Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 21:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe
-
Size
454KB
-
MD5
3b8697916aff86e42255e5cc4f31ac69
-
SHA1
22ea5b5e0aa777d9b044a024493edabd918d0204
-
SHA256
74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e
-
SHA512
41ed4250d7bdb48a4a0ccb2c9c72bca02f34b3f6b1405d6441298dde42db7d8bbf8b0accb6ea7b7f10d159ffc0b71b5772199b4e431a3234c61ca91fbd59ded0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4176-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/796-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-1067-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 540 xffrlfx.exe 2312 vjpdp.exe 2528 xfrfrfx.exe 3184 lxxrfxr.exe 4488 btbnbt.exe 5008 fxfxlff.exe 4472 bhnbnh.exe 932 tttnbn.exe 1928 lflfrlr.exe 448 jvpjp.exe 1876 nbthbt.exe 3860 ffxfffx.exe 3100 fffffff.exe 4836 ttnnhh.exe 4924 vjjjd.exe 3996 xrrrlll.exe 428 9tnnnh.exe 4952 vpjjd.exe 4296 rfrlfxx.exe 116 5bhbbb.exe 5108 nhnhhh.exe 4760 tnnnhh.exe 3456 lfllrrr.exe 2692 rxrrxfl.exe 1228 bhtnhh.exe 680 jdjjd.exe 3572 xrfflfr.exe 4032 htbthh.exe 5004 pjjdd.exe 4100 nntnhh.exe 796 lxlllrr.exe 440 lxfxrrl.exe 708 rfllflf.exe 1812 nttbht.exe 1576 jddvp.exe 4824 xffxllf.exe 4832 1ddvv.exe 2920 rffxlxr.exe 1952 jjpjj.exe 2960 dpddv.exe 2476 lrxllff.exe 3780 tnnhbb.exe 2636 btbtbt.exe 2560 vjjjp.exe 3812 1ffxrlf.exe 4956 tbhbnn.exe 4420 5hhbtb.exe 5104 9xxrlll.exe 4364 bhnhbt.exe 552 dvvjd.exe 764 vdjvp.exe 4676 lrrffxr.exe 2916 tnhbnn.exe 3588 vpjdd.exe 4776 lxlrrxx.exe 3280 1ffxxxr.exe 4852 btbtnt.exe 236 dpvvv.exe 1492 frxllfx.exe 1716 rffxrlf.exe 3952 hnttnb.exe 4016 jpdvp.exe 5080 rxlffff.exe 1176 bhbtnh.exe -
resource yara_rule behavioral2/memory/4176-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/796-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-538-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4176 wrote to memory of 540 4176 74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe 83 PID 4176 wrote to memory of 540 4176 74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe 83 PID 4176 wrote to memory of 540 4176 74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe 83 PID 540 wrote to memory of 2312 540 xffrlfx.exe 84 PID 540 wrote to memory of 2312 540 xffrlfx.exe 84 PID 540 wrote to memory of 2312 540 xffrlfx.exe 84 PID 2312 wrote to memory of 2528 2312 vjpdp.exe 85 PID 2312 wrote to memory of 2528 2312 vjpdp.exe 85 PID 2312 wrote to memory of 2528 2312 vjpdp.exe 85 PID 2528 wrote to memory of 3184 2528 xfrfrfx.exe 86 PID 2528 wrote to memory of 3184 2528 xfrfrfx.exe 86 PID 2528 wrote to memory of 3184 2528 xfrfrfx.exe 86 PID 3184 wrote to memory of 4488 3184 lxxrfxr.exe 87 PID 3184 wrote to memory of 4488 3184 lxxrfxr.exe 87 PID 3184 wrote to memory of 4488 3184 lxxrfxr.exe 87 PID 4488 wrote to memory of 5008 4488 btbnbt.exe 88 PID 4488 wrote to memory of 5008 4488 btbnbt.exe 88 PID 4488 wrote to memory of 5008 4488 btbnbt.exe 88 PID 5008 wrote to memory of 4472 5008 fxfxlff.exe 89 PID 5008 wrote to memory of 4472 5008 fxfxlff.exe 89 PID 5008 wrote to memory of 4472 5008 fxfxlff.exe 89 PID 4472 wrote to memory of 932 4472 bhnbnh.exe 90 PID 4472 wrote to memory of 932 4472 bhnbnh.exe 90 PID 4472 wrote to memory of 932 4472 bhnbnh.exe 90 PID 932 wrote to memory of 1928 932 tttnbn.exe 91 PID 932 wrote to memory of 1928 932 tttnbn.exe 91 PID 932 wrote to memory of 1928 932 tttnbn.exe 91 PID 1928 wrote to memory of 448 1928 lflfrlr.exe 92 PID 1928 wrote to memory of 448 1928 lflfrlr.exe 92 PID 1928 wrote to memory of 448 1928 lflfrlr.exe 92 PID 448 wrote to memory of 1876 448 jvpjp.exe 93 PID 448 wrote to memory of 1876 448 jvpjp.exe 93 PID 448 wrote to memory of 1876 448 jvpjp.exe 93 PID 1876 wrote to memory of 3860 1876 nbthbt.exe 94 PID 1876 wrote to memory of 3860 1876 nbthbt.exe 94 PID 1876 wrote to memory of 3860 1876 nbthbt.exe 94 PID 3860 wrote to memory of 3100 3860 ffxfffx.exe 95 PID 3860 wrote to memory of 3100 3860 ffxfffx.exe 95 PID 3860 wrote to memory of 3100 3860 ffxfffx.exe 95 PID 3100 wrote to memory of 4836 3100 fffffff.exe 96 PID 3100 wrote to memory of 4836 3100 fffffff.exe 96 PID 3100 wrote to memory of 4836 3100 fffffff.exe 96 PID 4836 wrote to memory of 4924 4836 ttnnhh.exe 97 PID 4836 wrote to memory of 4924 4836 ttnnhh.exe 97 PID 4836 wrote to memory of 4924 4836 ttnnhh.exe 97 PID 4924 wrote to memory of 3996 4924 vjjjd.exe 98 PID 4924 wrote to memory of 3996 4924 vjjjd.exe 98 PID 4924 wrote to memory of 3996 4924 vjjjd.exe 98 PID 3996 wrote to memory of 428 3996 xrrrlll.exe 99 PID 3996 wrote to memory of 428 3996 xrrrlll.exe 99 PID 3996 wrote to memory of 428 3996 xrrrlll.exe 99 PID 428 wrote to memory of 4952 428 9tnnnh.exe 100 PID 428 wrote to memory of 4952 428 9tnnnh.exe 100 PID 428 wrote to memory of 4952 428 9tnnnh.exe 100 PID 4952 wrote to memory of 4296 4952 vpjjd.exe 101 PID 4952 wrote to memory of 4296 4952 vpjjd.exe 101 PID 4952 wrote to memory of 4296 4952 vpjjd.exe 101 PID 4296 wrote to memory of 116 4296 rfrlfxx.exe 102 PID 4296 wrote to memory of 116 4296 rfrlfxx.exe 102 PID 4296 wrote to memory of 116 4296 rfrlfxx.exe 102 PID 116 wrote to memory of 5108 116 5bhbbb.exe 103 PID 116 wrote to memory of 5108 116 5bhbbb.exe 103 PID 116 wrote to memory of 5108 116 5bhbbb.exe 103 PID 5108 wrote to memory of 4760 5108 nhnhhh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe"C:\Users\Admin\AppData\Local\Temp\74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\xffrlfx.exec:\xffrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\vjpdp.exec:\vjpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\xfrfrfx.exec:\xfrfrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\btbnbt.exec:\btbnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\fxfxlff.exec:\fxfxlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\bhnbnh.exec:\bhnbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\tttnbn.exec:\tttnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\lflfrlr.exec:\lflfrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\jvpjp.exec:\jvpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\nbthbt.exec:\nbthbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\ffxfffx.exec:\ffxfffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\fffffff.exec:\fffffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\ttnnhh.exec:\ttnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\vjjjd.exec:\vjjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\xrrrlll.exec:\xrrrlll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\9tnnnh.exec:\9tnnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\vpjjd.exec:\vpjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\rfrlfxx.exec:\rfrlfxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\5bhbbb.exec:\5bhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\nhnhhh.exec:\nhnhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\tnnnhh.exec:\tnnnhh.exe23⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lfllrrr.exec:\lfllrrr.exe24⤵
- Executes dropped EXE
PID:3456 -
\??\c:\rxrrxfl.exec:\rxrrxfl.exe25⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bhtnhh.exec:\bhtnhh.exe26⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jdjjd.exec:\jdjjd.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:680 -
\??\c:\xrfflfr.exec:\xrfflfr.exe28⤵
- Executes dropped EXE
PID:3572 -
\??\c:\htbthh.exec:\htbthh.exe29⤵
- Executes dropped EXE
PID:4032 -
\??\c:\pjjdd.exec:\pjjdd.exe30⤵
- Executes dropped EXE
PID:5004 -
\??\c:\nntnhh.exec:\nntnhh.exe31⤵
- Executes dropped EXE
PID:4100 -
\??\c:\lxlllrr.exec:\lxlllrr.exe32⤵
- Executes dropped EXE
PID:796 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe33⤵
- Executes dropped EXE
PID:440 -
\??\c:\rfllflf.exec:\rfllflf.exe34⤵
- Executes dropped EXE
PID:708 -
\??\c:\nttbht.exec:\nttbht.exe35⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jddvp.exec:\jddvp.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xffxllf.exec:\xffxllf.exe37⤵
- Executes dropped EXE
PID:4824 -
\??\c:\1ddvv.exec:\1ddvv.exe38⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rffxlxr.exec:\rffxlxr.exe39⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jjpjj.exec:\jjpjj.exe40⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dpddv.exec:\dpddv.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lrxllff.exec:\lrxllff.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tnnhbb.exec:\tnnhbb.exe43⤵
- Executes dropped EXE
PID:3780 -
\??\c:\btbtbt.exec:\btbtbt.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vjjjp.exec:\vjjjp.exe45⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1ffxrlf.exec:\1ffxrlf.exe46⤵
- Executes dropped EXE
PID:3812 -
\??\c:\tbhbnn.exec:\tbhbnn.exe47⤵
- Executes dropped EXE
PID:4956 -
\??\c:\5hhbtb.exec:\5hhbtb.exe48⤵
- Executes dropped EXE
PID:4420 -
\??\c:\9xxrlll.exec:\9xxrlll.exe49⤵
- Executes dropped EXE
PID:5104 -
\??\c:\bhnhbt.exec:\bhnhbt.exe50⤵
- Executes dropped EXE
PID:4364 -
\??\c:\dvvjd.exec:\dvvjd.exe51⤵
- Executes dropped EXE
PID:552 -
\??\c:\vdjvp.exec:\vdjvp.exe52⤵
- Executes dropped EXE
PID:764 -
\??\c:\lrrffxr.exec:\lrrffxr.exe53⤵
- Executes dropped EXE
PID:4676 -
\??\c:\tnhbnn.exec:\tnhbnn.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916 -
\??\c:\vpjdd.exec:\vpjdd.exe55⤵
- Executes dropped EXE
PID:3588 -
\??\c:\lxlrrxx.exec:\lxlrrxx.exe56⤵
- Executes dropped EXE
PID:4776 -
\??\c:\1ffxxxr.exec:\1ffxxxr.exe57⤵
- Executes dropped EXE
PID:3280 -
\??\c:\btbtnt.exec:\btbtnt.exe58⤵
- Executes dropped EXE
PID:4852 -
\??\c:\dpvvv.exec:\dpvvv.exe59⤵
- Executes dropped EXE
PID:236 -
\??\c:\frxllfx.exec:\frxllfx.exe60⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rffxrlf.exec:\rffxrlf.exe61⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hnttnb.exec:\hnttnb.exe62⤵
- Executes dropped EXE
PID:3952 -
\??\c:\jpdvp.exec:\jpdvp.exe63⤵
- Executes dropped EXE
PID:4016 -
\??\c:\rxlffff.exec:\rxlffff.exe64⤵
- Executes dropped EXE
PID:5080 -
\??\c:\bhbtnh.exec:\bhbtnh.exe65⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vvvpj.exec:\vvvpj.exe66⤵PID:448
-
\??\c:\btbbtt.exec:\btbbtt.exe67⤵PID:1572
-
\??\c:\thbtnh.exec:\thbtnh.exe68⤵PID:4028
-
\??\c:\vjdjj.exec:\vjdjj.exe69⤵PID:3076
-
\??\c:\lflfrrl.exec:\lflfrrl.exe70⤵PID:2168
-
\??\c:\thhbnh.exec:\thhbnh.exe71⤵PID:3648
-
\??\c:\jpvpv.exec:\jpvpv.exe72⤵PID:3460
-
\??\c:\flfxrlx.exec:\flfxrlx.exe73⤵PID:3696
-
\??\c:\bhtnhh.exec:\bhtnhh.exe74⤵PID:1364
-
\??\c:\nbbbnt.exec:\nbbbnt.exe75⤵PID:4796
-
\??\c:\vpvpv.exec:\vpvpv.exe76⤵PID:400
-
\??\c:\fxxlffx.exec:\fxxlffx.exe77⤵PID:2100
-
\??\c:\fxlflfl.exec:\fxlflfl.exe78⤵
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\ttthbb.exec:\ttthbb.exe79⤵PID:3992
-
\??\c:\pvdvv.exec:\pvdvv.exe80⤵PID:1600
-
\??\c:\frfxfxr.exec:\frfxfxr.exe81⤵PID:1892
-
\??\c:\thnhbb.exec:\thnhbb.exe82⤵PID:2444
-
\??\c:\vjpjp.exec:\vjpjp.exe83⤵PID:1832
-
\??\c:\dppjd.exec:\dppjd.exe84⤵PID:1836
-
\??\c:\rxllxxr.exec:\rxllxxr.exe85⤵PID:4764
-
\??\c:\htnnbb.exec:\htnnbb.exe86⤵PID:4124
-
\??\c:\jpdvj.exec:\jpdvj.exe87⤵PID:908
-
\??\c:\lrxrlff.exec:\lrxrlff.exe88⤵PID:852
-
\??\c:\hbhhhb.exec:\hbhhhb.exe89⤵PID:4008
-
\??\c:\nhbthb.exec:\nhbthb.exe90⤵PID:4032
-
\??\c:\djvpd.exec:\djvpd.exe91⤵PID:4160
-
\??\c:\1xffxxr.exec:\1xffxxr.exe92⤵PID:3216
-
\??\c:\nhtnnn.exec:\nhtnnn.exe93⤵PID:1108
-
\??\c:\pjvvv.exec:\pjvvv.exe94⤵PID:4400
-
\??\c:\djvpj.exec:\djvpj.exe95⤵PID:4228
-
\??\c:\9flfxxr.exec:\9flfxxr.exe96⤵PID:1400
-
\??\c:\nhbtht.exec:\nhbtht.exe97⤵PID:3396
-
\??\c:\ddjdj.exec:\ddjdj.exe98⤵PID:4928
-
\??\c:\3lfxxxr.exec:\3lfxxxr.exe99⤵PID:2304
-
\??\c:\llxrllf.exec:\llxrllf.exe100⤵PID:4244
-
\??\c:\3hbttt.exec:\3hbttt.exe101⤵PID:1776
-
\??\c:\vpjdp.exec:\vpjdp.exe102⤵PID:4540
-
\??\c:\rxfxlrr.exec:\rxfxlrr.exe103⤵PID:1952
-
\??\c:\tnbtbt.exec:\tnbtbt.exe104⤵PID:5072
-
\??\c:\bntthb.exec:\bntthb.exe105⤵PID:2476
-
\??\c:\pvdpd.exec:\pvdpd.exe106⤵PID:3732
-
\??\c:\xflfxxr.exec:\xflfxxr.exe107⤵PID:1476
-
\??\c:\bnhbtt.exec:\bnhbtt.exe108⤵PID:3404
-
\??\c:\5jpjj.exec:\5jpjj.exe109⤵PID:1964
-
\??\c:\pddvp.exec:\pddvp.exe110⤵PID:3180
-
\??\c:\7rrlfxr.exec:\7rrlfxr.exe111⤵PID:2804
-
\??\c:\lxxrffx.exec:\lxxrffx.exe112⤵PID:1580
-
\??\c:\nntnhb.exec:\nntnhb.exe113⤵PID:5104
-
\??\c:\jvvdv.exec:\jvvdv.exe114⤵PID:1244
-
\??\c:\lxxlxfx.exec:\lxxlxfx.exe115⤵PID:4716
-
\??\c:\frlfffx.exec:\frlfffx.exe116⤵PID:1124
-
\??\c:\nbhtnn.exec:\nbhtnn.exe117⤵PID:4676
-
\??\c:\pdpdv.exec:\pdpdv.exe118⤵PID:2528
-
\??\c:\7jpjd.exec:\7jpjd.exe119⤵PID:5076
-
\??\c:\lxlfrrf.exec:\lxlfrrf.exe120⤵PID:4776
-
\??\c:\btttbb.exec:\btttbb.exe121⤵
- System Location Discovery: System Language Discovery
PID:3540 -
\??\c:\5xlfxxr.exec:\5xlfxxr.exe122⤵PID:5008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-