Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 09:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe
-
Size
453KB
-
MD5
754089979729cc9c5832818547315a06
-
SHA1
7e234f66e8c0ff49ea0ff5c2aad5ec2b963756b0
-
SHA256
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4
-
SHA512
ef310ffeee73e80a1afee43bc121128cf43c2e0008e6d2b8a0b01451c3b1c8da53b11e4236e7029332e7fcca02aa8f4e61cf29eab62a1876f605abb51a9c8573
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2584-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/792-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-914-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-924-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-949-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-1109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-1438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 208 tbhbbb.exe 2996 rxxxxxf.exe 3772 1nbttt.exe 3012 tthbbh.exe 3452 5jddd.exe 2180 xfllxfx.exe 2868 xxflrxl.exe 1056 jjjjp.exe 792 hhbbbh.exe 4800 llffflf.exe 2408 bbnhnn.exe 4340 rlrfrff.exe 3248 pvvpj.exe 764 bnhhht.exe 2296 rrllllx.exe 1892 nthhhh.exe 3808 pddvj.exe 4872 tnbbtb.exe 4380 rxxxxfl.exe 1680 hbhhhb.exe 4476 xxfffrl.exe 4896 ppddp.exe 3208 bttntb.exe 808 vjvvv.exe 1520 flfxllx.exe 1684 rxlllxx.exe 936 lllllll.exe 912 bnnnnh.exe 5064 bttttt.exe 5040 jjvdd.exe 3708 rlrrlfx.exe 752 3hbbbn.exe 3020 hhnhhh.exe 1120 jdddd.exe 3784 lrlllll.exe 4888 pvvvv.exe 4756 xlfxxxx.exe 3892 htbtnt.exe 548 vjjdv.exe 3260 lrxxrrl.exe 3128 pjpdj.exe 2068 3rlffff.exe 3440 bbhhhn.exe 4084 pvvvv.exe 4460 7xfrlrr.exe 4748 xlxxxxf.exe 1968 9jvvv.exe 4760 jddvp.exe 2992 lfrrxxx.exe 2084 ttbbht.exe 1188 pjppd.exe 2600 ffllrrr.exe 2552 bttnhh.exe 2000 bhnnth.exe 2156 pdpvp.exe 1880 ffrfrll.exe 964 btbbtt.exe 1068 pvvvv.exe 2756 3djjj.exe 4764 lfxrfxl.exe 764 tbbbbh.exe 4632 vpvpj.exe 1428 lrfrffr.exe 4088 bbtntt.exe -
resource yara_rule behavioral2/memory/2584-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/792-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-914-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2584 wrote to memory of 208 2584 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 83 PID 2584 wrote to memory of 208 2584 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 83 PID 2584 wrote to memory of 208 2584 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 83 PID 208 wrote to memory of 2996 208 tbhbbb.exe 84 PID 208 wrote to memory of 2996 208 tbhbbb.exe 84 PID 208 wrote to memory of 2996 208 tbhbbb.exe 84 PID 2996 wrote to memory of 3772 2996 rxxxxxf.exe 85 PID 2996 wrote to memory of 3772 2996 rxxxxxf.exe 85 PID 2996 wrote to memory of 3772 2996 rxxxxxf.exe 85 PID 3772 wrote to memory of 3012 3772 1nbttt.exe 86 PID 3772 wrote to memory of 3012 3772 1nbttt.exe 86 PID 3772 wrote to memory of 3012 3772 1nbttt.exe 86 PID 3012 wrote to memory of 3452 3012 tthbbh.exe 87 PID 3012 wrote to memory of 3452 3012 tthbbh.exe 87 PID 3012 wrote to memory of 3452 3012 tthbbh.exe 87 PID 3452 wrote to memory of 2180 3452 5jddd.exe 88 PID 3452 wrote to memory of 2180 3452 5jddd.exe 88 PID 3452 wrote to memory of 2180 3452 5jddd.exe 88 PID 2180 wrote to memory of 2868 2180 xfllxfx.exe 89 PID 2180 wrote to memory of 2868 2180 xfllxfx.exe 89 PID 2180 wrote to memory of 2868 2180 xfllxfx.exe 89 PID 2868 wrote to memory of 1056 2868 xxflrxl.exe 90 PID 2868 wrote to memory of 1056 2868 xxflrxl.exe 90 PID 2868 wrote to memory of 1056 2868 xxflrxl.exe 90 PID 1056 wrote to memory of 792 1056 jjjjp.exe 91 PID 1056 wrote to memory of 792 1056 jjjjp.exe 91 PID 1056 wrote to memory of 792 1056 jjjjp.exe 91 PID 792 wrote to memory of 4800 792 hhbbbh.exe 92 PID 792 wrote to memory of 4800 792 hhbbbh.exe 92 PID 792 wrote to memory of 4800 792 hhbbbh.exe 92 PID 4800 wrote to memory of 2408 4800 llffflf.exe 93 PID 4800 wrote to memory of 2408 4800 llffflf.exe 93 PID 4800 wrote to memory of 2408 4800 llffflf.exe 93 PID 2408 wrote to memory of 4340 2408 bbnhnn.exe 94 PID 2408 wrote to memory of 4340 2408 bbnhnn.exe 94 PID 2408 wrote to memory of 4340 2408 bbnhnn.exe 94 PID 4340 wrote to memory of 3248 4340 rlrfrff.exe 95 PID 4340 wrote to memory of 3248 4340 rlrfrff.exe 95 PID 4340 wrote to memory of 3248 4340 rlrfrff.exe 95 PID 3248 wrote to memory of 764 3248 pvvpj.exe 96 PID 3248 wrote to memory of 764 3248 pvvpj.exe 96 PID 3248 wrote to memory of 764 3248 pvvpj.exe 96 PID 764 wrote to memory of 2296 764 bnhhht.exe 97 PID 764 wrote to memory of 2296 764 bnhhht.exe 97 PID 764 wrote to memory of 2296 764 bnhhht.exe 97 PID 2296 wrote to memory of 1892 2296 rrllllx.exe 98 PID 2296 wrote to memory of 1892 2296 rrllllx.exe 98 PID 2296 wrote to memory of 1892 2296 rrllllx.exe 98 PID 1892 wrote to memory of 3808 1892 nthhhh.exe 99 PID 1892 wrote to memory of 3808 1892 nthhhh.exe 99 PID 1892 wrote to memory of 3808 1892 nthhhh.exe 99 PID 3808 wrote to memory of 4872 3808 pddvj.exe 100 PID 3808 wrote to memory of 4872 3808 pddvj.exe 100 PID 3808 wrote to memory of 4872 3808 pddvj.exe 100 PID 4872 wrote to memory of 4380 4872 tnbbtb.exe 101 PID 4872 wrote to memory of 4380 4872 tnbbtb.exe 101 PID 4872 wrote to memory of 4380 4872 tnbbtb.exe 101 PID 4380 wrote to memory of 1680 4380 rxxxxfl.exe 102 PID 4380 wrote to memory of 1680 4380 rxxxxfl.exe 102 PID 4380 wrote to memory of 1680 4380 rxxxxfl.exe 102 PID 1680 wrote to memory of 4476 1680 hbhhhb.exe 103 PID 1680 wrote to memory of 4476 1680 hbhhhb.exe 103 PID 1680 wrote to memory of 4476 1680 hbhhhb.exe 103 PID 4476 wrote to memory of 4896 4476 xxfffrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe"C:\Users\Admin\AppData\Local\Temp\f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\tbhbbb.exec:\tbhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\rxxxxxf.exec:\rxxxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\1nbttt.exec:\1nbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\tthbbh.exec:\tthbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\5jddd.exec:\5jddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\xfllxfx.exec:\xfllxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\xxflrxl.exec:\xxflrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\jjjjp.exec:\jjjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\hhbbbh.exec:\hhbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\llffflf.exec:\llffflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\bbnhnn.exec:\bbnhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\rlrfrff.exec:\rlrfrff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\pvvpj.exec:\pvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\bnhhht.exec:\bnhhht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\rrllllx.exec:\rrllllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\nthhhh.exec:\nthhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\pddvj.exec:\pddvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\tnbbtb.exec:\tnbbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\rxxxxfl.exec:\rxxxxfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\hbhhhb.exec:\hbhhhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\xxfffrl.exec:\xxfffrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\ppddp.exec:\ppddp.exe23⤵
- Executes dropped EXE
PID:4896 -
\??\c:\bttntb.exec:\bttntb.exe24⤵
- Executes dropped EXE
PID:3208 -
\??\c:\vjvvv.exec:\vjvvv.exe25⤵
- Executes dropped EXE
PID:808 -
\??\c:\flfxllx.exec:\flfxllx.exe26⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rxlllxx.exec:\rxlllxx.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lllllll.exec:\lllllll.exe28⤵
- Executes dropped EXE
PID:936 -
\??\c:\bnnnnh.exec:\bnnnnh.exe29⤵
- Executes dropped EXE
PID:912 -
\??\c:\bttttt.exec:\bttttt.exe30⤵
- Executes dropped EXE
PID:5064 -
\??\c:\jjvdd.exec:\jjvdd.exe31⤵
- Executes dropped EXE
PID:5040 -
\??\c:\rlrrlfx.exec:\rlrrlfx.exe32⤵
- Executes dropped EXE
PID:3708 -
\??\c:\3hbbbn.exec:\3hbbbn.exe33⤵
- Executes dropped EXE
PID:752 -
\??\c:\hhnhhh.exec:\hhnhhh.exe34⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jdddd.exec:\jdddd.exe35⤵
- Executes dropped EXE
PID:1120 -
\??\c:\lrlllll.exec:\lrlllll.exe36⤵
- Executes dropped EXE
PID:3784 -
\??\c:\pvvvv.exec:\pvvvv.exe37⤵
- Executes dropped EXE
PID:4888 -
\??\c:\xlfxxxx.exec:\xlfxxxx.exe38⤵
- Executes dropped EXE
PID:4756 -
\??\c:\htbtnt.exec:\htbtnt.exe39⤵
- Executes dropped EXE
PID:3892 -
\??\c:\vjjdv.exec:\vjjdv.exe40⤵
- Executes dropped EXE
PID:548 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe41⤵
- Executes dropped EXE
PID:3260 -
\??\c:\pjpdj.exec:\pjpdj.exe42⤵
- Executes dropped EXE
PID:3128 -
\??\c:\3rlffff.exec:\3rlffff.exe43⤵
- Executes dropped EXE
PID:2068 -
\??\c:\bbhhhn.exec:\bbhhhn.exe44⤵
- Executes dropped EXE
PID:3440 -
\??\c:\pvvvv.exec:\pvvvv.exe45⤵
- Executes dropped EXE
PID:4084 -
\??\c:\7xfrlrr.exec:\7xfrlrr.exe46⤵
- Executes dropped EXE
PID:4460 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe47⤵
- Executes dropped EXE
PID:4748 -
\??\c:\9jvvv.exec:\9jvvv.exe48⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jddvp.exec:\jddvp.exe49⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe50⤵
- Executes dropped EXE
PID:2992 -
\??\c:\ttbbht.exec:\ttbbht.exe51⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pjppd.exec:\pjppd.exe52⤵
- Executes dropped EXE
PID:1188 -
\??\c:\ffllrrr.exec:\ffllrrr.exe53⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bttnhh.exec:\bttnhh.exe54⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bhnnth.exec:\bhnnth.exe55⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pdpvp.exec:\pdpvp.exe56⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ffrfrll.exec:\ffrfrll.exe57⤵
- Executes dropped EXE
PID:1880 -
\??\c:\btbbtt.exec:\btbbtt.exe58⤵
- Executes dropped EXE
PID:964 -
\??\c:\pvvvv.exec:\pvvvv.exe59⤵
- Executes dropped EXE
PID:1068 -
\??\c:\3djjj.exec:\3djjj.exe60⤵
- Executes dropped EXE
PID:2756 -
\??\c:\lfxrfxl.exec:\lfxrfxl.exe61⤵
- Executes dropped EXE
PID:4764 -
\??\c:\tbbbbh.exec:\tbbbbh.exe62⤵
- Executes dropped EXE
PID:764 -
\??\c:\vpvpj.exec:\vpvpj.exe63⤵
- Executes dropped EXE
PID:4632 -
\??\c:\lrfrffr.exec:\lrfrffr.exe64⤵
- Executes dropped EXE
PID:1428 -
\??\c:\bbtntt.exec:\bbtntt.exe65⤵
- Executes dropped EXE
PID:4088 -
\??\c:\jdvjj.exec:\jdvjj.exe66⤵PID:3808
-
\??\c:\xfffxfr.exec:\xfffxfr.exe67⤵PID:4652
-
\??\c:\tbtthn.exec:\tbtthn.exe68⤵PID:4300
-
\??\c:\jpppp.exec:\jpppp.exe69⤵PID:4508
-
\??\c:\jpddp.exec:\jpddp.exe70⤵PID:3172
-
\??\c:\9thbbh.exec:\9thbbh.exe71⤵PID:2412
-
\??\c:\btbttb.exec:\btbttb.exe72⤵PID:1568
-
\??\c:\vdpjj.exec:\vdpjj.exe73⤵PID:4160
-
\??\c:\3lxffff.exec:\3lxffff.exe74⤵PID:3212
-
\??\c:\hhtttb.exec:\hhtttb.exe75⤵PID:1964
-
\??\c:\dpdjv.exec:\dpdjv.exe76⤵PID:972
-
\??\c:\rxlfxxf.exec:\rxlfxxf.exe77⤵PID:3224
-
\??\c:\xxxllll.exec:\xxxllll.exe78⤵PID:1012
-
\??\c:\ntttnb.exec:\ntttnb.exe79⤵PID:2784
-
\??\c:\djvdd.exec:\djvdd.exe80⤵PID:4584
-
\??\c:\lfrfxxx.exec:\lfrfxxx.exe81⤵PID:4808
-
\??\c:\1bbbbh.exec:\1bbbbh.exe82⤵PID:1128
-
\??\c:\jpddd.exec:\jpddd.exe83⤵PID:4844
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe84⤵PID:4156
-
\??\c:\bbnbtb.exec:\bbnbtb.exe85⤵PID:744
-
\??\c:\tbnttt.exec:\tbnttt.exe86⤵PID:4276
-
\??\c:\vdppv.exec:\vdppv.exe87⤵PID:4880
-
\??\c:\1xxlfll.exec:\1xxlfll.exe88⤵PID:4052
-
\??\c:\bttttt.exec:\bttttt.exe89⤵PID:3968
-
\??\c:\jpppv.exec:\jpppv.exe90⤵PID:3044
-
\??\c:\lfllrrx.exec:\lfllrrx.exe91⤵PID:3820
-
\??\c:\9tnnhn.exec:\9tnnhn.exe92⤵PID:3116
-
\??\c:\bhbbbb.exec:\bhbbbb.exe93⤵PID:4528
-
\??\c:\5pjpp.exec:\5pjpp.exe94⤵PID:2288
-
\??\c:\fffffff.exec:\fffffff.exe95⤵PID:2392
-
\??\c:\1bnbtb.exec:\1bnbtb.exe96⤵PID:544
-
\??\c:\pvdjd.exec:\pvdjd.exe97⤵PID:3984
-
\??\c:\lrllflx.exec:\lrllflx.exe98⤵PID:392
-
\??\c:\tthhhh.exec:\tthhhh.exe99⤵PID:1904
-
\??\c:\jjvdv.exec:\jjvdv.exe100⤵PID:208
-
\??\c:\3lfxxxx.exec:\3lfxxxx.exe101⤵PID:2160
-
\??\c:\nbhbbb.exec:\nbhbbb.exe102⤵PID:3888
-
\??\c:\ttttnn.exec:\ttttnn.exe103⤵PID:4416
-
\??\c:\vdjpv.exec:\vdjpv.exe104⤵PID:4320
-
\??\c:\xxfrfll.exec:\xxfrfll.exe105⤵PID:4460
-
\??\c:\thnnnn.exec:\thnnnn.exe106⤵PID:2636
-
\??\c:\bbbtnn.exec:\bbbtnn.exe107⤵PID:4620
-
\??\c:\jpvpv.exec:\jpvpv.exe108⤵PID:3584
-
\??\c:\3xllrrr.exec:\3xllrrr.exe109⤵PID:2180
-
\??\c:\hthhbb.exec:\hthhbb.exe110⤵PID:2328
-
\??\c:\dvvjp.exec:\dvvjp.exe111⤵PID:2324
-
\??\c:\rlxffll.exec:\rlxffll.exe112⤵PID:1056
-
\??\c:\nnnbbb.exec:\nnnbbb.exe113⤵PID:1768
-
\??\c:\jvvpj.exec:\jvvpj.exe114⤵PID:184
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe115⤵PID:112
-
\??\c:\1hthbn.exec:\1hthbn.exe116⤵PID:3872
-
\??\c:\tnhhhh.exec:\tnhhhh.exe117⤵PID:4964
-
\??\c:\pvvvp.exec:\pvvvp.exe118⤵PID:4340
-
\??\c:\3ntttt.exec:\3ntttt.exe119⤵PID:3028
-
\??\c:\1jdvj.exec:\1jdvj.exe120⤵PID:4360
-
\??\c:\flffrlf.exec:\flffrlf.exe121⤵PID:4256
-
\??\c:\llllfll.exec:\llllfll.exe122⤵PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-