Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 09:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe
-
Size
454KB
-
MD5
5bdb15a4f914b7ce8d6859308024c80f
-
SHA1
34dffca373535f5cb4c97a085eb0feadfe343e64
-
SHA256
fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9
-
SHA512
67f76913a83e0b45d397acd3adaa23950236cb9e8aee178cb794e996f75861f0e47199788805dfcfd09821ed60b2f2db4a48f809f855a65e22df74b9b7c458d3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3128-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/600-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-945-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-1411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 548 3pjjd.exe 4912 vdpjj.exe 4640 xffllff.exe 3076 btnhhh.exe 2328 rxrrlrl.exe 3976 fxfffff.exe 2892 tbbtnn.exe 2800 5flfffx.exe 2948 ffffffl.exe 2000 tbbbtb.exe 768 rrrrlll.exe 2452 pdvpj.exe 2656 rrrlllf.exe 1760 7nbbtt.exe 212 jvddv.exe 4808 tnhhbt.exe 4508 vddpj.exe 4584 xrrrrfx.exe 2312 xfrrrxx.exe 4588 nthhhn.exe 1372 pjpjd.exe 4076 lrxfxfr.exe 3720 7lrrxfx.exe 1992 xrlfffx.exe 4504 jjddd.exe 916 bnnhtt.exe 2220 5rrrrrr.exe 2776 ddjjj.exe 4804 7hhbhn.exe 432 1jpjj.exe 3260 vdvvj.exe 4452 vvppj.exe 4500 1fxxrrr.exe 1052 nthhhn.exe 4068 rxxxrrr.exe 1616 flllrxx.exe 4652 bbnnnt.exe 1516 lxxlfxr.exe 1284 3ntnnh.exe 2792 pdvvp.exe 4388 rrxxrrr.exe 4008 nhttbt.exe 1988 jpppj.exe 2400 vvjjp.exe 1820 1fflfff.exe 4944 nthnhn.exe 2840 1jpjp.exe 4408 5ppjd.exe 4856 rflfxxx.exe 1340 1bnnhn.exe 3844 ddjpv.exe 4780 nnnhhh.exe 5104 vvvdp.exe 2412 rllxfxr.exe 3208 hntttt.exe 2544 pdddp.exe 4420 lxffllr.exe 4188 tbhnnn.exe 1540 vdpvv.exe 3652 lxfrfff.exe 3560 ntttnb.exe 996 1tnnnn.exe 2396 ddppp.exe 2000 xfxllll.exe -
resource yara_rule behavioral2/memory/3128-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/600-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-689-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3128 wrote to memory of 548 3128 fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe 83 PID 3128 wrote to memory of 548 3128 fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe 83 PID 3128 wrote to memory of 548 3128 fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe 83 PID 548 wrote to memory of 4912 548 3pjjd.exe 84 PID 548 wrote to memory of 4912 548 3pjjd.exe 84 PID 548 wrote to memory of 4912 548 3pjjd.exe 84 PID 4912 wrote to memory of 4640 4912 vdpjj.exe 85 PID 4912 wrote to memory of 4640 4912 vdpjj.exe 85 PID 4912 wrote to memory of 4640 4912 vdpjj.exe 85 PID 4640 wrote to memory of 3076 4640 xffllff.exe 86 PID 4640 wrote to memory of 3076 4640 xffllff.exe 86 PID 4640 wrote to memory of 3076 4640 xffllff.exe 86 PID 3076 wrote to memory of 2328 3076 btnhhh.exe 87 PID 3076 wrote to memory of 2328 3076 btnhhh.exe 87 PID 3076 wrote to memory of 2328 3076 btnhhh.exe 87 PID 2328 wrote to memory of 3976 2328 rxrrlrl.exe 88 PID 2328 wrote to memory of 3976 2328 rxrrlrl.exe 88 PID 2328 wrote to memory of 3976 2328 rxrrlrl.exe 88 PID 3976 wrote to memory of 2892 3976 fxfffff.exe 89 PID 3976 wrote to memory of 2892 3976 fxfffff.exe 89 PID 3976 wrote to memory of 2892 3976 fxfffff.exe 89 PID 2892 wrote to memory of 2800 2892 tbbtnn.exe 90 PID 2892 wrote to memory of 2800 2892 tbbtnn.exe 90 PID 2892 wrote to memory of 2800 2892 tbbtnn.exe 90 PID 2800 wrote to memory of 2948 2800 5flfffx.exe 91 PID 2800 wrote to memory of 2948 2800 5flfffx.exe 91 PID 2800 wrote to memory of 2948 2800 5flfffx.exe 91 PID 2948 wrote to memory of 2000 2948 ffffffl.exe 92 PID 2948 wrote to memory of 2000 2948 ffffffl.exe 92 PID 2948 wrote to memory of 2000 2948 ffffffl.exe 92 PID 2000 wrote to memory of 768 2000 tbbbtb.exe 93 PID 2000 wrote to memory of 768 2000 tbbbtb.exe 93 PID 2000 wrote to memory of 768 2000 tbbbtb.exe 93 PID 768 wrote to memory of 2452 768 rrrrlll.exe 94 PID 768 wrote to memory of 2452 768 rrrrlll.exe 94 PID 768 wrote to memory of 2452 768 rrrrlll.exe 94 PID 2452 wrote to memory of 2656 2452 pdvpj.exe 95 PID 2452 wrote to memory of 2656 2452 pdvpj.exe 95 PID 2452 wrote to memory of 2656 2452 pdvpj.exe 95 PID 2656 wrote to memory of 1760 2656 rrrlllf.exe 96 PID 2656 wrote to memory of 1760 2656 rrrlllf.exe 96 PID 2656 wrote to memory of 1760 2656 rrrlllf.exe 96 PID 1760 wrote to memory of 212 1760 7nbbtt.exe 97 PID 1760 wrote to memory of 212 1760 7nbbtt.exe 97 PID 1760 wrote to memory of 212 1760 7nbbtt.exe 97 PID 212 wrote to memory of 4808 212 jvddv.exe 98 PID 212 wrote to memory of 4808 212 jvddv.exe 98 PID 212 wrote to memory of 4808 212 jvddv.exe 98 PID 4808 wrote to memory of 4508 4808 tnhhbt.exe 99 PID 4808 wrote to memory of 4508 4808 tnhhbt.exe 99 PID 4808 wrote to memory of 4508 4808 tnhhbt.exe 99 PID 4508 wrote to memory of 4584 4508 vddpj.exe 100 PID 4508 wrote to memory of 4584 4508 vddpj.exe 100 PID 4508 wrote to memory of 4584 4508 vddpj.exe 100 PID 4584 wrote to memory of 2312 4584 xrrrrfx.exe 101 PID 4584 wrote to memory of 2312 4584 xrrrrfx.exe 101 PID 4584 wrote to memory of 2312 4584 xrrrrfx.exe 101 PID 2312 wrote to memory of 4588 2312 xfrrrxx.exe 102 PID 2312 wrote to memory of 4588 2312 xfrrrxx.exe 102 PID 2312 wrote to memory of 4588 2312 xfrrrxx.exe 102 PID 4588 wrote to memory of 1372 4588 nthhhn.exe 103 PID 4588 wrote to memory of 1372 4588 nthhhn.exe 103 PID 4588 wrote to memory of 1372 4588 nthhhn.exe 103 PID 1372 wrote to memory of 4076 1372 pjpjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe"C:\Users\Admin\AppData\Local\Temp\fb2266f7496cc1b937711f335176cc97709b3de82913c4edf9831641922afde9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\3pjjd.exec:\3pjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\vdpjj.exec:\vdpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\xffllff.exec:\xffllff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\btnhhh.exec:\btnhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\rxrrlrl.exec:\rxrrlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\fxfffff.exec:\fxfffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\tbbtnn.exec:\tbbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\5flfffx.exec:\5flfffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ffffffl.exec:\ffffffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\tbbbtb.exec:\tbbbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\rrrrlll.exec:\rrrrlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\pdvpj.exec:\pdvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\rrrlllf.exec:\rrrlllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7nbbtt.exec:\7nbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\jvddv.exec:\jvddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\tnhhbt.exec:\tnhhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\vddpj.exec:\vddpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\xrrrrfx.exec:\xrrrrfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\xfrrrxx.exec:\xfrrrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\nthhhn.exec:\nthhhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\pjpjd.exec:\pjpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\lrxfxfr.exec:\lrxfxfr.exe23⤵
- Executes dropped EXE
PID:4076 -
\??\c:\7lrrxfx.exec:\7lrrxfx.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3720 -
\??\c:\xrlfffx.exec:\xrlfffx.exe25⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jjddd.exec:\jjddd.exe26⤵
- Executes dropped EXE
PID:4504 -
\??\c:\bnnhtt.exec:\bnnhtt.exe27⤵
- Executes dropped EXE
PID:916 -
\??\c:\5rrrrrr.exec:\5rrrrrr.exe28⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ddjjj.exec:\ddjjj.exe29⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7hhbhn.exec:\7hhbhn.exe30⤵
- Executes dropped EXE
PID:4804 -
\??\c:\1jpjj.exec:\1jpjj.exe31⤵
- Executes dropped EXE
PID:432 -
\??\c:\vdvvj.exec:\vdvvj.exe32⤵
- Executes dropped EXE
PID:3260 -
\??\c:\vvppj.exec:\vvppj.exe33⤵
- Executes dropped EXE
PID:4452 -
\??\c:\1fxxrrr.exec:\1fxxrrr.exe34⤵
- Executes dropped EXE
PID:4500 -
\??\c:\nthhhn.exec:\nthhhn.exe35⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe36⤵
- Executes dropped EXE
PID:4068 -
\??\c:\flllrxx.exec:\flllrxx.exe37⤵
- Executes dropped EXE
PID:1616 -
\??\c:\bbnnnt.exec:\bbnnnt.exe38⤵
- Executes dropped EXE
PID:4652 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe39⤵
- Executes dropped EXE
PID:1516 -
\??\c:\3ntnnh.exec:\3ntnnh.exe40⤵
- Executes dropped EXE
PID:1284 -
\??\c:\pdvvp.exec:\pdvvp.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe42⤵
- Executes dropped EXE
PID:4388 -
\??\c:\nhttbt.exec:\nhttbt.exe43⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jpppj.exec:\jpppj.exe44⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vvjjp.exec:\vvjjp.exe45⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1fflfff.exec:\1fflfff.exe46⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nthnhn.exec:\nthnhn.exe47⤵
- Executes dropped EXE
PID:4944 -
\??\c:\1jpjp.exec:\1jpjp.exe48⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5ppjd.exec:\5ppjd.exe49⤵
- Executes dropped EXE
PID:4408 -
\??\c:\rflfxxx.exec:\rflfxxx.exe50⤵
- Executes dropped EXE
PID:4856 -
\??\c:\1bnnhn.exec:\1bnnhn.exe51⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ddjpv.exec:\ddjpv.exe52⤵
- Executes dropped EXE
PID:3844 -
\??\c:\nnnhhh.exec:\nnnhhh.exe53⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vvvdp.exec:\vvvdp.exe54⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rllxfxr.exec:\rllxfxr.exe55⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hntttt.exec:\hntttt.exe56⤵
- Executes dropped EXE
PID:3208 -
\??\c:\pdddp.exec:\pdddp.exe57⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lxffllr.exec:\lxffllr.exe58⤵
- Executes dropped EXE
PID:4420 -
\??\c:\tbhnnn.exec:\tbhnnn.exe59⤵
- Executes dropped EXE
PID:4188 -
\??\c:\vdpvv.exec:\vdpvv.exe60⤵
- Executes dropped EXE
PID:1540 -
\??\c:\lxfrfff.exec:\lxfrfff.exe61⤵
- Executes dropped EXE
PID:3652 -
\??\c:\ntttnb.exec:\ntttnb.exe62⤵
- Executes dropped EXE
PID:3560 -
\??\c:\1tnnnn.exec:\1tnnnn.exe63⤵
- Executes dropped EXE
PID:996 -
\??\c:\ddppp.exec:\ddppp.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\xfxllll.exec:\xfxllll.exe65⤵
- Executes dropped EXE
PID:2000 -
\??\c:\tbbbbn.exec:\tbbbbn.exe66⤵PID:228
-
\??\c:\jdjpv.exec:\jdjpv.exe67⤵PID:5052
-
\??\c:\xflflrr.exec:\xflflrr.exe68⤵PID:3132
-
\??\c:\htbbbb.exec:\htbbbb.exe69⤵PID:4900
-
\??\c:\7pvpp.exec:\7pvpp.exe70⤵PID:1692
-
\??\c:\rrflrxx.exec:\rrflrxx.exe71⤵PID:1432
-
\??\c:\bthhbh.exec:\bthhbh.exe72⤵PID:2908
-
\??\c:\vvdvj.exec:\vvdvj.exe73⤵PID:4496
-
\??\c:\rfllxlx.exec:\rfllxlx.exe74⤵PID:3492
-
\??\c:\lrllrrr.exec:\lrllrrr.exe75⤵PID:3160
-
\??\c:\bhbbhh.exec:\bhbbhh.exe76⤵PID:2528
-
\??\c:\pdvpp.exec:\pdvpp.exe77⤵PID:3656
-
\??\c:\xflllll.exec:\xflllll.exe78⤵PID:3104
-
\??\c:\btbbbb.exec:\btbbbb.exe79⤵PID:2496
-
\??\c:\vdddd.exec:\vdddd.exe80⤵PID:5032
-
\??\c:\xffrllf.exec:\xffrllf.exe81⤵PID:1452
-
\??\c:\9ntbnt.exec:\9ntbnt.exe82⤵PID:600
-
\??\c:\7vjdv.exec:\7vjdv.exe83⤵PID:1240
-
\??\c:\ppppp.exec:\ppppp.exe84⤵PID:3600
-
\??\c:\xxxxxxf.exec:\xxxxxxf.exe85⤵PID:4972
-
\??\c:\ntttnt.exec:\ntttnt.exe86⤵PID:3580
-
\??\c:\ppdjj.exec:\ppdjj.exe87⤵PID:916
-
\??\c:\llffflr.exec:\llffflr.exe88⤵PID:2964
-
\??\c:\xfffxxl.exec:\xfffxxl.exe89⤵PID:2280
-
\??\c:\bnhbnh.exec:\bnhbnh.exe90⤵PID:4960
-
\??\c:\vpppv.exec:\vpppv.exe91⤵PID:4016
-
\??\c:\fxxrllf.exec:\fxxrllf.exe92⤵PID:3236
-
\??\c:\nnttbh.exec:\nnttbh.exe93⤵PID:1404
-
\??\c:\bntbbh.exec:\bntbbh.exe94⤵PID:2212
-
\??\c:\vvvvj.exec:\vvvvj.exe95⤵PID:220
-
\??\c:\hnbbbh.exec:\hnbbbh.exe96⤵PID:1828
-
\??\c:\1ntttb.exec:\1ntttb.exe97⤵PID:1052
-
\??\c:\1vppd.exec:\1vppd.exe98⤵PID:2620
-
\??\c:\xrxfxxr.exec:\xrxfxxr.exe99⤵PID:4432
-
\??\c:\bbhhbb.exec:\bbhhbb.exe100⤵PID:4652
-
\??\c:\hbhnhn.exec:\hbhnhn.exe101⤵PID:376
-
\??\c:\pvjpj.exec:\pvjpj.exe102⤵PID:2660
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe103⤵PID:4544
-
\??\c:\nbntnt.exec:\nbntnt.exe104⤵PID:1952
-
\??\c:\bhbbhn.exec:\bhbbhn.exe105⤵PID:3956
-
\??\c:\1vvvv.exec:\1vvvv.exe106⤵PID:2996
-
\??\c:\5lxxffl.exec:\5lxxffl.exe107⤵PID:1592
-
\??\c:\bnbbnt.exec:\bnbbnt.exe108⤵PID:864
-
\??\c:\nbtttt.exec:\nbtttt.exe109⤵PID:3616
-
\??\c:\ppddj.exec:\ppddj.exe110⤵PID:4376
-
\??\c:\7rffxfr.exec:\7rffxfr.exe111⤵PID:744
-
\??\c:\ntbbbh.exec:\ntbbbh.exe112⤵PID:4928
-
\??\c:\ddjdj.exec:\ddjdj.exe113⤵PID:1296
-
\??\c:\fxllfll.exec:\fxllfll.exe114⤵PID:4836
-
\??\c:\fllffll.exec:\fllffll.exe115⤵PID:4992
-
\??\c:\nhhnnt.exec:\nhhnnt.exe116⤵PID:184
-
\??\c:\7dddj.exec:\7dddj.exe117⤵PID:4640
-
\??\c:\flxxfxf.exec:\flxxfxf.exe118⤵PID:2036
-
\??\c:\hntbhh.exec:\hntbhh.exe119⤵PID:1532
-
\??\c:\jvppd.exec:\jvppd.exe120⤵PID:4560
-
\??\c:\jjdvp.exec:\jjdvp.exe121⤵PID:4260
-
\??\c:\1fxxflf.exec:\1fxxflf.exe122⤵PID:2608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-