Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 21:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe
-
Size
454KB
-
MD5
ce5ff046d425c02c565a595818dd40ef
-
SHA1
0bc68b9b0fa454341790c221c867d6a13dd69a80
-
SHA256
2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91
-
SHA512
5e01fa7a4cd6508ab1f7702ea9e700c65a6f070d1f407845a62081fbdda87c0d7d22a8038567f2cb11102d2e2083708fe227a4b5dd49e6bf974e8db416e5c44a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTB:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4964-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-820-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-1209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-1213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-1720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-1853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4492 rxxxxfl.exe 4064 7tbbtt.exe 1572 ffllfll.exe 4600 1rffxxl.exe 3356 bnbttn.exe 3712 xlxxxxl.exe 3604 pvddd.exe 4692 fflxrrl.exe 4808 bbhnnt.exe 3028 tnhtbb.exe 972 bttntt.exe 2200 xxlllrr.exe 2596 vjvvv.exe 1440 rrfffll.exe 4680 jpdjv.exe 5020 dvppp.exe 4276 ffrrrxf.exe 3200 nhtnbh.exe 1940 3dppd.exe 3980 fxrllrr.exe 3444 hhtttb.exe 3940 ppdpj.exe 3088 7vjdp.exe 456 ddjjj.exe 528 hthbtb.exe 4052 hhnnbb.exe 316 fxffxff.exe 3984 llrxxxf.exe 2112 jdppp.exe 3288 llrrrxx.exe 3328 bnbbnt.exe 1832 tnttnn.exe 1400 jjddd.exe 4420 lxlllrr.exe 5092 5tbttt.exe 4792 hnttnn.exe 1996 jdpvv.exe 4980 rrfxlll.exe 3508 ttbbbb.exe 4704 pjddd.exe 4456 dpjdj.exe 3624 rlxxllr.exe 4044 tntnnt.exe 3944 ddjdd.exe 1312 rrxxrrr.exe 4548 bttthh.exe 1032 jjppj.exe 1916 vdjjp.exe 5096 9xrllll.exe 4388 5ttttt.exe 1116 ddpdd.exe 896 xrlxlfx.exe 2680 xrlfrxf.exe 2192 bnbnbt.exe 4600 vjppp.exe 3652 xlxrrxx.exe 548 nhnnnh.exe 4556 5jvdd.exe 1480 xffrxxl.exe 4824 nhtnnt.exe 3580 jpjjp.exe 4692 rrffllr.exe 5052 hthtbh.exe 4512 vvjjj.exe -
resource yara_rule behavioral2/memory/4964-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-1209-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4964 wrote to memory of 4492 4964 2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe 82 PID 4964 wrote to memory of 4492 4964 2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe 82 PID 4964 wrote to memory of 4492 4964 2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe 82 PID 4492 wrote to memory of 4064 4492 rxxxxfl.exe 83 PID 4492 wrote to memory of 4064 4492 rxxxxfl.exe 83 PID 4492 wrote to memory of 4064 4492 rxxxxfl.exe 83 PID 4064 wrote to memory of 1572 4064 7tbbtt.exe 84 PID 4064 wrote to memory of 1572 4064 7tbbtt.exe 84 PID 4064 wrote to memory of 1572 4064 7tbbtt.exe 84 PID 1572 wrote to memory of 4600 1572 ffllfll.exe 85 PID 1572 wrote to memory of 4600 1572 ffllfll.exe 85 PID 1572 wrote to memory of 4600 1572 ffllfll.exe 85 PID 4600 wrote to memory of 3356 4600 1rffxxl.exe 86 PID 4600 wrote to memory of 3356 4600 1rffxxl.exe 86 PID 4600 wrote to memory of 3356 4600 1rffxxl.exe 86 PID 3356 wrote to memory of 3712 3356 bnbttn.exe 87 PID 3356 wrote to memory of 3712 3356 bnbttn.exe 87 PID 3356 wrote to memory of 3712 3356 bnbttn.exe 87 PID 3712 wrote to memory of 3604 3712 xlxxxxl.exe 88 PID 3712 wrote to memory of 3604 3712 xlxxxxl.exe 88 PID 3712 wrote to memory of 3604 3712 xlxxxxl.exe 88 PID 3604 wrote to memory of 4692 3604 pvddd.exe 89 PID 3604 wrote to memory of 4692 3604 pvddd.exe 89 PID 3604 wrote to memory of 4692 3604 pvddd.exe 89 PID 4692 wrote to memory of 4808 4692 fflxrrl.exe 90 PID 4692 wrote to memory of 4808 4692 fflxrrl.exe 90 PID 4692 wrote to memory of 4808 4692 fflxrrl.exe 90 PID 4808 wrote to memory of 3028 4808 bbhnnt.exe 91 PID 4808 wrote to memory of 3028 4808 bbhnnt.exe 91 PID 4808 wrote to memory of 3028 4808 bbhnnt.exe 91 PID 3028 wrote to memory of 972 3028 tnhtbb.exe 92 PID 3028 wrote to memory of 972 3028 tnhtbb.exe 92 PID 3028 wrote to memory of 972 3028 tnhtbb.exe 92 PID 972 wrote to memory of 2200 972 bttntt.exe 93 PID 972 wrote to memory of 2200 972 bttntt.exe 93 PID 972 wrote to memory of 2200 972 bttntt.exe 93 PID 2200 wrote to memory of 2596 2200 xxlllrr.exe 94 PID 2200 wrote to memory of 2596 2200 xxlllrr.exe 94 PID 2200 wrote to memory of 2596 2200 xxlllrr.exe 94 PID 2596 wrote to memory of 1440 2596 vjvvv.exe 95 PID 2596 wrote to memory of 1440 2596 vjvvv.exe 95 PID 2596 wrote to memory of 1440 2596 vjvvv.exe 95 PID 1440 wrote to memory of 4680 1440 rrfffll.exe 96 PID 1440 wrote to memory of 4680 1440 rrfffll.exe 96 PID 1440 wrote to memory of 4680 1440 rrfffll.exe 96 PID 4680 wrote to memory of 5020 4680 jpdjv.exe 97 PID 4680 wrote to memory of 5020 4680 jpdjv.exe 97 PID 4680 wrote to memory of 5020 4680 jpdjv.exe 97 PID 5020 wrote to memory of 4276 5020 dvppp.exe 98 PID 5020 wrote to memory of 4276 5020 dvppp.exe 98 PID 5020 wrote to memory of 4276 5020 dvppp.exe 98 PID 4276 wrote to memory of 3200 4276 ffrrrxf.exe 99 PID 4276 wrote to memory of 3200 4276 ffrrrxf.exe 99 PID 4276 wrote to memory of 3200 4276 ffrrrxf.exe 99 PID 3200 wrote to memory of 1940 3200 nhtnbh.exe 100 PID 3200 wrote to memory of 1940 3200 nhtnbh.exe 100 PID 3200 wrote to memory of 1940 3200 nhtnbh.exe 100 PID 1940 wrote to memory of 3980 1940 3dppd.exe 101 PID 1940 wrote to memory of 3980 1940 3dppd.exe 101 PID 1940 wrote to memory of 3980 1940 3dppd.exe 101 PID 3980 wrote to memory of 3444 3980 fxrllrr.exe 102 PID 3980 wrote to memory of 3444 3980 fxrllrr.exe 102 PID 3980 wrote to memory of 3444 3980 fxrllrr.exe 102 PID 3444 wrote to memory of 3940 3444 hhtttb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe"C:\Users\Admin\AppData\Local\Temp\2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\rxxxxfl.exec:\rxxxxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\7tbbtt.exec:\7tbbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\ffllfll.exec:\ffllfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\1rffxxl.exec:\1rffxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\bnbttn.exec:\bnbttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\xlxxxxl.exec:\xlxxxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\pvddd.exec:\pvddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\fflxrrl.exec:\fflxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\bbhnnt.exec:\bbhnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\tnhtbb.exec:\tnhtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\bttntt.exec:\bttntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\xxlllrr.exec:\xxlllrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\vjvvv.exec:\vjvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rrfffll.exec:\rrfffll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\jpdjv.exec:\jpdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\dvppp.exec:\dvppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\ffrrrxf.exec:\ffrrrxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\nhtnbh.exec:\nhtnbh.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\3dppd.exec:\3dppd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\fxrllrr.exec:\fxrllrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\hhtttb.exec:\hhtttb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\ppdpj.exec:\ppdpj.exe23⤵
- Executes dropped EXE
PID:3940 -
\??\c:\7vjdp.exec:\7vjdp.exe24⤵
- Executes dropped EXE
PID:3088 -
\??\c:\ddjjj.exec:\ddjjj.exe25⤵
- Executes dropped EXE
PID:456 -
\??\c:\hthbtb.exec:\hthbtb.exe26⤵
- Executes dropped EXE
PID:528 -
\??\c:\hhnnbb.exec:\hhnnbb.exe27⤵
- Executes dropped EXE
PID:4052 -
\??\c:\fxffxff.exec:\fxffxff.exe28⤵
- Executes dropped EXE
PID:316 -
\??\c:\llrxxxf.exec:\llrxxxf.exe29⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jdppp.exec:\jdppp.exe30⤵
- Executes dropped EXE
PID:2112 -
\??\c:\llrrrxx.exec:\llrrrxx.exe31⤵
- Executes dropped EXE
PID:3288 -
\??\c:\bnbbnt.exec:\bnbbnt.exe32⤵
- Executes dropped EXE
PID:3328 -
\??\c:\tnttnn.exec:\tnttnn.exe33⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jjddd.exec:\jjddd.exe34⤵
- Executes dropped EXE
PID:1400 -
\??\c:\lxlllrr.exec:\lxlllrr.exe35⤵
- Executes dropped EXE
PID:4420 -
\??\c:\5tbttt.exec:\5tbttt.exe36⤵
- Executes dropped EXE
PID:5092 -
\??\c:\hnttnn.exec:\hnttnn.exe37⤵
- Executes dropped EXE
PID:4792 -
\??\c:\jdpvv.exec:\jdpvv.exe38⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rrfxlll.exec:\rrfxlll.exe39⤵
- Executes dropped EXE
PID:4980 -
\??\c:\ttbbbb.exec:\ttbbbb.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3508 -
\??\c:\pjddd.exec:\pjddd.exe41⤵
- Executes dropped EXE
PID:4704 -
\??\c:\dpjdj.exec:\dpjdj.exe42⤵
- Executes dropped EXE
PID:4456 -
\??\c:\rlxxllr.exec:\rlxxllr.exe43⤵
- Executes dropped EXE
PID:3624 -
\??\c:\tntnnt.exec:\tntnnt.exe44⤵
- Executes dropped EXE
PID:4044 -
\??\c:\ddjdd.exec:\ddjdd.exe45⤵
- Executes dropped EXE
PID:3944 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe46⤵
- Executes dropped EXE
PID:1312 -
\??\c:\bttthh.exec:\bttthh.exe47⤵
- Executes dropped EXE
PID:4548 -
\??\c:\jjppj.exec:\jjppj.exe48⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vdjjp.exec:\vdjjp.exe49⤵
- Executes dropped EXE
PID:1916 -
\??\c:\9xrllll.exec:\9xrllll.exe50⤵
- Executes dropped EXE
PID:5096 -
\??\c:\5ttttt.exec:\5ttttt.exe51⤵
- Executes dropped EXE
PID:4388 -
\??\c:\ddpdd.exec:\ddpdd.exe52⤵
- Executes dropped EXE
PID:1116 -
\??\c:\xrlxlfx.exec:\xrlxlfx.exe53⤵
- Executes dropped EXE
PID:896 -
\??\c:\xrlfrxf.exec:\xrlfrxf.exe54⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bnbnbt.exec:\bnbnbt.exe55⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vjppp.exec:\vjppp.exe56⤵
- Executes dropped EXE
PID:4600 -
\??\c:\xlxrrxx.exec:\xlxrrxx.exe57⤵
- Executes dropped EXE
PID:3652 -
\??\c:\nhnnnh.exec:\nhnnnh.exe58⤵
- Executes dropped EXE
PID:548 -
\??\c:\5jvdd.exec:\5jvdd.exe59⤵
- Executes dropped EXE
PID:4556 -
\??\c:\xffrxxl.exec:\xffrxxl.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1480 -
\??\c:\nhtnnt.exec:\nhtnnt.exe61⤵
- Executes dropped EXE
PID:4824 -
\??\c:\jpjjp.exec:\jpjjp.exe62⤵
- Executes dropped EXE
PID:3580 -
\??\c:\rrffllr.exec:\rrffllr.exe63⤵
- Executes dropped EXE
PID:4692 -
\??\c:\hthtbh.exec:\hthtbh.exe64⤵
- Executes dropped EXE
PID:5052 -
\??\c:\vvjjj.exec:\vvjjj.exe65⤵
- Executes dropped EXE
PID:4512 -
\??\c:\9fllfll.exec:\9fllfll.exe66⤵PID:4800
-
\??\c:\ffxxxff.exec:\ffxxxff.exe67⤵PID:3824
-
\??\c:\hbhhhn.exec:\hbhhhn.exe68⤵PID:2760
-
\??\c:\pvjdp.exec:\pvjdp.exe69⤵PID:972
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe70⤵PID:3932
-
\??\c:\nhttnt.exec:\nhttnt.exe71⤵PID:4936
-
\??\c:\hbhhbh.exec:\hbhhbh.exe72⤵PID:996
-
\??\c:\dvjjd.exec:\dvjjd.exe73⤵PID:4836
-
\??\c:\9lrrflf.exec:\9lrrflf.exe74⤵PID:4564
-
\??\c:\hbbhbh.exec:\hbbhbh.exe75⤵PID:3060
-
\??\c:\nbntht.exec:\nbntht.exe76⤵PID:2428
-
\??\c:\ppvpp.exec:\ppvpp.exe77⤵PID:3856
-
\??\c:\llffxff.exec:\llffxff.exe78⤵PID:3200
-
\??\c:\xxrfrff.exec:\xxrfrff.exe79⤵PID:3980
-
\??\c:\hhnhhh.exec:\hhnhhh.exe80⤵PID:1868
-
\??\c:\jjjjj.exec:\jjjjj.exe81⤵PID:3124
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe82⤵PID:2144
-
\??\c:\bnbttn.exec:\bnbttn.exe83⤵PID:5044
-
\??\c:\5htbhh.exec:\5htbhh.exe84⤵PID:3368
-
\??\c:\jpddv.exec:\jpddv.exe85⤵PID:1656
-
\??\c:\rrlrrxx.exec:\rrlrrxx.exe86⤵PID:4716
-
\??\c:\hhbhnb.exec:\hhbhnb.exe87⤵PID:4504
-
\??\c:\jjpvv.exec:\jjpvv.exe88⤵PID:2452
-
\??\c:\rxrrrff.exec:\rxrrrff.exe89⤵PID:3140
-
\??\c:\bbtnbh.exec:\bbtnbh.exe90⤵PID:4312
-
\??\c:\dvdjj.exec:\dvdjj.exe91⤵PID:3696
-
\??\c:\vpjdd.exec:\vpjdd.exe92⤵PID:4992
-
\??\c:\hhtnnn.exec:\hhtnnn.exe93⤵PID:4444
-
\??\c:\ntbbhn.exec:\ntbbhn.exe94⤵PID:4176
-
\??\c:\jjppv.exec:\jjppv.exe95⤵PID:3156
-
\??\c:\xflffff.exec:\xflffff.exe96⤵PID:3328
-
\??\c:\nntttt.exec:\nntttt.exe97⤵PID:1388
-
\??\c:\1nnhbb.exec:\1nnhbb.exe98⤵PID:1720
-
\??\c:\ppjvv.exec:\ppjvv.exe99⤵PID:940
-
\??\c:\rlfxxxf.exec:\rlfxxxf.exe100⤵PID:2616
-
\??\c:\bnbttb.exec:\bnbttb.exe101⤵PID:2824
-
\??\c:\nnbbhh.exec:\nnbbhh.exe102⤵PID:3424
-
\??\c:\3dppd.exec:\3dppd.exe103⤵PID:5072
-
\??\c:\1xfflrx.exec:\1xfflrx.exe104⤵PID:2356
-
\??\c:\bbnnnn.exec:\bbnnnn.exe105⤵PID:2184
-
\??\c:\jjvpv.exec:\jjvpv.exe106⤵PID:4896
-
\??\c:\jpvvp.exec:\jpvvp.exe107⤵
- System Location Discovery: System Language Discovery
PID:4864 -
\??\c:\xlffxff.exec:\xlffxff.exe108⤵PID:3624
-
\??\c:\nnttbh.exec:\nnttbh.exe109⤵PID:4044
-
\??\c:\nnbhhn.exec:\nnbhhn.exe110⤵PID:4804
-
\??\c:\vvdvv.exec:\vvdvv.exe111⤵PID:4748
-
\??\c:\xflllrr.exec:\xflllrr.exe112⤵PID:3300
-
\??\c:\hbnnhn.exec:\hbnnhn.exe113⤵PID:1032
-
\??\c:\ppvdj.exec:\ppvdj.exe114⤵PID:4396
-
\??\c:\frfflrl.exec:\frfflrl.exe115⤵PID:348
-
\??\c:\hhttnn.exec:\hhttnn.exe116⤵PID:1636
-
\??\c:\nbnnht.exec:\nbnnht.exe117⤵PID:3976
-
\??\c:\jdjjd.exec:\jdjjd.exe118⤵PID:4740
-
\??\c:\fxllrrf.exec:\fxllrrf.exe119⤵PID:1572
-
\??\c:\7hhhbh.exec:\7hhhbh.exe120⤵PID:3536
-
\??\c:\thttnn.exec:\thttnn.exe121⤵PID:5112
-
\??\c:\7vvvv.exec:\7vvvv.exe122⤵PID:2300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-