Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 05:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe
-
Size
453KB
-
MD5
21f7f1bb95bfc7466f96b95b89014e35
-
SHA1
ef7c775bd3be2c8c01fcb19408178bf59b0d2d16
-
SHA256
fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9
-
SHA512
b240ad4d4537e68cc99da80459875933fee94002e72675966704693e5cb23697aba1fffd20e776ed287e77e3bb9cbe1ffdd6a4545f5a870784e58913e675e742
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1708-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-847-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-884-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4836 ddppp.exe 1372 lrfrfrx.exe 1028 tnnnhh.exe 4948 dvjvd.exe 2836 9llfxxr.exe 4144 3thhbb.exe 4356 djjdp.exe 3656 nnhbtn.exe 3492 frlxlxl.exe 428 nhbthh.exe 5116 ffrlllr.exe 4868 dvddp.exe 5036 llllllr.exe 2772 jjdvp.exe 3524 xllfrlf.exe 4328 nhhhhb.exe 3668 lxfxrrl.exe 1468 ffllffx.exe 2456 fxrxxxf.exe 4720 pddpp.exe 1792 flrrlff.exe 2648 vjvvj.exe 1076 ddddv.exe 2960 rfxrllf.exe 2704 hbhhbb.exe 2912 pdvjd.exe 2540 7ttnbt.exe 4200 jdvdv.exe 4440 pvddj.exe 4724 lrxfrff.exe 2600 ttbbtt.exe 3028 xfrlxlf.exe 3460 xffxllf.exe 2516 9lfxrxr.exe 1616 9tthth.exe 3380 ddjjj.exe 4112 lrlxlxr.exe 2308 7hhthb.exe 3736 vdjvj.exe 640 flrrllf.exe 1568 fxffxff.exe 4508 thntnb.exe 4512 dvddj.exe 2184 hthbbt.exe 4904 pdjjp.exe 4036 lxrlxrr.exe 3112 ffffxxx.exe 1108 bnnnnn.exe 4384 bbnhbt.exe 1284 9vdpv.exe 3608 5lrlllf.exe 544 hbhbnh.exe 1372 jddvj.exe 1084 rrrfxrf.exe 3700 tbnnhb.exe 5096 bbhhbb.exe 1340 5jvpv.exe 4676 rxlfrrf.exe 4712 hbhhnh.exe 3384 hbbnbh.exe 3196 jvjvv.exe 2520 xxffrfr.exe 3680 hbbbbb.exe 2888 dvvpj.exe -
resource yara_rule behavioral2/memory/1708-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-847-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 4836 1708 fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe 82 PID 1708 wrote to memory of 4836 1708 fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe 82 PID 1708 wrote to memory of 4836 1708 fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe 82 PID 4836 wrote to memory of 1372 4836 ddppp.exe 83 PID 4836 wrote to memory of 1372 4836 ddppp.exe 83 PID 4836 wrote to memory of 1372 4836 ddppp.exe 83 PID 1372 wrote to memory of 1028 1372 lrfrfrx.exe 84 PID 1372 wrote to memory of 1028 1372 lrfrfrx.exe 84 PID 1372 wrote to memory of 1028 1372 lrfrfrx.exe 84 PID 1028 wrote to memory of 4948 1028 tnnnhh.exe 85 PID 1028 wrote to memory of 4948 1028 tnnnhh.exe 85 PID 1028 wrote to memory of 4948 1028 tnnnhh.exe 85 PID 4948 wrote to memory of 2836 4948 dvjvd.exe 86 PID 4948 wrote to memory of 2836 4948 dvjvd.exe 86 PID 4948 wrote to memory of 2836 4948 dvjvd.exe 86 PID 2836 wrote to memory of 4144 2836 9llfxxr.exe 87 PID 2836 wrote to memory of 4144 2836 9llfxxr.exe 87 PID 2836 wrote to memory of 4144 2836 9llfxxr.exe 87 PID 4144 wrote to memory of 4356 4144 3thhbb.exe 88 PID 4144 wrote to memory of 4356 4144 3thhbb.exe 88 PID 4144 wrote to memory of 4356 4144 3thhbb.exe 88 PID 4356 wrote to memory of 3656 4356 djjdp.exe 89 PID 4356 wrote to memory of 3656 4356 djjdp.exe 89 PID 4356 wrote to memory of 3656 4356 djjdp.exe 89 PID 3656 wrote to memory of 3492 3656 nnhbtn.exe 90 PID 3656 wrote to memory of 3492 3656 nnhbtn.exe 90 PID 3656 wrote to memory of 3492 3656 nnhbtn.exe 90 PID 3492 wrote to memory of 428 3492 frlxlxl.exe 91 PID 3492 wrote to memory of 428 3492 frlxlxl.exe 91 PID 3492 wrote to memory of 428 3492 frlxlxl.exe 91 PID 428 wrote to memory of 5116 428 nhbthh.exe 92 PID 428 wrote to memory of 5116 428 nhbthh.exe 92 PID 428 wrote to memory of 5116 428 nhbthh.exe 92 PID 5116 wrote to memory of 4868 5116 ffrlllr.exe 93 PID 5116 wrote to memory of 4868 5116 ffrlllr.exe 93 PID 5116 wrote to memory of 4868 5116 ffrlllr.exe 93 PID 4868 wrote to memory of 5036 4868 dvddp.exe 94 PID 4868 wrote to memory of 5036 4868 dvddp.exe 94 PID 4868 wrote to memory of 5036 4868 dvddp.exe 94 PID 5036 wrote to memory of 2772 5036 llllllr.exe 95 PID 5036 wrote to memory of 2772 5036 llllllr.exe 95 PID 5036 wrote to memory of 2772 5036 llllllr.exe 95 PID 2772 wrote to memory of 3524 2772 jjdvp.exe 96 PID 2772 wrote to memory of 3524 2772 jjdvp.exe 96 PID 2772 wrote to memory of 3524 2772 jjdvp.exe 96 PID 3524 wrote to memory of 4328 3524 xllfrlf.exe 97 PID 3524 wrote to memory of 4328 3524 xllfrlf.exe 97 PID 3524 wrote to memory of 4328 3524 xllfrlf.exe 97 PID 4328 wrote to memory of 3668 4328 nhhhhb.exe 98 PID 4328 wrote to memory of 3668 4328 nhhhhb.exe 98 PID 4328 wrote to memory of 3668 4328 nhhhhb.exe 98 PID 3668 wrote to memory of 1468 3668 lxfxrrl.exe 99 PID 3668 wrote to memory of 1468 3668 lxfxrrl.exe 99 PID 3668 wrote to memory of 1468 3668 lxfxrrl.exe 99 PID 1468 wrote to memory of 2456 1468 ffllffx.exe 100 PID 1468 wrote to memory of 2456 1468 ffllffx.exe 100 PID 1468 wrote to memory of 2456 1468 ffllffx.exe 100 PID 2456 wrote to memory of 4720 2456 fxrxxxf.exe 101 PID 2456 wrote to memory of 4720 2456 fxrxxxf.exe 101 PID 2456 wrote to memory of 4720 2456 fxrxxxf.exe 101 PID 4720 wrote to memory of 1792 4720 pddpp.exe 102 PID 4720 wrote to memory of 1792 4720 pddpp.exe 102 PID 4720 wrote to memory of 1792 4720 pddpp.exe 102 PID 1792 wrote to memory of 2648 1792 flrrlff.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe"C:\Users\Admin\AppData\Local\Temp\fe676b0c320473c2e2939f793de5a3d89bf0067c9b87fb4cede7d120043a60b9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\ddppp.exec:\ddppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\lrfrfrx.exec:\lrfrfrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\tnnnhh.exec:\tnnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\dvjvd.exec:\dvjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\9llfxxr.exec:\9llfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\3thhbb.exec:\3thhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\djjdp.exec:\djjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\nnhbtn.exec:\nnhbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\frlxlxl.exec:\frlxlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\nhbthh.exec:\nhbthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\ffrlllr.exec:\ffrlllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\dvddp.exec:\dvddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\llllllr.exec:\llllllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\jjdvp.exec:\jjdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xllfrlf.exec:\xllfrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\nhhhhb.exec:\nhhhhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\ffllffx.exec:\ffllffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\fxrxxxf.exec:\fxrxxxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\pddpp.exec:\pddpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\flrrlff.exec:\flrrlff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\vjvvj.exec:\vjvvj.exe23⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ddddv.exec:\ddddv.exe24⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rfxrllf.exec:\rfxrllf.exe25⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hbhhbb.exec:\hbhhbb.exe26⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pdvjd.exec:\pdvjd.exe27⤵
- Executes dropped EXE
PID:2912 -
\??\c:\7ttnbt.exec:\7ttnbt.exe28⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jdvdv.exec:\jdvdv.exe29⤵
- Executes dropped EXE
PID:4200 -
\??\c:\pvddj.exec:\pvddj.exe30⤵
- Executes dropped EXE
PID:4440 -
\??\c:\lrxfrff.exec:\lrxfrff.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4724 -
\??\c:\ttbbtt.exec:\ttbbtt.exe32⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xfrlxlf.exec:\xfrlxlf.exe33⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xffxllf.exec:\xffxllf.exe34⤵
- Executes dropped EXE
PID:3460 -
\??\c:\9lfxrxr.exec:\9lfxrxr.exe35⤵
- Executes dropped EXE
PID:2516 -
\??\c:\9tthth.exec:\9tthth.exe36⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ddjjj.exec:\ddjjj.exe37⤵
- Executes dropped EXE
PID:3380 -
\??\c:\lrlxlxr.exec:\lrlxlxr.exe38⤵
- Executes dropped EXE
PID:4112 -
\??\c:\7hhthb.exec:\7hhthb.exe39⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vdjvj.exec:\vdjvj.exe40⤵
- Executes dropped EXE
PID:3736 -
\??\c:\flrrllf.exec:\flrrllf.exe41⤵
- Executes dropped EXE
PID:640 -
\??\c:\fxffxff.exec:\fxffxff.exe42⤵
- Executes dropped EXE
PID:1568 -
\??\c:\thntnb.exec:\thntnb.exe43⤵
- Executes dropped EXE
PID:4508 -
\??\c:\dvddj.exec:\dvddj.exe44⤵
- Executes dropped EXE
PID:4512 -
\??\c:\hthbbt.exec:\hthbbt.exe45⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pdjjp.exec:\pdjjp.exe46⤵
- Executes dropped EXE
PID:4904 -
\??\c:\lxrlxrr.exec:\lxrlxrr.exe47⤵
- Executes dropped EXE
PID:4036 -
\??\c:\ffffxxx.exec:\ffffxxx.exe48⤵
- Executes dropped EXE
PID:3112 -
\??\c:\bnnnnn.exec:\bnnnnn.exe49⤵
- Executes dropped EXE
PID:1108 -
\??\c:\bbnhbt.exec:\bbnhbt.exe50⤵
- Executes dropped EXE
PID:4384 -
\??\c:\9vdpv.exec:\9vdpv.exe51⤵
- Executes dropped EXE
PID:1284 -
\??\c:\5lrlllf.exec:\5lrlllf.exe52⤵
- Executes dropped EXE
PID:3608 -
\??\c:\hbhbnh.exec:\hbhbnh.exe53⤵
- Executes dropped EXE
PID:544 -
\??\c:\jddvj.exec:\jddvj.exe54⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rrrfxrf.exec:\rrrfxrf.exe55⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tbnnhb.exec:\tbnnhb.exe56⤵
- Executes dropped EXE
PID:3700 -
\??\c:\bbhhbb.exec:\bbhhbb.exe57⤵
- Executes dropped EXE
PID:5096 -
\??\c:\5jvpv.exec:\5jvpv.exe58⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rxlfrrf.exec:\rxlfrrf.exe59⤵
- Executes dropped EXE
PID:4676 -
\??\c:\hbhhnh.exec:\hbhhnh.exe60⤵
- Executes dropped EXE
PID:4712 -
\??\c:\hbbnbh.exec:\hbbnbh.exe61⤵
- Executes dropped EXE
PID:3384 -
\??\c:\jvjvv.exec:\jvjvv.exe62⤵
- Executes dropped EXE
PID:3196 -
\??\c:\xxffrfr.exec:\xxffrfr.exe63⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hbbbbb.exec:\hbbbbb.exe64⤵
- Executes dropped EXE
PID:3680 -
\??\c:\dvvpj.exec:\dvvpj.exe65⤵
- Executes dropped EXE
PID:2888 -
\??\c:\1rfxrrf.exec:\1rfxrrf.exe66⤵PID:428
-
\??\c:\hbhbnh.exec:\hbhbnh.exe67⤵PID:232
-
\??\c:\pvppp.exec:\pvppp.exe68⤵PID:116
-
\??\c:\5rlxrlx.exec:\5rlxrlx.exe69⤵PID:4868
-
\??\c:\7hhthh.exec:\7hhthh.exe70⤵PID:3596
-
\??\c:\pjjvd.exec:\pjjvd.exe71⤵PID:1484
-
\??\c:\dvvpj.exec:\dvvpj.exe72⤵PID:5008
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe73⤵PID:5024
-
\??\c:\nhhhnn.exec:\nhhhnn.exe74⤵PID:928
-
\??\c:\vvvpd.exec:\vvvpd.exe75⤵PID:4360
-
\??\c:\pdpjj.exec:\pdpjj.exe76⤵PID:1528
-
\??\c:\rfffxxl.exec:\rfffxxl.exe77⤵PID:860
-
\??\c:\lfrlfrl.exec:\lfrlfrl.exe78⤵PID:3368
-
\??\c:\1hhbbb.exec:\1hhbbb.exe79⤵PID:4244
-
\??\c:\vjpjj.exec:\vjpjj.exe80⤵PID:4624
-
\??\c:\lfflxrl.exec:\lfflxrl.exe81⤵PID:4864
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe82⤵PID:740
-
\??\c:\3hbttt.exec:\3hbttt.exe83⤵PID:2044
-
\??\c:\pvvpj.exec:\pvvpj.exe84⤵PID:4780
-
\??\c:\vjpjj.exec:\vjpjj.exe85⤵PID:3704
-
\??\c:\llfllxx.exec:\llfllxx.exe86⤵PID:1324
-
\??\c:\bhnnnn.exec:\bhnnnn.exe87⤵PID:4156
-
\??\c:\dppjd.exec:\dppjd.exe88⤵PID:1100
-
\??\c:\vvppj.exec:\vvppj.exe89⤵PID:1832
-
\??\c:\frxfxxr.exec:\frxfxxr.exe90⤵PID:4964
-
\??\c:\3tbtbb.exec:\3tbtbb.exe91⤵PID:1052
-
\??\c:\ddvpj.exec:\ddvpj.exe92⤵PID:1720
-
\??\c:\pjjjd.exec:\pjjjd.exe93⤵PID:3364
-
\??\c:\lrxrllf.exec:\lrxrllf.exe94⤵PID:3708
-
\??\c:\1hbttt.exec:\1hbttt.exe95⤵PID:2600
-
\??\c:\3ddvp.exec:\3ddvp.exe96⤵PID:4960
-
\??\c:\7fxrlfx.exec:\7fxrlfx.exe97⤵PID:3028
-
\??\c:\rlrlfff.exec:\rlrlfff.exe98⤵PID:2592
-
\??\c:\hnhbtt.exec:\hnhbtt.exe99⤵PID:4796
-
\??\c:\pvddv.exec:\pvddv.exe100⤵PID:456
-
\??\c:\7lxrlxr.exec:\7lxrlxr.exe101⤵PID:2524
-
\??\c:\nttnhh.exec:\nttnhh.exe102⤵PID:4020
-
\??\c:\bnnbbn.exec:\bnnbbn.exe103⤵PID:4716
-
\??\c:\vppdp.exec:\vppdp.exe104⤵PID:3764
-
\??\c:\llxxxlf.exec:\llxxxlf.exe105⤵PID:2852
-
\??\c:\hbtnhh.exec:\hbtnhh.exe106⤵PID:2188
-
\??\c:\hntnhh.exec:\hntnhh.exe107⤵PID:4932
-
\??\c:\jvdvv.exec:\jvdvv.exe108⤵PID:2076
-
\??\c:\1lrllrr.exec:\1lrllrr.exe109⤵PID:3836
-
\??\c:\rllfrrl.exec:\rllfrrl.exe110⤵PID:4840
-
\??\c:\btbthh.exec:\btbthh.exe111⤵PID:1452
-
\??\c:\htbttn.exec:\htbttn.exe112⤵
- System Location Discovery: System Language Discovery
PID:1420 -
\??\c:\jvvpv.exec:\jvvpv.exe113⤵PID:4352
-
\??\c:\llfrlll.exec:\llfrlll.exe114⤵PID:1108
-
\??\c:\tthttt.exec:\tthttt.exe115⤵
- System Location Discovery: System Language Discovery
PID:4384 -
\??\c:\bththb.exec:\bththb.exe116⤵PID:1284
-
\??\c:\ddvpv.exec:\ddvpv.exe117⤵PID:4032
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe118⤵PID:1028
-
\??\c:\xfffxrr.exec:\xfffxrr.exe119⤵PID:1372
-
\??\c:\9bhnnh.exec:\9bhnnh.exe120⤵PID:1088
-
\??\c:\pddvp.exec:\pddvp.exe121⤵PID:5012
-
\??\c:\rllfrrl.exec:\rllfrrl.exe122⤵PID:3936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-