Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 04:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe
-
Size
454KB
-
MD5
461470b4af3eecdfe0353a10b7114339
-
SHA1
f28906cfbcc6482783b7f3920f033e8127e2893c
-
SHA256
f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf
-
SHA512
4cbd68100dd8cde189a3d54fc29eb5381a4df4bc99e7d02f6d00dd0cfbb5aebb7b7934e690f75302696e4493943769b2be418c90bedac2405d8c45e1b698c3e0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4804-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-809-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-873-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-928-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-1342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5044 rrrrlll.exe 216 ntnhbb.exe 4804 1jjdv.exe 1524 7flfffx.exe 3936 vjjdv.exe 652 rfrlfxl.exe 1688 9xxfrrl.exe 4808 htnnhn.exe 3384 ntbtnh.exe 2752 nhnntn.exe 1976 vdpjd.exe 4268 xfxxrrl.exe 2900 vpjdp.exe 1332 xrxxxxx.exe 3804 bntnhh.exe 4796 vjjpd.exe 3688 rxrlffx.exe 2372 nbhbtn.exe 5036 dppjd.exe 1112 tbtnhh.exe 2728 nbtnbn.exe 4680 1bbtnn.exe 976 dvdjd.exe 4768 lxrfxrf.exe 4024 xlllfxr.exe 384 hnbttt.exe 4568 pddvp.exe 5096 hbhnnb.exe 4836 3ddvj.exe 688 xxxrxxr.exe 224 nnbtnh.exe 4248 lxfrfxl.exe 4480 frrllxr.exe 1548 fxxrlff.exe 768 nhnbtt.exe 516 flrlfxr.exe 5116 tbhbnn.exe 4812 pjjdv.exe 2936 dvvpd.exe 1928 lxrflff.exe 880 nbnhbt.exe 4376 jvvpj.exe 2796 xxfrfxr.exe 4200 xlfxrrl.exe 4296 nttnhb.exe 1604 dvvpj.exe 1716 rrfrlfx.exe 2596 nhtnnh.exe 5024 hbhhbb.exe 2216 dvvjv.exe 5088 xrxxxxf.exe 4708 9rxrlll.exe 4312 bntbtn.exe 1400 pvdvj.exe 1744 3vvjd.exe 1396 frrrfff.exe 2428 htbnnh.exe 972 djjdp.exe 4392 dddvp.exe 1044 lffrlff.exe 1416 ntbbbt.exe 3384 dpdvj.exe 3708 5nnhbt.exe 2644 5pjdv.exe -
resource yara_rule behavioral2/memory/1524-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-809-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1716 wrote to memory of 5044 1716 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 83 PID 1716 wrote to memory of 5044 1716 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 83 PID 1716 wrote to memory of 5044 1716 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 83 PID 5044 wrote to memory of 216 5044 rrrrlll.exe 84 PID 5044 wrote to memory of 216 5044 rrrrlll.exe 84 PID 5044 wrote to memory of 216 5044 rrrrlll.exe 84 PID 216 wrote to memory of 4804 216 ntnhbb.exe 85 PID 216 wrote to memory of 4804 216 ntnhbb.exe 85 PID 216 wrote to memory of 4804 216 ntnhbb.exe 85 PID 4804 wrote to memory of 1524 4804 1jjdv.exe 86 PID 4804 wrote to memory of 1524 4804 1jjdv.exe 86 PID 4804 wrote to memory of 1524 4804 1jjdv.exe 86 PID 1524 wrote to memory of 3936 1524 7flfffx.exe 87 PID 1524 wrote to memory of 3936 1524 7flfffx.exe 87 PID 1524 wrote to memory of 3936 1524 7flfffx.exe 87 PID 3936 wrote to memory of 652 3936 vjjdv.exe 88 PID 3936 wrote to memory of 652 3936 vjjdv.exe 88 PID 3936 wrote to memory of 652 3936 vjjdv.exe 88 PID 652 wrote to memory of 1688 652 rfrlfxl.exe 89 PID 652 wrote to memory of 1688 652 rfrlfxl.exe 89 PID 652 wrote to memory of 1688 652 rfrlfxl.exe 89 PID 1688 wrote to memory of 4808 1688 9xxfrrl.exe 90 PID 1688 wrote to memory of 4808 1688 9xxfrrl.exe 90 PID 1688 wrote to memory of 4808 1688 9xxfrrl.exe 90 PID 4808 wrote to memory of 3384 4808 htnnhn.exe 91 PID 4808 wrote to memory of 3384 4808 htnnhn.exe 91 PID 4808 wrote to memory of 3384 4808 htnnhn.exe 91 PID 3384 wrote to memory of 2752 3384 ntbtnh.exe 92 PID 3384 wrote to memory of 2752 3384 ntbtnh.exe 92 PID 3384 wrote to memory of 2752 3384 ntbtnh.exe 92 PID 2752 wrote to memory of 1976 2752 nhnntn.exe 93 PID 2752 wrote to memory of 1976 2752 nhnntn.exe 93 PID 2752 wrote to memory of 1976 2752 nhnntn.exe 93 PID 1976 wrote to memory of 4268 1976 vdpjd.exe 94 PID 1976 wrote to memory of 4268 1976 vdpjd.exe 94 PID 1976 wrote to memory of 4268 1976 vdpjd.exe 94 PID 4268 wrote to memory of 2900 4268 xfxxrrl.exe 95 PID 4268 wrote to memory of 2900 4268 xfxxrrl.exe 95 PID 4268 wrote to memory of 2900 4268 xfxxrrl.exe 95 PID 2900 wrote to memory of 1332 2900 vpjdp.exe 96 PID 2900 wrote to memory of 1332 2900 vpjdp.exe 96 PID 2900 wrote to memory of 1332 2900 vpjdp.exe 96 PID 1332 wrote to memory of 3804 1332 xrxxxxx.exe 97 PID 1332 wrote to memory of 3804 1332 xrxxxxx.exe 97 PID 1332 wrote to memory of 3804 1332 xrxxxxx.exe 97 PID 3804 wrote to memory of 4796 3804 bntnhh.exe 98 PID 3804 wrote to memory of 4796 3804 bntnhh.exe 98 PID 3804 wrote to memory of 4796 3804 bntnhh.exe 98 PID 4796 wrote to memory of 3688 4796 vjjpd.exe 99 PID 4796 wrote to memory of 3688 4796 vjjpd.exe 99 PID 4796 wrote to memory of 3688 4796 vjjpd.exe 99 PID 3688 wrote to memory of 2372 3688 rxrlffx.exe 100 PID 3688 wrote to memory of 2372 3688 rxrlffx.exe 100 PID 3688 wrote to memory of 2372 3688 rxrlffx.exe 100 PID 2372 wrote to memory of 5036 2372 nbhbtn.exe 101 PID 2372 wrote to memory of 5036 2372 nbhbtn.exe 101 PID 2372 wrote to memory of 5036 2372 nbhbtn.exe 101 PID 5036 wrote to memory of 1112 5036 dppjd.exe 102 PID 5036 wrote to memory of 1112 5036 dppjd.exe 102 PID 5036 wrote to memory of 1112 5036 dppjd.exe 102 PID 1112 wrote to memory of 2728 1112 tbtnhh.exe 103 PID 1112 wrote to memory of 2728 1112 tbtnhh.exe 103 PID 1112 wrote to memory of 2728 1112 tbtnhh.exe 103 PID 2728 wrote to memory of 4680 2728 nbtnbn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe"C:\Users\Admin\AppData\Local\Temp\f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\rrrrlll.exec:\rrrrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\ntnhbb.exec:\ntnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\1jjdv.exec:\1jjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\7flfffx.exec:\7flfffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\vjjdv.exec:\vjjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\rfrlfxl.exec:\rfrlfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\9xxfrrl.exec:\9xxfrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\htnnhn.exec:\htnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\ntbtnh.exec:\ntbtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\nhnntn.exec:\nhnntn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vdpjd.exec:\vdpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\xfxxrrl.exec:\xfxxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\vpjdp.exec:\vpjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\bntnhh.exec:\bntnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\vjjpd.exec:\vjjpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\rxrlffx.exec:\rxrlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\nbhbtn.exec:\nbhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\dppjd.exec:\dppjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\tbtnhh.exec:\tbtnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\nbtnbn.exec:\nbtnbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\1bbtnn.exec:\1bbtnn.exe23⤵
- Executes dropped EXE
PID:4680 -
\??\c:\dvdjd.exec:\dvdjd.exe24⤵
- Executes dropped EXE
PID:976 -
\??\c:\lxrfxrf.exec:\lxrfxrf.exe25⤵
- Executes dropped EXE
PID:4768 -
\??\c:\xlllfxr.exec:\xlllfxr.exe26⤵
- Executes dropped EXE
PID:4024 -
\??\c:\hnbttt.exec:\hnbttt.exe27⤵
- Executes dropped EXE
PID:384 -
\??\c:\pddvp.exec:\pddvp.exe28⤵
- Executes dropped EXE
PID:4568 -
\??\c:\hbhnnb.exec:\hbhnnb.exe29⤵
- Executes dropped EXE
PID:5096 -
\??\c:\3ddvj.exec:\3ddvj.exe30⤵
- Executes dropped EXE
PID:4836 -
\??\c:\xxxrxxr.exec:\xxxrxxr.exe31⤵
- Executes dropped EXE
PID:688 -
\??\c:\nnbtnh.exec:\nnbtnh.exe32⤵
- Executes dropped EXE
PID:224 -
\??\c:\lxfrfxl.exec:\lxfrfxl.exe33⤵
- Executes dropped EXE
PID:4248 -
\??\c:\frrllxr.exec:\frrllxr.exe34⤵
- Executes dropped EXE
PID:4480 -
\??\c:\fxxrlff.exec:\fxxrlff.exe35⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nhnbtt.exec:\nhnbtt.exe36⤵
- Executes dropped EXE
PID:768 -
\??\c:\flrlfxr.exec:\flrlfxr.exe37⤵
- Executes dropped EXE
PID:516 -
\??\c:\tbhbnn.exec:\tbhbnn.exe38⤵
- Executes dropped EXE
PID:5116 -
\??\c:\pjjdv.exec:\pjjdv.exe39⤵
- Executes dropped EXE
PID:4812 -
\??\c:\dvvpd.exec:\dvvpd.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lxrflff.exec:\lxrflff.exe41⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nbnhbt.exec:\nbnhbt.exe42⤵
- Executes dropped EXE
PID:880 -
\??\c:\jvvpj.exec:\jvvpj.exe43⤵
- Executes dropped EXE
PID:4376 -
\??\c:\xxfrfxr.exec:\xxfrfxr.exe44⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe45⤵
- Executes dropped EXE
PID:4200 -
\??\c:\nttnhb.exec:\nttnhb.exe46⤵
- Executes dropped EXE
PID:4296 -
\??\c:\dvvpj.exec:\dvvpj.exe47⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rrfrlfx.exec:\rrfrlfx.exe48⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nhtnnh.exec:\nhtnnh.exe49⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hbhhbb.exec:\hbhhbb.exe50⤵
- Executes dropped EXE
PID:5024 -
\??\c:\dvvjv.exec:\dvvjv.exe51⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe52⤵
- Executes dropped EXE
PID:5088 -
\??\c:\9rxrlll.exec:\9rxrlll.exe53⤵
- Executes dropped EXE
PID:4708 -
\??\c:\bntbtn.exec:\bntbtn.exe54⤵
- Executes dropped EXE
PID:4312 -
\??\c:\pvdvj.exec:\pvdvj.exe55⤵
- Executes dropped EXE
PID:1400 -
\??\c:\3vvjd.exec:\3vvjd.exe56⤵
- Executes dropped EXE
PID:1744 -
\??\c:\frrrfff.exec:\frrrfff.exe57⤵
- Executes dropped EXE
PID:1396 -
\??\c:\htbnnh.exec:\htbnnh.exe58⤵
- Executes dropped EXE
PID:2428 -
\??\c:\djjdp.exec:\djjdp.exe59⤵
- Executes dropped EXE
PID:972 -
\??\c:\dddvp.exec:\dddvp.exe60⤵
- Executes dropped EXE
PID:4392 -
\??\c:\lffrlff.exec:\lffrlff.exe61⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ntbbbt.exec:\ntbbbt.exe62⤵
- Executes dropped EXE
PID:1416 -
\??\c:\dpdvj.exec:\dpdvj.exe63⤵
- Executes dropped EXE
PID:3384 -
\??\c:\5nnhbt.exec:\5nnhbt.exe64⤵
- Executes dropped EXE
PID:3708 -
\??\c:\5pjdv.exec:\5pjdv.exe65⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1llxrlr.exec:\1llxrlr.exe66⤵
- System Location Discovery: System Language Discovery
PID:3952 -
\??\c:\lxfxfxf.exec:\lxfxfxf.exe67⤵PID:4268
-
\??\c:\bnhbtt.exec:\bnhbtt.exe68⤵PID:2040
-
\??\c:\dvdpj.exec:\dvdpj.exe69⤵PID:2892
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe70⤵PID:1740
-
\??\c:\5nbntt.exec:\5nbntt.exe71⤵PID:2436
-
\??\c:\pvdvp.exec:\pvdvp.exe72⤵PID:5012
-
\??\c:\rflrlfr.exec:\rflrlfr.exe73⤵PID:1228
-
\??\c:\xxlfxfx.exec:\xxlfxfx.exe74⤵PID:2348
-
\??\c:\nhtnhh.exec:\nhtnhh.exe75⤵PID:2144
-
\??\c:\bhhthn.exec:\bhhthn.exe76⤵PID:1288
-
\??\c:\pdvpd.exec:\pdvpd.exe77⤵PID:2952
-
\??\c:\xllrfxr.exec:\xllrfxr.exe78⤵PID:3104
-
\??\c:\rllxlfx.exec:\rllxlfx.exe79⤵PID:5068
-
\??\c:\bnnbnn.exec:\bnnbnn.exe80⤵PID:4776
-
\??\c:\1vdvd.exec:\1vdvd.exe81⤵PID:4292
-
\??\c:\pddvv.exec:\pddvv.exe82⤵PID:2244
-
\??\c:\fxxrllf.exec:\fxxrllf.exe83⤵PID:1916
-
\??\c:\1hbbth.exec:\1hbbth.exe84⤵PID:3184
-
\??\c:\hhnnnb.exec:\hhnnnb.exe85⤵PID:776
-
\??\c:\jvjdp.exec:\jvjdp.exe86⤵PID:1936
-
\??\c:\djjvj.exec:\djjvj.exe87⤵PID:1560
-
\??\c:\xllxrlx.exec:\xllxrlx.exe88⤵PID:736
-
\??\c:\nhbtnn.exec:\nhbtnn.exe89⤵PID:4308
-
\??\c:\dddvv.exec:\dddvv.exe90⤵PID:3684
-
\??\c:\lflfrrl.exec:\lflfrrl.exe91⤵PID:4624
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe92⤵PID:3644
-
\??\c:\nbntnh.exec:\nbntnh.exe93⤵PID:4052
-
\??\c:\pdjvd.exec:\pdjvd.exe94⤵PID:2160
-
\??\c:\fxfrxrf.exec:\fxfrxrf.exe95⤵PID:664
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe96⤵PID:5000
-
\??\c:\5ttnhh.exec:\5ttnhh.exe97⤵PID:2816
-
\??\c:\jjvvv.exec:\jjvvv.exe98⤵PID:3288
-
\??\c:\rlrlxxf.exec:\rlrlxxf.exe99⤵PID:1808
-
\??\c:\nhnhbh.exec:\nhnhbh.exe100⤵PID:516
-
\??\c:\nnthnn.exec:\nnthnn.exe101⤵PID:4944
-
\??\c:\vpvvv.exec:\vpvvv.exe102⤵PID:1932
-
\??\c:\frrlxrl.exec:\frrlxrl.exe103⤵PID:3308
-
\??\c:\9xlfrll.exec:\9xlfrll.exe104⤵PID:3864
-
\??\c:\bnnhhb.exec:\bnnhhb.exe105⤵PID:3056
-
\??\c:\pjjdv.exec:\pjjdv.exe106⤵PID:4820
-
\??\c:\dpdpp.exec:\dpdpp.exe107⤵PID:4376
-
\??\c:\7nttnn.exec:\7nttnn.exe108⤵PID:3812
-
\??\c:\bhtntt.exec:\bhtntt.exe109⤵PID:1204
-
\??\c:\jdjvp.exec:\jdjvp.exe110⤵PID:3008
-
\??\c:\rffrllf.exec:\rffrllf.exe111⤵PID:1580
-
\??\c:\5bttnn.exec:\5bttnn.exe112⤵PID:1716
-
\??\c:\djvpd.exec:\djvpd.exe113⤵PID:2020
-
\??\c:\pvdvj.exec:\pvdvj.exe114⤵PID:5020
-
\??\c:\xxrrlxx.exec:\xxrrlxx.exe115⤵PID:244
-
\??\c:\bnnhtt.exec:\bnnhtt.exe116⤵PID:2820
-
\??\c:\htbttn.exec:\htbttn.exe117⤵PID:3328
-
\??\c:\djppd.exec:\djppd.exe118⤵PID:4648
-
\??\c:\flrlllf.exec:\flrlllf.exe119⤵PID:1348
-
\??\c:\lffxlfx.exec:\lffxlfx.exe120⤵PID:2840
-
\??\c:\ntbhbb.exec:\ntbhbb.exe121⤵PID:2420
-
\??\c:\pvjvp.exec:\pvjvp.exe122⤵PID:5076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-