Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 21:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe
-
Size
454KB
-
MD5
3ae412290ed5e15b39a272fc1989956f
-
SHA1
c9f6d25cf2b501090cf07aed88a250f824aa2b30
-
SHA256
414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5
-
SHA512
7c63868cad38872f2ee148ce049a4108139f72d521187911bf98ab517e851bc149db0754623cdd01f01ca4dcfcc72d470c0d1ef30db7eea2e8b6d602259e8507
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeQ:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4904-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-828-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-1006-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-1019-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-1161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-1290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-1550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3684 flflllf.exe 4252 5bbtnh.exe 3500 pdjdd.exe 1640 pjjdv.exe 2068 7xfxfff.exe 2080 tttntt.exe 4280 3ntnnn.exe 5012 djpjd.exe 3284 rrrlrrx.exe 4448 rlrxrll.exe 1036 bntnhb.exe 2428 vjpjd.exe 1016 vjpjd.exe 3056 3ffxflf.exe 3268 3hnhbb.exe 684 3bbtnn.exe 2228 jvdjj.exe 2564 xfxxllf.exe 4576 tttnhh.exe 3520 vvvvp.exe 1504 frlfxlr.exe 1428 btthbn.exe 4076 1ttnhh.exe 5068 vdpvv.exe 2368 rlfrlrf.exe 4008 1tnhbn.exe 3312 9pppj.exe 2424 rllffxl.exe 2132 xlxrrxx.exe 3484 bnnhbb.exe 2660 vpdjp.exe 4048 vjvdj.exe 4820 xxlflll.exe 4212 tthbbb.exe 2748 bttnnh.exe 3708 jpdpp.exe 3992 lrxxrrl.exe 744 5lrllll.exe 4964 9hbhbn.exe 4732 5thbhh.exe 4380 pjjdv.exe 4420 lflfllr.exe 2452 lrllffx.exe 2820 btbttb.exe 64 jddvv.exe 756 jddvp.exe 3580 xrrfrrl.exe 3864 lrxrlfx.exe 448 nntttt.exe 4324 vpvdv.exe 1676 jdjdv.exe 2276 1rrlflf.exe 5116 hthbtb.exe 4316 bnbhbb.exe 2208 3vjdj.exe 3804 xxxxrxr.exe 2144 rlllfff.exe 2068 bnnhbt.exe 2904 vjpvv.exe 2196 rxrfrfr.exe 1476 rlfxrll.exe 4980 hbbhbh.exe 1036 vddvp.exe 4748 rxxrrfx.exe -
resource yara_rule behavioral2/memory/4904-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-1092-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 3684 4904 414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe 83 PID 4904 wrote to memory of 3684 4904 414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe 83 PID 4904 wrote to memory of 3684 4904 414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe 83 PID 3684 wrote to memory of 4252 3684 flflllf.exe 84 PID 3684 wrote to memory of 4252 3684 flflllf.exe 84 PID 3684 wrote to memory of 4252 3684 flflllf.exe 84 PID 4252 wrote to memory of 3500 4252 5bbtnh.exe 85 PID 4252 wrote to memory of 3500 4252 5bbtnh.exe 85 PID 4252 wrote to memory of 3500 4252 5bbtnh.exe 85 PID 3500 wrote to memory of 1640 3500 pdjdd.exe 86 PID 3500 wrote to memory of 1640 3500 pdjdd.exe 86 PID 3500 wrote to memory of 1640 3500 pdjdd.exe 86 PID 1640 wrote to memory of 2068 1640 pjjdv.exe 140 PID 1640 wrote to memory of 2068 1640 pjjdv.exe 140 PID 1640 wrote to memory of 2068 1640 pjjdv.exe 140 PID 2068 wrote to memory of 2080 2068 7xfxfff.exe 88 PID 2068 wrote to memory of 2080 2068 7xfxfff.exe 88 PID 2068 wrote to memory of 2080 2068 7xfxfff.exe 88 PID 2080 wrote to memory of 4280 2080 tttntt.exe 89 PID 2080 wrote to memory of 4280 2080 tttntt.exe 89 PID 2080 wrote to memory of 4280 2080 tttntt.exe 89 PID 4280 wrote to memory of 5012 4280 3ntnnn.exe 90 PID 4280 wrote to memory of 5012 4280 3ntnnn.exe 90 PID 4280 wrote to memory of 5012 4280 3ntnnn.exe 90 PID 5012 wrote to memory of 3284 5012 djpjd.exe 91 PID 5012 wrote to memory of 3284 5012 djpjd.exe 91 PID 5012 wrote to memory of 3284 5012 djpjd.exe 91 PID 3284 wrote to memory of 4448 3284 rrrlrrx.exe 92 PID 3284 wrote to memory of 4448 3284 rrrlrrx.exe 92 PID 3284 wrote to memory of 4448 3284 rrrlrrx.exe 92 PID 4448 wrote to memory of 1036 4448 rlrxrll.exe 145 PID 4448 wrote to memory of 1036 4448 rlrxrll.exe 145 PID 4448 wrote to memory of 1036 4448 rlrxrll.exe 145 PID 1036 wrote to memory of 2428 1036 bntnhb.exe 94 PID 1036 wrote to memory of 2428 1036 bntnhb.exe 94 PID 1036 wrote to memory of 2428 1036 bntnhb.exe 94 PID 2428 wrote to memory of 1016 2428 vjpjd.exe 95 PID 2428 wrote to memory of 1016 2428 vjpjd.exe 95 PID 2428 wrote to memory of 1016 2428 vjpjd.exe 95 PID 1016 wrote to memory of 3056 1016 vjpjd.exe 96 PID 1016 wrote to memory of 3056 1016 vjpjd.exe 96 PID 1016 wrote to memory of 3056 1016 vjpjd.exe 96 PID 3056 wrote to memory of 3268 3056 3ffxflf.exe 97 PID 3056 wrote to memory of 3268 3056 3ffxflf.exe 97 PID 3056 wrote to memory of 3268 3056 3ffxflf.exe 97 PID 3268 wrote to memory of 684 3268 3hnhbb.exe 98 PID 3268 wrote to memory of 684 3268 3hnhbb.exe 98 PID 3268 wrote to memory of 684 3268 3hnhbb.exe 98 PID 684 wrote to memory of 2228 684 3bbtnn.exe 99 PID 684 wrote to memory of 2228 684 3bbtnn.exe 99 PID 684 wrote to memory of 2228 684 3bbtnn.exe 99 PID 2228 wrote to memory of 2564 2228 jvdjj.exe 100 PID 2228 wrote to memory of 2564 2228 jvdjj.exe 100 PID 2228 wrote to memory of 2564 2228 jvdjj.exe 100 PID 2564 wrote to memory of 4576 2564 xfxxllf.exe 101 PID 2564 wrote to memory of 4576 2564 xfxxllf.exe 101 PID 2564 wrote to memory of 4576 2564 xfxxllf.exe 101 PID 4576 wrote to memory of 3520 4576 tttnhh.exe 102 PID 4576 wrote to memory of 3520 4576 tttnhh.exe 102 PID 4576 wrote to memory of 3520 4576 tttnhh.exe 102 PID 3520 wrote to memory of 1504 3520 vvvvp.exe 103 PID 3520 wrote to memory of 1504 3520 vvvvp.exe 103 PID 3520 wrote to memory of 1504 3520 vvvvp.exe 103 PID 1504 wrote to memory of 1428 1504 frlfxlr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe"C:\Users\Admin\AppData\Local\Temp\414ac5a238680ccd44ee4b3a172e82270adfaf1f743046b69c7848f8bbe72cc5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\flflllf.exec:\flflllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\5bbtnh.exec:\5bbtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\pdjdd.exec:\pdjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\pjjdv.exec:\pjjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\7xfxfff.exec:\7xfxfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\tttntt.exec:\tttntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\3ntnnn.exec:\3ntnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\djpjd.exec:\djpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\rrrlrrx.exec:\rrrlrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\rlrxrll.exec:\rlrxrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\bntnhb.exec:\bntnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\vjpjd.exec:\vjpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\vjpjd.exec:\vjpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\3ffxflf.exec:\3ffxflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\3hnhbb.exec:\3hnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\3bbtnn.exec:\3bbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\jvdjj.exec:\jvdjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\xfxxllf.exec:\xfxxllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\tttnhh.exec:\tttnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\vvvvp.exec:\vvvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\frlfxlr.exec:\frlfxlr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\btthbn.exec:\btthbn.exe23⤵
- Executes dropped EXE
PID:1428 -
\??\c:\1ttnhh.exec:\1ttnhh.exe24⤵
- Executes dropped EXE
PID:4076 -
\??\c:\vdpvv.exec:\vdpvv.exe25⤵
- Executes dropped EXE
PID:5068 -
\??\c:\rlfrlrf.exec:\rlfrlrf.exe26⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1tnhbn.exec:\1tnhbn.exe27⤵
- Executes dropped EXE
PID:4008 -
\??\c:\9pppj.exec:\9pppj.exe28⤵
- Executes dropped EXE
PID:3312 -
\??\c:\rllffxl.exec:\rllffxl.exe29⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xlxrrxx.exec:\xlxrrxx.exe30⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bnnhbb.exec:\bnnhbb.exe31⤵
- Executes dropped EXE
PID:3484 -
\??\c:\vpdjp.exec:\vpdjp.exe32⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vjvdj.exec:\vjvdj.exe33⤵
- Executes dropped EXE
PID:4048 -
\??\c:\xxlflll.exec:\xxlflll.exe34⤵
- Executes dropped EXE
PID:4820 -
\??\c:\tthbbb.exec:\tthbbb.exe35⤵
- Executes dropped EXE
PID:4212 -
\??\c:\bttnnh.exec:\bttnnh.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jpdpp.exec:\jpdpp.exe37⤵
- Executes dropped EXE
PID:3708 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe38⤵
- Executes dropped EXE
PID:3992 -
\??\c:\5lrllll.exec:\5lrllll.exe39⤵
- Executes dropped EXE
PID:744 -
\??\c:\9hbhbn.exec:\9hbhbn.exe40⤵
- Executes dropped EXE
PID:4964 -
\??\c:\5thbhh.exec:\5thbhh.exe41⤵
- Executes dropped EXE
PID:4732 -
\??\c:\pjjdv.exec:\pjjdv.exe42⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lflfllr.exec:\lflfllr.exe43⤵
- Executes dropped EXE
PID:4420 -
\??\c:\lrllffx.exec:\lrllffx.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\btbttb.exec:\btbttb.exe45⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jddvv.exec:\jddvv.exe46⤵
- Executes dropped EXE
PID:64 -
\??\c:\jddvp.exec:\jddvp.exe47⤵
- Executes dropped EXE
PID:756 -
\??\c:\xrrfrrl.exec:\xrrfrrl.exe48⤵
- Executes dropped EXE
PID:3580 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe49⤵
- Executes dropped EXE
PID:3864 -
\??\c:\nntttt.exec:\nntttt.exe50⤵
- Executes dropped EXE
PID:448 -
\??\c:\vpvdv.exec:\vpvdv.exe51⤵
- Executes dropped EXE
PID:4324 -
\??\c:\jdjdv.exec:\jdjdv.exe52⤵
- Executes dropped EXE
PID:1676 -
\??\c:\1rrlflf.exec:\1rrlflf.exe53⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hthbtb.exec:\hthbtb.exe54⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bnbhbb.exec:\bnbhbb.exe55⤵
- Executes dropped EXE
PID:4316 -
\??\c:\3vjdj.exec:\3vjdj.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xxxxrxr.exec:\xxxxrxr.exe57⤵
- Executes dropped EXE
PID:3804 -
\??\c:\rlllfff.exec:\rlllfff.exe58⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bnnhbt.exec:\bnnhbt.exe59⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vjpvv.exec:\vjpvv.exe60⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rxrfrfr.exec:\rxrfrfr.exe61⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rlfxrll.exec:\rlfxrll.exe62⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hbbhbh.exec:\hbbhbh.exe63⤵
- Executes dropped EXE
PID:4980 -
\??\c:\vddvp.exec:\vddvp.exe64⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rxxrrfx.exec:\rxxrrfx.exe65⤵
- Executes dropped EXE
PID:4748 -
\??\c:\3llfrrf.exec:\3llfrrf.exe66⤵PID:4872
-
\??\c:\nhttnn.exec:\nhttnn.exe67⤵PID:2872
-
\??\c:\pjjdv.exec:\pjjdv.exe68⤵PID:3040
-
\??\c:\7xfrlll.exec:\7xfrlll.exe69⤵PID:736
-
\??\c:\ntnnhn.exec:\ntnnhn.exe70⤵PID:3424
-
\??\c:\dvvvd.exec:\dvvvd.exe71⤵PID:2380
-
\??\c:\ffllrxl.exec:\ffllrxl.exe72⤵PID:3540
-
\??\c:\btbbtt.exec:\btbbtt.exe73⤵PID:2900
-
\??\c:\jpjvp.exec:\jpjvp.exe74⤵PID:4064
-
\??\c:\hbbttn.exec:\hbbttn.exe75⤵PID:1756
-
\??\c:\dvdjp.exec:\dvdjp.exe76⤵PID:3912
-
\??\c:\xlfrlfx.exec:\xlfrlfx.exe77⤵PID:228
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe78⤵PID:3312
-
\??\c:\bhnhhb.exec:\bhnhhb.exe79⤵PID:1396
-
\??\c:\pvjvp.exec:\pvjvp.exe80⤵PID:2132
-
\??\c:\xfrrrlf.exec:\xfrrrlf.exe81⤵PID:2660
-
\??\c:\7dddd.exec:\7dddd.exe82⤵PID:1528
-
\??\c:\xxlfffr.exec:\xxlfffr.exe83⤵PID:1992
-
\??\c:\thnhbb.exec:\thnhbb.exe84⤵PID:2692
-
\??\c:\bhhbtt.exec:\bhhbtt.exe85⤵PID:2748
-
\??\c:\vddvp.exec:\vddvp.exe86⤵PID:3696
-
\??\c:\lflfffx.exec:\lflfffx.exe87⤵PID:4588
-
\??\c:\nhhthn.exec:\nhhthn.exe88⤵PID:3180
-
\??\c:\dvvpp.exec:\dvvpp.exe89⤵PID:836
-
\??\c:\rffrxxr.exec:\rffrxxr.exe90⤵PID:1672
-
\??\c:\nbttnn.exec:\nbttnn.exe91⤵PID:4492
-
\??\c:\fxfffff.exec:\fxfffff.exe92⤵PID:2244
-
\??\c:\9xxrlll.exec:\9xxrlll.exe93⤵PID:1392
-
\??\c:\7hnnnt.exec:\7hnnnt.exe94⤵
- System Location Discovery: System Language Discovery
PID:848 -
\??\c:\dvjdv.exec:\dvjdv.exe95⤵PID:3948
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe96⤵PID:1468
-
\??\c:\hhnhbh.exec:\hhnhbh.exe97⤵PID:3464
-
\??\c:\bbtbhh.exec:\bbtbhh.exe98⤵PID:4084
-
\??\c:\hhnbtb.exec:\hhnbtb.exe99⤵PID:3588
-
\??\c:\rlxrfxf.exec:\rlxrfxf.exe100⤵PID:2276
-
\??\c:\5vvpj.exec:\5vvpj.exe101⤵PID:5104
-
\??\c:\bthbbt.exec:\bthbbt.exe102⤵PID:1076
-
\??\c:\pdpjj.exec:\pdpjj.exe103⤵PID:4412
-
\??\c:\frrrrrr.exec:\frrrrrr.exe104⤵PID:620
-
\??\c:\nnnnhh.exec:\nnnnhh.exe105⤵PID:3260
-
\??\c:\vpppj.exec:\vpppj.exe106⤵PID:3684
-
\??\c:\frrlllf.exec:\frrlllf.exe107⤵PID:1312
-
\??\c:\bhnnhh.exec:\bhnnhh.exe108⤵PID:1012
-
\??\c:\pjjdv.exec:\pjjdv.exe109⤵PID:4300
-
\??\c:\bbhhbb.exec:\bbhhbb.exe110⤵PID:4280
-
\??\c:\llrxffr.exec:\llrxffr.exe111⤵PID:2836
-
\??\c:\bbnhbh.exec:\bbnhbh.exe112⤵PID:4804
-
\??\c:\vvvvp.exec:\vvvvp.exe113⤵PID:4980
-
\??\c:\rxxlrff.exec:\rxxlrff.exe114⤵PID:1036
-
\??\c:\1tbtbb.exec:\1tbtbb.exe115⤵PID:1016
-
\??\c:\pjddv.exec:\pjddv.exe116⤵PID:1628
-
\??\c:\llllffx.exec:\llllffx.exe117⤵PID:3556
-
\??\c:\hbhbtn.exec:\hbhbtn.exe118⤵PID:4908
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe119⤵PID:544
-
\??\c:\bhthhh.exec:\bhthhh.exe120⤵PID:1200
-
\??\c:\dvvvp.exec:\dvvvp.exe121⤵PID:4456
-
\??\c:\lrfllff.exec:\lrfllff.exe122⤵PID:3432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-