Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe
-
Size
455KB
-
MD5
fdcb0d1c35362790c47d3496a73ae170
-
SHA1
b12e29a4bff892a257ac112af499888eadfeb77d
-
SHA256
faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7
-
SHA512
b84ee16844220c5b6969465ffa5fd53ee775c262ff1449ecee628b85bd1f5bddcea86b2e5aaddc9ca1cbabd29d8802e0888de6663194c05ce31127cbaaa3223a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRIJ:q7Tc2NYHUrAwfMp3CDRQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1900-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/420-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/604-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-855-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-907-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-1496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-4813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4724 llxrlxr.exe 4864 vpvpj.exe 1764 lxxxxfl.exe 1932 ttbthb.exe 2820 vdvvp.exe 2704 3fffxxr.exe 1380 thtnbt.exe 4756 1vpjd.exe 3888 5hnnhn.exe 2580 rflfrrl.exe 2976 1thbtn.exe 936 xxxrffr.exe 3964 1dvvv.exe 2980 rlffxxr.exe 2280 nnbbhh.exe 420 bbhbhb.exe 2684 xxxxxxx.exe 4792 9bhhhh.exe 2188 jpvvp.exe 1212 xxxrllf.exe 4760 hhnnnn.exe 4044 5llllll.exe 4232 bhnhnn.exe 1148 ppvvv.exe 3868 5rlllll.exe 912 9hhbbb.exe 4460 flrrlrl.exe 4432 djvvd.exe 4660 rflrlrl.exe 1360 9rrrrrr.exe 2368 vvvvv.exe 1624 fxfxlxx.exe 4256 vdddd.exe 2880 3rffllx.exe 3128 ntbntn.exe 396 dpvvv.exe 2660 xlrlrlf.exe 5012 thbbbh.exe 3552 7pddp.exe 4424 xfrrrrf.exe 3268 nhnnhn.exe 4944 jvpjd.exe 3088 fflxxxx.exe 4496 nbhbbb.exe 3240 1tnnnt.exe 2204 djppj.exe 4360 rxxrlrl.exe 4988 1bbbbb.exe 4840 jjppp.exe 2680 ppddd.exe 4200 llrrllf.exe 1628 thbbbh.exe 1780 9btttt.exe 2232 vpdvv.exe 2060 xlfxffr.exe 4404 bhhbtt.exe 4800 jjpjd.exe 1068 ffrlffx.exe 4032 bhnhbb.exe 3740 djppv.exe 3428 vvjdp.exe 3056 5llllrl.exe 2580 1hbttt.exe 4240 djdvv.exe -
resource yara_rule behavioral2/memory/1900-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/420-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/604-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-907-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fffflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 4724 1900 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 83 PID 1900 wrote to memory of 4724 1900 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 83 PID 1900 wrote to memory of 4724 1900 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 83 PID 4724 wrote to memory of 4864 4724 llxrlxr.exe 84 PID 4724 wrote to memory of 4864 4724 llxrlxr.exe 84 PID 4724 wrote to memory of 4864 4724 llxrlxr.exe 84 PID 4864 wrote to memory of 1764 4864 vpvpj.exe 85 PID 4864 wrote to memory of 1764 4864 vpvpj.exe 85 PID 4864 wrote to memory of 1764 4864 vpvpj.exe 85 PID 1764 wrote to memory of 1932 1764 lxxxxfl.exe 86 PID 1764 wrote to memory of 1932 1764 lxxxxfl.exe 86 PID 1764 wrote to memory of 1932 1764 lxxxxfl.exe 86 PID 1932 wrote to memory of 2820 1932 ttbthb.exe 87 PID 1932 wrote to memory of 2820 1932 ttbthb.exe 87 PID 1932 wrote to memory of 2820 1932 ttbthb.exe 87 PID 2820 wrote to memory of 2704 2820 vdvvp.exe 88 PID 2820 wrote to memory of 2704 2820 vdvvp.exe 88 PID 2820 wrote to memory of 2704 2820 vdvvp.exe 88 PID 2704 wrote to memory of 1380 2704 3fffxxr.exe 89 PID 2704 wrote to memory of 1380 2704 3fffxxr.exe 89 PID 2704 wrote to memory of 1380 2704 3fffxxr.exe 89 PID 1380 wrote to memory of 4756 1380 thtnbt.exe 90 PID 1380 wrote to memory of 4756 1380 thtnbt.exe 90 PID 1380 wrote to memory of 4756 1380 thtnbt.exe 90 PID 4756 wrote to memory of 3888 4756 1vpjd.exe 91 PID 4756 wrote to memory of 3888 4756 1vpjd.exe 91 PID 4756 wrote to memory of 3888 4756 1vpjd.exe 91 PID 3888 wrote to memory of 2580 3888 5hnnhn.exe 92 PID 3888 wrote to memory of 2580 3888 5hnnhn.exe 92 PID 3888 wrote to memory of 2580 3888 5hnnhn.exe 92 PID 2580 wrote to memory of 2976 2580 rflfrrl.exe 93 PID 2580 wrote to memory of 2976 2580 rflfrrl.exe 93 PID 2580 wrote to memory of 2976 2580 rflfrrl.exe 93 PID 2976 wrote to memory of 936 2976 1thbtn.exe 94 PID 2976 wrote to memory of 936 2976 1thbtn.exe 94 PID 2976 wrote to memory of 936 2976 1thbtn.exe 94 PID 936 wrote to memory of 3964 936 xxxrffr.exe 95 PID 936 wrote to memory of 3964 936 xxxrffr.exe 95 PID 936 wrote to memory of 3964 936 xxxrffr.exe 95 PID 3964 wrote to memory of 2980 3964 1dvvv.exe 96 PID 3964 wrote to memory of 2980 3964 1dvvv.exe 96 PID 3964 wrote to memory of 2980 3964 1dvvv.exe 96 PID 2980 wrote to memory of 2280 2980 rlffxxr.exe 97 PID 2980 wrote to memory of 2280 2980 rlffxxr.exe 97 PID 2980 wrote to memory of 2280 2980 rlffxxr.exe 97 PID 2280 wrote to memory of 420 2280 nnbbhh.exe 98 PID 2280 wrote to memory of 420 2280 nnbbhh.exe 98 PID 2280 wrote to memory of 420 2280 nnbbhh.exe 98 PID 420 wrote to memory of 2684 420 bbhbhb.exe 99 PID 420 wrote to memory of 2684 420 bbhbhb.exe 99 PID 420 wrote to memory of 2684 420 bbhbhb.exe 99 PID 2684 wrote to memory of 4792 2684 xxxxxxx.exe 100 PID 2684 wrote to memory of 4792 2684 xxxxxxx.exe 100 PID 2684 wrote to memory of 4792 2684 xxxxxxx.exe 100 PID 4792 wrote to memory of 2188 4792 9bhhhh.exe 101 PID 4792 wrote to memory of 2188 4792 9bhhhh.exe 101 PID 4792 wrote to memory of 2188 4792 9bhhhh.exe 101 PID 2188 wrote to memory of 1212 2188 jpvvp.exe 102 PID 2188 wrote to memory of 1212 2188 jpvvp.exe 102 PID 2188 wrote to memory of 1212 2188 jpvvp.exe 102 PID 1212 wrote to memory of 4760 1212 xxxrllf.exe 103 PID 1212 wrote to memory of 4760 1212 xxxrllf.exe 103 PID 1212 wrote to memory of 4760 1212 xxxrllf.exe 103 PID 4760 wrote to memory of 4044 4760 hhnnnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe"C:\Users\Admin\AppData\Local\Temp\faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\llxrlxr.exec:\llxrlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\vpvpj.exec:\vpvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\lxxxxfl.exec:\lxxxxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\ttbthb.exec:\ttbthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\vdvvp.exec:\vdvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\3fffxxr.exec:\3fffxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\thtnbt.exec:\thtnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\1vpjd.exec:\1vpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\5hnnhn.exec:\5hnnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\rflfrrl.exec:\rflfrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\1thbtn.exec:\1thbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xxxrffr.exec:\xxxrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\1dvvv.exec:\1dvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\rlffxxr.exec:\rlffxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\nnbbhh.exec:\nnbbhh.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\bbhbhb.exec:\bbhbhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\9bhhhh.exec:\9bhhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\jpvvp.exec:\jpvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\xxxrllf.exec:\xxxrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\hhnnnn.exec:\hhnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\5llllll.exec:\5llllll.exe23⤵
- Executes dropped EXE
PID:4044 -
\??\c:\bhnhnn.exec:\bhnhnn.exe24⤵
- Executes dropped EXE
PID:4232 -
\??\c:\ppvvv.exec:\ppvvv.exe25⤵
- Executes dropped EXE
PID:1148 -
\??\c:\5rlllll.exec:\5rlllll.exe26⤵
- Executes dropped EXE
PID:3868 -
\??\c:\9hhbbb.exec:\9hhbbb.exe27⤵
- Executes dropped EXE
PID:912 -
\??\c:\flrrlrl.exec:\flrrlrl.exe28⤵
- Executes dropped EXE
PID:4460 -
\??\c:\djvvd.exec:\djvvd.exe29⤵
- Executes dropped EXE
PID:4432 -
\??\c:\rflrlrl.exec:\rflrlrl.exe30⤵
- Executes dropped EXE
PID:4660 -
\??\c:\9rrrrrr.exec:\9rrrrrr.exe31⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vvvvv.exec:\vvvvv.exe32⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fxfxlxx.exec:\fxfxlxx.exe33⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vdddd.exec:\vdddd.exe34⤵
- Executes dropped EXE
PID:4256 -
\??\c:\3rffllx.exec:\3rffllx.exe35⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ntbntn.exec:\ntbntn.exe36⤵
- Executes dropped EXE
PID:3128 -
\??\c:\dpvvv.exec:\dpvvv.exe37⤵
- Executes dropped EXE
PID:396 -
\??\c:\xlrlrlf.exec:\xlrlrlf.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\thbbbh.exec:\thbbbh.exe39⤵
- Executes dropped EXE
PID:5012 -
\??\c:\7pddp.exec:\7pddp.exe40⤵
- Executes dropped EXE
PID:3552 -
\??\c:\xfrrrrf.exec:\xfrrrrf.exe41⤵
- Executes dropped EXE
PID:4424 -
\??\c:\nhnnhn.exec:\nhnnhn.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3268 -
\??\c:\jvpjd.exec:\jvpjd.exe43⤵
- Executes dropped EXE
PID:4944 -
\??\c:\fflxxxx.exec:\fflxxxx.exe44⤵
- Executes dropped EXE
PID:3088 -
\??\c:\nbhbbb.exec:\nbhbbb.exe45⤵
- Executes dropped EXE
PID:4496 -
\??\c:\1tnnnt.exec:\1tnnnt.exe46⤵
- Executes dropped EXE
PID:3240 -
\??\c:\djppj.exec:\djppj.exe47⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rxxrlrl.exec:\rxxrlrl.exe48⤵
- Executes dropped EXE
PID:4360 -
\??\c:\1bbbbb.exec:\1bbbbb.exe49⤵
- Executes dropped EXE
PID:4988 -
\??\c:\jjppp.exec:\jjppp.exe50⤵
- Executes dropped EXE
PID:4840 -
\??\c:\ppddd.exec:\ppddd.exe51⤵
- Executes dropped EXE
PID:2680 -
\??\c:\llrrllf.exec:\llrrllf.exe52⤵
- Executes dropped EXE
PID:4200 -
\??\c:\thbbbh.exec:\thbbbh.exe53⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9btttt.exec:\9btttt.exe54⤵
- Executes dropped EXE
PID:1780 -
\??\c:\vpdvv.exec:\vpdvv.exe55⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xlfxffr.exec:\xlfxffr.exe56⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bhhbtt.exec:\bhhbtt.exe57⤵
- Executes dropped EXE
PID:4404 -
\??\c:\jjpjd.exec:\jjpjd.exe58⤵
- Executes dropped EXE
PID:4800 -
\??\c:\ffrlffx.exec:\ffrlffx.exe59⤵
- Executes dropped EXE
PID:1068 -
\??\c:\bhnhbb.exec:\bhnhbb.exe60⤵
- Executes dropped EXE
PID:4032 -
\??\c:\djppv.exec:\djppv.exe61⤵
- Executes dropped EXE
PID:3740 -
\??\c:\vvjdp.exec:\vvjdp.exe62⤵
- Executes dropped EXE
PID:3428 -
\??\c:\5llllrl.exec:\5llllrl.exe63⤵
- Executes dropped EXE
PID:3056 -
\??\c:\1hbttt.exec:\1hbttt.exe64⤵
- Executes dropped EXE
PID:2580 -
\??\c:\djdvv.exec:\djdvv.exe65⤵
- Executes dropped EXE
PID:4240 -
\??\c:\pvddp.exec:\pvddp.exe66⤵PID:4120
-
\??\c:\fflffff.exec:\fflffff.exe67⤵PID:4504
-
\??\c:\hbnntt.exec:\hbnntt.exe68⤵PID:4128
-
\??\c:\dppjd.exec:\dppjd.exe69⤵PID:2104
-
\??\c:\lxxxxff.exec:\lxxxxff.exe70⤵PID:2980
-
\??\c:\tntthh.exec:\tntthh.exe71⤵PID:3708
-
\??\c:\7pppp.exec:\7pppp.exe72⤵PID:1232
-
\??\c:\rxxrllf.exec:\rxxrllf.exe73⤵PID:3332
-
\??\c:\fxlllxr.exec:\fxlllxr.exe74⤵
- System Location Discovery: System Language Discovery
PID:4284 -
\??\c:\7bhbbh.exec:\7bhbbh.exe75⤵PID:4184
-
\??\c:\ppvvp.exec:\ppvvp.exe76⤵PID:2600
-
\??\c:\flrrrrl.exec:\flrrrrl.exe77⤵PID:3160
-
\??\c:\tthbhb.exec:\tthbhb.exe78⤵PID:2196
-
\??\c:\bhbbhh.exec:\bhbbhh.exe79⤵PID:4004
-
\??\c:\vpvpj.exec:\vpvpj.exe80⤵PID:2228
-
\??\c:\9dvvv.exec:\9dvvv.exe81⤵PID:1016
-
\??\c:\flrxrfx.exec:\flrxrfx.exe82⤵PID:604
-
\??\c:\bthhhn.exec:\bthhhn.exe83⤵PID:2700
-
\??\c:\pvpjd.exec:\pvpjd.exe84⤵PID:1608
-
\??\c:\rlrrllf.exec:\rlrrllf.exe85⤵PID:3564
-
\??\c:\xxffxff.exec:\xxffxff.exe86⤵PID:4176
-
\??\c:\tbnbbn.exec:\tbnbbn.exe87⤵PID:4556
-
\??\c:\vdvvp.exec:\vdvvp.exe88⤵PID:2876
-
\??\c:\vdddv.exec:\vdddv.exe89⤵PID:4432
-
\??\c:\lllfffx.exec:\lllfffx.exe90⤵PID:2824
-
\??\c:\ttthbh.exec:\ttthbh.exe91⤵PID:2848
-
\??\c:\pvvpp.exec:\pvvpp.exe92⤵PID:2212
-
\??\c:\rxxxrxl.exec:\rxxxrxl.exe93⤵PID:4416
-
\??\c:\bnttnn.exec:\bnttnn.exe94⤵PID:660
-
\??\c:\ddjvp.exec:\ddjvp.exe95⤵PID:4256
-
\??\c:\3dpvd.exec:\3dpvd.exe96⤵PID:4832
-
\??\c:\3xlflrx.exec:\3xlflrx.exe97⤵PID:4248
-
\??\c:\tbnnbb.exec:\tbnnbb.exe98⤵PID:4856
-
\??\c:\vvvpj.exec:\vvvpj.exe99⤵PID:4628
-
\??\c:\xxfffff.exec:\xxfffff.exe100⤵PID:3652
-
\??\c:\htttnn.exec:\htttnn.exe101⤵PID:4024
-
\??\c:\nhtttt.exec:\nhtttt.exe102⤵PID:4716
-
\??\c:\jdjvp.exec:\jdjvp.exe103⤵PID:2496
-
\??\c:\7lfxrrl.exec:\7lfxrrl.exe104⤵PID:3268
-
\??\c:\fxffrlf.exec:\fxffrlf.exe105⤵PID:548
-
\??\c:\bbhhhn.exec:\bbhhhn.exe106⤵PID:4304
-
\??\c:\pvvpj.exec:\pvvpj.exe107⤵PID:232
-
\??\c:\flfffll.exec:\flfffll.exe108⤵PID:3876
-
\??\c:\bbtttb.exec:\bbtttb.exe109⤵PID:2096
-
\??\c:\ttbtnh.exec:\ttbtnh.exe110⤵PID:2788
-
\??\c:\vjddv.exec:\vjddv.exe111⤵PID:1436
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe112⤵PID:2036
-
\??\c:\tbhhnn.exec:\tbhhnn.exe113⤵PID:468
-
\??\c:\pjpjj.exec:\pjpjj.exe114⤵PID:4200
-
\??\c:\jdjvp.exec:\jdjvp.exe115⤵PID:1372
-
\??\c:\ffrrxff.exec:\ffrrxff.exe116⤵PID:840
-
\??\c:\tbbbbb.exec:\tbbbbb.exe117⤵PID:2820
-
\??\c:\5hnnhh.exec:\5hnnhh.exe118⤵PID:3644
-
\??\c:\ddjjj.exec:\ddjjj.exe119⤵PID:4188
-
\??\c:\frxrrrx.exec:\frxrrrx.exe120⤵PID:644
-
\??\c:\rxxrllf.exec:\rxxrllf.exe121⤵PID:4796
-
\??\c:\tthnnb.exec:\tthnnb.exe122⤵PID:804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-