Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 07:08
Behavioral task
behavioral1
Sample
feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe
-
Size
333KB
-
MD5
a4af0b16db027f3bf8fdaa886eb41f4f
-
SHA1
1394a4df374c88044c7fcd297e8b1341d90eec68
-
SHA256
feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df
-
SHA512
de18ab3836384fca5496836c2d49fd57353e79f5ee71ea2f87916fba1eb22e2f16bcf15fea628070dc77497d64077b238cc96d2c0d12c668b6e1dca762443234
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeTX:R4wFHoSHYHUrAwfMp3CDj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4260-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1308-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/336-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/348-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/800-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/416-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-924-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4664 xlfxrrr.exe 2664 djddj.exe 3976 vpjdd.exe 4600 lxlllrr.exe 464 bnbbbb.exe 1872 hhnthn.exe 4972 dvjdd.exe 1140 lfxrfxl.exe 4692 rrrrxxf.exe 4080 rrrrllf.exe 1308 ppvvv.exe 4336 rrlllrr.exe 4136 bbnntt.exe 3932 9rxrlrl.exe 3812 ntbtnb.exe 876 ddjjj.exe 4564 nhnnnt.exe 2316 pvjdv.exe 3848 pppvj.exe 680 thhbtt.exe 1828 xrxxrxf.exe 336 ppvdv.exe 3948 ttbnnh.exe 4516 jpjjd.exe 3448 9tnnnb.exe 4716 xxxllrr.exe 2440 lrrrlll.exe 4504 nbhhhn.exe 316 bnhtbt.exe 3984 jdjjj.exe 3080 llrllll.exe 2128 vvddd.exe 4444 bnnbnn.exe 5056 dvjpj.exe 3328 rrlfxff.exe 2304 rrrrrrr.exe 1020 bthhhh.exe 1988 pjvdd.exe 4596 vpvpj.exe 1580 rlrxfxf.exe 408 bnbhhn.exe 4792 thttnt.exe 2824 1pjdv.exe 5072 1rffxlf.exe 636 5ttttt.exe 832 hbnhht.exe 2184 vppjv.exe 2688 1lfxlfx.exe 2460 bnnhhb.exe 4184 1djjd.exe 3616 flfrxxl.exe 3672 fxlllll.exe 4424 ttbtnh.exe 4524 hthhbb.exe 1032 jvvvj.exe 2176 lxfxffx.exe 4404 5rllfff.exe 4380 nhhnnn.exe 348 hhttbt.exe 1604 vvjdd.exe 2664 lfrllll.exe 508 rrffxxx.exe 800 nbhttt.exe 1708 pjvdj.exe -
resource yara_rule behavioral2/memory/4260-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c0f-3.dat upx behavioral2/memory/4260-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4664-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cad-11.dat upx behavioral2/files/0x0009000000023ca4-10.dat upx behavioral2/memory/2664-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3976-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cae-19.dat upx behavioral2/files/0x0007000000023cb0-23.dat upx behavioral2/memory/4600-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb1-28.dat upx behavioral2/files/0x0007000000023cb2-34.dat upx behavioral2/memory/4972-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb3-39.dat upx behavioral2/memory/1140-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1872-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb4-43.dat upx behavioral2/memory/1140-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb5-48.dat upx behavioral2/memory/4692-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb6-53.dat upx behavioral2/memory/4080-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb7-58.dat upx behavioral2/memory/1308-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb8-63.dat upx behavioral2/memory/4336-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4136-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-68.dat upx behavioral2/files/0x0007000000023cba-73.dat upx behavioral2/memory/3932-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbb-79.dat upx behavioral2/memory/3812-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/876-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ca5-84.dat upx behavioral2/memory/876-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-89.dat upx behavioral2/memory/4564-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2316-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbe-95.dat upx behavioral2/memory/3848-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbf-100.dat upx behavioral2/files/0x0007000000023cc0-104.dat upx behavioral2/files/0x0007000000023cc1-108.dat upx behavioral2/files/0x0007000000023cc2-112.dat upx behavioral2/memory/336-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3948-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc3-118.dat upx behavioral2/files/0x0007000000023cc4-122.dat upx behavioral2/files/0x0007000000023cc5-126.dat upx behavioral2/memory/3448-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4716-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc6-132.dat upx behavioral2/files/0x0007000000023cc7-136.dat upx behavioral2/files/0x0007000000023cc8-139.dat upx behavioral2/files/0x0007000000023cc9-144.dat upx behavioral2/files/0x0007000000023cca-148.dat upx behavioral2/memory/3984-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccb-152.dat upx behavioral2/memory/2128-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1988-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/408-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4792-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/636-187-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 4664 4260 feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe 82 PID 4260 wrote to memory of 4664 4260 feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe 82 PID 4260 wrote to memory of 4664 4260 feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe 82 PID 4664 wrote to memory of 2664 4664 xlfxrrr.exe 83 PID 4664 wrote to memory of 2664 4664 xlfxrrr.exe 83 PID 4664 wrote to memory of 2664 4664 xlfxrrr.exe 83 PID 2664 wrote to memory of 3976 2664 djddj.exe 84 PID 2664 wrote to memory of 3976 2664 djddj.exe 84 PID 2664 wrote to memory of 3976 2664 djddj.exe 84 PID 3976 wrote to memory of 4600 3976 vpjdd.exe 85 PID 3976 wrote to memory of 4600 3976 vpjdd.exe 85 PID 3976 wrote to memory of 4600 3976 vpjdd.exe 85 PID 4600 wrote to memory of 464 4600 lxlllrr.exe 86 PID 4600 wrote to memory of 464 4600 lxlllrr.exe 86 PID 4600 wrote to memory of 464 4600 lxlllrr.exe 86 PID 464 wrote to memory of 1872 464 bnbbbb.exe 87 PID 464 wrote to memory of 1872 464 bnbbbb.exe 87 PID 464 wrote to memory of 1872 464 bnbbbb.exe 87 PID 1872 wrote to memory of 4972 1872 hhnthn.exe 88 PID 1872 wrote to memory of 4972 1872 hhnthn.exe 88 PID 1872 wrote to memory of 4972 1872 hhnthn.exe 88 PID 4972 wrote to memory of 1140 4972 dvjdd.exe 89 PID 4972 wrote to memory of 1140 4972 dvjdd.exe 89 PID 4972 wrote to memory of 1140 4972 dvjdd.exe 89 PID 1140 wrote to memory of 4692 1140 lfxrfxl.exe 90 PID 1140 wrote to memory of 4692 1140 lfxrfxl.exe 90 PID 1140 wrote to memory of 4692 1140 lfxrfxl.exe 90 PID 4692 wrote to memory of 4080 4692 rrrrxxf.exe 91 PID 4692 wrote to memory of 4080 4692 rrrrxxf.exe 91 PID 4692 wrote to memory of 4080 4692 rrrrxxf.exe 91 PID 4080 wrote to memory of 1308 4080 rrrrllf.exe 92 PID 4080 wrote to memory of 1308 4080 rrrrllf.exe 92 PID 4080 wrote to memory of 1308 4080 rrrrllf.exe 92 PID 1308 wrote to memory of 4336 1308 ppvvv.exe 93 PID 1308 wrote to memory of 4336 1308 ppvvv.exe 93 PID 1308 wrote to memory of 4336 1308 ppvvv.exe 93 PID 4336 wrote to memory of 4136 4336 rrlllrr.exe 94 PID 4336 wrote to memory of 4136 4336 rrlllrr.exe 94 PID 4336 wrote to memory of 4136 4336 rrlllrr.exe 94 PID 4136 wrote to memory of 3932 4136 bbnntt.exe 95 PID 4136 wrote to memory of 3932 4136 bbnntt.exe 95 PID 4136 wrote to memory of 3932 4136 bbnntt.exe 95 PID 3932 wrote to memory of 3812 3932 9rxrlrl.exe 96 PID 3932 wrote to memory of 3812 3932 9rxrlrl.exe 96 PID 3932 wrote to memory of 3812 3932 9rxrlrl.exe 96 PID 3812 wrote to memory of 876 3812 ntbtnb.exe 97 PID 3812 wrote to memory of 876 3812 ntbtnb.exe 97 PID 3812 wrote to memory of 876 3812 ntbtnb.exe 97 PID 876 wrote to memory of 4564 876 ddjjj.exe 98 PID 876 wrote to memory of 4564 876 ddjjj.exe 98 PID 876 wrote to memory of 4564 876 ddjjj.exe 98 PID 4564 wrote to memory of 2316 4564 nhnnnt.exe 99 PID 4564 wrote to memory of 2316 4564 nhnnnt.exe 99 PID 4564 wrote to memory of 2316 4564 nhnnnt.exe 99 PID 2316 wrote to memory of 3848 2316 pvjdv.exe 100 PID 2316 wrote to memory of 3848 2316 pvjdv.exe 100 PID 2316 wrote to memory of 3848 2316 pvjdv.exe 100 PID 3848 wrote to memory of 680 3848 pppvj.exe 101 PID 3848 wrote to memory of 680 3848 pppvj.exe 101 PID 3848 wrote to memory of 680 3848 pppvj.exe 101 PID 680 wrote to memory of 1828 680 thhbtt.exe 102 PID 680 wrote to memory of 1828 680 thhbtt.exe 102 PID 680 wrote to memory of 1828 680 thhbtt.exe 102 PID 1828 wrote to memory of 336 1828 xrxxrxf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe"C:\Users\Admin\AppData\Local\Temp\feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\xlfxrrr.exec:\xlfxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\djddj.exec:\djddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vpjdd.exec:\vpjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\lxlllrr.exec:\lxlllrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\bnbbbb.exec:\bnbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\hhnthn.exec:\hhnthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\dvjdd.exec:\dvjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\lfxrfxl.exec:\lfxrfxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\rrrrxxf.exec:\rrrrxxf.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\rrrrllf.exec:\rrrrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\ppvvv.exec:\ppvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\rrlllrr.exec:\rrlllrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\bbnntt.exec:\bbnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\9rxrlrl.exec:\9rxrlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\ntbtnb.exec:\ntbtnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\ddjjj.exec:\ddjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\nhnnnt.exec:\nhnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\pvjdv.exec:\pvjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\pppvj.exec:\pppvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\thhbtt.exec:\thhbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\xrxxrxf.exec:\xrxxrxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\ppvdv.exec:\ppvdv.exe23⤵
- Executes dropped EXE
PID:336 -
\??\c:\ttbnnh.exec:\ttbnnh.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3948 -
\??\c:\jpjjd.exec:\jpjjd.exe25⤵
- Executes dropped EXE
PID:4516 -
\??\c:\9tnnnb.exec:\9tnnnb.exe26⤵
- Executes dropped EXE
PID:3448 -
\??\c:\xxxllrr.exec:\xxxllrr.exe27⤵
- Executes dropped EXE
PID:4716 -
\??\c:\lrrrlll.exec:\lrrrlll.exe28⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nbhhhn.exec:\nbhhhn.exe29⤵
- Executes dropped EXE
PID:4504 -
\??\c:\bnhtbt.exec:\bnhtbt.exe30⤵
- Executes dropped EXE
PID:316 -
\??\c:\jdjjj.exec:\jdjjj.exe31⤵
- Executes dropped EXE
PID:3984 -
\??\c:\llrllll.exec:\llrllll.exe32⤵
- Executes dropped EXE
PID:3080 -
\??\c:\vvddd.exec:\vvddd.exe33⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bnnbnn.exec:\bnnbnn.exe34⤵
- Executes dropped EXE
PID:4444 -
\??\c:\dvjpj.exec:\dvjpj.exe35⤵
- Executes dropped EXE
PID:5056 -
\??\c:\rrlfxff.exec:\rrlfxff.exe36⤵
- Executes dropped EXE
PID:3328 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe37⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bthhhh.exec:\bthhhh.exe38⤵
- Executes dropped EXE
PID:1020 -
\??\c:\pjvdd.exec:\pjvdd.exe39⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vpvpj.exec:\vpvpj.exe40⤵
- Executes dropped EXE
PID:4596 -
\??\c:\rlrxfxf.exec:\rlrxfxf.exe41⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bnbhhn.exec:\bnbhhn.exe42⤵
- Executes dropped EXE
PID:408 -
\??\c:\thttnt.exec:\thttnt.exe43⤵
- Executes dropped EXE
PID:4792 -
\??\c:\1pjdv.exec:\1pjdv.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1rffxlf.exec:\1rffxlf.exe45⤵
- Executes dropped EXE
PID:5072 -
\??\c:\5ttttt.exec:\5ttttt.exe46⤵
- Executes dropped EXE
PID:636 -
\??\c:\hbnhht.exec:\hbnhht.exe47⤵
- Executes dropped EXE
PID:832 -
\??\c:\vppjv.exec:\vppjv.exe48⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1lfxlfx.exec:\1lfxlfx.exe49⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bnnhhb.exec:\bnnhhb.exe50⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1djjd.exec:\1djjd.exe51⤵
- Executes dropped EXE
PID:4184 -
\??\c:\flfrxxl.exec:\flfrxxl.exe52⤵
- Executes dropped EXE
PID:3616 -
\??\c:\fxlllll.exec:\fxlllll.exe53⤵
- Executes dropped EXE
PID:3672 -
\??\c:\ttbtnh.exec:\ttbtnh.exe54⤵
- Executes dropped EXE
PID:4424 -
\??\c:\hthhbb.exec:\hthhbb.exe55⤵
- Executes dropped EXE
PID:4524 -
\??\c:\jvvvj.exec:\jvvvj.exe56⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lxfxffx.exec:\lxfxffx.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\5rllfff.exec:\5rllfff.exe58⤵
- Executes dropped EXE
PID:4404 -
\??\c:\nhhnnn.exec:\nhhnnn.exe59⤵
- Executes dropped EXE
PID:4380 -
\??\c:\hhttbt.exec:\hhttbt.exe60⤵
- Executes dropped EXE
PID:348 -
\??\c:\vvjdd.exec:\vvjdd.exe61⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lfrllll.exec:\lfrllll.exe62⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rrffxxx.exec:\rrffxxx.exe63⤵
- Executes dropped EXE
PID:508 -
\??\c:\nbhttt.exec:\nbhttt.exe64⤵
- Executes dropped EXE
PID:800 -
\??\c:\pjvdj.exec:\pjvdj.exe65⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lrlxlrr.exec:\lrlxlrr.exe66⤵PID:548
-
\??\c:\hhnnnn.exec:\hhnnnn.exe67⤵PID:2568
-
\??\c:\jdjdv.exec:\jdjdv.exe68⤵
- System Location Discovery: System Language Discovery
PID:1872 -
\??\c:\9xxlxrr.exec:\9xxlxrr.exe69⤵PID:3712
-
\??\c:\frxrfxx.exec:\frxrfxx.exe70⤵PID:4608
-
\??\c:\tnbbbh.exec:\tnbbbh.exe71⤵PID:2964
-
\??\c:\ddjjj.exec:\ddjjj.exe72⤵PID:2296
-
\??\c:\5jdvp.exec:\5jdvp.exe73⤵PID:4024
-
\??\c:\flxxrfr.exec:\flxxrfr.exe74⤵PID:2408
-
\??\c:\btnhnn.exec:\btnhnn.exe75⤵PID:4428
-
\??\c:\btbbtt.exec:\btbbtt.exe76⤵PID:3356
-
\??\c:\dvdvv.exec:\dvdvv.exe77⤵PID:2324
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe78⤵PID:2200
-
\??\c:\htnnhh.exec:\htnnhh.exe79⤵PID:416
-
\??\c:\tthnnn.exec:\tthnnn.exe80⤵PID:1076
-
\??\c:\9pvjd.exec:\9pvjd.exe81⤵PID:3736
-
\??\c:\ddjvj.exec:\ddjvj.exe82⤵PID:4964
-
\??\c:\ffrlxxf.exec:\ffrlxxf.exe83⤵PID:1080
-
\??\c:\thbhbb.exec:\thbhbb.exe84⤵PID:876
-
\??\c:\pjppj.exec:\pjppj.exe85⤵PID:2428
-
\??\c:\jdjjj.exec:\jdjjj.exe86⤵PID:2316
-
\??\c:\7rrlffx.exec:\7rrlffx.exe87⤵PID:4084
-
\??\c:\vdjdp.exec:\vdjdp.exe88⤵PID:4364
-
\??\c:\jdvpv.exec:\jdvpv.exe89⤵PID:4508
-
\??\c:\frffflr.exec:\frffflr.exe90⤵PID:2320
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe91⤵PID:1828
-
\??\c:\nbhbbh.exec:\nbhbbh.exe92⤵PID:336
-
\??\c:\nhnnhn.exec:\nhnnhn.exe93⤵PID:796
-
\??\c:\dpjjp.exec:\dpjjp.exe94⤵PID:1952
-
\??\c:\xrllfff.exec:\xrllfff.exe95⤵PID:3584
-
\??\c:\nhtnhn.exec:\nhtnhn.exe96⤵PID:4956
-
\??\c:\ttbbbh.exec:\ttbbbh.exe97⤵PID:2080
-
\??\c:\dppdp.exec:\dppdp.exe98⤵PID:5008
-
\??\c:\dpdvp.exec:\dpdvp.exe99⤵PID:3304
-
\??\c:\xrxrrlf.exec:\xrxrrlf.exe100⤵PID:3128
-
\??\c:\nbnnnn.exec:\nbnnnn.exe101⤵PID:4660
-
\??\c:\jjpvp.exec:\jjpvp.exe102⤵PID:316
-
\??\c:\vvdvj.exec:\vvdvj.exe103⤵PID:3696
-
\??\c:\fxrflfx.exec:\fxrflfx.exe104⤵PID:4544
-
\??\c:\ttnnbh.exec:\ttnnbh.exe105⤵PID:4904
-
\??\c:\vpjvj.exec:\vpjvj.exe106⤵PID:2128
-
\??\c:\ddjjv.exec:\ddjjv.exe107⤵PID:4444
-
\??\c:\lfxrfxx.exec:\lfxrfxx.exe108⤵PID:1276
-
\??\c:\ththbb.exec:\ththbb.exe109⤵PID:1832
-
\??\c:\pddvj.exec:\pddvj.exe110⤵PID:3156
-
\??\c:\fxfxrll.exec:\fxfxrll.exe111⤵PID:64
-
\??\c:\xxlrrlf.exec:\xxlrrlf.exe112⤵PID:1988
-
\??\c:\thhbhh.exec:\thhbhh.exe113⤵PID:2608
-
\??\c:\tthbtb.exec:\tthbtb.exe114⤵PID:2616
-
\??\c:\vpvpj.exec:\vpvpj.exe115⤵
- System Location Discovery: System Language Discovery
PID:4328 -
\??\c:\3fxrlfx.exec:\3fxrlfx.exe116⤵PID:1996
-
\??\c:\1hbttt.exec:\1hbttt.exe117⤵PID:2876
-
\??\c:\nbtnbb.exec:\nbtnbb.exe118⤵PID:1836
-
\??\c:\pjdvp.exec:\pjdvp.exe119⤵PID:1036
-
\??\c:\xllfxxr.exec:\xllfxxr.exe120⤵PID:4456
-
\??\c:\xfxxflx.exec:\xfxxflx.exe121⤵PID:3068
-
\??\c:\1nbtbh.exec:\1nbtbh.exe122⤵PID:4452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-