Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe
-
Size
454KB
-
MD5
dd0505d68214397e092bc13b917087d1
-
SHA1
66c3cfd2f7e28596df8b2f92195409ddc1f60ba6
-
SHA256
a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0
-
SHA512
a02fba83b03ae01f932689672bef2c230c5af6fcd6da91ff1bbecfce569522aaea07fbb06c7cdfd7705b9942acb57cb20923ce1f6c36d431da6d20e422c88d3d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4164-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/796-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-867-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-901-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-1049-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-1662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1472 lxllfxr.exe 1920 pdjdp.exe 2236 rrxrrrf.exe 4968 5btttt.exe 1788 dvpvv.exe 4488 vvvpj.exe 4220 ddpdv.exe 4548 tthbbb.exe 4516 jpvpp.exe 1912 lflflfx.exe 1792 ttnthh.exe 1632 fffrlxx.exe 1896 5nnnhh.exe 4384 vddvd.exe 1584 lfffxxx.exe 3164 1bhbbb.exe 4688 3vjvv.exe 2704 5btnhn.exe 1960 lxxlrlr.exe 2896 bbnnhn.exe 3808 vvdpv.exe 3988 lflfxxr.exe 1548 vppvp.exe 4072 lffffrl.exe 452 lxxfllr.exe 4344 vvvjp.exe 1940 pdvvv.exe 3444 nnhbth.exe 4668 fffllrx.exe 3516 jdvpd.exe 4580 htthbt.exe 4932 lxflfxr.exe 2908 jdjdv.exe 3632 fflrfrr.exe 916 hbtnnn.exe 4176 vjvpv.exe 4912 fxffxff.exe 3440 nhhbtt.exe 4184 jjppp.exe 2968 frxxxxx.exe 2492 tttnhh.exe 4552 jjjjd.exe 224 9vvpp.exe 1816 fffxrrf.exe 4372 vjpjd.exe 4468 rfllfxx.exe 4000 hbnnhh.exe 2012 7vvpd.exe 60 lfxrffx.exe 4212 tttnnh.exe 2132 ddpjd.exe 2708 lxfxllf.exe 4360 lllrlrr.exe 1780 ttbnhh.exe 2112 xxxrrrl.exe 1604 rxffrrl.exe 1040 llrlfxl.exe 940 ththbb.exe 752 xllrfrf.exe 3324 tnbbtt.exe 1872 1dpjd.exe 2408 frrxrfx.exe 4384 btbbtt.exe 2248 7jpvj.exe -
resource yara_rule behavioral2/memory/4164-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/796-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-769-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4164 wrote to memory of 1472 4164 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 83 PID 4164 wrote to memory of 1472 4164 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 83 PID 4164 wrote to memory of 1472 4164 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 83 PID 1472 wrote to memory of 1920 1472 lxllfxr.exe 84 PID 1472 wrote to memory of 1920 1472 lxllfxr.exe 84 PID 1472 wrote to memory of 1920 1472 lxllfxr.exe 84 PID 1920 wrote to memory of 2236 1920 pdjdp.exe 85 PID 1920 wrote to memory of 2236 1920 pdjdp.exe 85 PID 1920 wrote to memory of 2236 1920 pdjdp.exe 85 PID 2236 wrote to memory of 4968 2236 rrxrrrf.exe 86 PID 2236 wrote to memory of 4968 2236 rrxrrrf.exe 86 PID 2236 wrote to memory of 4968 2236 rrxrrrf.exe 86 PID 4968 wrote to memory of 1788 4968 5btttt.exe 87 PID 4968 wrote to memory of 1788 4968 5btttt.exe 87 PID 4968 wrote to memory of 1788 4968 5btttt.exe 87 PID 1788 wrote to memory of 4488 1788 dvpvv.exe 88 PID 1788 wrote to memory of 4488 1788 dvpvv.exe 88 PID 1788 wrote to memory of 4488 1788 dvpvv.exe 88 PID 4488 wrote to memory of 4220 4488 vvvpj.exe 89 PID 4488 wrote to memory of 4220 4488 vvvpj.exe 89 PID 4488 wrote to memory of 4220 4488 vvvpj.exe 89 PID 4220 wrote to memory of 4548 4220 ddpdv.exe 90 PID 4220 wrote to memory of 4548 4220 ddpdv.exe 90 PID 4220 wrote to memory of 4548 4220 ddpdv.exe 90 PID 4548 wrote to memory of 4516 4548 tthbbb.exe 91 PID 4548 wrote to memory of 4516 4548 tthbbb.exe 91 PID 4548 wrote to memory of 4516 4548 tthbbb.exe 91 PID 4516 wrote to memory of 1912 4516 jpvpp.exe 92 PID 4516 wrote to memory of 1912 4516 jpvpp.exe 92 PID 4516 wrote to memory of 1912 4516 jpvpp.exe 92 PID 1912 wrote to memory of 1792 1912 lflflfx.exe 93 PID 1912 wrote to memory of 1792 1912 lflflfx.exe 93 PID 1912 wrote to memory of 1792 1912 lflflfx.exe 93 PID 1792 wrote to memory of 1632 1792 ttnthh.exe 94 PID 1792 wrote to memory of 1632 1792 ttnthh.exe 94 PID 1792 wrote to memory of 1632 1792 ttnthh.exe 94 PID 1632 wrote to memory of 1896 1632 fffrlxx.exe 95 PID 1632 wrote to memory of 1896 1632 fffrlxx.exe 95 PID 1632 wrote to memory of 1896 1632 fffrlxx.exe 95 PID 1896 wrote to memory of 4384 1896 5nnnhh.exe 96 PID 1896 wrote to memory of 4384 1896 5nnnhh.exe 96 PID 1896 wrote to memory of 4384 1896 5nnnhh.exe 96 PID 4384 wrote to memory of 1584 4384 vddvd.exe 97 PID 4384 wrote to memory of 1584 4384 vddvd.exe 97 PID 4384 wrote to memory of 1584 4384 vddvd.exe 97 PID 1584 wrote to memory of 3164 1584 lfffxxx.exe 98 PID 1584 wrote to memory of 3164 1584 lfffxxx.exe 98 PID 1584 wrote to memory of 3164 1584 lfffxxx.exe 98 PID 3164 wrote to memory of 4688 3164 1bhbbb.exe 99 PID 3164 wrote to memory of 4688 3164 1bhbbb.exe 99 PID 3164 wrote to memory of 4688 3164 1bhbbb.exe 99 PID 4688 wrote to memory of 2704 4688 3vjvv.exe 100 PID 4688 wrote to memory of 2704 4688 3vjvv.exe 100 PID 4688 wrote to memory of 2704 4688 3vjvv.exe 100 PID 2704 wrote to memory of 1960 2704 5btnhn.exe 101 PID 2704 wrote to memory of 1960 2704 5btnhn.exe 101 PID 2704 wrote to memory of 1960 2704 5btnhn.exe 101 PID 1960 wrote to memory of 2896 1960 lxxlrlr.exe 102 PID 1960 wrote to memory of 2896 1960 lxxlrlr.exe 102 PID 1960 wrote to memory of 2896 1960 lxxlrlr.exe 102 PID 2896 wrote to memory of 3808 2896 bbnnhn.exe 103 PID 2896 wrote to memory of 3808 2896 bbnnhn.exe 103 PID 2896 wrote to memory of 3808 2896 bbnnhn.exe 103 PID 3808 wrote to memory of 3988 3808 vvdpv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe"C:\Users\Admin\AppData\Local\Temp\a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\lxllfxr.exec:\lxllfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\pdjdp.exec:\pdjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\rrxrrrf.exec:\rrxrrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\5btttt.exec:\5btttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\dvpvv.exec:\dvpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\vvvpj.exec:\vvvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\ddpdv.exec:\ddpdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\tthbbb.exec:\tthbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\jpvpp.exec:\jpvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\lflflfx.exec:\lflflfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\ttnthh.exec:\ttnthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\fffrlxx.exec:\fffrlxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\5nnnhh.exec:\5nnnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\vddvd.exec:\vddvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\lfffxxx.exec:\lfffxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\1bhbbb.exec:\1bhbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\3vjvv.exec:\3vjvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\5btnhn.exec:\5btnhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\lxxlrlr.exec:\lxxlrlr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\bbnnhn.exec:\bbnnhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\vvdpv.exec:\vvdpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\lflfxxr.exec:\lflfxxr.exe23⤵
- Executes dropped EXE
PID:3988 -
\??\c:\vppvp.exec:\vppvp.exe24⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lffffrl.exec:\lffffrl.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4072 -
\??\c:\lxxfllr.exec:\lxxfllr.exe26⤵
- Executes dropped EXE
PID:452 -
\??\c:\vvvjp.exec:\vvvjp.exe27⤵
- Executes dropped EXE
PID:4344 -
\??\c:\pdvvv.exec:\pdvvv.exe28⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nnhbth.exec:\nnhbth.exe29⤵
- Executes dropped EXE
PID:3444 -
\??\c:\fffllrx.exec:\fffllrx.exe30⤵
- Executes dropped EXE
PID:4668 -
\??\c:\jdvpd.exec:\jdvpd.exe31⤵
- Executes dropped EXE
PID:3516 -
\??\c:\htthbt.exec:\htthbt.exe32⤵
- Executes dropped EXE
PID:4580 -
\??\c:\lxflfxr.exec:\lxflfxr.exe33⤵
- Executes dropped EXE
PID:4932 -
\??\c:\jdjdv.exec:\jdjdv.exe34⤵
- Executes dropped EXE
PID:2908 -
\??\c:\fflrfrr.exec:\fflrfrr.exe35⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hbtnnn.exec:\hbtnnn.exe36⤵
- Executes dropped EXE
PID:916 -
\??\c:\vjvpv.exec:\vjvpv.exe37⤵
- Executes dropped EXE
PID:4176 -
\??\c:\fxffxff.exec:\fxffxff.exe38⤵
- Executes dropped EXE
PID:4912 -
\??\c:\nhhbtt.exec:\nhhbtt.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3440 -
\??\c:\jjppp.exec:\jjppp.exe40⤵
- Executes dropped EXE
PID:4184 -
\??\c:\frxxxxx.exec:\frxxxxx.exe41⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tttnhh.exec:\tttnhh.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jjjjd.exec:\jjjjd.exe43⤵
- Executes dropped EXE
PID:4552 -
\??\c:\9vvpp.exec:\9vvpp.exe44⤵
- Executes dropped EXE
PID:224 -
\??\c:\fffxrrf.exec:\fffxrrf.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816 -
\??\c:\vjpjd.exec:\vjpjd.exe46⤵
- Executes dropped EXE
PID:4372 -
\??\c:\rfllfxx.exec:\rfllfxx.exe47⤵
- Executes dropped EXE
PID:4468 -
\??\c:\hbnnhh.exec:\hbnnhh.exe48⤵
- Executes dropped EXE
PID:4000 -
\??\c:\7vvpd.exec:\7vvpd.exe49⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lfxrffx.exec:\lfxrffx.exe50⤵
- Executes dropped EXE
PID:60 -
\??\c:\tttnnh.exec:\tttnnh.exe51⤵
- Executes dropped EXE
PID:4212 -
\??\c:\ddpjd.exec:\ddpjd.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lxfxllf.exec:\lxfxllf.exe53⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lllrlrr.exec:\lllrlrr.exe54⤵
- Executes dropped EXE
PID:4360 -
\??\c:\ttbnhh.exec:\ttbnhh.exe55⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe56⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rxffrrl.exec:\rxffrrl.exe57⤵
- Executes dropped EXE
PID:1604 -
\??\c:\llrlfxl.exec:\llrlfxl.exe58⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ththbb.exec:\ththbb.exe59⤵
- Executes dropped EXE
PID:940 -
\??\c:\xllrfrf.exec:\xllrfrf.exe60⤵
- Executes dropped EXE
PID:752 -
\??\c:\tnbbtt.exec:\tnbbtt.exe61⤵
- Executes dropped EXE
PID:3324 -
\??\c:\1dpjd.exec:\1dpjd.exe62⤵
- Executes dropped EXE
PID:1872 -
\??\c:\frrxrfx.exec:\frrxrfx.exe63⤵
- Executes dropped EXE
PID:2408 -
\??\c:\btbbtt.exec:\btbbtt.exe64⤵
- Executes dropped EXE
PID:4384 -
\??\c:\7jpvj.exec:\7jpvj.exe65⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xlrlxrl.exec:\xlrlxrl.exe66⤵PID:1820
-
\??\c:\bbbnhb.exec:\bbbnhb.exe67⤵
- System Location Discovery: System Language Discovery
PID:5000 -
\??\c:\nhhbnn.exec:\nhhbnn.exe68⤵PID:3604
-
\??\c:\pdpdp.exec:\pdpdp.exe69⤵PID:4688
-
\??\c:\xrrfrrx.exec:\xrrfrrx.exe70⤵PID:2800
-
\??\c:\ttbnhh.exec:\ttbnhh.exe71⤵PID:4692
-
\??\c:\pjppd.exec:\pjppd.exe72⤵PID:796
-
\??\c:\vjvjv.exec:\vjvjv.exe73⤵PID:2448
-
\??\c:\nbbbtn.exec:\nbbbtn.exe74⤵PID:1524
-
\??\c:\dpdvj.exec:\dpdvj.exe75⤵PID:1776
-
\??\c:\3ppdp.exec:\3ppdp.exe76⤵PID:2960
-
\??\c:\fffxllf.exec:\fffxllf.exe77⤵PID:2712
-
\??\c:\tbbnhb.exec:\tbbnhb.exe78⤵PID:4556
-
\??\c:\jdvjv.exec:\jdvjv.exe79⤵PID:1628
-
\??\c:\7ffxrrl.exec:\7ffxrrl.exe80⤵PID:1596
-
\??\c:\thnhbt.exec:\thnhbt.exe81⤵PID:2216
-
\??\c:\3vdpj.exec:\3vdpj.exe82⤵PID:4532
-
\??\c:\xxlfllf.exec:\xxlfllf.exe83⤵PID:2120
-
\??\c:\bbhbnh.exec:\bbhbnh.exe84⤵PID:4416
-
\??\c:\7vpdv.exec:\7vpdv.exe85⤵PID:4728
-
\??\c:\xrxrfxr.exec:\xrxrfxr.exe86⤵PID:3420
-
\??\c:\htbbtt.exec:\htbbtt.exe87⤵PID:1664
-
\??\c:\pdjpv.exec:\pdjpv.exe88⤵PID:2204
-
\??\c:\rfrxrrf.exec:\rfrxrrf.exe89⤵PID:316
-
\??\c:\bnnbnb.exec:\bnnbnb.exe90⤵PID:4932
-
\??\c:\5vvpd.exec:\5vvpd.exe91⤵PID:3836
-
\??\c:\9fxllxr.exec:\9fxllxr.exe92⤵PID:2536
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe93⤵PID:5104
-
\??\c:\tthnhb.exec:\tthnhb.exe94⤵PID:2932
-
\??\c:\fxrlffx.exec:\fxrlffx.exe95⤵PID:4912
-
\??\c:\5fxrlff.exec:\5fxrlff.exe96⤵PID:396
-
\??\c:\tnhtnb.exec:\tnhtnb.exe97⤵PID:2228
-
\??\c:\jppjp.exec:\jppjp.exe98⤵PID:2968
-
\??\c:\xrlxllx.exec:\xrlxllx.exe99⤵PID:4412
-
\??\c:\thnhbb.exec:\thnhbb.exe100⤵PID:2744
-
\??\c:\vdjjv.exec:\vdjjv.exe101⤵PID:2696
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe102⤵PID:1920
-
\??\c:\nnthtt.exec:\nnthtt.exe103⤵PID:1944
-
\??\c:\pjjdp.exec:\pjjdp.exe104⤵PID:1916
-
\??\c:\rfllfrl.exec:\rfllfrl.exe105⤵PID:1068
-
\??\c:\nhtnhh.exec:\nhtnhh.exe106⤵PID:3796
-
\??\c:\vpvjd.exec:\vpvjd.exe107⤵PID:60
-
\??\c:\7fxrxxf.exec:\7fxrxxf.exe108⤵PID:1240
-
\??\c:\3bhhnn.exec:\3bhhnn.exe109⤵PID:2132
-
\??\c:\djvpj.exec:\djvpj.exe110⤵PID:3884
-
\??\c:\5rxrlll.exec:\5rxrlll.exe111⤵PID:4360
-
\??\c:\1hnnhb.exec:\1hnnhb.exe112⤵PID:1904
-
\??\c:\ddpvv.exec:\ddpvv.exe113⤵PID:1740
-
\??\c:\xlxfrrx.exec:\xlxfrrx.exe114⤵PID:1408
-
\??\c:\btbnhh.exec:\btbnhh.exe115⤵PID:3940
-
\??\c:\pppjj.exec:\pppjj.exe116⤵PID:1464
-
\??\c:\fffffxx.exec:\fffffxx.exe117⤵PID:1012
-
\??\c:\xlrlffx.exec:\xlrlffx.exe118⤵PID:4828
-
\??\c:\nnhhhb.exec:\nnhhhb.exe119⤵PID:4736
-
\??\c:\pjvpd.exec:\pjvpd.exe120⤵PID:4860
-
\??\c:\xlxrlrr.exec:\xlxrlrr.exe121⤵PID:3084
-
\??\c:\dvvpd.exec:\dvvpd.exe122⤵PID:4716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-