Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 05:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe
-
Size
454KB
-
MD5
570488473f20a445405fa858c6155240
-
SHA1
ed815118be42f659324e311a38cdafce2cb49c35
-
SHA256
be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645cc
-
SHA512
2b8913b339ad126b21d6c57b7b7c188e3709e9191110b06588855c90ec721a3feb444f8ae13e1f26e67a43e9b4f30c8fce0325107fa99277d75930686a6bfa34
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4764-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/508-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-802-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-866-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-1021-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3592 rrlrrfx.exe 1208 3jpjj.exe 4688 bhnttb.exe 4808 ttnnhn.exe 376 lllflrr.exe 3956 tnnbbn.exe 3512 fffffff.exe 4716 3ppjv.exe 532 9ffxrrx.exe 3760 rxrrllf.exe 2892 pvvpp.exe 508 xxrrrrl.exe 1320 7bhnbb.exe 4908 flrlffl.exe 4828 jjjjp.exe 2148 9ddvv.exe 2428 frrrlll.exe 2824 7nbtbh.exe 3628 pddvp.exe 5072 vpvpj.exe 2880 5pvpp.exe 4032 lxxrrlf.exe 1296 ddjdd.exe 1696 frxrrrx.exe 4792 ffrrxrf.exe 2220 nntnht.exe 3868 fxfxrrr.exe 2860 pjddj.exe 1984 tbtbbt.exe 4364 nnttnn.exe 1824 9xfflrx.exe 1040 7vdvv.exe 1244 5hbbtn.exe 4748 1pddv.exe 4020 rlllfff.exe 2568 btbhhh.exe 540 bbbttt.exe 4784 pvppd.exe 4920 3llffxx.exe 2520 hbhbtt.exe 3728 5rxxxxl.exe 3732 5xrllfx.exe 4508 hbbhhb.exe 1208 ppjjd.exe 4092 3vvpj.exe 4688 xfffxll.exe 4952 nbtnhh.exe 4212 1ppjd.exe 1848 frxrllf.exe 2724 nntnnn.exe 3956 djdvp.exe 4028 jjjjj.exe 244 xxxrxrx.exe 4716 tntnhb.exe 2108 ppppj.exe 3396 lxffxrl.exe 4460 hhtthb.exe 4536 nhnnhb.exe 4732 pvppj.exe 3992 xlrrlrl.exe 368 ntbnhh.exe 384 1htnbb.exe 4828 jpvpj.exe 4620 llfxrlf.exe -
resource yara_rule behavioral2/memory/4764-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/508-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-866-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnhhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4764 wrote to memory of 3592 4764 be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe 83 PID 4764 wrote to memory of 3592 4764 be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe 83 PID 4764 wrote to memory of 3592 4764 be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe 83 PID 3592 wrote to memory of 1208 3592 rrlrrfx.exe 84 PID 3592 wrote to memory of 1208 3592 rrlrrfx.exe 84 PID 3592 wrote to memory of 1208 3592 rrlrrfx.exe 84 PID 1208 wrote to memory of 4688 1208 3jpjj.exe 85 PID 1208 wrote to memory of 4688 1208 3jpjj.exe 85 PID 1208 wrote to memory of 4688 1208 3jpjj.exe 85 PID 4688 wrote to memory of 4808 4688 bhnttb.exe 86 PID 4688 wrote to memory of 4808 4688 bhnttb.exe 86 PID 4688 wrote to memory of 4808 4688 bhnttb.exe 86 PID 4808 wrote to memory of 376 4808 ttnnhn.exe 87 PID 4808 wrote to memory of 376 4808 ttnnhn.exe 87 PID 4808 wrote to memory of 376 4808 ttnnhn.exe 87 PID 376 wrote to memory of 3956 376 lllflrr.exe 88 PID 376 wrote to memory of 3956 376 lllflrr.exe 88 PID 376 wrote to memory of 3956 376 lllflrr.exe 88 PID 3956 wrote to memory of 3512 3956 tnnbbn.exe 89 PID 3956 wrote to memory of 3512 3956 tnnbbn.exe 89 PID 3956 wrote to memory of 3512 3956 tnnbbn.exe 89 PID 3512 wrote to memory of 4716 3512 fffffff.exe 90 PID 3512 wrote to memory of 4716 3512 fffffff.exe 90 PID 3512 wrote to memory of 4716 3512 fffffff.exe 90 PID 4716 wrote to memory of 532 4716 3ppjv.exe 91 PID 4716 wrote to memory of 532 4716 3ppjv.exe 91 PID 4716 wrote to memory of 532 4716 3ppjv.exe 91 PID 532 wrote to memory of 3760 532 9ffxrrx.exe 92 PID 532 wrote to memory of 3760 532 9ffxrrx.exe 92 PID 532 wrote to memory of 3760 532 9ffxrrx.exe 92 PID 3760 wrote to memory of 2892 3760 rxrrllf.exe 93 PID 3760 wrote to memory of 2892 3760 rxrrllf.exe 93 PID 3760 wrote to memory of 2892 3760 rxrrllf.exe 93 PID 2892 wrote to memory of 508 2892 pvvpp.exe 94 PID 2892 wrote to memory of 508 2892 pvvpp.exe 94 PID 2892 wrote to memory of 508 2892 pvvpp.exe 94 PID 508 wrote to memory of 1320 508 xxrrrrl.exe 95 PID 508 wrote to memory of 1320 508 xxrrrrl.exe 95 PID 508 wrote to memory of 1320 508 xxrrrrl.exe 95 PID 1320 wrote to memory of 4908 1320 7bhnbb.exe 96 PID 1320 wrote to memory of 4908 1320 7bhnbb.exe 96 PID 1320 wrote to memory of 4908 1320 7bhnbb.exe 96 PID 4908 wrote to memory of 4828 4908 flrlffl.exe 97 PID 4908 wrote to memory of 4828 4908 flrlffl.exe 97 PID 4908 wrote to memory of 4828 4908 flrlffl.exe 97 PID 4828 wrote to memory of 2148 4828 jjjjp.exe 98 PID 4828 wrote to memory of 2148 4828 jjjjp.exe 98 PID 4828 wrote to memory of 2148 4828 jjjjp.exe 98 PID 2148 wrote to memory of 2428 2148 9ddvv.exe 99 PID 2148 wrote to memory of 2428 2148 9ddvv.exe 99 PID 2148 wrote to memory of 2428 2148 9ddvv.exe 99 PID 2428 wrote to memory of 2824 2428 frrrlll.exe 100 PID 2428 wrote to memory of 2824 2428 frrrlll.exe 100 PID 2428 wrote to memory of 2824 2428 frrrlll.exe 100 PID 2824 wrote to memory of 3628 2824 7nbtbh.exe 101 PID 2824 wrote to memory of 3628 2824 7nbtbh.exe 101 PID 2824 wrote to memory of 3628 2824 7nbtbh.exe 101 PID 3628 wrote to memory of 5072 3628 pddvp.exe 102 PID 3628 wrote to memory of 5072 3628 pddvp.exe 102 PID 3628 wrote to memory of 5072 3628 pddvp.exe 102 PID 5072 wrote to memory of 2880 5072 vpvpj.exe 103 PID 5072 wrote to memory of 2880 5072 vpvpj.exe 103 PID 5072 wrote to memory of 2880 5072 vpvpj.exe 103 PID 2880 wrote to memory of 4032 2880 5pvpp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe"C:\Users\Admin\AppData\Local\Temp\be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\rrlrrfx.exec:\rrlrrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\3jpjj.exec:\3jpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\bhnttb.exec:\bhnttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\ttnnhn.exec:\ttnnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\lllflrr.exec:\lllflrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\tnnbbn.exec:\tnnbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\fffffff.exec:\fffffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\3ppjv.exec:\3ppjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\9ffxrrx.exec:\9ffxrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\rxrrllf.exec:\rxrrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\pvvpp.exec:\pvvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\xxrrrrl.exec:\xxrrrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\7bhnbb.exec:\7bhnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\flrlffl.exec:\flrlffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\jjjjp.exec:\jjjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\9ddvv.exec:\9ddvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\frrrlll.exec:\frrrlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\7nbtbh.exec:\7nbtbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\pddvp.exec:\pddvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\vpvpj.exec:\vpvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\5pvpp.exec:\5pvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\lxxrrlf.exec:\lxxrrlf.exe23⤵
- Executes dropped EXE
PID:4032 -
\??\c:\ddjdd.exec:\ddjdd.exe24⤵
- Executes dropped EXE
PID:1296 -
\??\c:\frxrrrx.exec:\frxrrrx.exe25⤵
- Executes dropped EXE
PID:1696 -
\??\c:\ffrrxrf.exec:\ffrrxrf.exe26⤵
- Executes dropped EXE
PID:4792 -
\??\c:\nntnht.exec:\nntnht.exe27⤵
- Executes dropped EXE
PID:2220 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe28⤵
- Executes dropped EXE
PID:3868 -
\??\c:\pjddj.exec:\pjddj.exe29⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tbtbbt.exec:\tbtbbt.exe30⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nnttnn.exec:\nnttnn.exe31⤵
- Executes dropped EXE
PID:4364 -
\??\c:\9xfflrx.exec:\9xfflrx.exe32⤵
- Executes dropped EXE
PID:1824 -
\??\c:\7vdvv.exec:\7vdvv.exe33⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5hbbtn.exec:\5hbbtn.exe34⤵
- Executes dropped EXE
PID:1244 -
\??\c:\1pddv.exec:\1pddv.exe35⤵
- Executes dropped EXE
PID:4748 -
\??\c:\rlllfff.exec:\rlllfff.exe36⤵
- Executes dropped EXE
PID:4020 -
\??\c:\btbhhh.exec:\btbhhh.exe37⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bbbttt.exec:\bbbttt.exe38⤵
- Executes dropped EXE
PID:540 -
\??\c:\pvppd.exec:\pvppd.exe39⤵
- Executes dropped EXE
PID:4784 -
\??\c:\3llffxx.exec:\3llffxx.exe40⤵
- Executes dropped EXE
PID:4920 -
\??\c:\hbhbtt.exec:\hbhbtt.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3djdv.exec:\3djdv.exe42⤵PID:4368
-
\??\c:\5rxxxxl.exec:\5rxxxxl.exe43⤵
- Executes dropped EXE
PID:3728 -
\??\c:\5xrllfx.exec:\5xrllfx.exe44⤵
- Executes dropped EXE
PID:3732 -
\??\c:\hbbhhb.exec:\hbbhhb.exe45⤵
- Executes dropped EXE
PID:4508 -
\??\c:\ppjjd.exec:\ppjjd.exe46⤵
- Executes dropped EXE
PID:1208 -
\??\c:\3vvpj.exec:\3vvpj.exe47⤵
- Executes dropped EXE
PID:4092 -
\??\c:\xfffxll.exec:\xfffxll.exe48⤵
- Executes dropped EXE
PID:4688 -
\??\c:\nbtnhh.exec:\nbtnhh.exe49⤵
- Executes dropped EXE
PID:4952 -
\??\c:\1ppjd.exec:\1ppjd.exe50⤵
- Executes dropped EXE
PID:4212 -
\??\c:\frxrllf.exec:\frxrllf.exe51⤵
- Executes dropped EXE
PID:1848 -
\??\c:\nntnnn.exec:\nntnnn.exe52⤵
- Executes dropped EXE
PID:2724 -
\??\c:\djdvp.exec:\djdvp.exe53⤵
- Executes dropped EXE
PID:3956 -
\??\c:\jjjjj.exec:\jjjjj.exe54⤵
- Executes dropped EXE
PID:4028 -
\??\c:\xxxrxrx.exec:\xxxrxrx.exe55⤵
- Executes dropped EXE
PID:244 -
\??\c:\tntnhb.exec:\tntnhb.exe56⤵
- Executes dropped EXE
PID:4716 -
\??\c:\ppppj.exec:\ppppj.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\lxffxrl.exec:\lxffxrl.exe58⤵
- Executes dropped EXE
PID:3396 -
\??\c:\hhtthb.exec:\hhtthb.exe59⤵
- Executes dropped EXE
PID:4460 -
\??\c:\nhnnhb.exec:\nhnnhb.exe60⤵
- Executes dropped EXE
PID:4536 -
\??\c:\pvppj.exec:\pvppj.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4732 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe62⤵
- Executes dropped EXE
PID:3992 -
\??\c:\ntbnhh.exec:\ntbnhh.exe63⤵
- Executes dropped EXE
PID:368 -
\??\c:\1htnbb.exec:\1htnbb.exe64⤵
- Executes dropped EXE
PID:384 -
\??\c:\jpvpj.exec:\jpvpj.exe65⤵
- Executes dropped EXE
PID:4828 -
\??\c:\llfxrlf.exec:\llfxrlf.exe66⤵
- Executes dropped EXE
PID:4620 -
\??\c:\httttt.exec:\httttt.exe67⤵PID:1060
-
\??\c:\5bnnnt.exec:\5bnnnt.exe68⤵PID:2052
-
\??\c:\7ddpj.exec:\7ddpj.exe69⤵PID:1960
-
\??\c:\xrlxxrr.exec:\xrlxxrr.exe70⤵PID:4900
-
\??\c:\hhbbhb.exec:\hhbbhb.exe71⤵PID:2180
-
\??\c:\9pvvd.exec:\9pvvd.exe72⤵PID:3816
-
\??\c:\9rllfff.exec:\9rllfff.exe73⤵PID:3476
-
\??\c:\ntbtbt.exec:\ntbtbt.exe74⤵PID:5020
-
\??\c:\bbbnnb.exec:\bbbnnb.exe75⤵PID:5032
-
\??\c:\djdpj.exec:\djdpj.exe76⤵PID:3540
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe77⤵PID:2416
-
\??\c:\bhbttt.exec:\bhbttt.exe78⤵PID:1896
-
\??\c:\3jvpp.exec:\3jvpp.exe79⤵PID:2344
-
\??\c:\5dvpj.exec:\5dvpj.exe80⤵PID:2220
-
\??\c:\rxrxrrx.exec:\rxrxrrx.exe81⤵PID:4472
-
\??\c:\nhhhbb.exec:\nhhhbb.exe82⤵PID:3968
-
\??\c:\hhttnn.exec:\hhttnn.exe83⤵PID:4060
-
\??\c:\7pppp.exec:\7pppp.exe84⤵PID:5080
-
\??\c:\3fffffx.exec:\3fffffx.exe85⤵PID:3208
-
\??\c:\nntttn.exec:\nntttn.exe86⤵PID:816
-
\??\c:\dvjdv.exec:\dvjdv.exe87⤵PID:668
-
\??\c:\5rxrrrr.exec:\5rxrrrr.exe88⤵PID:664
-
\??\c:\xllfxxx.exec:\xllfxxx.exe89⤵PID:1472
-
\??\c:\ttbttt.exec:\ttbttt.exe90⤵PID:4748
-
\??\c:\ppdpv.exec:\ppdpv.exe91⤵PID:5028
-
\??\c:\lxfxxrl.exec:\lxfxxrl.exe92⤵PID:2568
-
\??\c:\bbhbhh.exec:\bbhbhh.exe93⤵PID:3748
-
\??\c:\hbhbtb.exec:\hbhbtb.exe94⤵PID:2420
-
\??\c:\ddvpj.exec:\ddvpj.exe95⤵PID:4920
-
\??\c:\rlffxrx.exec:\rlffxrx.exe96⤵PID:1072
-
\??\c:\nnbttb.exec:\nnbttb.exe97⤵PID:4764
-
\??\c:\bbnnhb.exec:\bbnnhb.exe98⤵PID:1108
-
\??\c:\dvjpv.exec:\dvjpv.exe99⤵PID:3412
-
\??\c:\rxxrllx.exec:\rxxrllx.exe100⤵PID:4088
-
\??\c:\btbtnn.exec:\btbtnn.exe101⤵PID:2652
-
\??\c:\jjjjj.exec:\jjjjj.exe102⤵PID:1188
-
\??\c:\1dppp.exec:\1dppp.exe103⤵PID:996
-
\??\c:\1ffrlrl.exec:\1ffrlrl.exe104⤵PID:936
-
\??\c:\3nntnh.exec:\3nntnh.exe105⤵PID:2104
-
\??\c:\5ddvp.exec:\5ddvp.exe106⤵PID:2316
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe107⤵PID:2572
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe108⤵PID:4160
-
\??\c:\nbtttt.exec:\nbtttt.exe109⤵PID:3512
-
\??\c:\9pppj.exec:\9pppj.exe110⤵PID:3956
-
\??\c:\3pjjd.exec:\3pjjd.exe111⤵PID:912
-
\??\c:\lxxrllf.exec:\lxxrllf.exe112⤵PID:1828
-
\??\c:\bttnhh.exec:\bttnhh.exe113⤵PID:4700
-
\??\c:\pppjp.exec:\pppjp.exe114⤵PID:1392
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe115⤵PID:4980
-
\??\c:\btbhbb.exec:\btbhbb.exe116⤵PID:3188
-
\??\c:\nnbtnh.exec:\nnbtnh.exe117⤵
- System Location Discovery: System Language Discovery
PID:2560 -
\??\c:\jvpjd.exec:\jvpjd.exe118⤵PID:2892
-
\??\c:\3lffxfx.exec:\3lffxfx.exe119⤵PID:4972
-
\??\c:\hhhnth.exec:\hhhnth.exe120⤵PID:1952
-
\??\c:\5tbbbb.exec:\5tbbbb.exe121⤵PID:4540
-
\??\c:\5vdvv.exec:\5vdvv.exe122⤵PID:1916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-