Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe
-
Size
454KB
-
MD5
ca175a8654e17740060bd3dc7beecc4c
-
SHA1
1fca61813a09a03bc15d5d3e8904ac619cd66949
-
SHA256
45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4
-
SHA512
7b2ebc19b512ae2c36f8c9a52d2ac70ec60bfaf72ce8bb910ad43ba2eb694d79ad10d09b8535d52d8803608da17b304b54da9af807bfc20412773917138842e1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTx:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4632-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/180-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-965-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-1781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-1791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-1807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4632 vpvvp.exe 1940 fxrrllf.exe 2964 hbbhtb.exe 2028 dpvvd.exe 1644 lxxfxlx.exe 2312 flrfrfr.exe 4032 bthbbh.exe 4012 vvddv.exe 232 xlfrlxl.exe 1456 bnbtht.exe 2968 5jddd.exe 1392 jdpjj.exe 2140 xxffrrl.exe 3816 5nhhtb.exe 2344 djppv.exe 2288 vdjjj.exe 4128 xrxxflr.exe 4280 nhtttb.exe 4492 3bnnnh.exe 2900 9jppp.exe 388 ffflrxr.exe 4700 ffrrxff.exe 4796 bbtttb.exe 8 pdvpp.exe 2272 5dppd.exe 3828 7fxffrr.exe 2412 lflxrfx.exe 2700 hbnbbn.exe 3856 ddjdd.exe 5060 dvjdd.exe 1484 xrfxfff.exe 2960 hthhnn.exe 4548 nnbnnh.exe 392 vvjpp.exe 4860 xrrrflx.exe 4496 nhtbbh.exe 1616 ttbbbh.exe 4244 ddjjp.exe 1312 flffrff.exe 2104 lfrrrxx.exe 4932 ntnntt.exe 4808 3dpvj.exe 1144 vvpdd.exe 2376 xrfffff.exe 2024 nbnbht.exe 4404 tbhthn.exe 2976 ddjjv.exe 2996 xfxxxlr.exe 396 llrxxrr.exe 4536 5tttbh.exe 224 vvvdp.exe 2336 frxrrff.exe 220 xxllrxf.exe 3012 tnbbtt.exe 1224 7djvd.exe 1964 rxlrrxl.exe 2844 7rrrrrr.exe 1268 1ttthn.exe 624 9vppv.exe 936 vjvvd.exe 4992 fxxxrll.exe 1608 bbbnbt.exe 4816 jdvpv.exe 3364 rffxrrl.exe -
resource yara_rule behavioral2/memory/4632-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/180-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-965-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-1224-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 4632 4456 45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe 82 PID 4456 wrote to memory of 4632 4456 45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe 82 PID 4456 wrote to memory of 4632 4456 45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe 82 PID 4632 wrote to memory of 1940 4632 vpvvp.exe 83 PID 4632 wrote to memory of 1940 4632 vpvvp.exe 83 PID 4632 wrote to memory of 1940 4632 vpvvp.exe 83 PID 1940 wrote to memory of 2964 1940 fxrrllf.exe 84 PID 1940 wrote to memory of 2964 1940 fxrrllf.exe 84 PID 1940 wrote to memory of 2964 1940 fxrrllf.exe 84 PID 2964 wrote to memory of 2028 2964 hbbhtb.exe 85 PID 2964 wrote to memory of 2028 2964 hbbhtb.exe 85 PID 2964 wrote to memory of 2028 2964 hbbhtb.exe 85 PID 2028 wrote to memory of 1644 2028 dpvvd.exe 86 PID 2028 wrote to memory of 1644 2028 dpvvd.exe 86 PID 2028 wrote to memory of 1644 2028 dpvvd.exe 86 PID 1644 wrote to memory of 2312 1644 lxxfxlx.exe 157 PID 1644 wrote to memory of 2312 1644 lxxfxlx.exe 157 PID 1644 wrote to memory of 2312 1644 lxxfxlx.exe 157 PID 2312 wrote to memory of 4032 2312 flrfrfr.exe 88 PID 2312 wrote to memory of 4032 2312 flrfrfr.exe 88 PID 2312 wrote to memory of 4032 2312 flrfrfr.exe 88 PID 4032 wrote to memory of 4012 4032 bthbbh.exe 89 PID 4032 wrote to memory of 4012 4032 bthbbh.exe 89 PID 4032 wrote to memory of 4012 4032 bthbbh.exe 89 PID 4012 wrote to memory of 232 4012 vvddv.exe 90 PID 4012 wrote to memory of 232 4012 vvddv.exe 90 PID 4012 wrote to memory of 232 4012 vvddv.exe 90 PID 232 wrote to memory of 1456 232 xlfrlxl.exe 91 PID 232 wrote to memory of 1456 232 xlfrlxl.exe 91 PID 232 wrote to memory of 1456 232 xlfrlxl.exe 91 PID 1456 wrote to memory of 2968 1456 bnbtht.exe 92 PID 1456 wrote to memory of 2968 1456 bnbtht.exe 92 PID 1456 wrote to memory of 2968 1456 bnbtht.exe 92 PID 2968 wrote to memory of 1392 2968 5jddd.exe 93 PID 2968 wrote to memory of 1392 2968 5jddd.exe 93 PID 2968 wrote to memory of 1392 2968 5jddd.exe 93 PID 1392 wrote to memory of 2140 1392 jdpjj.exe 94 PID 1392 wrote to memory of 2140 1392 jdpjj.exe 94 PID 1392 wrote to memory of 2140 1392 jdpjj.exe 94 PID 2140 wrote to memory of 3816 2140 xxffrrl.exe 95 PID 2140 wrote to memory of 3816 2140 xxffrrl.exe 95 PID 2140 wrote to memory of 3816 2140 xxffrrl.exe 95 PID 3816 wrote to memory of 2344 3816 5nhhtb.exe 96 PID 3816 wrote to memory of 2344 3816 5nhhtb.exe 96 PID 3816 wrote to memory of 2344 3816 5nhhtb.exe 96 PID 2344 wrote to memory of 2288 2344 djppv.exe 97 PID 2344 wrote to memory of 2288 2344 djppv.exe 97 PID 2344 wrote to memory of 2288 2344 djppv.exe 97 PID 2288 wrote to memory of 4128 2288 vdjjj.exe 98 PID 2288 wrote to memory of 4128 2288 vdjjj.exe 98 PID 2288 wrote to memory of 4128 2288 vdjjj.exe 98 PID 4128 wrote to memory of 4280 4128 xrxxflr.exe 99 PID 4128 wrote to memory of 4280 4128 xrxxflr.exe 99 PID 4128 wrote to memory of 4280 4128 xrxxflr.exe 99 PID 4280 wrote to memory of 4492 4280 nhtttb.exe 100 PID 4280 wrote to memory of 4492 4280 nhtttb.exe 100 PID 4280 wrote to memory of 4492 4280 nhtttb.exe 100 PID 4492 wrote to memory of 2900 4492 3bnnnh.exe 101 PID 4492 wrote to memory of 2900 4492 3bnnnh.exe 101 PID 4492 wrote to memory of 2900 4492 3bnnnh.exe 101 PID 2900 wrote to memory of 388 2900 9jppp.exe 102 PID 2900 wrote to memory of 388 2900 9jppp.exe 102 PID 2900 wrote to memory of 388 2900 9jppp.exe 102 PID 388 wrote to memory of 4700 388 ffflrxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe"C:\Users\Admin\AppData\Local\Temp\45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\vpvvp.exec:\vpvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\fxrrllf.exec:\fxrrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\hbbhtb.exec:\hbbhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\dpvvd.exec:\dpvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\lxxfxlx.exec:\lxxfxlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\flrfrfr.exec:\flrfrfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\bthbbh.exec:\bthbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\vvddv.exec:\vvddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\xlfrlxl.exec:\xlfrlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\bnbtht.exec:\bnbtht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\5jddd.exec:\5jddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\jdpjj.exec:\jdpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\xxffrrl.exec:\xxffrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\5nhhtb.exec:\5nhhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\djppv.exec:\djppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\vdjjj.exec:\vdjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\xrxxflr.exec:\xrxxflr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\nhtttb.exec:\nhtttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\3bnnnh.exec:\3bnnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\9jppp.exec:\9jppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\ffflrxr.exec:\ffflrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\ffrrxff.exec:\ffrrxff.exe23⤵
- Executes dropped EXE
PID:4700 -
\??\c:\bbtttb.exec:\bbtttb.exe24⤵
- Executes dropped EXE
PID:4796 -
\??\c:\pdvpp.exec:\pdvpp.exe25⤵
- Executes dropped EXE
PID:8 -
\??\c:\5dppd.exec:\5dppd.exe26⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7fxffrr.exec:\7fxffrr.exe27⤵
- Executes dropped EXE
PID:3828 -
\??\c:\lflxrfx.exec:\lflxrfx.exe28⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hbnbbn.exec:\hbnbbn.exe29⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ddjdd.exec:\ddjdd.exe30⤵
- Executes dropped EXE
PID:3856 -
\??\c:\dvjdd.exec:\dvjdd.exe31⤵
- Executes dropped EXE
PID:5060 -
\??\c:\xrfxfff.exec:\xrfxfff.exe32⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hthhnn.exec:\hthhnn.exe33⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nnbnnh.exec:\nnbnnh.exe34⤵
- Executes dropped EXE
PID:4548 -
\??\c:\vvjpp.exec:\vvjpp.exe35⤵
- Executes dropped EXE
PID:392 -
\??\c:\xrrrflx.exec:\xrrrflx.exe36⤵
- Executes dropped EXE
PID:4860 -
\??\c:\nhtbbh.exec:\nhtbbh.exe37⤵
- Executes dropped EXE
PID:4496 -
\??\c:\ttbbbh.exec:\ttbbbh.exe38⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ddjjp.exec:\ddjjp.exe39⤵
- Executes dropped EXE
PID:4244 -
\??\c:\flffrff.exec:\flffrff.exe40⤵
- Executes dropped EXE
PID:1312 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe41⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ntnntt.exec:\ntnntt.exe42⤵
- Executes dropped EXE
PID:4932 -
\??\c:\3dpvj.exec:\3dpvj.exe43⤵
- Executes dropped EXE
PID:4808 -
\??\c:\vvpdd.exec:\vvpdd.exe44⤵
- Executes dropped EXE
PID:1144 -
\??\c:\xrfffff.exec:\xrfffff.exe45⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nbnbht.exec:\nbnbht.exe46⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tbhthn.exec:\tbhthn.exe47⤵
- Executes dropped EXE
PID:4404 -
\??\c:\ddjjv.exec:\ddjjv.exe48⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xfxxxlr.exec:\xfxxxlr.exe49⤵
- Executes dropped EXE
PID:2996 -
\??\c:\llrxxrr.exec:\llrxxrr.exe50⤵
- Executes dropped EXE
PID:396 -
\??\c:\5tttbh.exec:\5tttbh.exe51⤵
- Executes dropped EXE
PID:4536 -
\??\c:\vvvdp.exec:\vvvdp.exe52⤵
- Executes dropped EXE
PID:224 -
\??\c:\frxrrff.exec:\frxrrff.exe53⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xxllrxf.exec:\xxllrxf.exe54⤵
- Executes dropped EXE
PID:220 -
\??\c:\tnbbtt.exec:\tnbbtt.exe55⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7djvd.exec:\7djvd.exe56⤵
- Executes dropped EXE
PID:1224 -
\??\c:\rxlrrxl.exec:\rxlrrxl.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7rrrrrr.exec:\7rrrrrr.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\1ttthn.exec:\1ttthn.exe59⤵
- Executes dropped EXE
PID:1268 -
\??\c:\9vppv.exec:\9vppv.exe60⤵
- Executes dropped EXE
PID:624 -
\??\c:\vjvvd.exec:\vjvvd.exe61⤵
- Executes dropped EXE
PID:936 -
\??\c:\fxxxrll.exec:\fxxxrll.exe62⤵
- Executes dropped EXE
PID:4992 -
\??\c:\bbbnbt.exec:\bbbnbt.exe63⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jdvpv.exec:\jdvpv.exe64⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rffxrrl.exec:\rffxrrl.exe65⤵
- Executes dropped EXE
PID:3364 -
\??\c:\hntbbh.exec:\hntbbh.exe66⤵PID:1636
-
\??\c:\nnbhhh.exec:\nnbhhh.exe67⤵PID:2676
-
\??\c:\jjddj.exec:\jjddj.exe68⤵PID:4348
-
\??\c:\lrrfxrr.exec:\lrrfxrr.exe69⤵PID:2664
-
\??\c:\rlxlrlx.exec:\rlxlrlx.exe70⤵PID:2296
-
\??\c:\bbtthn.exec:\bbtthn.exe71⤵PID:2644
-
\??\c:\5vjjp.exec:\5vjjp.exe72⤵PID:2564
-
\??\c:\1pppv.exec:\1pppv.exe73⤵PID:3184
-
\??\c:\lxxlrll.exec:\lxxlrll.exe74⤵PID:3164
-
\??\c:\3bbhhn.exec:\3bbhhn.exe75⤵PID:2448
-
\??\c:\vvvvd.exec:\vvvvd.exe76⤵PID:3280
-
\??\c:\7xllrrf.exec:\7xllrrf.exe77⤵PID:2312
-
\??\c:\hnbbbh.exec:\hnbbbh.exe78⤵PID:1600
-
\??\c:\bhhhnt.exec:\bhhhnt.exe79⤵PID:1176
-
\??\c:\jjddv.exec:\jjddv.exe80⤵PID:232
-
\??\c:\7rflrxx.exec:\7rflrxx.exe81⤵PID:4028
-
\??\c:\llxfrxl.exec:\llxfrxl.exe82⤵PID:556
-
\??\c:\hhtthh.exec:\hhtthh.exe83⤵PID:3336
-
\??\c:\vppvp.exec:\vppvp.exe84⤵PID:4824
-
\??\c:\3frrlrf.exec:\3frrlrf.exe85⤵PID:4124
-
\??\c:\llllxlx.exec:\llllxlx.exe86⤵PID:2848
-
\??\c:\nnhbbb.exec:\nnhbbb.exe87⤵PID:4656
-
\??\c:\pvjjp.exec:\pvjjp.exe88⤵PID:4828
-
\??\c:\xffflll.exec:\xffflll.exe89⤵PID:3412
-
\??\c:\hhnntb.exec:\hhnntb.exe90⤵PID:4604
-
\??\c:\3djjv.exec:\3djjv.exe91⤵PID:2884
-
\??\c:\hbbbtb.exec:\hbbbtb.exe92⤵PID:4440
-
\??\c:\jvpvv.exec:\jvpvv.exe93⤵PID:2756
-
\??\c:\xlrxllf.exec:\xlrxllf.exe94⤵PID:844
-
\??\c:\hhbhhn.exec:\hhbhhn.exe95⤵PID:1072
-
\??\c:\llrrrxx.exec:\llrrrxx.exe96⤵PID:3624
-
\??\c:\tnttnh.exec:\tnttnh.exe97⤵PID:4544
-
\??\c:\pvvpj.exec:\pvvpj.exe98⤵PID:2960
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe99⤵PID:4780
-
\??\c:\vpjdp.exec:\vpjdp.exe100⤵PID:2656
-
\??\c:\xxffxfx.exec:\xxffxfx.exe101⤵PID:4736
-
\??\c:\djvpp.exec:\djvpp.exe102⤵PID:744
-
\??\c:\flxxfll.exec:\flxxfll.exe103⤵
- System Location Discovery: System Language Discovery
PID:4296 -
\??\c:\bhbhnt.exec:\bhbhnt.exe104⤵PID:4620
-
\??\c:\jppdp.exec:\jppdp.exe105⤵PID:872
-
\??\c:\jjpvd.exec:\jjpvd.exe106⤵PID:1144
-
\??\c:\ffllrrr.exec:\ffllrrr.exe107⤵PID:3136
-
\??\c:\bhttbt.exec:\bhttbt.exe108⤵PID:3004
-
\??\c:\5hhhnn.exec:\5hhhnn.exe109⤵PID:2952
-
\??\c:\vvjdp.exec:\vvjdp.exe110⤵PID:1052
-
\??\c:\xfxlxlr.exec:\xfxlxlr.exe111⤵PID:4308
-
\??\c:\nhbhth.exec:\nhbhth.exe112⤵PID:2560
-
\??\c:\3jddj.exec:\3jddj.exe113⤵PID:2336
-
\??\c:\tntttb.exec:\tntttb.exe114⤵PID:4792
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe115⤵PID:3012
-
\??\c:\dvjpp.exec:\dvjpp.exe116⤵PID:4460
-
\??\c:\ntnthn.exec:\ntnthn.exe117⤵PID:1956
-
\??\c:\vdpvv.exec:\vdpvv.exe118⤵PID:2444
-
\??\c:\htbtnt.exec:\htbtnt.exe119⤵PID:3408
-
\??\c:\jpvvv.exec:\jpvvv.exe120⤵PID:3304
-
\??\c:\tnntth.exec:\tnntth.exe121⤵PID:3616
-
\??\c:\hhnnbb.exec:\hhnnbb.exe122⤵PID:4992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-