Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 01:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe
-
Size
453KB
-
MD5
1767a84134b8741183ff99cb91227d91
-
SHA1
ace019c2b92f5183dcc683aa302c2530018428df
-
SHA256
a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5
-
SHA512
397d2decccd1046f78848d8e5fcdce92ac2342ffca6e1a398edf86817484a83371d576467b88eb64af8c5acd93714b0915db90206edb3beeee9af220d8bc7053
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2136-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-760-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-902-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-1081-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-1139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-1280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4432 rllxlfr.exe 2136 thnhhb.exe 1552 dvpjd.exe 3516 xffrlfr.exe 2676 fflxrlf.exe 1380 bhnbnh.exe 3028 dvpjd.exe 1696 vvdpv.exe 5096 jjjdp.exe 4572 xfffrlf.exe 3992 htbhhb.exe 2056 vvvjd.exe 4524 rllfxrl.exe 1364 3bbbth.exe 4980 3xffrxl.exe 2128 fxfxfxf.exe 2680 bbbbbb.exe 1396 lxfxxff.exe 4852 3hnhnh.exe 4116 dpvpj.exe 4884 jdddv.exe 988 llllffx.exe 2216 thnbtt.exe 2316 xrxrxrx.exe 3996 rfffxrr.exe 4444 1frlllf.exe 1408 bbtttb.exe 3596 vvjjp.exe 3972 lxllrrl.exe 3612 nbhbtt.exe 2308 jvvpd.exe 3264 5llfxxx.exe 2644 7lxrxrr.exe 4824 nnbtbb.exe 2512 rxfxrlf.exe 100 btttnn.exe 1864 vpddv.exe 2092 lfxlxxr.exe 3140 bbthht.exe 2204 pddvv.exe 2392 hbbttt.exe 4528 5nnhnn.exe 4028 dvdvj.exe 4432 fxxrlfx.exe 4344 nhnhhb.exe 8 vjvvv.exe 3516 jvjdd.exe 3408 5ffffff.exe 3312 bntntb.exe 2464 3dddj.exe 1768 5xrlxxr.exe 2772 thhnhb.exe 2576 hthntn.exe 3016 djjjv.exe 3440 llrlrll.exe 3796 hbbthh.exe 3680 7dvpj.exe 540 1flxffl.exe 1132 7bttnn.exe 2844 pjvdp.exe 1460 3xlfxxr.exe 1048 nthtnh.exe 4256 hhhbtn.exe 4980 jddvp.exe -
resource yara_rule behavioral2/memory/2136-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/988-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-902-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1936 wrote to memory of 4432 1936 a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe 82 PID 1936 wrote to memory of 4432 1936 a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe 82 PID 1936 wrote to memory of 4432 1936 a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe 82 PID 4432 wrote to memory of 2136 4432 rllxlfr.exe 83 PID 4432 wrote to memory of 2136 4432 rllxlfr.exe 83 PID 4432 wrote to memory of 2136 4432 rllxlfr.exe 83 PID 2136 wrote to memory of 1552 2136 thnhhb.exe 84 PID 2136 wrote to memory of 1552 2136 thnhhb.exe 84 PID 2136 wrote to memory of 1552 2136 thnhhb.exe 84 PID 1552 wrote to memory of 3516 1552 dvpjd.exe 85 PID 1552 wrote to memory of 3516 1552 dvpjd.exe 85 PID 1552 wrote to memory of 3516 1552 dvpjd.exe 85 PID 3516 wrote to memory of 2676 3516 xffrlfr.exe 86 PID 3516 wrote to memory of 2676 3516 xffrlfr.exe 86 PID 3516 wrote to memory of 2676 3516 xffrlfr.exe 86 PID 2676 wrote to memory of 1380 2676 fflxrlf.exe 87 PID 2676 wrote to memory of 1380 2676 fflxrlf.exe 87 PID 2676 wrote to memory of 1380 2676 fflxrlf.exe 87 PID 1380 wrote to memory of 3028 1380 bhnbnh.exe 88 PID 1380 wrote to memory of 3028 1380 bhnbnh.exe 88 PID 1380 wrote to memory of 3028 1380 bhnbnh.exe 88 PID 3028 wrote to memory of 1696 3028 dvpjd.exe 89 PID 3028 wrote to memory of 1696 3028 dvpjd.exe 89 PID 3028 wrote to memory of 1696 3028 dvpjd.exe 89 PID 1696 wrote to memory of 5096 1696 vvdpv.exe 90 PID 1696 wrote to memory of 5096 1696 vvdpv.exe 90 PID 1696 wrote to memory of 5096 1696 vvdpv.exe 90 PID 5096 wrote to memory of 4572 5096 jjjdp.exe 91 PID 5096 wrote to memory of 4572 5096 jjjdp.exe 91 PID 5096 wrote to memory of 4572 5096 jjjdp.exe 91 PID 4572 wrote to memory of 3992 4572 xfffrlf.exe 92 PID 4572 wrote to memory of 3992 4572 xfffrlf.exe 92 PID 4572 wrote to memory of 3992 4572 xfffrlf.exe 92 PID 3992 wrote to memory of 2056 3992 htbhhb.exe 93 PID 3992 wrote to memory of 2056 3992 htbhhb.exe 93 PID 3992 wrote to memory of 2056 3992 htbhhb.exe 93 PID 2056 wrote to memory of 4524 2056 vvvjd.exe 94 PID 2056 wrote to memory of 4524 2056 vvvjd.exe 94 PID 2056 wrote to memory of 4524 2056 vvvjd.exe 94 PID 4524 wrote to memory of 1364 4524 rllfxrl.exe 95 PID 4524 wrote to memory of 1364 4524 rllfxrl.exe 95 PID 4524 wrote to memory of 1364 4524 rllfxrl.exe 95 PID 1364 wrote to memory of 4980 1364 3bbbth.exe 96 PID 1364 wrote to memory of 4980 1364 3bbbth.exe 96 PID 1364 wrote to memory of 4980 1364 3bbbth.exe 96 PID 4980 wrote to memory of 2128 4980 3xffrxl.exe 97 PID 4980 wrote to memory of 2128 4980 3xffrxl.exe 97 PID 4980 wrote to memory of 2128 4980 3xffrxl.exe 97 PID 2128 wrote to memory of 2680 2128 fxfxfxf.exe 98 PID 2128 wrote to memory of 2680 2128 fxfxfxf.exe 98 PID 2128 wrote to memory of 2680 2128 fxfxfxf.exe 98 PID 2680 wrote to memory of 1396 2680 bbbbbb.exe 99 PID 2680 wrote to memory of 1396 2680 bbbbbb.exe 99 PID 2680 wrote to memory of 1396 2680 bbbbbb.exe 99 PID 1396 wrote to memory of 4852 1396 lxfxxff.exe 100 PID 1396 wrote to memory of 4852 1396 lxfxxff.exe 100 PID 1396 wrote to memory of 4852 1396 lxfxxff.exe 100 PID 4852 wrote to memory of 4116 4852 3hnhnh.exe 101 PID 4852 wrote to memory of 4116 4852 3hnhnh.exe 101 PID 4852 wrote to memory of 4116 4852 3hnhnh.exe 101 PID 4116 wrote to memory of 4884 4116 dpvpj.exe 102 PID 4116 wrote to memory of 4884 4116 dpvpj.exe 102 PID 4116 wrote to memory of 4884 4116 dpvpj.exe 102 PID 4884 wrote to memory of 988 4884 jdddv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe"C:\Users\Admin\AppData\Local\Temp\a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\rllxlfr.exec:\rllxlfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\thnhhb.exec:\thnhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\dvpjd.exec:\dvpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\xffrlfr.exec:\xffrlfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\fflxrlf.exec:\fflxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bhnbnh.exec:\bhnbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\dvpjd.exec:\dvpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\vvdpv.exec:\vvdpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\jjjdp.exec:\jjjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\xfffrlf.exec:\xfffrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\htbhhb.exec:\htbhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\vvvjd.exec:\vvvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\rllfxrl.exec:\rllfxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\3bbbth.exec:\3bbbth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\3xffrxl.exec:\3xffrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\fxfxfxf.exec:\fxfxfxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\bbbbbb.exec:\bbbbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\lxfxxff.exec:\lxfxxff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\3hnhnh.exec:\3hnhnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\dpvpj.exec:\dpvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\jdddv.exec:\jdddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\llllffx.exec:\llllffx.exe23⤵
- Executes dropped EXE
PID:988 -
\??\c:\thnbtt.exec:\thnbtt.exe24⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe25⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rfffxrr.exec:\rfffxrr.exe26⤵
- Executes dropped EXE
PID:3996 -
\??\c:\1frlllf.exec:\1frlllf.exe27⤵
- Executes dropped EXE
PID:4444 -
\??\c:\bbtttb.exec:\bbtttb.exe28⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vvjjp.exec:\vvjjp.exe29⤵
- Executes dropped EXE
PID:3596 -
\??\c:\lxllrrl.exec:\lxllrrl.exe30⤵
- Executes dropped EXE
PID:3972 -
\??\c:\nbhbtt.exec:\nbhbtt.exe31⤵
- Executes dropped EXE
PID:3612 -
\??\c:\jvvpd.exec:\jvvpd.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5llfxxx.exec:\5llfxxx.exe33⤵
- Executes dropped EXE
PID:3264 -
\??\c:\7lxrxrr.exec:\7lxrxrr.exe34⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nnbtbb.exec:\nnbtbb.exe35⤵
- Executes dropped EXE
PID:4824 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe36⤵
- Executes dropped EXE
PID:2512 -
\??\c:\btttnn.exec:\btttnn.exe37⤵
- Executes dropped EXE
PID:100 -
\??\c:\vpddv.exec:\vpddv.exe38⤵
- Executes dropped EXE
PID:1864 -
\??\c:\lfxlxxr.exec:\lfxlxxr.exe39⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bbthht.exec:\bbthht.exe40⤵
- Executes dropped EXE
PID:3140 -
\??\c:\pddvv.exec:\pddvv.exe41⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hbbttt.exec:\hbbttt.exe42⤵
- Executes dropped EXE
PID:2392 -
\??\c:\5nnhnn.exec:\5nnhnn.exe43⤵
- Executes dropped EXE
PID:4528 -
\??\c:\dvdvj.exec:\dvdvj.exe44⤵
- Executes dropped EXE
PID:4028 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe45⤵
- Executes dropped EXE
PID:4432 -
\??\c:\nhnhhb.exec:\nhnhhb.exe46⤵
- Executes dropped EXE
PID:4344 -
\??\c:\vjvvv.exec:\vjvvv.exe47⤵
- Executes dropped EXE
PID:8 -
\??\c:\jvjdd.exec:\jvjdd.exe48⤵
- Executes dropped EXE
PID:3516 -
\??\c:\5ffffff.exec:\5ffffff.exe49⤵
- Executes dropped EXE
PID:3408 -
\??\c:\bntntb.exec:\bntntb.exe50⤵
- Executes dropped EXE
PID:3312 -
\??\c:\3dddj.exec:\3dddj.exe51⤵
- Executes dropped EXE
PID:2464 -
\??\c:\5xrlxxr.exec:\5xrlxxr.exe52⤵
- Executes dropped EXE
PID:1768 -
\??\c:\thhnhb.exec:\thhnhb.exe53⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hthntn.exec:\hthntn.exe54⤵
- Executes dropped EXE
PID:2576 -
\??\c:\djjjv.exec:\djjjv.exe55⤵
- Executes dropped EXE
PID:3016 -
\??\c:\llrlrll.exec:\llrlrll.exe56⤵
- Executes dropped EXE
PID:3440 -
\??\c:\hbbthh.exec:\hbbthh.exe57⤵
- Executes dropped EXE
PID:3796 -
\??\c:\7dvpj.exec:\7dvpj.exe58⤵
- Executes dropped EXE
PID:3680 -
\??\c:\1flxffl.exec:\1flxffl.exe59⤵
- Executes dropped EXE
PID:540 -
\??\c:\7bttnn.exec:\7bttnn.exe60⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pjvdp.exec:\pjvdp.exe61⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3xlfxxr.exec:\3xlfxxr.exe62⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nthtnh.exec:\nthtnh.exe63⤵
- Executes dropped EXE
PID:1048 -
\??\c:\hhhbtn.exec:\hhhbtn.exe64⤵
- Executes dropped EXE
PID:4256 -
\??\c:\jddvp.exec:\jddvp.exe65⤵
- Executes dropped EXE
PID:4980 -
\??\c:\3llfffx.exec:\3llfffx.exe66⤵PID:3276
-
\??\c:\bbhttn.exec:\bbhttn.exe67⤵PID:2120
-
\??\c:\djpjv.exec:\djpjv.exe68⤵PID:2192
-
\??\c:\fxxrrrf.exec:\fxxrrrf.exe69⤵PID:1784
-
\??\c:\htnbnh.exec:\htnbnh.exe70⤵PID:4792
-
\??\c:\dpdvp.exec:\dpdvp.exe71⤵PID:4128
-
\??\c:\flrrlrl.exec:\flrrlrl.exe72⤵PID:1272
-
\??\c:\rxfxrrf.exec:\rxfxrrf.exe73⤵PID:1524
-
\??\c:\htnhth.exec:\htnhth.exe74⤵PID:4884
-
\??\c:\pddpj.exec:\pddpj.exe75⤵PID:864
-
\??\c:\vpvvd.exec:\vpvvd.exe76⤵PID:4472
-
\??\c:\hhhtht.exec:\hhhtht.exe77⤵PID:2832
-
\??\c:\dvdpv.exec:\dvdpv.exe78⤵PID:1384
-
\??\c:\vvdvj.exec:\vvdvj.exe79⤵PID:3996
-
\??\c:\3xrlrrx.exec:\3xrlrrx.exe80⤵PID:396
-
\??\c:\bnnhbb.exec:\bnnhbb.exe81⤵PID:2084
-
\??\c:\vvpjd.exec:\vvpjd.exe82⤵PID:4416
-
\??\c:\1fflxrf.exec:\1fflxrf.exe83⤵PID:4604
-
\??\c:\nntnhb.exec:\nntnhb.exe84⤵PID:5008
-
\??\c:\htbnhb.exec:\htbnhb.exe85⤵PID:2984
-
\??\c:\dpppj.exec:\dpppj.exe86⤵PID:724
-
\??\c:\ffflffl.exec:\ffflffl.exe87⤵PID:4568
-
\??\c:\1lfrlfr.exec:\1lfrlfr.exe88⤵PID:2424
-
\??\c:\nbbbtt.exec:\nbbbtt.exe89⤵PID:3860
-
\??\c:\vvdjd.exec:\vvdjd.exe90⤵PID:4584
-
\??\c:\7lfrfxl.exec:\7lfrfxl.exe91⤵PID:2672
-
\??\c:\7ntnnn.exec:\7ntnnn.exe92⤵PID:4824
-
\??\c:\nhhnhn.exec:\nhhnhn.exe93⤵PID:1924
-
\??\c:\vjpdv.exec:\vjpdv.exe94⤵PID:3704
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe95⤵PID:1840
-
\??\c:\frxrllf.exec:\frxrllf.exe96⤵PID:3816
-
\??\c:\bnnnbb.exec:\bnnnbb.exe97⤵PID:628
-
\??\c:\vppjp.exec:\vppjp.exe98⤵PID:2296
-
\??\c:\rrfxllr.exec:\rrfxllr.exe99⤵PID:5028
-
\??\c:\bnhtnh.exec:\bnhtnh.exe100⤵PID:4916
-
\??\c:\tnnhbb.exec:\tnnhbb.exe101⤵PID:4984
-
\??\c:\3dvpj.exec:\3dvpj.exe102⤵PID:4520
-
\??\c:\fllfrrl.exec:\fllfrrl.exe103⤵PID:5012
-
\??\c:\7bttnn.exec:\7bttnn.exe104⤵PID:4340
-
\??\c:\ttnhbb.exec:\ttnhbb.exe105⤵PID:3608
-
\??\c:\vdjdv.exec:\vdjdv.exe106⤵PID:4868
-
\??\c:\xlrfffr.exec:\xlrfffr.exe107⤵PID:3688
-
\??\c:\tnbbbb.exec:\tnbbbb.exe108⤵PID:5108
-
\??\c:\jddvj.exec:\jddvj.exe109⤵PID:1664
-
\??\c:\3xxlxfr.exec:\3xxlxfr.exe110⤵PID:4284
-
\??\c:\hhhbnn.exec:\hhhbnn.exe111⤵PID:4860
-
\??\c:\djpjd.exec:\djpjd.exe112⤵PID:3912
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe113⤵PID:3472
-
\??\c:\bbbttn.exec:\bbbttn.exe114⤵PID:1768
-
\??\c:\nhnbbb.exec:\nhnbbb.exe115⤵PID:4548
-
\??\c:\3ppdv.exec:\3ppdv.exe116⤵PID:3332
-
\??\c:\7flxrlr.exec:\7flxrlr.exe117⤵PID:2912
-
\??\c:\nttnnn.exec:\nttnnn.exe118⤵PID:3716
-
\??\c:\5jjdp.exec:\5jjdp.exe119⤵PID:1144
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe120⤵PID:4488
-
\??\c:\ttbnbb.exec:\ttbnbb.exe121⤵PID:4064
-
\??\c:\nnbhhb.exec:\nnbhhb.exe122⤵PID:4800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-