Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 22:33
Behavioral task
behavioral1
Sample
544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe
-
Size
335KB
-
MD5
882320eab3b10774600369841adc47f5
-
SHA1
5d4e8913529b8f2bb1c732d6632daf502b3f1867
-
SHA256
544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc
-
SHA512
0f5914751aa1b19904cd6892387c2f67b7c5b0087b2f4410b42c3d24d48dbb74326db1b10e6329a5bdc73eac8f585b6391d43e7fec70e71b5f21ac20e7da52a7
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR1:R4wFHoSHYHUrAwfMp3CDR1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4592-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1264-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3788-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2144-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2528-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-1174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-1249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3984 ddvpj.exe 1852 7nthnb.exe 2216 dpvvv.exe 4504 ddvjd.exe 3272 xlrlxxl.exe 4616 nhhthh.exe 396 vpdvv.exe 1328 rlxrllf.exe 1128 nbnhbt.exe 2888 ppvpj.exe 1264 7frlfrl.exe 2020 xlxrrll.exe 3656 1rxrxfx.exe 4380 tbhbnn.exe 736 vpvjv.exe 1680 fllfflf.exe 3788 rffxfxx.exe 1816 nhbbbh.exe 2760 bnthbn.exe 1052 bbhbhb.exe 4708 xrfxrlr.exe 4336 nbhhhh.exe 2272 9jpdv.exe 3940 fxxrflf.exe 2144 xflrrxx.exe 1436 rllfxrl.exe 2616 jddvv.exe 5068 lrxxrrl.exe 512 pppdv.exe 3772 1vpdv.exe 1300 rfxlrlr.exe 3508 hbhhhh.exe 2396 1hhhbh.exe 3704 bbhbtt.exe 5000 9pppj.exe 5016 rlxlxxr.exe 2160 1tnhbt.exe 3808 jddpj.exe 2820 9xxxrrr.exe 4760 ttbbtn.exe 1712 pjvpj.exe 2780 pvddv.exe 1424 lffxllx.exe 372 hbbtbb.exe 956 hthbnn.exe 4520 lrxxlll.exe 3576 bbtnhh.exe 448 tnbtbb.exe 4192 dppjd.exe 528 lflxxxr.exe 2884 tbtbtb.exe 8 3jpjd.exe 4956 pppdv.exe 2288 lfllffx.exe 3132 xrxllxl.exe 4860 ddjjv.exe 1860 xlrlfxx.exe 2528 thhbbt.exe 4904 nhnhbt.exe 2140 xlllrlf.exe 4504 9llrllr.exe 3272 tbhhbt.exe 2988 tbhbnt.exe 4224 rlrxlll.exe -
resource yara_rule behavioral2/memory/4592-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cda-3.dat upx behavioral2/memory/4592-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023ce0-8.dat upx behavioral2/memory/3984-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1852-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce1-11.dat upx behavioral2/memory/2216-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce2-20.dat upx behavioral2/memory/4504-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3272-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce4-29.dat upx behavioral2/memory/4616-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce3-25.dat upx behavioral2/files/0x0007000000023ce5-34.dat upx behavioral2/memory/4616-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce7-39.dat upx behavioral2/memory/396-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce8-44.dat upx behavioral2/memory/1328-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce9-50.dat upx behavioral2/memory/2888-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cea-56.dat upx behavioral2/memory/1128-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ceb-59.dat upx behavioral2/memory/1264-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2020-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cec-65.dat upx behavioral2/files/0x0007000000023ced-70.dat upx behavioral2/files/0x0007000000023cef-74.dat upx behavioral2/files/0x0007000000023cf0-78.dat upx behavioral2/memory/736-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cf1-82.dat upx behavioral2/memory/3788-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cf2-88.dat upx behavioral2/files/0x0008000000023cde-92.dat upx behavioral2/memory/2760-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cf3-97.dat upx behavioral2/files/0x0007000000023cf4-100.dat upx behavioral2/files/0x0007000000023cf5-104.dat upx behavioral2/memory/2272-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cf7-114.dat upx behavioral2/files/0x0007000000023cf6-110.dat upx behavioral2/memory/4336-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cf8-119.dat upx behavioral2/memory/3940-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2144-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cf9-123.dat upx behavioral2/files/0x0007000000023cfa-127.dat upx behavioral2/memory/1436-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cfb-133.dat upx behavioral2/memory/2616-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cfc-139.dat upx behavioral2/memory/5068-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cfd-144.dat upx behavioral2/memory/512-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cff-152.dat upx behavioral2/files/0x0007000000023cfe-148.dat upx behavioral2/memory/3508-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2396-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3704-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5000-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5016-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3808-173-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4592 wrote to memory of 3984 4592 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 84 PID 4592 wrote to memory of 3984 4592 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 84 PID 4592 wrote to memory of 3984 4592 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 84 PID 3984 wrote to memory of 1852 3984 ddvpj.exe 85 PID 3984 wrote to memory of 1852 3984 ddvpj.exe 85 PID 3984 wrote to memory of 1852 3984 ddvpj.exe 85 PID 1852 wrote to memory of 2216 1852 7nthnb.exe 86 PID 1852 wrote to memory of 2216 1852 7nthnb.exe 86 PID 1852 wrote to memory of 2216 1852 7nthnb.exe 86 PID 2216 wrote to memory of 4504 2216 dpvvv.exe 87 PID 2216 wrote to memory of 4504 2216 dpvvv.exe 87 PID 2216 wrote to memory of 4504 2216 dpvvv.exe 87 PID 4504 wrote to memory of 3272 4504 ddvjd.exe 88 PID 4504 wrote to memory of 3272 4504 ddvjd.exe 88 PID 4504 wrote to memory of 3272 4504 ddvjd.exe 88 PID 3272 wrote to memory of 4616 3272 xlrlxxl.exe 89 PID 3272 wrote to memory of 4616 3272 xlrlxxl.exe 89 PID 3272 wrote to memory of 4616 3272 xlrlxxl.exe 89 PID 4616 wrote to memory of 396 4616 nhhthh.exe 90 PID 4616 wrote to memory of 396 4616 nhhthh.exe 90 PID 4616 wrote to memory of 396 4616 nhhthh.exe 90 PID 396 wrote to memory of 1328 396 vpdvv.exe 91 PID 396 wrote to memory of 1328 396 vpdvv.exe 91 PID 396 wrote to memory of 1328 396 vpdvv.exe 91 PID 1328 wrote to memory of 1128 1328 rlxrllf.exe 92 PID 1328 wrote to memory of 1128 1328 rlxrllf.exe 92 PID 1328 wrote to memory of 1128 1328 rlxrllf.exe 92 PID 1128 wrote to memory of 2888 1128 nbnhbt.exe 93 PID 1128 wrote to memory of 2888 1128 nbnhbt.exe 93 PID 1128 wrote to memory of 2888 1128 nbnhbt.exe 93 PID 2888 wrote to memory of 1264 2888 ppvpj.exe 94 PID 2888 wrote to memory of 1264 2888 ppvpj.exe 94 PID 2888 wrote to memory of 1264 2888 ppvpj.exe 94 PID 1264 wrote to memory of 2020 1264 7frlfrl.exe 95 PID 1264 wrote to memory of 2020 1264 7frlfrl.exe 95 PID 1264 wrote to memory of 2020 1264 7frlfrl.exe 95 PID 2020 wrote to memory of 3656 2020 xlxrrll.exe 96 PID 2020 wrote to memory of 3656 2020 xlxrrll.exe 96 PID 2020 wrote to memory of 3656 2020 xlxrrll.exe 96 PID 3656 wrote to memory of 4380 3656 1rxrxfx.exe 97 PID 3656 wrote to memory of 4380 3656 1rxrxfx.exe 97 PID 3656 wrote to memory of 4380 3656 1rxrxfx.exe 97 PID 4380 wrote to memory of 736 4380 tbhbnn.exe 98 PID 4380 wrote to memory of 736 4380 tbhbnn.exe 98 PID 4380 wrote to memory of 736 4380 tbhbnn.exe 98 PID 736 wrote to memory of 1680 736 vpvjv.exe 99 PID 736 wrote to memory of 1680 736 vpvjv.exe 99 PID 736 wrote to memory of 1680 736 vpvjv.exe 99 PID 1680 wrote to memory of 3788 1680 fllfflf.exe 100 PID 1680 wrote to memory of 3788 1680 fllfflf.exe 100 PID 1680 wrote to memory of 3788 1680 fllfflf.exe 100 PID 3788 wrote to memory of 1816 3788 rffxfxx.exe 101 PID 3788 wrote to memory of 1816 3788 rffxfxx.exe 101 PID 3788 wrote to memory of 1816 3788 rffxfxx.exe 101 PID 1816 wrote to memory of 2760 1816 nhbbbh.exe 102 PID 1816 wrote to memory of 2760 1816 nhbbbh.exe 102 PID 1816 wrote to memory of 2760 1816 nhbbbh.exe 102 PID 2760 wrote to memory of 1052 2760 bnthbn.exe 103 PID 2760 wrote to memory of 1052 2760 bnthbn.exe 103 PID 2760 wrote to memory of 1052 2760 bnthbn.exe 103 PID 1052 wrote to memory of 4708 1052 bbhbhb.exe 104 PID 1052 wrote to memory of 4708 1052 bbhbhb.exe 104 PID 1052 wrote to memory of 4708 1052 bbhbhb.exe 104 PID 4708 wrote to memory of 4336 4708 xrfxrlr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe"C:\Users\Admin\AppData\Local\Temp\544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\ddvpj.exec:\ddvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\7nthnb.exec:\7nthnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\dpvvv.exec:\dpvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\ddvjd.exec:\ddvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\xlrlxxl.exec:\xlrlxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\nhhthh.exec:\nhhthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\vpdvv.exec:\vpdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\rlxrllf.exec:\rlxrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\nbnhbt.exec:\nbnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\ppvpj.exec:\ppvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\7frlfrl.exec:\7frlfrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\xlxrrll.exec:\xlxrrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\1rxrxfx.exec:\1rxrxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\tbhbnn.exec:\tbhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\vpvjv.exec:\vpvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\fllfflf.exec:\fllfflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\rffxfxx.exec:\rffxfxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\nhbbbh.exec:\nhbbbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\bnthbn.exec:\bnthbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\bbhbhb.exec:\bbhbhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\xrfxrlr.exec:\xrfxrlr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\nbhhhh.exec:\nbhhhh.exe23⤵
- Executes dropped EXE
PID:4336 -
\??\c:\9jpdv.exec:\9jpdv.exe24⤵
- Executes dropped EXE
PID:2272 -
\??\c:\fxxrflf.exec:\fxxrflf.exe25⤵
- Executes dropped EXE
PID:3940 -
\??\c:\xflrrxx.exec:\xflrrxx.exe26⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rllfxrl.exec:\rllfxrl.exe27⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jddvv.exec:\jddvv.exe28⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe29⤵
- Executes dropped EXE
PID:5068 -
\??\c:\pppdv.exec:\pppdv.exe30⤵
- Executes dropped EXE
PID:512 -
\??\c:\1vpdv.exec:\1vpdv.exe31⤵
- Executes dropped EXE
PID:3772 -
\??\c:\rfxlrlr.exec:\rfxlrlr.exe32⤵
- Executes dropped EXE
PID:1300 -
\??\c:\hbhhhh.exec:\hbhhhh.exe33⤵
- Executes dropped EXE
PID:3508 -
\??\c:\1hhhbh.exec:\1hhhbh.exe34⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bbhbtt.exec:\bbhbtt.exe35⤵
- Executes dropped EXE
PID:3704 -
\??\c:\9pppj.exec:\9pppj.exe36⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rlxlxxr.exec:\rlxlxxr.exe37⤵
- Executes dropped EXE
PID:5016 -
\??\c:\1tnhbt.exec:\1tnhbt.exe38⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jddpj.exec:\jddpj.exe39⤵
- Executes dropped EXE
PID:3808 -
\??\c:\9xxxrrr.exec:\9xxxrrr.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ttbbtn.exec:\ttbbtn.exe41⤵
- Executes dropped EXE
PID:4760 -
\??\c:\pjvpj.exec:\pjvpj.exe42⤵
- Executes dropped EXE
PID:1712 -
\??\c:\pvddv.exec:\pvddv.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lffxllx.exec:\lffxllx.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1424 -
\??\c:\hbbtbb.exec:\hbbtbb.exe45⤵
- Executes dropped EXE
PID:372 -
\??\c:\hthbnn.exec:\hthbnn.exe46⤵
- Executes dropped EXE
PID:956 -
\??\c:\lrxxlll.exec:\lrxxlll.exe47⤵
- Executes dropped EXE
PID:4520 -
\??\c:\bbtnhh.exec:\bbtnhh.exe48⤵
- Executes dropped EXE
PID:3576 -
\??\c:\tnbtbb.exec:\tnbtbb.exe49⤵
- Executes dropped EXE
PID:448 -
\??\c:\dppjd.exec:\dppjd.exe50⤵
- Executes dropped EXE
PID:4192 -
\??\c:\lflxxxr.exec:\lflxxxr.exe51⤵
- Executes dropped EXE
PID:528 -
\??\c:\tbtbtb.exec:\tbtbtb.exe52⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3jpjd.exec:\3jpjd.exe53⤵
- Executes dropped EXE
PID:8 -
\??\c:\pppdv.exec:\pppdv.exe54⤵
- Executes dropped EXE
PID:4956 -
\??\c:\lfllffx.exec:\lfllffx.exe55⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xrxllxl.exec:\xrxllxl.exe56⤵
- Executes dropped EXE
PID:3132 -
\??\c:\htbthh.exec:\htbthh.exe57⤵PID:2872
-
\??\c:\ddjjv.exec:\ddjjv.exe58⤵
- Executes dropped EXE
PID:4860 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe59⤵
- Executes dropped EXE
PID:1860 -
\??\c:\thhbbt.exec:\thhbbt.exe60⤵
- Executes dropped EXE
PID:2528 -
\??\c:\nhnhbt.exec:\nhnhbt.exe61⤵
- Executes dropped EXE
PID:4904 -
\??\c:\xlllrlf.exec:\xlllrlf.exe62⤵
- Executes dropped EXE
PID:2140 -
\??\c:\9llrllr.exec:\9llrllr.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4504 -
\??\c:\tbhhbt.exec:\tbhhbt.exe64⤵
- Executes dropped EXE
PID:3272 -
\??\c:\tbhbnt.exec:\tbhbnt.exe65⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rlrxlll.exec:\rlrxlll.exe66⤵
- Executes dropped EXE
PID:4224 -
\??\c:\lxrlxxf.exec:\lxrlxxf.exe67⤵PID:3320
-
\??\c:\1hnhbb.exec:\1hnhbb.exe68⤵PID:3340
-
\??\c:\vdppp.exec:\vdppp.exe69⤵PID:3488
-
\??\c:\dvpdj.exec:\dvpdj.exe70⤵PID:2184
-
\??\c:\flxfrfx.exec:\flxfrfx.exe71⤵PID:4324
-
\??\c:\hbttnn.exec:\hbttnn.exe72⤵PID:4308
-
\??\c:\dvdvj.exec:\dvdvj.exe73⤵PID:2888
-
\??\c:\xllfrrl.exec:\xllfrrl.exe74⤵PID:1496
-
\??\c:\bbbbbb.exec:\bbbbbb.exe75⤵PID:2132
-
\??\c:\1bnhhh.exec:\1bnhhh.exe76⤵PID:3544
-
\??\c:\vdjdp.exec:\vdjdp.exe77⤵PID:436
-
\??\c:\rlxfxlf.exec:\rlxfxlf.exe78⤵PID:4932
-
\??\c:\btbnhh.exec:\btbnhh.exe79⤵PID:2408
-
\??\c:\vdjdv.exec:\vdjdv.exe80⤵PID:1084
-
\??\c:\dvpdd.exec:\dvpdd.exe81⤵PID:972
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe82⤵PID:3752
-
\??\c:\bbbtnn.exec:\bbbtnn.exe83⤵PID:3252
-
\??\c:\tntnhh.exec:\tntnhh.exe84⤵PID:824
-
\??\c:\jdddv.exec:\jdddv.exe85⤵PID:3352
-
\??\c:\rflfxfx.exec:\rflfxfx.exe86⤵PID:1288
-
\??\c:\9frlrll.exec:\9frlrll.exe87⤵PID:4980
-
\??\c:\bbbhhb.exec:\bbbhhb.exe88⤵PID:3136
-
\??\c:\5vdvd.exec:\5vdvd.exe89⤵PID:2828
-
\??\c:\jddpd.exec:\jddpd.exe90⤵PID:4572
-
\??\c:\lxlxffx.exec:\lxlxffx.exe91⤵PID:1916
-
\??\c:\7tnntb.exec:\7tnntb.exe92⤵PID:2400
-
\??\c:\tbbhnh.exec:\tbbhnh.exe93⤵PID:2976
-
\??\c:\jjpdd.exec:\jjpdd.exe94⤵PID:1016
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe95⤵
- System Location Discovery: System Language Discovery
PID:4580 -
\??\c:\1bnnbb.exec:\1bnnbb.exe96⤵PID:3932
-
\??\c:\btbtnh.exec:\btbtnh.exe97⤵PID:1908
-
\??\c:\jddvv.exec:\jddvv.exe98⤵PID:4076
-
\??\c:\lffrrlf.exec:\lffrrlf.exe99⤵PID:4972
-
\??\c:\nttnhb.exec:\nttnhb.exe100⤵PID:784
-
\??\c:\nhhbnn.exec:\nhhbnn.exe101⤵
- System Location Discovery: System Language Discovery
PID:1920 -
\??\c:\9pvvp.exec:\9pvvp.exe102⤵PID:3648
-
\??\c:\xxlxxxf.exec:\xxlxxxf.exe103⤵PID:1300
-
\??\c:\ntnntn.exec:\ntnntn.exe104⤵PID:3516
-
\??\c:\vdpdp.exec:\vdpdp.exe105⤵PID:3708
-
\??\c:\5jpjd.exec:\5jpjd.exe106⤵PID:2396
-
\??\c:\llfxrrr.exec:\llfxrrr.exe107⤵PID:2188
-
\??\c:\ttbnbb.exec:\ttbnbb.exe108⤵PID:3372
-
\??\c:\hbhbtt.exec:\hbhbtt.exe109⤵PID:4048
-
\??\c:\dvpjj.exec:\dvpjj.exe110⤵PID:764
-
\??\c:\frrfxfx.exec:\frrfxfx.exe111⤵PID:1600
-
\??\c:\nthhbb.exec:\nthhbb.exe112⤵PID:3044
-
\??\c:\nbhhbt.exec:\nbhhbt.exe113⤵PID:3520
-
\??\c:\jdddd.exec:\jdddd.exe114⤵PID:4840
-
\??\c:\5llfxxr.exec:\5llfxxr.exe115⤵PID:1712
-
\??\c:\tbhbtt.exec:\tbhbtt.exe116⤵PID:2780
-
\??\c:\hhtnhh.exec:\hhtnhh.exe117⤵PID:3748
-
\??\c:\jpppj.exec:\jpppj.exe118⤵PID:3216
-
\??\c:\jdddv.exec:\jdddv.exe119⤵PID:5076
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe120⤵PID:3760
-
\??\c:\nhhhbb.exec:\nhhhbb.exe121⤵PID:2596
-
\??\c:\vjvpv.exec:\vjvpv.exe122⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-