Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 02:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acb534fd806350c87d46ada2c89fff35e1736bc22ab9ad433ffbe5d8c98c0c77N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
acb534fd806350c87d46ada2c89fff35e1736bc22ab9ad433ffbe5d8c98c0c77N.exe
-
Size
453KB
-
MD5
fd20d2a5d88ae49b6c342fd44b5f9a10
-
SHA1
092baca0d46995000a57202cb6219e4d86953401
-
SHA256
acb534fd806350c87d46ada2c89fff35e1736bc22ab9ad433ffbe5d8c98c0c77
-
SHA512
fba5e43f6c16d3fe22dc984c76fdb307644f174db8859f71c32834a6c232f27ded733b47e038808295f32d42624ab2e781a57db2382fc9a65dfa93c83b2d76bc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbefN:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/5076-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-1286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-1593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2200 ppppp.exe 3296 9pvpp.exe 2284 lrxxlfl.exe 4864 bnhtbt.exe 3640 tnbbtb.exe 444 bhnntb.exe 3992 xxllxff.exe 2752 5nhbhb.exe 4736 rfllrrx.exe 3388 hhbnth.exe 1468 rxfxxxx.exe 1152 bbnnhh.exe 4976 7xffllr.exe 536 jvdjj.exe 2072 llxfxfr.exe 4848 tnnntt.exe 376 xrlfxxr.exe 5000 vjddd.exe 3036 jjjdd.exe 2140 9jjdd.exe 4268 9jjjj.exe 4264 flrrxlr.exe 1216 5bhbbn.exe 1664 frxxrrr.exe 856 hhtbhn.exe 2196 lfrlxxf.exe 1616 tttbnn.exe 2440 rlxxxfl.exe 2276 vjjvp.exe 1020 llfflll.exe 2632 jdpvj.exe 2724 btttnn.exe 2740 ffffllx.exe 4812 vddjp.exe 2676 lxfffll.exe 1716 pjppp.exe 4660 nhnnnt.exe 1900 xflllrf.exe 4252 fxllfll.exe 4424 nntttt.exe 3208 djpjj.exe 1188 ffxrlff.exe 3632 thhbhb.exe 5068 3pvpj.exe 4440 xrlxfxl.exe 3656 dvddp.exe 3924 vpddv.exe 3928 lxfxrrr.exe 744 bthhbh.exe 4396 hntntn.exe 5064 ddvdv.exe 4656 9jddv.exe 1692 xlllxxf.exe 2212 nnthbb.exe 2284 9vjdd.exe 2252 dpppj.exe 3348 xfffllx.exe 2816 btbtnn.exe 4368 7dppp.exe 4948 pppvv.exe 4748 xfxlrrx.exe 4460 bhbtnt.exe 2812 7thnnt.exe 3248 dpddd.exe -
resource yara_rule behavioral2/memory/5076-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-876-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5076 wrote to memory of 2200 5076 acb534fd806350c87d46ada2c89fff35e1736bc22ab9ad433ffbe5d8c98c0c77N.exe 82 PID 5076 wrote to memory of 2200 5076 acb534fd806350c87d46ada2c89fff35e1736bc22ab9ad433ffbe5d8c98c0c77N.exe 82 PID 5076 wrote to memory of 2200 5076 acb534fd806350c87d46ada2c89fff35e1736bc22ab9ad433ffbe5d8c98c0c77N.exe 82 PID 2200 wrote to memory of 3296 2200 ppppp.exe 83 PID 2200 wrote to memory of 3296 2200 ppppp.exe 83 PID 2200 wrote to memory of 3296 2200 ppppp.exe 83 PID 3296 wrote to memory of 2284 3296 9pvpp.exe 84 PID 3296 wrote to memory of 2284 3296 9pvpp.exe 84 PID 3296 wrote to memory of 2284 3296 9pvpp.exe 84 PID 2284 wrote to memory of 4864 2284 lrxxlfl.exe 85 PID 2284 wrote to memory of 4864 2284 lrxxlfl.exe 85 PID 2284 wrote to memory of 4864 2284 lrxxlfl.exe 85 PID 4864 wrote to memory of 3640 4864 bnhtbt.exe 86 PID 4864 wrote to memory of 3640 4864 bnhtbt.exe 86 PID 4864 wrote to memory of 3640 4864 bnhtbt.exe 86 PID 3640 wrote to memory of 444 3640 tnbbtb.exe 87 PID 3640 wrote to memory of 444 3640 tnbbtb.exe 87 PID 3640 wrote to memory of 444 3640 tnbbtb.exe 87 PID 444 wrote to memory of 3992 444 bhnntb.exe 88 PID 444 wrote to memory of 3992 444 bhnntb.exe 88 PID 444 wrote to memory of 3992 444 bhnntb.exe 88 PID 3992 wrote to memory of 2752 3992 xxllxff.exe 89 PID 3992 wrote to memory of 2752 3992 xxllxff.exe 89 PID 3992 wrote to memory of 2752 3992 xxllxff.exe 89 PID 2752 wrote to memory of 4736 2752 5nhbhb.exe 90 PID 2752 wrote to memory of 4736 2752 5nhbhb.exe 90 PID 2752 wrote to memory of 4736 2752 5nhbhb.exe 90 PID 4736 wrote to memory of 3388 4736 rfllrrx.exe 91 PID 4736 wrote to memory of 3388 4736 rfllrrx.exe 91 PID 4736 wrote to memory of 3388 4736 rfllrrx.exe 91 PID 3388 wrote to memory of 1468 3388 hhbnth.exe 92 PID 3388 wrote to memory of 1468 3388 hhbnth.exe 92 PID 3388 wrote to memory of 1468 3388 hhbnth.exe 92 PID 1468 wrote to memory of 1152 1468 rxfxxxx.exe 93 PID 1468 wrote to memory of 1152 1468 rxfxxxx.exe 93 PID 1468 wrote to memory of 1152 1468 rxfxxxx.exe 93 PID 1152 wrote to memory of 4976 1152 bbnnhh.exe 94 PID 1152 wrote to memory of 4976 1152 bbnnhh.exe 94 PID 1152 wrote to memory of 4976 1152 bbnnhh.exe 94 PID 4976 wrote to memory of 536 4976 7xffllr.exe 95 PID 4976 wrote to memory of 536 4976 7xffllr.exe 95 PID 4976 wrote to memory of 536 4976 7xffllr.exe 95 PID 536 wrote to memory of 2072 536 jvdjj.exe 96 PID 536 wrote to memory of 2072 536 jvdjj.exe 96 PID 536 wrote to memory of 2072 536 jvdjj.exe 96 PID 2072 wrote to memory of 4848 2072 llxfxfr.exe 97 PID 2072 wrote to memory of 4848 2072 llxfxfr.exe 97 PID 2072 wrote to memory of 4848 2072 llxfxfr.exe 97 PID 4848 wrote to memory of 376 4848 tnnntt.exe 98 PID 4848 wrote to memory of 376 4848 tnnntt.exe 98 PID 4848 wrote to memory of 376 4848 tnnntt.exe 98 PID 376 wrote to memory of 5000 376 xrlfxxr.exe 99 PID 376 wrote to memory of 5000 376 xrlfxxr.exe 99 PID 376 wrote to memory of 5000 376 xrlfxxr.exe 99 PID 5000 wrote to memory of 3036 5000 vjddd.exe 100 PID 5000 wrote to memory of 3036 5000 vjddd.exe 100 PID 5000 wrote to memory of 3036 5000 vjddd.exe 100 PID 3036 wrote to memory of 2140 3036 jjjdd.exe 101 PID 3036 wrote to memory of 2140 3036 jjjdd.exe 101 PID 3036 wrote to memory of 2140 3036 jjjdd.exe 101 PID 2140 wrote to memory of 4268 2140 9jjdd.exe 102 PID 2140 wrote to memory of 4268 2140 9jjdd.exe 102 PID 2140 wrote to memory of 4268 2140 9jjdd.exe 102 PID 4268 wrote to memory of 4264 4268 9jjjj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\acb534fd806350c87d46ada2c89fff35e1736bc22ab9ad433ffbe5d8c98c0c77N.exe"C:\Users\Admin\AppData\Local\Temp\acb534fd806350c87d46ada2c89fff35e1736bc22ab9ad433ffbe5d8c98c0c77N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\ppppp.exec:\ppppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\9pvpp.exec:\9pvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\lrxxlfl.exec:\lrxxlfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\bnhtbt.exec:\bnhtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\tnbbtb.exec:\tnbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\bhnntb.exec:\bhnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\xxllxff.exec:\xxllxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\5nhbhb.exec:\5nhbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\rfllrrx.exec:\rfllrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\hhbnth.exec:\hhbnth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\bbnnhh.exec:\bbnnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\7xffllr.exec:\7xffllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\jvdjj.exec:\jvdjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\llxfxfr.exec:\llxfxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\tnnntt.exec:\tnnntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\vjddd.exec:\vjddd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\jjjdd.exec:\jjjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\9jjdd.exec:\9jjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\9jjjj.exec:\9jjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\flrrxlr.exec:\flrrxlr.exe23⤵
- Executes dropped EXE
PID:4264 -
\??\c:\5bhbbn.exec:\5bhbbn.exe24⤵
- Executes dropped EXE
PID:1216 -
\??\c:\frxxrrr.exec:\frxxrrr.exe25⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hhtbhn.exec:\hhtbhn.exe26⤵
- Executes dropped EXE
PID:856 -
\??\c:\lfrlxxf.exec:\lfrlxxf.exe27⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tttbnn.exec:\tttbnn.exe28⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rlxxxfl.exec:\rlxxxfl.exe29⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vjjvp.exec:\vjjvp.exe30⤵
- Executes dropped EXE
PID:2276 -
\??\c:\llfflll.exec:\llfflll.exe31⤵
- Executes dropped EXE
PID:1020 -
\??\c:\jdpvj.exec:\jdpvj.exe32⤵
- Executes dropped EXE
PID:2632 -
\??\c:\btttnn.exec:\btttnn.exe33⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ffffllx.exec:\ffffllx.exe34⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vddjp.exec:\vddjp.exe35⤵
- Executes dropped EXE
PID:4812 -
\??\c:\lxfffll.exec:\lxfffll.exe36⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pjppp.exec:\pjppp.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1716 -
\??\c:\nhnnnt.exec:\nhnnnt.exe38⤵
- Executes dropped EXE
PID:4660 -
\??\c:\xflllrf.exec:\xflllrf.exe39⤵
- Executes dropped EXE
PID:1900 -
\??\c:\fxllfll.exec:\fxllfll.exe40⤵
- Executes dropped EXE
PID:4252 -
\??\c:\nntttt.exec:\nntttt.exe41⤵
- Executes dropped EXE
PID:4424 -
\??\c:\djpjj.exec:\djpjj.exe42⤵
- Executes dropped EXE
PID:3208 -
\??\c:\ffxrlff.exec:\ffxrlff.exe43⤵
- Executes dropped EXE
PID:1188 -
\??\c:\thhbhb.exec:\thhbhb.exe44⤵
- Executes dropped EXE
PID:3632 -
\??\c:\3pvpj.exec:\3pvpj.exe45⤵
- Executes dropped EXE
PID:5068 -
\??\c:\xrlxfxl.exec:\xrlxfxl.exe46⤵
- Executes dropped EXE
PID:4440 -
\??\c:\dvddp.exec:\dvddp.exe47⤵
- Executes dropped EXE
PID:3656 -
\??\c:\vpddv.exec:\vpddv.exe48⤵
- Executes dropped EXE
PID:3924 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe49⤵
- Executes dropped EXE
PID:3928 -
\??\c:\bthhbh.exec:\bthhbh.exe50⤵
- Executes dropped EXE
PID:744 -
\??\c:\hntntn.exec:\hntntn.exe51⤵
- Executes dropped EXE
PID:4396 -
\??\c:\ddvdv.exec:\ddvdv.exe52⤵
- Executes dropped EXE
PID:5064 -
\??\c:\9jddv.exec:\9jddv.exe53⤵
- Executes dropped EXE
PID:4656 -
\??\c:\xlllxxf.exec:\xlllxxf.exe54⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nnthbb.exec:\nnthbb.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\9vjdd.exec:\9vjdd.exe56⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dpppj.exec:\dpppj.exe57⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xfffllx.exec:\xfffllx.exe58⤵
- Executes dropped EXE
PID:3348 -
\??\c:\btbtnn.exec:\btbtnn.exe59⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7dppp.exec:\7dppp.exe60⤵
- Executes dropped EXE
PID:4368 -
\??\c:\pppvv.exec:\pppvv.exe61⤵
- Executes dropped EXE
PID:4948 -
\??\c:\xfxlrrx.exec:\xfxlrrx.exe62⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bhbtnt.exec:\bhbtnt.exe63⤵
- Executes dropped EXE
PID:4460 -
\??\c:\7thnnt.exec:\7thnnt.exe64⤵
- Executes dropped EXE
PID:2812 -
\??\c:\dpddd.exec:\dpddd.exe65⤵
- Executes dropped EXE
PID:3248 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe66⤵PID:4736
-
\??\c:\vdvpv.exec:\vdvpv.exe67⤵PID:3040
-
\??\c:\dpdvj.exec:\dpdvj.exe68⤵PID:2912
-
\??\c:\hnbnnb.exec:\hnbnnb.exe69⤵PID:1468
-
\??\c:\9bhtnn.exec:\9bhtnn.exe70⤵PID:1556
-
\??\c:\9vdvp.exec:\9vdvp.exe71⤵
- System Location Discovery: System Language Discovery
PID:1196 -
\??\c:\7fflfxl.exec:\7fflfxl.exe72⤵PID:4112
-
\??\c:\nnntnh.exec:\nnntnh.exe73⤵PID:616
-
\??\c:\vpjdd.exec:\vpjdd.exe74⤵PID:2056
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe75⤵PID:2604
-
\??\c:\rxxrlff.exec:\rxxrlff.exe76⤵PID:4848
-
\??\c:\nntnhh.exec:\nntnhh.exe77⤵PID:2096
-
\??\c:\vdpjj.exec:\vdpjj.exe78⤵PID:2908
-
\??\c:\rxllxrx.exec:\rxllxrx.exe79⤵PID:2404
-
\??\c:\thnnhb.exec:\thnnhb.exe80⤵PID:4988
-
\??\c:\vjvpj.exec:\vjvpj.exe81⤵PID:620
-
\??\c:\9rfffll.exec:\9rfffll.exe82⤵PID:1732
-
\??\c:\httnht.exec:\httnht.exe83⤵PID:4920
-
\??\c:\jdvpj.exec:\jdvpj.exe84⤵PID:4264
-
\??\c:\lxrfrfx.exec:\lxrfrfx.exe85⤵PID:1216
-
\??\c:\rlxrlll.exec:\rlxrlll.exe86⤵PID:728
-
\??\c:\nntnhh.exec:\nntnhh.exe87⤵PID:988
-
\??\c:\ddpdp.exec:\ddpdp.exe88⤵PID:8
-
\??\c:\xfxfrfr.exec:\xfxfrfr.exe89⤵PID:3300
-
\??\c:\3ntbnt.exec:\3ntbnt.exe90⤵PID:4020
-
\??\c:\vpdpj.exec:\vpdpj.exe91⤵PID:1616
-
\??\c:\dvjdp.exec:\dvjdp.exe92⤵
- System Location Discovery: System Language Discovery
PID:2080 -
\??\c:\xxflxfl.exec:\xxflxfl.exe93⤵PID:4056
-
\??\c:\nhthbn.exec:\nhthbn.exe94⤵PID:3432
-
\??\c:\jdpdp.exec:\jdpdp.exe95⤵PID:1020
-
\??\c:\xlrllfx.exec:\xlrllfx.exe96⤵PID:1428
-
\??\c:\htnbhn.exec:\htnbhn.exe97⤵PID:1640
-
\??\c:\vdpdp.exec:\vdpdp.exe98⤵PID:2672
-
\??\c:\lflxxlf.exec:\lflxxlf.exe99⤵PID:2740
-
\??\c:\ntnnbt.exec:\ntnnbt.exe100⤵PID:4704
-
\??\c:\hhhbth.exec:\hhhbth.exe101⤵PID:1988
-
\??\c:\jpjvd.exec:\jpjvd.exe102⤵PID:4144
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe103⤵PID:4940
-
\??\c:\hhnbbb.exec:\hhnbbb.exe104⤵PID:1688
-
\??\c:\9vjpv.exec:\9vjpv.exe105⤵PID:4252
-
\??\c:\5jpdj.exec:\5jpdj.exe106⤵PID:3472
-
\??\c:\hhbttt.exec:\hhbttt.exe107⤵PID:1324
-
\??\c:\pjppj.exec:\pjppj.exe108⤵PID:4504
-
\??\c:\3fllrxl.exec:\3fllrxl.exe109⤵PID:3308
-
\??\c:\ntbtnt.exec:\ntbtnt.exe110⤵PID:1148
-
\??\c:\djjvv.exec:\djjvv.exe111⤵PID:2188
-
\??\c:\fxffffr.exec:\fxffffr.exe112⤵PID:684
-
\??\c:\rxxrffr.exec:\rxxrffr.exe113⤵PID:3260
-
\??\c:\5bbhhb.exec:\5bbhhb.exe114⤵PID:5008
-
\??\c:\jpvvv.exec:\jpvvv.exe115⤵PID:5088
-
\??\c:\fxrrxff.exec:\fxrrxff.exe116⤵PID:3652
-
\??\c:\hnthht.exec:\hnthht.exe117⤵PID:2172
-
\??\c:\pjvvv.exec:\pjvvv.exe118⤵PID:2200
-
\??\c:\xfxlxlf.exec:\xfxlxlf.exe119⤵PID:4480
-
\??\c:\thbttt.exec:\thbttt.exe120⤵PID:3676
-
\??\c:\djdpp.exec:\djdpp.exe121⤵PID:356
-
\??\c:\xrlffll.exec:\xrlffll.exe122⤵PID:2252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-