82⤵PID:1092
-
\??\c:\vdddv.exec:\vdddv.exe83⤵PID:436
-
\??\c:\1xfrrxr.exec:\1xfrrxr.exe84⤵PID:3584
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe85⤵PID:2316
-
\??\c:\tbbtbb.exec:\tbbtbb.exe86⤵PID:4680
-
\??\c:\dvdvp.exec:\dvdvp.exe87⤵PID:672
-
\??\c:\rxfflfx.exec:\rxfflfx.exe88⤵PID:5072
-
\??\c:\9nnnnn.exec:\9nnnnn.exe89⤵PID:1964
-
\??\c:\7jvvj.exec:\7jvvj.exe90⤵PID:528
-
\??\c:\3rlfflx.exec:\3rlfflx.exe91⤵PID:440
-
\??\c:\frxxfxx.exec:\frxxfxx.exe92⤵PID:4824
-
\??\c:\5bbtnh.exec:\5bbtnh.exe93⤵PID:1132
-
\??\c:\jjpjj.exec:\jjpjj.exe94⤵PID:5028
-
\??\c:\rxffxfx.exec:\rxffxfx.exe95⤵PID:4292
-
\??\c:\hnnnhn.exec:\hnnnhn.exe96⤵PID:1316
-
\??\c:\vdjjj.exec:\vdjjj.exe97⤵PID:2596
-
\??\c:\fllxlfx.exec:\fllxlfx.exe98⤵PID:4128
-
\??\c:\ttnbnt.exec:\ttnbnt.exe99⤵PID:1788
-
\??\c:\vdpdp.exec:\vdpdp.exe100⤵PID:1620
-
\??\c:\xlxflrx.exec:\xlxflrx.exe101⤵PID:2168
-
\??\c:\xrllllf.exec:\xrllllf.exe102⤵PID:1800
-
\??\c:\hhnhhn.exec:\hhnhhn.exe103⤵PID:4808
-
\??\c:\pjppj.exec:\pjppj.exe104⤵PID:3008
-
\??\c:\xrxxxll.exec:\xrxxxll.exe105⤵PID:4800
-
\??\c:\nhnnnt.exec:\nhnnnt.exe106⤵PID:2964
-
\??\c:\jpppp.exec:\jpppp.exe107⤵PID:4404
-
\??\c:\vpjdd.exec:\vpjdd.exe108⤵PID:4512
-
\??\c:\1thtnt.exec:\1thtnt.exe109⤵PID:1892
-
\??\c:\pddvd.exec:\pddvd.exe110⤵PID:768
-
\??\c:\dpppp.exec:\dpppp.exe111⤵PID:2992
-
\??\c:\rlrfllf.exec:\rlrfllf.exe112⤵PID:4596
-
\??\c:\bhnntb.exec:\bhnntb.exe113⤵PID:1068
-
\??\c:\ppvdp.exec:\ppvdp.exe114⤵PID:1688
-
\??\c:\5lrrflf.exec:\5lrrflf.exe115⤵PID:1776
-
\??\c:\tbnntb.exec:\tbnntb.exe116⤵PID:3248
-
\??\c:\vvppp.exec:\vvppp.exe117⤵PID:384
-
\??\c:\xffflrr.exec:\xffflrr.exe118⤵PID:516
-
\??\c:\hnbbnt.exec:\hnbbnt.exe119⤵PID:4004
-
\??\c:\vdvdp.exec:\vdvdp.exe120⤵PID:3336
-
\??\c:\fflrrrx.exec:\fflrrrx.exe121⤵PID:1264
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe122⤵PID:4960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-