Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 20:35
Behavioral task
behavioral1
Sample
27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe
-
Size
345KB
-
MD5
5fd24bf7237b11b6cc5a166b728c4172
-
SHA1
1595a6df35c02dc4a6d5f14429e3fc730c33513f
-
SHA256
27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1
-
SHA512
55d7c24f0904175a1c1f94cc4f10430bcac3ba96c48963975acb80a4357c02f3f62ab14804dab6e94d5c8e44897679c117d588f387eede255a71990a98a91f64
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYApp:R4wFHoS3WXZshJX2VGdpp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2488-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/984-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1084-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/672-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/388-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-709-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-834-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-921-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2892 rxrlllf.exe 3724 9lllflx.exe 4456 thtttt.exe 2848 jvpvp.exe 2376 rlrrxrx.exe 4676 jdddj.exe 1112 xflffll.exe 4228 1vjjv.exe 3536 jvvdj.exe 2544 llrrrxx.exe 984 ppvvv.exe 2004 flxrffl.exe 2148 bbbbbb.exe 3044 tnnhbb.exe 2380 htbtnt.exe 2576 rlxrrrx.exe 3424 ttbbhh.exe 4956 pdjdv.exe 964 dvddv.exe 1020 rrxxxfx.exe 2732 3nthhn.exe 116 tbhhnn.exe 5012 djpjd.exe 880 lxxxrlf.exe 2660 nntthh.exe 3300 1ddjd.exe 852 jpppj.exe 2436 fflxrxx.exe 2860 bnnhhh.exe 5028 7hhhbh.exe 996 jdppd.exe 4180 7rffllf.exe 5000 jvppp.exe 5076 7dpjd.exe 1084 3rrrrrr.exe 3032 1pvvd.exe 3920 7rxrrxx.exe 1748 tnnttb.exe 4636 lrllfff.exe 3964 btnhhh.exe 1576 7jvvp.exe 968 fxfffff.exe 3960 tnttnn.exe 4352 dvdvp.exe 4340 7jppj.exe 4564 tnhhhh.exe 372 jvjjv.exe 1300 jppvp.exe 3564 fxrlxff.exe 3580 btbbbb.exe 4896 9vppv.exe 4388 frlflrx.exe 672 7nbntb.exe 5108 vjjdv.exe 1120 rrxxflx.exe 3556 lflrrxf.exe 1228 nnbhtb.exe 1192 5vvvp.exe 4296 pvpvv.exe 1460 3fxxxxr.exe 4316 1ttnbb.exe 3212 jddvj.exe 2368 1rffxrr.exe 3724 5lfxrll.exe -
resource yara_rule behavioral2/memory/2488-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b5b-3.dat upx behavioral2/memory/2488-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000f000000023bc3-9.dat upx behavioral2/memory/2892-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3724-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bd7-12.dat upx behavioral2/memory/3724-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bd9-19.dat upx behavioral2/memory/2848-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bdc-25.dat upx behavioral2/memory/2376-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4456-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bdd-31.dat upx behavioral2/memory/2376-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bde-35.dat upx behavioral2/memory/4676-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bdf-40.dat upx behavioral2/memory/1112-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c0e-45.dat upx behavioral2/memory/4228-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c0f-52.dat upx behavioral2/memory/3536-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c10-55.dat upx behavioral2/memory/2544-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c11-60.dat upx behavioral2/memory/2004-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/984-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c12-66.dat upx behavioral2/files/0x0008000000023c13-70.dat upx behavioral2/memory/2148-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3044-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c18-76.dat upx behavioral2/files/0x0008000000023c19-80.dat upx behavioral2/memory/2380-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c1a-86.dat upx behavioral2/files/0x0008000000023c2c-90.dat upx behavioral2/memory/964-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c32-94.dat upx behavioral2/memory/4956-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c33-100.dat upx behavioral2/memory/1020-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c34-104.dat upx behavioral2/files/0x0008000000023c35-108.dat upx behavioral2/files/0x0008000000023c36-112.dat upx behavioral2/files/0x0008000000023c37-116.dat upx behavioral2/files/0x000b000000023c4c-120.dat upx behavioral2/files/0x0016000000023c4d-124.dat upx behavioral2/memory/3300-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2660-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c53-131.dat upx behavioral2/files/0x0008000000023c57-134.dat upx behavioral2/memory/2436-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c63-139.dat upx behavioral2/memory/2860-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c64-143.dat upx behavioral2/files/0x0008000000023c65-148.dat upx behavioral2/memory/5028-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c66-154.dat upx behavioral2/memory/996-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5000-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5000-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5076-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1084-167-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2892 2488 27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe 82 PID 2488 wrote to memory of 2892 2488 27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe 82 PID 2488 wrote to memory of 2892 2488 27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe 82 PID 2892 wrote to memory of 3724 2892 rxrlllf.exe 83 PID 2892 wrote to memory of 3724 2892 rxrlllf.exe 83 PID 2892 wrote to memory of 3724 2892 rxrlllf.exe 83 PID 3724 wrote to memory of 4456 3724 9lllflx.exe 84 PID 3724 wrote to memory of 4456 3724 9lllflx.exe 84 PID 3724 wrote to memory of 4456 3724 9lllflx.exe 84 PID 4456 wrote to memory of 2848 4456 thtttt.exe 85 PID 4456 wrote to memory of 2848 4456 thtttt.exe 85 PID 4456 wrote to memory of 2848 4456 thtttt.exe 85 PID 2848 wrote to memory of 2376 2848 jvpvp.exe 86 PID 2848 wrote to memory of 2376 2848 jvpvp.exe 86 PID 2848 wrote to memory of 2376 2848 jvpvp.exe 86 PID 2376 wrote to memory of 4676 2376 rlrrxrx.exe 87 PID 2376 wrote to memory of 4676 2376 rlrrxrx.exe 87 PID 2376 wrote to memory of 4676 2376 rlrrxrx.exe 87 PID 4676 wrote to memory of 1112 4676 jdddj.exe 88 PID 4676 wrote to memory of 1112 4676 jdddj.exe 88 PID 4676 wrote to memory of 1112 4676 jdddj.exe 88 PID 1112 wrote to memory of 4228 1112 xflffll.exe 89 PID 1112 wrote to memory of 4228 1112 xflffll.exe 89 PID 1112 wrote to memory of 4228 1112 xflffll.exe 89 PID 4228 wrote to memory of 3536 4228 1vjjv.exe 90 PID 4228 wrote to memory of 3536 4228 1vjjv.exe 90 PID 4228 wrote to memory of 3536 4228 1vjjv.exe 90 PID 3536 wrote to memory of 2544 3536 jvvdj.exe 91 PID 3536 wrote to memory of 2544 3536 jvvdj.exe 91 PID 3536 wrote to memory of 2544 3536 jvvdj.exe 91 PID 2544 wrote to memory of 984 2544 llrrrxx.exe 92 PID 2544 wrote to memory of 984 2544 llrrrxx.exe 92 PID 2544 wrote to memory of 984 2544 llrrrxx.exe 92 PID 984 wrote to memory of 2004 984 ppvvv.exe 93 PID 984 wrote to memory of 2004 984 ppvvv.exe 93 PID 984 wrote to memory of 2004 984 ppvvv.exe 93 PID 2004 wrote to memory of 2148 2004 flxrffl.exe 94 PID 2004 wrote to memory of 2148 2004 flxrffl.exe 94 PID 2004 wrote to memory of 2148 2004 flxrffl.exe 94 PID 2148 wrote to memory of 3044 2148 bbbbbb.exe 95 PID 2148 wrote to memory of 3044 2148 bbbbbb.exe 95 PID 2148 wrote to memory of 3044 2148 bbbbbb.exe 95 PID 3044 wrote to memory of 2380 3044 tnnhbb.exe 96 PID 3044 wrote to memory of 2380 3044 tnnhbb.exe 96 PID 3044 wrote to memory of 2380 3044 tnnhbb.exe 96 PID 2380 wrote to memory of 2576 2380 htbtnt.exe 97 PID 2380 wrote to memory of 2576 2380 htbtnt.exe 97 PID 2380 wrote to memory of 2576 2380 htbtnt.exe 97 PID 2576 wrote to memory of 3424 2576 rlxrrrx.exe 98 PID 2576 wrote to memory of 3424 2576 rlxrrrx.exe 98 PID 2576 wrote to memory of 3424 2576 rlxrrrx.exe 98 PID 3424 wrote to memory of 4956 3424 ttbbhh.exe 99 PID 3424 wrote to memory of 4956 3424 ttbbhh.exe 99 PID 3424 wrote to memory of 4956 3424 ttbbhh.exe 99 PID 4956 wrote to memory of 964 4956 pdjdv.exe 100 PID 4956 wrote to memory of 964 4956 pdjdv.exe 100 PID 4956 wrote to memory of 964 4956 pdjdv.exe 100 PID 964 wrote to memory of 1020 964 dvddv.exe 101 PID 964 wrote to memory of 1020 964 dvddv.exe 101 PID 964 wrote to memory of 1020 964 dvddv.exe 101 PID 1020 wrote to memory of 2732 1020 rrxxxfx.exe 102 PID 1020 wrote to memory of 2732 1020 rrxxxfx.exe 102 PID 1020 wrote to memory of 2732 1020 rrxxxfx.exe 102 PID 2732 wrote to memory of 116 2732 3nthhn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe"C:\Users\Admin\AppData\Local\Temp\27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rxrlllf.exec:\rxrlllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\9lllflx.exec:\9lllflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\thtttt.exec:\thtttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\jvpvp.exec:\jvpvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\rlrrxrx.exec:\rlrrxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\jdddj.exec:\jdddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\xflffll.exec:\xflffll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\1vjjv.exec:\1vjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\jvvdj.exec:\jvvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\llrrrxx.exec:\llrrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\ppvvv.exec:\ppvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\flxrffl.exec:\flxrffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\bbbbbb.exec:\bbbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\tnnhbb.exec:\tnnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\htbtnt.exec:\htbtnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ttbbhh.exec:\ttbbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\pdjdv.exec:\pdjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\dvddv.exec:\dvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\rrxxxfx.exec:\rrxxxfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\3nthhn.exec:\3nthhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\tbhhnn.exec:\tbhhnn.exe23⤵
- Executes dropped EXE
PID:116 -
\??\c:\djpjd.exec:\djpjd.exe24⤵
- Executes dropped EXE
PID:5012 -
\??\c:\lxxxrlf.exec:\lxxxrlf.exe25⤵
- Executes dropped EXE
PID:880 -
\??\c:\nntthh.exec:\nntthh.exe26⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1ddjd.exec:\1ddjd.exe27⤵
- Executes dropped EXE
PID:3300 -
\??\c:\jpppj.exec:\jpppj.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:852 -
\??\c:\fflxrxx.exec:\fflxrxx.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\bnnhhh.exec:\bnnhhh.exe30⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7hhhbh.exec:\7hhhbh.exe31⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jdppd.exec:\jdppd.exe32⤵
- Executes dropped EXE
PID:996 -
\??\c:\7rffllf.exec:\7rffllf.exe33⤵
- Executes dropped EXE
PID:4180 -
\??\c:\jvppp.exec:\jvppp.exe34⤵
- Executes dropped EXE
PID:5000 -
\??\c:\7dpjd.exec:\7dpjd.exe35⤵
- Executes dropped EXE
PID:5076 -
\??\c:\3rrrrrr.exec:\3rrrrrr.exe36⤵
- Executes dropped EXE
PID:1084 -
\??\c:\1pvvd.exec:\1pvvd.exe37⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7rxrrxx.exec:\7rxrrxx.exe38⤵
- Executes dropped EXE
PID:3920 -
\??\c:\tnnttb.exec:\tnnttb.exe39⤵
- Executes dropped EXE
PID:1748 -
\??\c:\lrllfff.exec:\lrllfff.exe40⤵
- Executes dropped EXE
PID:4636 -
\??\c:\btnhhh.exec:\btnhhh.exe41⤵
- Executes dropped EXE
PID:3964 -
\??\c:\7jvvp.exec:\7jvvp.exe42⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxfffff.exec:\fxfffff.exe43⤵
- Executes dropped EXE
PID:968 -
\??\c:\tnttnn.exec:\tnttnn.exe44⤵
- Executes dropped EXE
PID:3960 -
\??\c:\dvdvp.exec:\dvdvp.exe45⤵
- Executes dropped EXE
PID:4352 -
\??\c:\7jppj.exec:\7jppj.exe46⤵
- Executes dropped EXE
PID:4340 -
\??\c:\tnhhhh.exec:\tnhhhh.exe47⤵
- Executes dropped EXE
PID:4564 -
\??\c:\jvjjv.exec:\jvjjv.exe48⤵
- Executes dropped EXE
PID:372 -
\??\c:\jppvp.exec:\jppvp.exe49⤵
- Executes dropped EXE
PID:1300 -
\??\c:\fxrlxff.exec:\fxrlxff.exe50⤵
- Executes dropped EXE
PID:3564 -
\??\c:\btbbbb.exec:\btbbbb.exe51⤵
- Executes dropped EXE
PID:3580 -
\??\c:\9vppv.exec:\9vppv.exe52⤵
- Executes dropped EXE
PID:4896 -
\??\c:\frlflrx.exec:\frlflrx.exe53⤵
- Executes dropped EXE
PID:4388 -
\??\c:\7nbntb.exec:\7nbntb.exe54⤵
- Executes dropped EXE
PID:672 -
\??\c:\vjjdv.exec:\vjjdv.exe55⤵
- Executes dropped EXE
PID:5108 -
\??\c:\rrxxflx.exec:\rrxxflx.exe56⤵
- Executes dropped EXE
PID:1120 -
\??\c:\lflrrxf.exec:\lflrrxf.exe57⤵
- Executes dropped EXE
PID:3556 -
\??\c:\nnbhtb.exec:\nnbhtb.exe58⤵
- Executes dropped EXE
PID:1228 -
\??\c:\5vvvp.exec:\5vvvp.exe59⤵
- Executes dropped EXE
PID:1192 -
\??\c:\pvpvv.exec:\pvpvv.exe60⤵
- Executes dropped EXE
PID:4296 -
\??\c:\3fxxxxr.exec:\3fxxxxr.exe61⤵
- Executes dropped EXE
PID:1460 -
\??\c:\1ttnbb.exec:\1ttnbb.exe62⤵
- Executes dropped EXE
PID:4316 -
\??\c:\jddvj.exec:\jddvj.exe63⤵
- Executes dropped EXE
PID:3212 -
\??\c:\1rffxrr.exec:\1rffxrr.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\5lfxrll.exec:\5lfxrll.exe65⤵
- Executes dropped EXE
PID:3724 -
\??\c:\nhthhn.exec:\nhthhn.exe66⤵PID:4184
-
\??\c:\vdpvd.exec:\vdpvd.exe67⤵PID:2244
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe68⤵PID:2392
-
\??\c:\3rxxxxf.exec:\3rxxxxf.exe69⤵PID:620
-
\??\c:\3nttbb.exec:\3nttbb.exe70⤵PID:2592
-
\??\c:\9vdvp.exec:\9vdvp.exe71⤵PID:2376
-
\??\c:\xrffllr.exec:\xrffllr.exe72⤵PID:3428
-
\??\c:\xxxxflr.exec:\xxxxflr.exe73⤵PID:3676
-
\??\c:\jpjjd.exec:\jpjjd.exe74⤵PID:4580
-
\??\c:\jvdvj.exec:\jvdvj.exe75⤵PID:3604
-
\??\c:\rrffrxf.exec:\rrffrxf.exe76⤵PID:3532
-
\??\c:\5tbtbb.exec:\5tbtbb.exe77⤵PID:1488
-
\??\c:\jdddp.exec:\jdddp.exe78⤵PID:1480
-
\??\c:\5xrrrxr.exec:\5xrrrxr.exe79⤵PID:1528
-
\??\c:\btbbtt.exec:\btbbtt.exe80⤵PID:2580
-
\??\c:\1jppp.exec:\1jppp.exe81⤵PID:3240
-
\??\c:\dvjjj.exec:\dvjjj.exe82⤵PID:2752
-
\??\c:\lxrrxff.exec:\lxrrxff.exe83⤵PID:2148
-
\??\c:\hthhnt.exec:\hthhnt.exe84⤵PID:5048
-
\??\c:\bhhnnt.exec:\bhhnnt.exe85⤵PID:100
-
\??\c:\5pppp.exec:\5pppp.exe86⤵PID:2972
-
\??\c:\lxffxfx.exec:\lxffxfx.exe87⤵PID:4684
-
\??\c:\tbntnn.exec:\tbntnn.exe88⤵PID:3940
-
\??\c:\vvddp.exec:\vvddp.exe89⤵PID:4840
-
\??\c:\rxxrllf.exec:\rxxrllf.exe90⤵PID:964
-
\??\c:\5bbtth.exec:\5bbtth.exe91⤵PID:4248
-
\??\c:\dvvjv.exec:\dvvjv.exe92⤵PID:4784
-
\??\c:\jjjjj.exec:\jjjjj.exe93⤵PID:4312
-
\??\c:\xxrxflr.exec:\xxrxflr.exe94⤵PID:4356
-
\??\c:\hnhbtn.exec:\hnhbtn.exe95⤵PID:2516
-
\??\c:\hnbbnb.exec:\hnbbnb.exe96⤵PID:5012
-
\??\c:\dvpjj.exec:\dvpjj.exe97⤵PID:4000
-
\??\c:\llrlrxx.exec:\llrlrxx.exe98⤵PID:880
-
\??\c:\nhnnbh.exec:\nhnnbh.exe99⤵PID:2320
-
\??\c:\vpdvv.exec:\vpdvv.exe100⤵PID:3220
-
\??\c:\1xffxll.exec:\1xffxll.exe101⤵PID:3000
-
\??\c:\lrlxxxx.exec:\lrlxxxx.exe102⤵PID:4752
-
\??\c:\thbttb.exec:\thbttb.exe103⤵PID:4660
-
\??\c:\bbttnh.exec:\bbttnh.exe104⤵PID:3884
-
\??\c:\5pvpj.exec:\5pvpj.exe105⤵PID:3516
-
\??\c:\fxffxxx.exec:\fxffxxx.exe106⤵PID:4756
-
\??\c:\7frxfxx.exec:\7frxfxx.exe107⤵PID:4872
-
\??\c:\nnbhhh.exec:\nnbhhh.exe108⤵PID:996
-
\??\c:\vppvv.exec:\vppvv.exe109⤵PID:4180
-
\??\c:\ffxxlrl.exec:\ffxxlrl.exe110⤵PID:2000
-
\??\c:\lxlrrxx.exec:\lxlrrxx.exe111⤵PID:4932
-
\??\c:\ttbbbb.exec:\ttbbbb.exe112⤵PID:3320
-
\??\c:\jdjdv.exec:\jdjdv.exe113⤵PID:2724
-
\??\c:\7flrxxx.exec:\7flrxxx.exe114⤵PID:924
-
\??\c:\rfxxrxf.exec:\rfxxrxf.exe115⤵PID:4192
-
\??\c:\tnhhhh.exec:\tnhhhh.exe116⤵PID:1748
-
\??\c:\jjpjv.exec:\jjpjv.exe117⤵PID:3528
-
\??\c:\5vjpj.exec:\5vjpj.exe118⤵PID:4364
-
\??\c:\bntnhh.exec:\bntnhh.exe119⤵PID:3744
-
\??\c:\bnbttt.exec:\bnbttt.exe120⤵PID:4200
-
\??\c:\vvvpj.exec:\vvvpj.exe121⤵PID:3456
-
\??\c:\xrllxlr.exec:\xrllxlr.exe122⤵PID:2360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-