Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 06:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f029c07d21d7eb4e551e2c42a2545fc6e6a4b341e7c6067e814b194d23ce004N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3f029c07d21d7eb4e551e2c42a2545fc6e6a4b341e7c6067e814b194d23ce004N.exe
-
Size
454KB
-
MD5
f99ddaccbeea903561f5be26c455bc00
-
SHA1
a2d901b16451e88047fb03f3093ded60cb77628e
-
SHA256
3f029c07d21d7eb4e551e2c42a2545fc6e6a4b341e7c6067e814b194d23ce004
-
SHA512
1eec37a400eb3ef38fe62540afdba967c2c132ea811c7c30e72c43f9ddbbd3f4dbac2bd6dcec5d1fef319296fe240feeef09df666f7275fffe7b5a7a9f1b3549
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeP:q7Tc2NYHUrAwfMp3CDP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1336-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/600-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-1591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4440 lxrxrrr.exe 860 vppjd.exe 600 xlrrlfx.exe 4008 5ddjj.exe 1572 lrfxrrl.exe 3568 xlrrllf.exe 2632 jdvjd.exe 4000 llrrrxr.exe 2584 nnhbtn.exe 4176 nhbhth.exe 1892 pjpjd.exe 4044 bnnhbt.exe 1908 lxlfrrx.exe 1268 jddjd.exe 4028 3jjdp.exe 2364 bhthtn.exe 2188 dvppp.exe 1884 9frxfxl.exe 2036 nntnhb.exe 3696 5ddvp.exe 2616 jvjvv.exe 1368 rflxllf.exe 3012 3ppjv.exe 1448 bhbbbb.exe 2440 ppddv.exe 3340 1xrlffx.exe 1724 3tbbht.exe 1312 xrrrlrl.exe 996 3vpjj.exe 436 llrrxrr.exe 4596 vvvjv.exe 1456 xlrlllf.exe 4048 tnhtbt.exe 4324 pdjjd.exe 2240 bbttnh.exe 3732 pvppj.exe 3252 xxxxfrl.exe 1528 tttnhh.exe 2372 pppjj.exe 1780 rlrlllf.exe 4952 tbnhbb.exe 1744 vjpvv.exe 2588 xfllffr.exe 4068 rxlfxxr.exe 224 pjvdv.exe 4576 rxlllll.exe 724 bnhbht.exe 3616 pvdvj.exe 4936 xrrrrrr.exe 4400 nhtttb.exe 4396 djvpd.exe 4776 rfxrrrx.exe 3856 3ntnnn.exe 4316 jdjdv.exe 4360 fxxfrxx.exe 600 bnbnbt.exe 1040 pvvvv.exe 2052 jdpjj.exe 4504 xlrlrrr.exe 4108 ddpjj.exe 2940 3pdvv.exe 1476 rxllffx.exe 4404 vjpdv.exe 3492 5rxxrff.exe -
resource yara_rule behavioral2/memory/1336-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/600-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-570-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1336 wrote to memory of 4440 1336 3f029c07d21d7eb4e551e2c42a2545fc6e6a4b341e7c6067e814b194d23ce004N.exe 83 PID 1336 wrote to memory of 4440 1336 3f029c07d21d7eb4e551e2c42a2545fc6e6a4b341e7c6067e814b194d23ce004N.exe 83 PID 1336 wrote to memory of 4440 1336 3f029c07d21d7eb4e551e2c42a2545fc6e6a4b341e7c6067e814b194d23ce004N.exe 83 PID 4440 wrote to memory of 860 4440 lxrxrrr.exe 84 PID 4440 wrote to memory of 860 4440 lxrxrrr.exe 84 PID 4440 wrote to memory of 860 4440 lxrxrrr.exe 84 PID 860 wrote to memory of 600 860 vppjd.exe 85 PID 860 wrote to memory of 600 860 vppjd.exe 85 PID 860 wrote to memory of 600 860 vppjd.exe 85 PID 600 wrote to memory of 4008 600 xlrrlfx.exe 86 PID 600 wrote to memory of 4008 600 xlrrlfx.exe 86 PID 600 wrote to memory of 4008 600 xlrrlfx.exe 86 PID 4008 wrote to memory of 1572 4008 5ddjj.exe 87 PID 4008 wrote to memory of 1572 4008 5ddjj.exe 87 PID 4008 wrote to memory of 1572 4008 5ddjj.exe 87 PID 1572 wrote to memory of 3568 1572 lrfxrrl.exe 88 PID 1572 wrote to memory of 3568 1572 lrfxrrl.exe 88 PID 1572 wrote to memory of 3568 1572 lrfxrrl.exe 88 PID 3568 wrote to memory of 2632 3568 xlrrllf.exe 89 PID 3568 wrote to memory of 2632 3568 xlrrllf.exe 89 PID 3568 wrote to memory of 2632 3568 xlrrllf.exe 89 PID 2632 wrote to memory of 4000 2632 jdvjd.exe 90 PID 2632 wrote to memory of 4000 2632 jdvjd.exe 90 PID 2632 wrote to memory of 4000 2632 jdvjd.exe 90 PID 4000 wrote to memory of 2584 4000 llrrrxr.exe 91 PID 4000 wrote to memory of 2584 4000 llrrrxr.exe 91 PID 4000 wrote to memory of 2584 4000 llrrrxr.exe 91 PID 2584 wrote to memory of 4176 2584 nnhbtn.exe 92 PID 2584 wrote to memory of 4176 2584 nnhbtn.exe 92 PID 2584 wrote to memory of 4176 2584 nnhbtn.exe 92 PID 4176 wrote to memory of 1892 4176 nhbhth.exe 93 PID 4176 wrote to memory of 1892 4176 nhbhth.exe 93 PID 4176 wrote to memory of 1892 4176 nhbhth.exe 93 PID 1892 wrote to memory of 4044 1892 pjpjd.exe 94 PID 1892 wrote to memory of 4044 1892 pjpjd.exe 94 PID 1892 wrote to memory of 4044 1892 pjpjd.exe 94 PID 4044 wrote to memory of 1908 4044 bnnhbt.exe 95 PID 4044 wrote to memory of 1908 4044 bnnhbt.exe 95 PID 4044 wrote to memory of 1908 4044 bnnhbt.exe 95 PID 1908 wrote to memory of 1268 1908 lxlfrrx.exe 96 PID 1908 wrote to memory of 1268 1908 lxlfrrx.exe 96 PID 1908 wrote to memory of 1268 1908 lxlfrrx.exe 96 PID 1268 wrote to memory of 4028 1268 jddjd.exe 97 PID 1268 wrote to memory of 4028 1268 jddjd.exe 97 PID 1268 wrote to memory of 4028 1268 jddjd.exe 97 PID 4028 wrote to memory of 2364 4028 3jjdp.exe 98 PID 4028 wrote to memory of 2364 4028 3jjdp.exe 98 PID 4028 wrote to memory of 2364 4028 3jjdp.exe 98 PID 2364 wrote to memory of 2188 2364 bhthtn.exe 99 PID 2364 wrote to memory of 2188 2364 bhthtn.exe 99 PID 2364 wrote to memory of 2188 2364 bhthtn.exe 99 PID 2188 wrote to memory of 1884 2188 dvppp.exe 100 PID 2188 wrote to memory of 1884 2188 dvppp.exe 100 PID 2188 wrote to memory of 1884 2188 dvppp.exe 100 PID 1884 wrote to memory of 2036 1884 9frxfxl.exe 101 PID 1884 wrote to memory of 2036 1884 9frxfxl.exe 101 PID 1884 wrote to memory of 2036 1884 9frxfxl.exe 101 PID 2036 wrote to memory of 3696 2036 nntnhb.exe 102 PID 2036 wrote to memory of 3696 2036 nntnhb.exe 102 PID 2036 wrote to memory of 3696 2036 nntnhb.exe 102 PID 3696 wrote to memory of 2616 3696 5ddvp.exe 103 PID 3696 wrote to memory of 2616 3696 5ddvp.exe 103 PID 3696 wrote to memory of 2616 3696 5ddvp.exe 103 PID 2616 wrote to memory of 1368 2616 jvjvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f029c07d21d7eb4e551e2c42a2545fc6e6a4b341e7c6067e814b194d23ce004N.exe"C:\Users\Admin\AppData\Local\Temp\3f029c07d21d7eb4e551e2c42a2545fc6e6a4b341e7c6067e814b194d23ce004N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\lxrxrrr.exec:\lxrxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\vppjd.exec:\vppjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\xlrrlfx.exec:\xlrrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\5ddjj.exec:\5ddjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\xlrrllf.exec:\xlrrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\jdvjd.exec:\jdvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\llrrrxr.exec:\llrrrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\nnhbtn.exec:\nnhbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\nhbhth.exec:\nhbhth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\pjpjd.exec:\pjpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\bnnhbt.exec:\bnnhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\lxlfrrx.exec:\lxlfrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\jddjd.exec:\jddjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\3jjdp.exec:\3jjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\bhthtn.exec:\bhthtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\dvppp.exec:\dvppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\9frxfxl.exec:\9frxfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\nntnhb.exec:\nntnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\5ddvp.exec:\5ddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\jvjvv.exec:\jvjvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rflxllf.exec:\rflxllf.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\3ppjv.exec:\3ppjv.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bhbbbb.exec:\bhbbbb.exe25⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ppddv.exec:\ppddv.exe26⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1xrlffx.exec:\1xrlffx.exe27⤵
- Executes dropped EXE
PID:3340 -
\??\c:\3tbbht.exec:\3tbbht.exe28⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrrrlrl.exec:\xrrrlrl.exe29⤵
- Executes dropped EXE
PID:1312 -
\??\c:\3vpjj.exec:\3vpjj.exe30⤵
- Executes dropped EXE
PID:996 -
\??\c:\llrrxrr.exec:\llrrxrr.exe31⤵
- Executes dropped EXE
PID:436 -
\??\c:\vvvjv.exec:\vvvjv.exe32⤵
- Executes dropped EXE
PID:4596 -
\??\c:\xlrlllf.exec:\xlrlllf.exe33⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tnhtbt.exec:\tnhtbt.exe34⤵
- Executes dropped EXE
PID:4048 -
\??\c:\pdjjd.exec:\pdjjd.exe35⤵
- Executes dropped EXE
PID:4324 -
\??\c:\bbttnh.exec:\bbttnh.exe36⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pvppj.exec:\pvppj.exe37⤵
- Executes dropped EXE
PID:3732 -
\??\c:\xxxxfrl.exec:\xxxxfrl.exe38⤵
- Executes dropped EXE
PID:3252 -
\??\c:\tttnhh.exec:\tttnhh.exe39⤵
- Executes dropped EXE
PID:1528 -
\??\c:\pppjj.exec:\pppjj.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rlrlllf.exec:\rlrlllf.exe41⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tbnhbb.exec:\tbnhbb.exe42⤵
- Executes dropped EXE
PID:4952 -
\??\c:\vjpvv.exec:\vjpvv.exe43⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xfllffr.exec:\xfllffr.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe45⤵
- Executes dropped EXE
PID:4068 -
\??\c:\pjvdv.exec:\pjvdv.exe46⤵
- Executes dropped EXE
PID:224 -
\??\c:\rxlllll.exec:\rxlllll.exe47⤵
- Executes dropped EXE
PID:4576 -
\??\c:\bnhbht.exec:\bnhbht.exe48⤵
- Executes dropped EXE
PID:724 -
\??\c:\pvdvj.exec:\pvdvj.exe49⤵
- Executes dropped EXE
PID:3616 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe50⤵
- Executes dropped EXE
PID:4936 -
\??\c:\nhtttb.exec:\nhtttb.exe51⤵
- Executes dropped EXE
PID:4400 -
\??\c:\djvpd.exec:\djvpd.exe52⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rfxrrrx.exec:\rfxrrrx.exe53⤵
- Executes dropped EXE
PID:4776 -
\??\c:\3ntnnn.exec:\3ntnnn.exe54⤵
- Executes dropped EXE
PID:3856 -
\??\c:\jdjdv.exec:\jdjdv.exe55⤵
- Executes dropped EXE
PID:4316 -
\??\c:\fxxfrxx.exec:\fxxfrxx.exe56⤵
- Executes dropped EXE
PID:4360 -
\??\c:\bnbnbt.exec:\bnbnbt.exe57⤵
- Executes dropped EXE
PID:600 -
\??\c:\pvvvv.exec:\pvvvv.exe58⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jdpjj.exec:\jdpjj.exe59⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xlrlrrr.exec:\xlrlrrr.exe60⤵
- Executes dropped EXE
PID:4504 -
\??\c:\ddpjj.exec:\ddpjj.exe61⤵
- Executes dropped EXE
PID:4108 -
\??\c:\3pdvv.exec:\3pdvv.exe62⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rxllffx.exec:\rxllffx.exe63⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vjpdv.exec:\vjpdv.exe64⤵
- Executes dropped EXE
PID:4404 -
\??\c:\5rxxrff.exec:\5rxxrff.exe65⤵
- Executes dropped EXE
PID:3492 -
\??\c:\flrlfxx.exec:\flrlfxx.exe66⤵PID:4016
-
\??\c:\hhnnhh.exec:\hhnnhh.exe67⤵PID:3704
-
\??\c:\dpvjd.exec:\dpvjd.exe68⤵PID:3208
-
\??\c:\flrfllf.exec:\flrfllf.exe69⤵PID:3376
-
\??\c:\bbbtbb.exec:\bbbtbb.exe70⤵PID:1768
-
\??\c:\vddpp.exec:\vddpp.exe71⤵PID:2448
-
\??\c:\dvvpj.exec:\dvvpj.exe72⤵PID:4412
-
\??\c:\xfrlffx.exec:\xfrlffx.exe73⤵PID:1832
-
\??\c:\pvdvp.exec:\pvdvp.exe74⤵PID:3460
-
\??\c:\9vvdv.exec:\9vvdv.exe75⤵PID:4300
-
\??\c:\lxfxffl.exec:\lxfxffl.exe76⤵PID:2420
-
\??\c:\5hbbtn.exec:\5hbbtn.exe77⤵PID:4828
-
\??\c:\vpppd.exec:\vpppd.exe78⤵PID:1812
-
\??\c:\rflxrrl.exec:\rflxrrl.exe79⤵PID:4756
-
\??\c:\btbbbb.exec:\btbbbb.exe80⤵PID:4156
-
\??\c:\5pdjd.exec:\5pdjd.exe81⤵PID:5104
-
\??\c:\dddvp.exec:\dddvp.exe82⤵PID:3696
-
\??\c:\lxrfxrf.exec:\lxrfxrf.exe83⤵PID:4928
-
\??\c:\httnbt.exec:\httnbt.exe84⤵PID:116
-
\??\c:\3lrxrfx.exec:\3lrxrfx.exe85⤵PID:2384
-
\??\c:\1lxfxfx.exec:\1lxfxfx.exe86⤵PID:1364
-
\??\c:\thtnhh.exec:\thtnhh.exe87⤵PID:1540
-
\??\c:\9vdpj.exec:\9vdpj.exe88⤵PID:2492
-
\??\c:\5lxxxfx.exec:\5lxxxfx.exe89⤵PID:1792
-
\??\c:\dpvpj.exec:\dpvpj.exe90⤵PID:2972
-
\??\c:\lllxllf.exec:\lllxllf.exe91⤵PID:5028
-
\??\c:\7bbtnh.exec:\7bbtnh.exe92⤵PID:5052
-
\??\c:\pvdvv.exec:\pvdvv.exe93⤵PID:996
-
\??\c:\fxrxlxl.exec:\fxrxlxl.exe94⤵PID:1772
-
\??\c:\5vvpj.exec:\5vvpj.exe95⤵PID:436
-
\??\c:\9rrfxxl.exec:\9rrfxxl.exe96⤵PID:3060
-
\??\c:\7htbtb.exec:\7htbtb.exe97⤵PID:4344
-
\??\c:\vvdpj.exec:\vvdpj.exe98⤵PID:1116
-
\??\c:\lllxrlf.exec:\lllxrlf.exe99⤵PID:4520
-
\??\c:\bttnhh.exec:\bttnhh.exe100⤵PID:3680
-
\??\c:\vjjvj.exec:\vjjvj.exe101⤵PID:2240
-
\??\c:\rfrflfx.exec:\rfrflfx.exe102⤵PID:4604
-
\??\c:\nttbhb.exec:\nttbhb.exe103⤵PID:1092
-
\??\c:\htbbbt.exec:\htbbbt.exe104⤵PID:3116
-
\??\c:\rrxrllf.exec:\rrxrllf.exe105⤵PID:2372
-
\??\c:\htnhtt.exec:\htnhtt.exe106⤵PID:1780
-
\??\c:\nhnhhh.exec:\nhnhhh.exe107⤵PID:4824
-
\??\c:\dpvjj.exec:\dpvjj.exe108⤵PID:1940
-
\??\c:\xllfrlf.exec:\xllfrlf.exe109⤵PID:4732
-
\??\c:\tntnbb.exec:\tntnbb.exe110⤵PID:2984
-
\??\c:\fxxrllf.exec:\fxxrllf.exe111⤵PID:1828
-
\??\c:\hhnntb.exec:\hhnntb.exe112⤵PID:4580
-
\??\c:\pjdvj.exec:\pjdvj.exe113⤵PID:1252
-
\??\c:\pddvj.exec:\pddvj.exe114⤵PID:4148
-
\??\c:\xllxlfx.exec:\xllxlfx.exe115⤵PID:4488
-
\??\c:\nttntn.exec:\nttntn.exe116⤵PID:4784
-
\??\c:\dvvdd.exec:\dvvdd.exe117⤵PID:744
-
\??\c:\rflfxxr.exec:\rflfxxr.exe118⤵PID:4440
-
\??\c:\ttbbnh.exec:\ttbbnh.exe119⤵PID:3024
-
\??\c:\jpjpd.exec:\jpjpd.exe120⤵PID:1492
-
\??\c:\frrfrxr.exec:\frrfrxr.exe121⤵PID:2864
-
\??\c:\ntnhbn.exec:\ntnhbn.exe122⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-