Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 02:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d737bde504aabef9e1b390f7fb93dbf050d46400de1ff33893e532b5c3311374N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d737bde504aabef9e1b390f7fb93dbf050d46400de1ff33893e532b5c3311374N.exe
-
Size
454KB
-
MD5
6da57749ed15379431d3181d5d98c320
-
SHA1
b366c59e634b200e10c0215ab5b862c36640a21c
-
SHA256
d737bde504aabef9e1b390f7fb93dbf050d46400de1ff33893e532b5c3311374
-
SHA512
68e8923635d0109ec29dbeacd3033dbc8a14d4623e4e4cc806df3421f4a9b6f79bea515e4c1569cccf22819ee3348760dfb6e2805622d1ba092255c03605f7cb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1196-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-1082-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-1189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-1259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-1389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2044 lfxrxxf.exe 1372 thhhhn.exe 4780 hnnhhh.exe 1868 pvdjp.exe 3864 rrxxlrx.exe 1992 7hnhhh.exe 1444 dpvpv.exe 1380 djpvv.exe 3712 ffflxlr.exe 4600 thbhbh.exe 2792 lfxxrll.exe 2952 btttbb.exe 4420 9jjdv.exe 4952 9tnnnb.exe 3992 xfrrllf.exe 5076 tthhhh.exe 1864 vvppv.exe 4948 lrrrrrr.exe 4324 xrxxxfl.exe 1704 jddjv.exe 3164 9bbttt.exe 5072 5lrrlrr.exe 4628 jvddd.exe 4356 nnhbbb.exe 1996 frfrlxx.exe 2336 hhhbbb.exe 64 7djjj.exe 4580 vvddd.exe 2724 xrlxxlf.exe 3492 djjvj.exe 808 thbnnn.exe 4240 hhnhnt.exe 3996 rrrlfll.exe 3772 5hbhhh.exe 212 xrxrrrr.exe 1840 xxffffl.exe 3640 hhtthn.exe 5080 7xffffl.exe 2240 tnthbb.exe 4424 jpddd.exe 3524 rxxrrrl.exe 4328 tnnnhn.exe 3728 bbhnhn.exe 3116 jvjjj.exe 3816 9xlffxx.exe 4028 bnbbbb.exe 3756 vdpjj.exe 3200 flxlxrl.exe 1060 1hnnnt.exe 2420 dvjjj.exe 3924 3dppj.exe 4732 bbnntt.exe 1952 3vjdd.exe 3272 ffrxllx.exe 2616 bhnnhh.exe 2264 fxflfxr.exe 3868 tthnnb.exe 4132 1pjjj.exe 2332 xxfllrr.exe 724 1rfffll.exe 5056 1httnt.exe 2384 vvjdp.exe 3676 lxlxlfr.exe 2596 3dddv.exe -
resource yara_rule behavioral2/memory/1196-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-834-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 2044 1196 d737bde504aabef9e1b390f7fb93dbf050d46400de1ff33893e532b5c3311374N.exe 83 PID 1196 wrote to memory of 2044 1196 d737bde504aabef9e1b390f7fb93dbf050d46400de1ff33893e532b5c3311374N.exe 83 PID 1196 wrote to memory of 2044 1196 d737bde504aabef9e1b390f7fb93dbf050d46400de1ff33893e532b5c3311374N.exe 83 PID 2044 wrote to memory of 1372 2044 lfxrxxf.exe 84 PID 2044 wrote to memory of 1372 2044 lfxrxxf.exe 84 PID 2044 wrote to memory of 1372 2044 lfxrxxf.exe 84 PID 1372 wrote to memory of 4780 1372 thhhhn.exe 85 PID 1372 wrote to memory of 4780 1372 thhhhn.exe 85 PID 1372 wrote to memory of 4780 1372 thhhhn.exe 85 PID 4780 wrote to memory of 1868 4780 hnnhhh.exe 86 PID 4780 wrote to memory of 1868 4780 hnnhhh.exe 86 PID 4780 wrote to memory of 1868 4780 hnnhhh.exe 86 PID 1868 wrote to memory of 3864 1868 pvdjp.exe 87 PID 1868 wrote to memory of 3864 1868 pvdjp.exe 87 PID 1868 wrote to memory of 3864 1868 pvdjp.exe 87 PID 3864 wrote to memory of 1992 3864 rrxxlrx.exe 88 PID 3864 wrote to memory of 1992 3864 rrxxlrx.exe 88 PID 3864 wrote to memory of 1992 3864 rrxxlrx.exe 88 PID 1992 wrote to memory of 1444 1992 7hnhhh.exe 89 PID 1992 wrote to memory of 1444 1992 7hnhhh.exe 89 PID 1992 wrote to memory of 1444 1992 7hnhhh.exe 89 PID 1444 wrote to memory of 1380 1444 dpvpv.exe 90 PID 1444 wrote to memory of 1380 1444 dpvpv.exe 90 PID 1444 wrote to memory of 1380 1444 dpvpv.exe 90 PID 1380 wrote to memory of 3712 1380 djpvv.exe 91 PID 1380 wrote to memory of 3712 1380 djpvv.exe 91 PID 1380 wrote to memory of 3712 1380 djpvv.exe 91 PID 3712 wrote to memory of 4600 3712 ffflxlr.exe 92 PID 3712 wrote to memory of 4600 3712 ffflxlr.exe 92 PID 3712 wrote to memory of 4600 3712 ffflxlr.exe 92 PID 4600 wrote to memory of 2792 4600 thbhbh.exe 93 PID 4600 wrote to memory of 2792 4600 thbhbh.exe 93 PID 4600 wrote to memory of 2792 4600 thbhbh.exe 93 PID 2792 wrote to memory of 2952 2792 lfxxrll.exe 94 PID 2792 wrote to memory of 2952 2792 lfxxrll.exe 94 PID 2792 wrote to memory of 2952 2792 lfxxrll.exe 94 PID 2952 wrote to memory of 4420 2952 btttbb.exe 95 PID 2952 wrote to memory of 4420 2952 btttbb.exe 95 PID 2952 wrote to memory of 4420 2952 btttbb.exe 95 PID 4420 wrote to memory of 4952 4420 9jjdv.exe 96 PID 4420 wrote to memory of 4952 4420 9jjdv.exe 96 PID 4420 wrote to memory of 4952 4420 9jjdv.exe 96 PID 4952 wrote to memory of 3992 4952 9tnnnb.exe 97 PID 4952 wrote to memory of 3992 4952 9tnnnb.exe 97 PID 4952 wrote to memory of 3992 4952 9tnnnb.exe 97 PID 3992 wrote to memory of 5076 3992 xfrrllf.exe 98 PID 3992 wrote to memory of 5076 3992 xfrrllf.exe 98 PID 3992 wrote to memory of 5076 3992 xfrrllf.exe 98 PID 5076 wrote to memory of 1864 5076 tthhhh.exe 99 PID 5076 wrote to memory of 1864 5076 tthhhh.exe 99 PID 5076 wrote to memory of 1864 5076 tthhhh.exe 99 PID 1864 wrote to memory of 4948 1864 vvppv.exe 100 PID 1864 wrote to memory of 4948 1864 vvppv.exe 100 PID 1864 wrote to memory of 4948 1864 vvppv.exe 100 PID 4948 wrote to memory of 4324 4948 lrrrrrr.exe 101 PID 4948 wrote to memory of 4324 4948 lrrrrrr.exe 101 PID 4948 wrote to memory of 4324 4948 lrrrrrr.exe 101 PID 4324 wrote to memory of 1704 4324 xrxxxfl.exe 102 PID 4324 wrote to memory of 1704 4324 xrxxxfl.exe 102 PID 4324 wrote to memory of 1704 4324 xrxxxfl.exe 102 PID 1704 wrote to memory of 3164 1704 jddjv.exe 103 PID 1704 wrote to memory of 3164 1704 jddjv.exe 103 PID 1704 wrote to memory of 3164 1704 jddjv.exe 103 PID 3164 wrote to memory of 5072 3164 9bbttt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d737bde504aabef9e1b390f7fb93dbf050d46400de1ff33893e532b5c3311374N.exe"C:\Users\Admin\AppData\Local\Temp\d737bde504aabef9e1b390f7fb93dbf050d46400de1ff33893e532b5c3311374N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\thhhhn.exec:\thhhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\hnnhhh.exec:\hnnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\pvdjp.exec:\pvdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\rrxxlrx.exec:\rrxxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\7hnhhh.exec:\7hnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\dpvpv.exec:\dpvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\djpvv.exec:\djpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\ffflxlr.exec:\ffflxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\thbhbh.exec:\thbhbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\lfxxrll.exec:\lfxxrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\btttbb.exec:\btttbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\9jjdv.exec:\9jjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\9tnnnb.exec:\9tnnnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\xfrrllf.exec:\xfrrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\tthhhh.exec:\tthhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\vvppv.exec:\vvppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\jddjv.exec:\jddjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\9bbttt.exec:\9bbttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\5lrrlrr.exec:\5lrrlrr.exe23⤵
- Executes dropped EXE
PID:5072 -
\??\c:\jvddd.exec:\jvddd.exe24⤵
- Executes dropped EXE
PID:4628 -
\??\c:\nnhbbb.exec:\nnhbbb.exe25⤵
- Executes dropped EXE
PID:4356 -
\??\c:\frfrlxx.exec:\frfrlxx.exe26⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hhhbbb.exec:\hhhbbb.exe27⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7djjj.exec:\7djjj.exe28⤵
- Executes dropped EXE
PID:64 -
\??\c:\vvddd.exec:\vvddd.exe29⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xrlxxlf.exec:\xrlxxlf.exe30⤵
- Executes dropped EXE
PID:2724 -
\??\c:\djjvj.exec:\djjvj.exe31⤵
- Executes dropped EXE
PID:3492 -
\??\c:\thbnnn.exec:\thbnnn.exe32⤵
- Executes dropped EXE
PID:808 -
\??\c:\hhnhnt.exec:\hhnhnt.exe33⤵
- Executes dropped EXE
PID:4240 -
\??\c:\rrrlfll.exec:\rrrlfll.exe34⤵
- Executes dropped EXE
PID:3996 -
\??\c:\5hbhhh.exec:\5hbhhh.exe35⤵
- Executes dropped EXE
PID:3772 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe36⤵
- Executes dropped EXE
PID:212 -
\??\c:\xxffffl.exec:\xxffffl.exe37⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hhtthn.exec:\hhtthn.exe38⤵
- Executes dropped EXE
PID:3640 -
\??\c:\7xffffl.exec:\7xffffl.exe39⤵
- Executes dropped EXE
PID:5080 -
\??\c:\tnthbb.exec:\tnthbb.exe40⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jpddd.exec:\jpddd.exe41⤵
- Executes dropped EXE
PID:4424 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe42⤵
- Executes dropped EXE
PID:3524 -
\??\c:\tnnnhn.exec:\tnnnhn.exe43⤵
- Executes dropped EXE
PID:4328 -
\??\c:\bbhnhn.exec:\bbhnhn.exe44⤵
- Executes dropped EXE
PID:3728 -
\??\c:\jvjjj.exec:\jvjjj.exe45⤵
- Executes dropped EXE
PID:3116 -
\??\c:\9xlffxx.exec:\9xlffxx.exe46⤵
- Executes dropped EXE
PID:3816 -
\??\c:\bnbbbb.exec:\bnbbbb.exe47⤵
- Executes dropped EXE
PID:4028 -
\??\c:\vdpjj.exec:\vdpjj.exe48⤵
- Executes dropped EXE
PID:3756 -
\??\c:\flxlxrl.exec:\flxlxrl.exe49⤵
- Executes dropped EXE
PID:3200 -
\??\c:\1hnnnt.exec:\1hnnnt.exe50⤵
- Executes dropped EXE
PID:1060 -
\??\c:\dvjjj.exec:\dvjjj.exe51⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3dppj.exec:\3dppj.exe52⤵
- Executes dropped EXE
PID:3924 -
\??\c:\bbnntt.exec:\bbnntt.exe53⤵
- Executes dropped EXE
PID:4732 -
\??\c:\3vjdd.exec:\3vjdd.exe54⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ffrxllx.exec:\ffrxllx.exe55⤵
- Executes dropped EXE
PID:3272 -
\??\c:\bhnnhh.exec:\bhnnhh.exe56⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fxflfxr.exec:\fxflfxr.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tthnnb.exec:\tthnnb.exe58⤵
- Executes dropped EXE
PID:3868 -
\??\c:\1pjjj.exec:\1pjjj.exe59⤵
- Executes dropped EXE
PID:4132 -
\??\c:\xxfllrr.exec:\xxfllrr.exe60⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1rfffll.exec:\1rfffll.exe61⤵
- Executes dropped EXE
PID:724 -
\??\c:\1httnt.exec:\1httnt.exe62⤵
- Executes dropped EXE
PID:5056 -
\??\c:\vvjdp.exec:\vvjdp.exe63⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lxlxlfr.exec:\lxlxlfr.exe64⤵
- Executes dropped EXE
PID:3676 -
\??\c:\3dddv.exec:\3dddv.exe65⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xlrrffl.exec:\xlrrffl.exe66⤵PID:3628
-
\??\c:\5thhhn.exec:\5thhhn.exe67⤵
- System Location Discovery: System Language Discovery
PID:4728 -
\??\c:\thnhhh.exec:\thnhhh.exe68⤵PID:1524
-
\??\c:\1ppjj.exec:\1ppjj.exe69⤵PID:4444
-
\??\c:\nhtntt.exec:\nhtntt.exe70⤵PID:4324
-
\??\c:\nhnnhh.exec:\nhnnhh.exe71⤵PID:4740
-
\??\c:\7pddv.exec:\7pddv.exe72⤵PID:3252
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe73⤵PID:1208
-
\??\c:\nhbnbb.exec:\nhbnbb.exe74⤵PID:4156
-
\??\c:\fllrlrf.exec:\fllrlrf.exe75⤵PID:4044
-
\??\c:\1httnt.exec:\1httnt.exe76⤵PID:2688
-
\??\c:\jdppd.exec:\jdppd.exe77⤵PID:4540
-
\??\c:\jjjjj.exec:\jjjjj.exe78⤵PID:1716
-
\??\c:\1rffxfx.exec:\1rffxfx.exe79⤵PID:1660
-
\??\c:\7bnnnt.exec:\7bnnnt.exe80⤵PID:2488
-
\??\c:\djppj.exec:\djppj.exe81⤵PID:2964
-
\??\c:\llfxxrf.exec:\llfxxrf.exe82⤵PID:1280
-
\??\c:\bntbbb.exec:\bntbbb.exe83⤵PID:3820
-
\??\c:\jvjdv.exec:\jvjdv.exe84⤵PID:5020
-
\??\c:\xfxflfr.exec:\xfxflfr.exe85⤵PID:3316
-
\??\c:\jdvvd.exec:\jdvvd.exe86⤵PID:2480
-
\??\c:\xxrrfxl.exec:\xxrrfxl.exe87⤵
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\nntbbh.exec:\nntbbh.exe88⤵PID:3184
-
\??\c:\vpdvv.exec:\vpdvv.exe89⤵PID:1168
-
\??\c:\flffxfx.exec:\flffxfx.exe90⤵PID:4040
-
\??\c:\1hhntn.exec:\1hhntn.exe91⤵PID:456
-
\??\c:\bbnhbt.exec:\bbnhbt.exe92⤵PID:3788
-
\??\c:\9vdvv.exec:\9vdvv.exe93⤵PID:3996
-
\??\c:\1ffffff.exec:\1ffffff.exe94⤵PID:3772
-
\??\c:\3ntbhn.exec:\3ntbhn.exe95⤵PID:2040
-
\??\c:\htnhhn.exec:\htnhhn.exe96⤵PID:1200
-
\??\c:\ppvvv.exec:\ppvvv.exe97⤵PID:4372
-
\??\c:\rrrrxfr.exec:\rrrrxfr.exe98⤵PID:3592
-
\??\c:\tnbhhn.exec:\tnbhhn.exe99⤵PID:1776
-
\??\c:\dvjvv.exec:\dvjvv.exe100⤵PID:4304
-
\??\c:\lflrrxf.exec:\lflrrxf.exe101⤵PID:1196
-
\??\c:\bbhhhn.exec:\bbhhhn.exe102⤵PID:2528
-
\??\c:\pvjjv.exec:\pvjjv.exe103⤵PID:3636
-
\??\c:\lrrrrxx.exec:\lrrrrxx.exe104⤵PID:3600
-
\??\c:\5ttnhn.exec:\5ttnhn.exe105⤵PID:4840
-
\??\c:\1nttth.exec:\1nttth.exe106⤵PID:2776
-
\??\c:\5jjvv.exec:\5jjvv.exe107⤵PID:3816
-
\??\c:\frflfll.exec:\frflfll.exe108⤵PID:4028
-
\??\c:\tbntbt.exec:\tbntbt.exe109⤵PID:3756
-
\??\c:\jvpdj.exec:\jvpdj.exe110⤵PID:3200
-
\??\c:\ffxlfrl.exec:\ffxlfrl.exe111⤵PID:1060
-
\??\c:\7bttbh.exec:\7bttbh.exe112⤵PID:3284
-
\??\c:\pppvj.exec:\pppvj.exe113⤵PID:4552
-
\??\c:\rrrxxfx.exec:\rrrxxfx.exe114⤵PID:1928
-
\??\c:\7bnnnt.exec:\7bnnnt.exe115⤵PID:2628
-
\??\c:\nbttnt.exec:\nbttnt.exe116⤵PID:3032
-
\??\c:\xxlfflx.exec:\xxlfflx.exe117⤵PID:3740
-
\??\c:\thtbht.exec:\thtbht.exe118⤵PID:2188
-
\??\c:\pjvvp.exec:\pjvvp.exe119⤵PID:2952
-
\??\c:\3rrxrfl.exec:\3rrxrfl.exe120⤵PID:1432
-
\??\c:\bhnntb.exec:\bhnntb.exe121⤵PID:4220
-
\??\c:\hhbbbt.exec:\hhbbbt.exe122⤵PID:1104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-