Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 04:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe
-
Size
454KB
-
MD5
1fe989f63790ff338c72e305d6addf10
-
SHA1
d51d53c83754a9691cde009327ab834d1f937d37
-
SHA256
28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3
-
SHA512
84642d7eba94ed6e567b49e10b992510e7088a1224c3d4b160e42b1f0df3c424dbbcb1ee5bf3346411369f0de33b93426f216a5d790d3dea1e107ed7309faf95
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2324-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-848-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-918-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-1060-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-1711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3964 7xxrrrl.exe 1020 thtnhh.exe 5072 5vpjv.exe 4776 pdvpv.exe 4664 lxxxrlf.exe 4484 bbbbtt.exe 2784 dvvpj.exe 804 pvvpj.exe 1472 lxlfxlf.exe 3644 1xfrlxr.exe 216 3hbtnt.exe 1092 nnthnn.exe 1772 lfllfff.exe 2928 nbhhbb.exe 3404 lllffxx.exe 1368 nhtnhh.exe 1652 7llfxxr.exe 1252 hhhbbt.exe 4676 5djdp.exe 3580 xlxrxrr.exe 1280 tnthbb.exe 2764 btnnnh.exe 4132 xxxlfxl.exe 744 vddpj.exe 1488 7fxrlfx.exe 4844 9vpjd.exe 4796 thhnnn.exe 4004 bhttnn.exe 1104 frfrfxl.exe 4732 nhbtnh.exe 3052 pddvp.exe 4020 xfrlfxr.exe 2160 3bhbhh.exe 1004 xlrlxxl.exe 3084 dvdvv.exe 1372 xrrfxlf.exe 1732 hbbtnt.exe 2184 dddpj.exe 3076 vdppv.exe 1848 9xxlfxl.exe 416 hhtnbb.exe 3348 dddvj.exe 684 1rrlxrl.exe 2600 ntbtnn.exe 3564 hnnnhh.exe 3260 dvjpj.exe 1144 rflfrlf.exe 3176 flrlfxr.exe 2324 htbhbh.exe 4112 dppjp.exe 2300 lrrfrlr.exe 4400 nhbbnn.exe 4872 7pvvd.exe 1272 rlrrlll.exe 3156 bbbtnn.exe 4056 9pppj.exe 2784 fxfxrlf.exe 5064 rrrrlll.exe 368 nbhbtn.exe 2748 jdvpj.exe 4728 xrrlffr.exe 2040 tnntnn.exe 1468 bnbbtt.exe 4588 vddvj.exe -
resource yara_rule behavioral2/memory/2324-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-918-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-1060-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnbnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 3964 2324 28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe 82 PID 2324 wrote to memory of 3964 2324 28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe 82 PID 2324 wrote to memory of 3964 2324 28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe 82 PID 3964 wrote to memory of 1020 3964 7xxrrrl.exe 83 PID 3964 wrote to memory of 1020 3964 7xxrrrl.exe 83 PID 3964 wrote to memory of 1020 3964 7xxrrrl.exe 83 PID 1020 wrote to memory of 5072 1020 thtnhh.exe 84 PID 1020 wrote to memory of 5072 1020 thtnhh.exe 84 PID 1020 wrote to memory of 5072 1020 thtnhh.exe 84 PID 5072 wrote to memory of 4776 5072 5vpjv.exe 85 PID 5072 wrote to memory of 4776 5072 5vpjv.exe 85 PID 5072 wrote to memory of 4776 5072 5vpjv.exe 85 PID 4776 wrote to memory of 4664 4776 pdvpv.exe 86 PID 4776 wrote to memory of 4664 4776 pdvpv.exe 86 PID 4776 wrote to memory of 4664 4776 pdvpv.exe 86 PID 4664 wrote to memory of 4484 4664 lxxxrlf.exe 87 PID 4664 wrote to memory of 4484 4664 lxxxrlf.exe 87 PID 4664 wrote to memory of 4484 4664 lxxxrlf.exe 87 PID 4484 wrote to memory of 2784 4484 bbbbtt.exe 88 PID 4484 wrote to memory of 2784 4484 bbbbtt.exe 88 PID 4484 wrote to memory of 2784 4484 bbbbtt.exe 88 PID 2784 wrote to memory of 804 2784 dvvpj.exe 89 PID 2784 wrote to memory of 804 2784 dvvpj.exe 89 PID 2784 wrote to memory of 804 2784 dvvpj.exe 89 PID 804 wrote to memory of 1472 804 pvvpj.exe 90 PID 804 wrote to memory of 1472 804 pvvpj.exe 90 PID 804 wrote to memory of 1472 804 pvvpj.exe 90 PID 1472 wrote to memory of 3644 1472 lxlfxlf.exe 91 PID 1472 wrote to memory of 3644 1472 lxlfxlf.exe 91 PID 1472 wrote to memory of 3644 1472 lxlfxlf.exe 91 PID 3644 wrote to memory of 216 3644 1xfrlxr.exe 92 PID 3644 wrote to memory of 216 3644 1xfrlxr.exe 92 PID 3644 wrote to memory of 216 3644 1xfrlxr.exe 92 PID 216 wrote to memory of 1092 216 3hbtnt.exe 93 PID 216 wrote to memory of 1092 216 3hbtnt.exe 93 PID 216 wrote to memory of 1092 216 3hbtnt.exe 93 PID 1092 wrote to memory of 1772 1092 nnthnn.exe 94 PID 1092 wrote to memory of 1772 1092 nnthnn.exe 94 PID 1092 wrote to memory of 1772 1092 nnthnn.exe 94 PID 1772 wrote to memory of 2928 1772 lfllfff.exe 95 PID 1772 wrote to memory of 2928 1772 lfllfff.exe 95 PID 1772 wrote to memory of 2928 1772 lfllfff.exe 95 PID 2928 wrote to memory of 3404 2928 nbhhbb.exe 96 PID 2928 wrote to memory of 3404 2928 nbhhbb.exe 96 PID 2928 wrote to memory of 3404 2928 nbhhbb.exe 96 PID 3404 wrote to memory of 1368 3404 lllffxx.exe 97 PID 3404 wrote to memory of 1368 3404 lllffxx.exe 97 PID 3404 wrote to memory of 1368 3404 lllffxx.exe 97 PID 1368 wrote to memory of 1652 1368 nhtnhh.exe 98 PID 1368 wrote to memory of 1652 1368 nhtnhh.exe 98 PID 1368 wrote to memory of 1652 1368 nhtnhh.exe 98 PID 1652 wrote to memory of 1252 1652 7llfxxr.exe 99 PID 1652 wrote to memory of 1252 1652 7llfxxr.exe 99 PID 1652 wrote to memory of 1252 1652 7llfxxr.exe 99 PID 1252 wrote to memory of 4676 1252 hhhbbt.exe 100 PID 1252 wrote to memory of 4676 1252 hhhbbt.exe 100 PID 1252 wrote to memory of 4676 1252 hhhbbt.exe 100 PID 4676 wrote to memory of 3580 4676 5djdp.exe 101 PID 4676 wrote to memory of 3580 4676 5djdp.exe 101 PID 4676 wrote to memory of 3580 4676 5djdp.exe 101 PID 3580 wrote to memory of 1280 3580 xlxrxrr.exe 102 PID 3580 wrote to memory of 1280 3580 xlxrxrr.exe 102 PID 3580 wrote to memory of 1280 3580 xlxrxrr.exe 102 PID 1280 wrote to memory of 2764 1280 tnthbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe"C:\Users\Admin\AppData\Local\Temp\28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\7xxrrrl.exec:\7xxrrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\thtnhh.exec:\thtnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\5vpjv.exec:\5vpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\pdvpv.exec:\pdvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\lxxxrlf.exec:\lxxxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\bbbbtt.exec:\bbbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\dvvpj.exec:\dvvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pvvpj.exec:\pvvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\lxlfxlf.exec:\lxlfxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\1xfrlxr.exec:\1xfrlxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\3hbtnt.exec:\3hbtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\nnthnn.exec:\nnthnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\lfllfff.exec:\lfllfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nbhhbb.exec:\nbhhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\lllffxx.exec:\lllffxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\nhtnhh.exec:\nhtnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\7llfxxr.exec:\7llfxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\hhhbbt.exec:\hhhbbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\5djdp.exec:\5djdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\xlxrxrr.exec:\xlxrxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\tnthbb.exec:\tnthbb.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\btnnnh.exec:\btnnnh.exe23⤵
- Executes dropped EXE
PID:2764 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe24⤵
- Executes dropped EXE
PID:4132 -
\??\c:\vddpj.exec:\vddpj.exe25⤵
- Executes dropped EXE
PID:744 -
\??\c:\7fxrlfx.exec:\7fxrlfx.exe26⤵
- Executes dropped EXE
PID:1488 -
\??\c:\9vpjd.exec:\9vpjd.exe27⤵
- Executes dropped EXE
PID:4844 -
\??\c:\thhnnn.exec:\thhnnn.exe28⤵
- Executes dropped EXE
PID:4796 -
\??\c:\bhttnn.exec:\bhttnn.exe29⤵
- Executes dropped EXE
PID:4004 -
\??\c:\frfrfxl.exec:\frfrfxl.exe30⤵
- Executes dropped EXE
PID:1104 -
\??\c:\nhbtnh.exec:\nhbtnh.exe31⤵
- Executes dropped EXE
PID:4732 -
\??\c:\pddvp.exec:\pddvp.exe32⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe33⤵
- Executes dropped EXE
PID:4020 -
\??\c:\3bhbhh.exec:\3bhbhh.exe34⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xlrlxxl.exec:\xlrlxxl.exe35⤵
- Executes dropped EXE
PID:1004 -
\??\c:\dvdvv.exec:\dvdvv.exe36⤵
- Executes dropped EXE
PID:3084 -
\??\c:\xrrfxlf.exec:\xrrfxlf.exe37⤵
- Executes dropped EXE
PID:1372 -
\??\c:\hbbtnt.exec:\hbbtnt.exe38⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dddpj.exec:\dddpj.exe39⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vdppv.exec:\vdppv.exe40⤵
- Executes dropped EXE
PID:3076 -
\??\c:\9xxlfxl.exec:\9xxlfxl.exe41⤵
- Executes dropped EXE
PID:1848 -
\??\c:\hhtnbb.exec:\hhtnbb.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:416 -
\??\c:\dddvj.exec:\dddvj.exe43⤵
- Executes dropped EXE
PID:3348 -
\??\c:\1rrlxrl.exec:\1rrlxrl.exe44⤵
- Executes dropped EXE
PID:684 -
\??\c:\ntbtnn.exec:\ntbtnn.exe45⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hnnnhh.exec:\hnnnhh.exe46⤵
- Executes dropped EXE
PID:3564 -
\??\c:\dvjpj.exec:\dvjpj.exe47⤵
- Executes dropped EXE
PID:3260 -
\??\c:\rflfrlf.exec:\rflfrlf.exe48⤵
- Executes dropped EXE
PID:1144 -
\??\c:\flrlfxr.exec:\flrlfxr.exe49⤵
- Executes dropped EXE
PID:3176 -
\??\c:\htbhbh.exec:\htbhbh.exe50⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dppjp.exec:\dppjp.exe51⤵
- Executes dropped EXE
PID:4112 -
\??\c:\lrrfrlr.exec:\lrrfrlr.exe52⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nhbbnn.exec:\nhbbnn.exe53⤵
- Executes dropped EXE
PID:4400 -
\??\c:\7pvvd.exec:\7pvvd.exe54⤵
- Executes dropped EXE
PID:4872 -
\??\c:\rlrrlll.exec:\rlrrlll.exe55⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bbbtnn.exec:\bbbtnn.exe56⤵
- Executes dropped EXE
PID:3156 -
\??\c:\9pppj.exec:\9pppj.exe57⤵
- Executes dropped EXE
PID:4056 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe58⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rrrrlll.exec:\rrrrlll.exe59⤵
- Executes dropped EXE
PID:5064 -
\??\c:\nbhbtn.exec:\nbhbtn.exe60⤵
- Executes dropped EXE
PID:368 -
\??\c:\jdvpj.exec:\jdvpj.exe61⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xrrlffr.exec:\xrrlffr.exe62⤵
- Executes dropped EXE
PID:4728 -
\??\c:\tnntnn.exec:\tnntnn.exe63⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bnbbtt.exec:\bnbbtt.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vddvj.exec:\vddvj.exe65⤵
- Executes dropped EXE
PID:4588 -
\??\c:\lrxlffx.exec:\lrxlffx.exe66⤵PID:4596
-
\??\c:\3hbnhb.exec:\3hbnhb.exe67⤵PID:112
-
\??\c:\3vvpv.exec:\3vvpv.exe68⤵PID:4016
-
\??\c:\rffrfxl.exec:\rffrfxl.exe69⤵PID:2780
-
\??\c:\bbnbtt.exec:\bbnbtt.exe70⤵PID:2168
-
\??\c:\jpdpd.exec:\jpdpd.exe71⤵PID:2940
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe72⤵PID:3028
-
\??\c:\7hhbnh.exec:\7hhbnh.exe73⤵PID:4920
-
\??\c:\pjdvj.exec:\pjdvj.exe74⤵PID:2736
-
\??\c:\dpvpv.exec:\dpvpv.exe75⤵PID:3068
-
\??\c:\xrxrfxl.exec:\xrxrfxl.exe76⤵PID:5024
-
\??\c:\hhntbt.exec:\hhntbt.exe77⤵PID:3444
-
\??\c:\jdjdv.exec:\jdjdv.exe78⤵PID:3984
-
\??\c:\dvdvd.exec:\dvdvd.exe79⤵PID:4680
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe80⤵PID:2596
-
\??\c:\ntbtht.exec:\ntbtht.exe81⤵PID:2612
-
\??\c:\vpdvp.exec:\vpdvp.exe82⤵PID:4196
-
\??\c:\vjpdv.exec:\vjpdv.exe83⤵PID:3532
-
\??\c:\9ffxxrr.exec:\9ffxxrr.exe84⤵PID:5112
-
\??\c:\nntnhb.exec:\nntnhb.exe85⤵PID:4568
-
\??\c:\ddppp.exec:\ddppp.exe86⤵PID:4132
-
\??\c:\fllxlfr.exec:\fllxlfr.exe87⤵
- System Location Discovery: System Language Discovery
PID:4028 -
\??\c:\flrlfxr.exec:\flrlfxr.exe88⤵PID:2144
-
\??\c:\ttbbth.exec:\ttbbth.exe89⤵PID:1428
-
\??\c:\pjvjd.exec:\pjvjd.exe90⤵PID:4264
-
\??\c:\9rrxllx.exec:\9rrxllx.exe91⤵PID:1224
-
\??\c:\9tthbt.exec:\9tthbt.exe92⤵PID:1520
-
\??\c:\3ddvp.exec:\3ddvp.exe93⤵PID:4004
-
\??\c:\pjvjj.exec:\pjvjj.exe94⤵PID:1824
-
\??\c:\xffxrlf.exec:\xffxrlf.exe95⤵PID:1620
-
\??\c:\7hbttn.exec:\7hbttn.exe96⤵PID:3908
-
\??\c:\9tthbt.exec:\9tthbt.exe97⤵PID:4828
-
\??\c:\3pvdv.exec:\3pvdv.exe98⤵PID:3320
-
\??\c:\1rfxlfr.exec:\1rfxlfr.exe99⤵PID:1032
-
\??\c:\5tnbhb.exec:\5tnbhb.exe100⤵
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\9ddpd.exec:\9ddpd.exe101⤵PID:3688
-
\??\c:\3vvjv.exec:\3vvjv.exe102⤵PID:2104
-
\??\c:\lxfrrlx.exec:\lxfrrlx.exe103⤵PID:1284
-
\??\c:\1hbttt.exec:\1hbttt.exe104⤵PID:1556
-
\??\c:\5jvjv.exec:\5jvjv.exe105⤵PID:2420
-
\??\c:\flffxxr.exec:\flffxxr.exe106⤵PID:5084
-
\??\c:\ffxrlxl.exec:\ffxrlxl.exe107⤵PID:1800
-
\??\c:\hntnbt.exec:\hntnbt.exe108⤵PID:2744
-
\??\c:\vjpdv.exec:\vjpdv.exe109⤵PID:3228
-
\??\c:\5ddvp.exec:\5ddvp.exe110⤵PID:2760
-
\??\c:\xffrrlx.exec:\xffrrlx.exe111⤵PID:4416
-
\??\c:\hnthbt.exec:\hnthbt.exe112⤵PID:2600
-
\??\c:\pjjdv.exec:\pjjdv.exe113⤵PID:4368
-
\??\c:\vvdjv.exec:\vvdjv.exe114⤵PID:4388
-
\??\c:\9rlxfxl.exec:\9rlxfxl.exe115⤵PID:3036
-
\??\c:\bbtnhh.exec:\bbtnhh.exe116⤵PID:4320
-
\??\c:\pjddd.exec:\pjddd.exe117⤵PID:4496
-
\??\c:\dvpdp.exec:\dvpdp.exe118⤵PID:1160
-
\??\c:\xrrfxrr.exec:\xrrfxrr.exe119⤵PID:3904
-
\??\c:\3bnthn.exec:\3bnthn.exe120⤵PID:3992
-
\??\c:\7jjjd.exec:\7jjjd.exe121⤵PID:4820
-
\??\c:\jdpjj.exec:\jdpjj.exe122⤵PID:4664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-