Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 05:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe
-
Size
454KB
-
MD5
41eb7578cc7fc82e14a32a8875ede202
-
SHA1
db5c4f47082b3ebd99a1e414599a127e29bf7127
-
SHA256
b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217
-
SHA512
6e0526104efce0ffed26c02c400cb6eb3feb80b773994e31b357bf02863603702fcbbd199dfe3ce35f706d281fc64f53f72df3058357cd81c7ec03bc4ef2971e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ6:q7Tc2NYHUrAwfMp3CDJ6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3888-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/728-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-943-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-1071-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3952 lfrrfxl.exe 4568 02040.exe 3240 086208.exe 4796 4008604.exe 552 2822842.exe 4024 vjdvp.exe 4204 pjjdv.exe 4476 ffxflxl.exe 2868 2286644.exe 4488 2404826.exe 3080 k22086.exe 4940 2260482.exe 2348 48882.exe 3456 lfrlffr.exe 3796 jvdvj.exe 3940 666082.exe 4280 066082.exe 2304 848082.exe 3628 a4648.exe 1468 42620.exe 2032 i888204.exe 3780 22248.exe 4236 2064488.exe 3880 624260.exe 2424 666042.exe 5044 0808428.exe 1820 rxfrlfr.exe 100 c248442.exe 3384 840268.exe 3056 ddddp.exe 768 266268.exe 644 08042.exe 5080 7ntntn.exe 2940 40048.exe 3684 68426.exe 4688 4060482.exe 4304 64266.exe 2696 dvpvp.exe 3400 86262.exe 2192 600266.exe 4536 jjpdv.exe 1916 22820.exe 4468 a4648.exe 4208 0420484.exe 4620 vjvvd.exe 3676 88826.exe 3448 vjdpj.exe 1136 llfxrlf.exe 4324 1tbnhb.exe 4276 bbhtnh.exe 3888 lrrfrrf.exe 3968 3xxrlfx.exe 5008 7rlxrlf.exe 4568 3rrfxrl.exe 5096 2086020.exe 2228 frxlfxr.exe 5028 00286.exe 3356 22426.exe 3660 1tbntt.exe 3488 8460820.exe 4204 ntbthb.exe 1980 dvvpj.exe 2780 pdjvj.exe 2648 628648.exe -
resource yara_rule behavioral2/memory/3888-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/728-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-659-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0820460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2404488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8682620.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6264826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0424684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4008604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24608.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e62260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtntt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3888 wrote to memory of 3952 3888 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 83 PID 3888 wrote to memory of 3952 3888 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 83 PID 3888 wrote to memory of 3952 3888 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 83 PID 3952 wrote to memory of 4568 3952 lfrrfxl.exe 84 PID 3952 wrote to memory of 4568 3952 lfrrfxl.exe 84 PID 3952 wrote to memory of 4568 3952 lfrrfxl.exe 84 PID 4568 wrote to memory of 3240 4568 02040.exe 85 PID 4568 wrote to memory of 3240 4568 02040.exe 85 PID 4568 wrote to memory of 3240 4568 02040.exe 85 PID 3240 wrote to memory of 4796 3240 086208.exe 86 PID 3240 wrote to memory of 4796 3240 086208.exe 86 PID 3240 wrote to memory of 4796 3240 086208.exe 86 PID 4796 wrote to memory of 552 4796 4008604.exe 87 PID 4796 wrote to memory of 552 4796 4008604.exe 87 PID 4796 wrote to memory of 552 4796 4008604.exe 87 PID 552 wrote to memory of 4024 552 2822842.exe 88 PID 552 wrote to memory of 4024 552 2822842.exe 88 PID 552 wrote to memory of 4024 552 2822842.exe 88 PID 4024 wrote to memory of 4204 4024 vjdvp.exe 143 PID 4024 wrote to memory of 4204 4024 vjdvp.exe 143 PID 4024 wrote to memory of 4204 4024 vjdvp.exe 143 PID 4204 wrote to memory of 4476 4204 pjjdv.exe 90 PID 4204 wrote to memory of 4476 4204 pjjdv.exe 90 PID 4204 wrote to memory of 4476 4204 pjjdv.exe 90 PID 4476 wrote to memory of 2868 4476 ffxflxl.exe 91 PID 4476 wrote to memory of 2868 4476 ffxflxl.exe 91 PID 4476 wrote to memory of 2868 4476 ffxflxl.exe 91 PID 2868 wrote to memory of 4488 2868 2286644.exe 92 PID 2868 wrote to memory of 4488 2868 2286644.exe 92 PID 2868 wrote to memory of 4488 2868 2286644.exe 92 PID 4488 wrote to memory of 3080 4488 2404826.exe 93 PID 4488 wrote to memory of 3080 4488 2404826.exe 93 PID 4488 wrote to memory of 3080 4488 2404826.exe 93 PID 3080 wrote to memory of 4940 3080 k22086.exe 94 PID 3080 wrote to memory of 4940 3080 k22086.exe 94 PID 3080 wrote to memory of 4940 3080 k22086.exe 94 PID 4940 wrote to memory of 2348 4940 2260482.exe 95 PID 4940 wrote to memory of 2348 4940 2260482.exe 95 PID 4940 wrote to memory of 2348 4940 2260482.exe 95 PID 2348 wrote to memory of 3456 2348 48882.exe 96 PID 2348 wrote to memory of 3456 2348 48882.exe 96 PID 2348 wrote to memory of 3456 2348 48882.exe 96 PID 3456 wrote to memory of 3796 3456 lfrlffr.exe 97 PID 3456 wrote to memory of 3796 3456 lfrlffr.exe 97 PID 3456 wrote to memory of 3796 3456 lfrlffr.exe 97 PID 3796 wrote to memory of 3940 3796 jvdvj.exe 98 PID 3796 wrote to memory of 3940 3796 jvdvj.exe 98 PID 3796 wrote to memory of 3940 3796 jvdvj.exe 98 PID 3940 wrote to memory of 4280 3940 666082.exe 99 PID 3940 wrote to memory of 4280 3940 666082.exe 99 PID 3940 wrote to memory of 4280 3940 666082.exe 99 PID 4280 wrote to memory of 2304 4280 066082.exe 100 PID 4280 wrote to memory of 2304 4280 066082.exe 100 PID 4280 wrote to memory of 2304 4280 066082.exe 100 PID 2304 wrote to memory of 3628 2304 848082.exe 101 PID 2304 wrote to memory of 3628 2304 848082.exe 101 PID 2304 wrote to memory of 3628 2304 848082.exe 101 PID 3628 wrote to memory of 1468 3628 a4648.exe 102 PID 3628 wrote to memory of 1468 3628 a4648.exe 102 PID 3628 wrote to memory of 1468 3628 a4648.exe 102 PID 1468 wrote to memory of 2032 1468 42620.exe 103 PID 1468 wrote to memory of 2032 1468 42620.exe 103 PID 1468 wrote to memory of 2032 1468 42620.exe 103 PID 2032 wrote to memory of 3780 2032 i888204.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe"C:\Users\Admin\AppData\Local\Temp\b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\lfrrfxl.exec:\lfrrfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\02040.exec:\02040.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\086208.exec:\086208.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\4008604.exec:\4008604.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\2822842.exec:\2822842.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\vjdvp.exec:\vjdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\pjjdv.exec:\pjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\ffxflxl.exec:\ffxflxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\2286644.exec:\2286644.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\2404826.exec:\2404826.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\k22086.exec:\k22086.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\2260482.exec:\2260482.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\48882.exec:\48882.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\lfrlffr.exec:\lfrlffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\jvdvj.exec:\jvdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\666082.exec:\666082.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\066082.exec:\066082.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\848082.exec:\848082.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\a4648.exec:\a4648.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\42620.exec:\42620.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\i888204.exec:\i888204.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\22248.exec:\22248.exe23⤵
- Executes dropped EXE
PID:3780 -
\??\c:\2064488.exec:\2064488.exe24⤵
- Executes dropped EXE
PID:4236 -
\??\c:\624260.exec:\624260.exe25⤵
- Executes dropped EXE
PID:3880 -
\??\c:\666042.exec:\666042.exe26⤵
- Executes dropped EXE
PID:2424 -
\??\c:\0808428.exec:\0808428.exe27⤵
- Executes dropped EXE
PID:5044 -
\??\c:\rxfrlfr.exec:\rxfrlfr.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\c248442.exec:\c248442.exe29⤵
- Executes dropped EXE
PID:100 -
\??\c:\840268.exec:\840268.exe30⤵
- Executes dropped EXE
PID:3384 -
\??\c:\ddddp.exec:\ddddp.exe31⤵
- Executes dropped EXE
PID:3056 -
\??\c:\266268.exec:\266268.exe32⤵
- Executes dropped EXE
PID:768 -
\??\c:\08042.exec:\08042.exe33⤵
- Executes dropped EXE
PID:644 -
\??\c:\7ntntn.exec:\7ntntn.exe34⤵
- Executes dropped EXE
PID:5080 -
\??\c:\40048.exec:\40048.exe35⤵
- Executes dropped EXE
PID:2940 -
\??\c:\68426.exec:\68426.exe36⤵
- Executes dropped EXE
PID:3684 -
\??\c:\4060482.exec:\4060482.exe37⤵
- Executes dropped EXE
PID:4688 -
\??\c:\64266.exec:\64266.exe38⤵
- Executes dropped EXE
PID:4304 -
\??\c:\dvpvp.exec:\dvpvp.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\86262.exec:\86262.exe40⤵
- Executes dropped EXE
PID:3400 -
\??\c:\600266.exec:\600266.exe41⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jjpdv.exec:\jjpdv.exe42⤵
- Executes dropped EXE
PID:4536 -
\??\c:\22820.exec:\22820.exe43⤵
- Executes dropped EXE
PID:1916 -
\??\c:\a4648.exec:\a4648.exe44⤵
- Executes dropped EXE
PID:4468 -
\??\c:\0420484.exec:\0420484.exe45⤵
- Executes dropped EXE
PID:4208 -
\??\c:\vjvvd.exec:\vjvvd.exe46⤵
- Executes dropped EXE
PID:4620 -
\??\c:\88826.exec:\88826.exe47⤵
- Executes dropped EXE
PID:3676 -
\??\c:\vjdpj.exec:\vjdpj.exe48⤵
- Executes dropped EXE
PID:3448 -
\??\c:\llfxrlf.exec:\llfxrlf.exe49⤵
- Executes dropped EXE
PID:1136 -
\??\c:\1tbnhb.exec:\1tbnhb.exe50⤵
- Executes dropped EXE
PID:4324 -
\??\c:\bbhtnh.exec:\bbhtnh.exe51⤵
- Executes dropped EXE
PID:4276 -
\??\c:\lrrfrrf.exec:\lrrfrrf.exe52⤵
- Executes dropped EXE
PID:3888 -
\??\c:\3xxrlfx.exec:\3xxrlfx.exe53⤵
- Executes dropped EXE
PID:3968 -
\??\c:\7rlxrlf.exec:\7rlxrlf.exe54⤵
- Executes dropped EXE
PID:5008 -
\??\c:\3rrfxrl.exec:\3rrfxrl.exe55⤵
- Executes dropped EXE
PID:4568 -
\??\c:\2086020.exec:\2086020.exe56⤵
- Executes dropped EXE
PID:5096 -
\??\c:\frxlfxr.exec:\frxlfxr.exe57⤵
- Executes dropped EXE
PID:2228 -
\??\c:\00286.exec:\00286.exe58⤵
- Executes dropped EXE
PID:5028 -
\??\c:\22426.exec:\22426.exe59⤵
- Executes dropped EXE
PID:3356 -
\??\c:\1tbntt.exec:\1tbntt.exe60⤵
- Executes dropped EXE
PID:3660 -
\??\c:\8460820.exec:\8460820.exe61⤵
- Executes dropped EXE
PID:3488 -
\??\c:\ntbthb.exec:\ntbthb.exe62⤵
- Executes dropped EXE
PID:4204 -
\??\c:\dvvpj.exec:\dvvpj.exe63⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pdjvj.exec:\pdjvj.exe64⤵
- Executes dropped EXE
PID:2780 -
\??\c:\628648.exec:\628648.exe65⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dpjvp.exec:\dpjvp.exe66⤵PID:1936
-
\??\c:\ttbnhb.exec:\ttbnhb.exe67⤵PID:628
-
\??\c:\06864.exec:\06864.exe68⤵PID:4104
-
\??\c:\tnhbth.exec:\tnhbth.exe69⤵PID:1096
-
\??\c:\htbnhb.exec:\htbnhb.exe70⤵PID:2804
-
\??\c:\202260.exec:\202260.exe71⤵PID:2396
-
\??\c:\hthhbt.exec:\hthhbt.exe72⤵PID:2692
-
\??\c:\828266.exec:\828266.exe73⤵PID:3596
-
\??\c:\026266.exec:\026266.exe74⤵PID:4428
-
\??\c:\5rfxrrf.exec:\5rfxrrf.exe75⤵PID:3744
-
\??\c:\lxrfrlx.exec:\lxrfrlx.exe76⤵PID:1552
-
\??\c:\q62460.exec:\q62460.exe77⤵PID:2628
-
\??\c:\1hnbhh.exec:\1hnbhh.exe78⤵PID:2776
-
\??\c:\hnnbtt.exec:\hnnbtt.exe79⤵PID:4332
-
\??\c:\2448260.exec:\2448260.exe80⤵PID:5052
-
\??\c:\6248622.exec:\6248622.exe81⤵PID:5040
-
\??\c:\vdjpp.exec:\vdjpp.exe82⤵PID:2268
-
\??\c:\pvpjv.exec:\pvpjv.exe83⤵PID:4836
-
\??\c:\htbhbt.exec:\htbhbt.exe84⤵PID:4868
-
\??\c:\60004.exec:\60004.exe85⤵PID:4372
-
\??\c:\xlllrxr.exec:\xlllrxr.exe86⤵PID:4784
-
\??\c:\e28642.exec:\e28642.exe87⤵PID:4828
-
\??\c:\6460066.exec:\6460066.exe88⤵PID:3056
-
\??\c:\42422.exec:\42422.exe89⤵PID:3904
-
\??\c:\vvvpj.exec:\vvvpj.exe90⤵PID:1616
-
\??\c:\24608.exec:\24608.exe91⤵
- System Location Discovery: System Language Discovery
PID:2940 -
\??\c:\e66482.exec:\e66482.exe92⤵PID:4952
-
\??\c:\g0268.exec:\g0268.exe93⤵PID:516
-
\??\c:\5ppjd.exec:\5ppjd.exe94⤵PID:2428
-
\??\c:\lrxfxfl.exec:\lrxfxfl.exe95⤵PID:728
-
\??\c:\dvpjd.exec:\dvpjd.exe96⤵PID:1120
-
\??\c:\24048.exec:\24048.exe97⤵PID:3320
-
\??\c:\842802.exec:\842802.exe98⤵PID:2404
-
\??\c:\ddvpj.exec:\ddvpj.exe99⤵PID:5092
-
\??\c:\bhhbtt.exec:\bhhbtt.exe100⤵PID:888
-
\??\c:\668868.exec:\668868.exe101⤵PID:2664
-
\??\c:\660646.exec:\660646.exe102⤵PID:2792
-
\??\c:\7ppdv.exec:\7ppdv.exe103⤵PID:4116
-
\??\c:\606648.exec:\606648.exe104⤵PID:880
-
\??\c:\42604.exec:\42604.exe105⤵PID:4572
-
\??\c:\4282666.exec:\4282666.exe106⤵PID:4364
-
\??\c:\bnnhtn.exec:\bnnhtn.exe107⤵PID:2512
-
\??\c:\644860.exec:\644860.exe108⤵PID:400
-
\??\c:\hbthtn.exec:\hbthtn.exe109⤵PID:872
-
\??\c:\40026.exec:\40026.exe110⤵PID:3092
-
\??\c:\hbtnbt.exec:\hbtnbt.exe111⤵PID:3616
-
\??\c:\4248866.exec:\4248866.exe112⤵PID:5048
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe113⤵PID:5064
-
\??\c:\646602.exec:\646602.exe114⤵PID:3124
-
\??\c:\hhnhbh.exec:\hhnhbh.exe115⤵PID:5028
-
\??\c:\20842.exec:\20842.exe116⤵PID:412
-
\??\c:\86642.exec:\86642.exe117⤵PID:8
-
\??\c:\4848286.exec:\4848286.exe118⤵PID:4508
-
\??\c:\hbnnht.exec:\hbnnht.exe119⤵PID:3136
-
\??\c:\k48288.exec:\k48288.exe120⤵PID:3100
-
\??\c:\028260.exec:\028260.exe121⤵PID:3848
-
\??\c:\o260260.exec:\o260260.exe122⤵PID:4204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-