Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 14:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe
-
Size
454KB
-
MD5
628693ccd4c90ece9270f66e27bd2a9c
-
SHA1
e483ef841425e9ff206e6b053c17c2898410da04
-
SHA256
dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4
-
SHA512
eb1265ecc8d4935f45eaa3bba9ee91796360a6f5266b55fb5aaa5b99f3a5c3bf0ef47d54601a9b73ffb0deaace1ea121671caa9790163c8852b7b533be3e6335
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1596-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-920-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-987-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1456 rfrfrff.exe 1224 3pjvv.exe 3112 xrxxlrl.exe 2480 hhnnnt.exe 1432 1frlllr.exe 3872 nhhbtt.exe 4704 frxlfxr.exe 2544 ddvpj.exe 4968 fflxrlf.exe 4716 5rlxrxl.exe 3992 1ttnhb.exe 1904 dpjdj.exe 3100 btthbt.exe 4596 vddpj.exe 1500 xxxrfff.exe 2088 btbtnn.exe 3784 lxfxfrl.exe 1216 bhbhbn.exe 2276 dvvjd.exe 2996 bbnhbb.exe 664 ddjpp.exe 1516 dvpjp.exe 3864 hhnntt.exe 5052 vdvpd.exe 4000 xrxxxll.exe 3128 jvjdp.exe 1300 rfrlxlx.exe 4252 7flfxxx.exe 3256 rxlxrrf.exe 2000 jvvvv.exe 2700 xxllffx.exe 2300 ppdvd.exe 4132 9bbtnt.exe 1492 9jjvp.exe 976 llrrrrx.exe 3288 tnnnhh.exe 3272 vjjdv.exe 1644 xxfffll.exe 3388 nhbhnh.exe 2132 ppjdd.exe 4388 hntttt.exe 1988 xxrrrfl.exe 2164 hhhnhh.exe 2924 7bbttt.exe 1036 dddvd.exe 4352 rffffll.exe 1900 xrlfffx.exe 3392 1tbbhn.exe 1420 pdppp.exe 452 rllrlxr.exe 4948 tntttt.exe 2364 tnnhhh.exe 2568 jvpvp.exe 624 7lxrxfx.exe 2176 llrrrrr.exe 2800 hbnhhh.exe 2288 vvppj.exe 4984 xrxxxff.exe 5056 hhhbbb.exe 2552 nnbtht.exe 2596 3pppj.exe 368 frffffx.exe 1384 ttbbtt.exe 4248 ddpdv.exe -
resource yara_rule behavioral2/memory/1596-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-751-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbbhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1456 1596 dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe 82 PID 1596 wrote to memory of 1456 1596 dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe 82 PID 1596 wrote to memory of 1456 1596 dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe 82 PID 1456 wrote to memory of 1224 1456 rfrfrff.exe 83 PID 1456 wrote to memory of 1224 1456 rfrfrff.exe 83 PID 1456 wrote to memory of 1224 1456 rfrfrff.exe 83 PID 1224 wrote to memory of 3112 1224 3pjvv.exe 84 PID 1224 wrote to memory of 3112 1224 3pjvv.exe 84 PID 1224 wrote to memory of 3112 1224 3pjvv.exe 84 PID 3112 wrote to memory of 2480 3112 xrxxlrl.exe 85 PID 3112 wrote to memory of 2480 3112 xrxxlrl.exe 85 PID 3112 wrote to memory of 2480 3112 xrxxlrl.exe 85 PID 2480 wrote to memory of 1432 2480 hhnnnt.exe 86 PID 2480 wrote to memory of 1432 2480 hhnnnt.exe 86 PID 2480 wrote to memory of 1432 2480 hhnnnt.exe 86 PID 1432 wrote to memory of 3872 1432 1frlllr.exe 87 PID 1432 wrote to memory of 3872 1432 1frlllr.exe 87 PID 1432 wrote to memory of 3872 1432 1frlllr.exe 87 PID 3872 wrote to memory of 4704 3872 nhhbtt.exe 88 PID 3872 wrote to memory of 4704 3872 nhhbtt.exe 88 PID 3872 wrote to memory of 4704 3872 nhhbtt.exe 88 PID 4704 wrote to memory of 2544 4704 frxlfxr.exe 89 PID 4704 wrote to memory of 2544 4704 frxlfxr.exe 89 PID 4704 wrote to memory of 2544 4704 frxlfxr.exe 89 PID 2544 wrote to memory of 4968 2544 ddvpj.exe 90 PID 2544 wrote to memory of 4968 2544 ddvpj.exe 90 PID 2544 wrote to memory of 4968 2544 ddvpj.exe 90 PID 4968 wrote to memory of 4716 4968 fflxrlf.exe 91 PID 4968 wrote to memory of 4716 4968 fflxrlf.exe 91 PID 4968 wrote to memory of 4716 4968 fflxrlf.exe 91 PID 4716 wrote to memory of 3992 4716 5rlxrxl.exe 92 PID 4716 wrote to memory of 3992 4716 5rlxrxl.exe 92 PID 4716 wrote to memory of 3992 4716 5rlxrxl.exe 92 PID 3992 wrote to memory of 1904 3992 1ttnhb.exe 93 PID 3992 wrote to memory of 1904 3992 1ttnhb.exe 93 PID 3992 wrote to memory of 1904 3992 1ttnhb.exe 93 PID 1904 wrote to memory of 3100 1904 dpjdj.exe 94 PID 1904 wrote to memory of 3100 1904 dpjdj.exe 94 PID 1904 wrote to memory of 3100 1904 dpjdj.exe 94 PID 3100 wrote to memory of 4596 3100 btthbt.exe 95 PID 3100 wrote to memory of 4596 3100 btthbt.exe 95 PID 3100 wrote to memory of 4596 3100 btthbt.exe 95 PID 4596 wrote to memory of 1500 4596 vddpj.exe 96 PID 4596 wrote to memory of 1500 4596 vddpj.exe 96 PID 4596 wrote to memory of 1500 4596 vddpj.exe 96 PID 1500 wrote to memory of 2088 1500 xxxrfff.exe 97 PID 1500 wrote to memory of 2088 1500 xxxrfff.exe 97 PID 1500 wrote to memory of 2088 1500 xxxrfff.exe 97 PID 2088 wrote to memory of 3784 2088 btbtnn.exe 98 PID 2088 wrote to memory of 3784 2088 btbtnn.exe 98 PID 2088 wrote to memory of 3784 2088 btbtnn.exe 98 PID 3784 wrote to memory of 1216 3784 lxfxfrl.exe 99 PID 3784 wrote to memory of 1216 3784 lxfxfrl.exe 99 PID 3784 wrote to memory of 1216 3784 lxfxfrl.exe 99 PID 1216 wrote to memory of 2276 1216 bhbhbn.exe 100 PID 1216 wrote to memory of 2276 1216 bhbhbn.exe 100 PID 1216 wrote to memory of 2276 1216 bhbhbn.exe 100 PID 2276 wrote to memory of 2996 2276 dvvjd.exe 101 PID 2276 wrote to memory of 2996 2276 dvvjd.exe 101 PID 2276 wrote to memory of 2996 2276 dvvjd.exe 101 PID 2996 wrote to memory of 664 2996 bbnhbb.exe 102 PID 2996 wrote to memory of 664 2996 bbnhbb.exe 102 PID 2996 wrote to memory of 664 2996 bbnhbb.exe 102 PID 664 wrote to memory of 1516 664 ddjpp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe"C:\Users\Admin\AppData\Local\Temp\dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\rfrfrff.exec:\rfrfrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\3pjvv.exec:\3pjvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\xrxxlrl.exec:\xrxxlrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\hhnnnt.exec:\hhnnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\1frlllr.exec:\1frlllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\nhhbtt.exec:\nhhbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\frxlfxr.exec:\frxlfxr.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\ddvpj.exec:\ddvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\fflxrlf.exec:\fflxrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\5rlxrxl.exec:\5rlxrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\1ttnhb.exec:\1ttnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\dpjdj.exec:\dpjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\btthbt.exec:\btthbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\vddpj.exec:\vddpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\xxxrfff.exec:\xxxrfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\btbtnn.exec:\btbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\lxfxfrl.exec:\lxfxfrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\bhbhbn.exec:\bhbhbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\dvvjd.exec:\dvvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\bbnhbb.exec:\bbnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\ddjpp.exec:\ddjpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\dvpjp.exec:\dvpjp.exe23⤵
- Executes dropped EXE
PID:1516 -
\??\c:\hhnntt.exec:\hhnntt.exe24⤵
- Executes dropped EXE
PID:3864 -
\??\c:\vdvpd.exec:\vdvpd.exe25⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xrxxxll.exec:\xrxxxll.exe26⤵
- Executes dropped EXE
PID:4000 -
\??\c:\jvjdp.exec:\jvjdp.exe27⤵
- Executes dropped EXE
PID:3128 -
\??\c:\rfrlxlx.exec:\rfrlxlx.exe28⤵
- Executes dropped EXE
PID:1300 -
\??\c:\7flfxxx.exec:\7flfxxx.exe29⤵
- Executes dropped EXE
PID:4252 -
\??\c:\rxlxrrf.exec:\rxlxrrf.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3256 -
\??\c:\jvvvv.exec:\jvvvv.exe31⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xxllffx.exec:\xxllffx.exe32⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ppdvd.exec:\ppdvd.exe33⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9bbtnt.exec:\9bbtnt.exe34⤵
- Executes dropped EXE
PID:4132 -
\??\c:\9jjvp.exec:\9jjvp.exe35⤵
- Executes dropped EXE
PID:1492 -
\??\c:\llrrrrx.exec:\llrrrrx.exe36⤵
- Executes dropped EXE
PID:976 -
\??\c:\tnnnhh.exec:\tnnnhh.exe37⤵
- Executes dropped EXE
PID:3288 -
\??\c:\vjjdv.exec:\vjjdv.exe38⤵
- Executes dropped EXE
PID:3272 -
\??\c:\xxfffll.exec:\xxfffll.exe39⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nhbhnh.exec:\nhbhnh.exe40⤵
- Executes dropped EXE
PID:3388 -
\??\c:\ppjdd.exec:\ppjdd.exe41⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hntttt.exec:\hntttt.exe42⤵
- Executes dropped EXE
PID:4388 -
\??\c:\xxrrrfl.exec:\xxrrrfl.exe43⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hhhnhh.exec:\hhhnhh.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7bbttt.exec:\7bbttt.exe45⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dddvd.exec:\dddvd.exe46⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rffffll.exec:\rffffll.exe47⤵
- Executes dropped EXE
PID:4352 -
\??\c:\xrlfffx.exec:\xrlfffx.exe48⤵
- Executes dropped EXE
PID:1900 -
\??\c:\1tbbhn.exec:\1tbbhn.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3392 -
\??\c:\pdppp.exec:\pdppp.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rllrlxr.exec:\rllrlxr.exe51⤵
- Executes dropped EXE
PID:452 -
\??\c:\tntttt.exec:\tntttt.exe52⤵
- Executes dropped EXE
PID:4948 -
\??\c:\tnnhhh.exec:\tnnhhh.exe53⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jvpvp.exec:\jvpvp.exe54⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7lxrxfx.exec:\7lxrxfx.exe55⤵
- Executes dropped EXE
PID:624 -
\??\c:\llrrrrr.exec:\llrrrrr.exe56⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hbnhhh.exec:\hbnhhh.exe57⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vvppj.exec:\vvppj.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xrxxxff.exec:\xrxxxff.exe59⤵
- Executes dropped EXE
PID:4984 -
\??\c:\hhhbbb.exec:\hhhbbb.exe60⤵
- Executes dropped EXE
PID:5056 -
\??\c:\nnbtht.exec:\nnbtht.exe61⤵
- Executes dropped EXE
PID:2552 -
\??\c:\3pppj.exec:\3pppj.exe62⤵
- Executes dropped EXE
PID:2596 -
\??\c:\frffffx.exec:\frffffx.exe63⤵
- Executes dropped EXE
PID:368 -
\??\c:\ttbbtt.exec:\ttbbtt.exe64⤵
- Executes dropped EXE
PID:1384 -
\??\c:\ddpdv.exec:\ddpdv.exe65⤵
- Executes dropped EXE
PID:4248 -
\??\c:\xxllfff.exec:\xxllfff.exe66⤵PID:112
-
\??\c:\5fffxxx.exec:\5fffxxx.exe67⤵PID:5012
-
\??\c:\bntthh.exec:\bntthh.exe68⤵PID:5024
-
\??\c:\ppjjj.exec:\ppjjj.exe69⤵PID:3324
-
\??\c:\rffrlfr.exec:\rffrlfr.exe70⤵PID:2600
-
\??\c:\rlrxxfx.exec:\rlrxxfx.exe71⤵PID:1592
-
\??\c:\3bbbbh.exec:\3bbbbh.exe72⤵PID:1860
-
\??\c:\vpddd.exec:\vpddd.exe73⤵PID:3992
-
\??\c:\llllrxx.exec:\llllrxx.exe74⤵PID:3656
-
\??\c:\1bbbbh.exec:\1bbbbh.exe75⤵PID:636
-
\??\c:\dpjpv.exec:\dpjpv.exe76⤵PID:724
-
\??\c:\ffffffx.exec:\ffffffx.exe77⤵PID:264
-
\??\c:\fflrxxx.exec:\fflrxxx.exe78⤵PID:4052
-
\??\c:\hbhhbb.exec:\hbhhbb.exe79⤵PID:4380
-
\??\c:\pjpjj.exec:\pjpjj.exe80⤵PID:4060
-
\??\c:\rlrlfll.exec:\rlrlfll.exe81⤵PID:4548
-
\??\c:\bhttbh.exec:\bhttbh.exe82⤵PID:4108
-
\??\c:\djjjd.exec:\djjjd.exe83⤵PID:4116
-
\??\c:\xfrfffl.exec:\xfrfffl.exe84⤵PID:4276
-
\??\c:\nbnhbh.exec:\nbnhbh.exe85⤵PID:2360
-
\??\c:\bbtnnt.exec:\bbtnnt.exe86⤵PID:3560
-
\??\c:\5dpvd.exec:\5dpvd.exe87⤵PID:640
-
\??\c:\xlxfffl.exec:\xlxfffl.exe88⤵PID:1720
-
\??\c:\nnttnt.exec:\nnttnt.exe89⤵PID:5052
-
\??\c:\dvpjj.exec:\dvpjj.exe90⤵PID:2648
-
\??\c:\xrfffll.exec:\xrfffll.exe91⤵PID:4832
-
\??\c:\hbhbbn.exec:\hbhbbn.exe92⤵PID:3604
-
\??\c:\nbnhhh.exec:\nbnhhh.exe93⤵PID:1748
-
\??\c:\vpjdj.exec:\vpjdj.exe94⤵PID:1300
-
\??\c:\9ffffff.exec:\9ffffff.exe95⤵PID:4180
-
\??\c:\nnbhtb.exec:\nnbhtb.exe96⤵PID:1100
-
\??\c:\5vvvv.exec:\5vvvv.exe97⤵PID:548
-
\??\c:\xrllxxf.exec:\xrllxxf.exe98⤵PID:592
-
\??\c:\bnbnbt.exec:\bnbnbt.exe99⤵PID:744
-
\??\c:\jjdvp.exec:\jjdvp.exe100⤵PID:2264
-
\??\c:\llxxxfl.exec:\llxxxfl.exe101⤵PID:2624
-
\??\c:\9hntbn.exec:\9hntbn.exe102⤵PID:1468
-
\??\c:\vdjjj.exec:\vdjjj.exe103⤵PID:2684
-
\??\c:\xflfxlf.exec:\xflfxlf.exe104⤵PID:232
-
\??\c:\3hntnt.exec:\3hntnt.exe105⤵PID:1696
-
\??\c:\ttntnn.exec:\ttntnn.exe106⤵PID:1756
-
\??\c:\vvddv.exec:\vvddv.exe107⤵
- System Location Discovery: System Language Discovery
PID:3696 -
\??\c:\lflfllx.exec:\lflfllx.exe108⤵PID:4216
-
\??\c:\tthbnn.exec:\tthbnn.exe109⤵PID:2320
-
\??\c:\hbhbtt.exec:\hbhbtt.exe110⤵PID:4388
-
\??\c:\vvvvv.exec:\vvvvv.exe111⤵PID:3236
-
\??\c:\lfffxxx.exec:\lfffxxx.exe112⤵PID:3036
-
\??\c:\rllllrx.exec:\rllllrx.exe113⤵PID:3420
-
\??\c:\hbnnnn.exec:\hbnnnn.exe114⤵PID:1036
-
\??\c:\5dddv.exec:\5dddv.exe115⤵PID:4352
-
\??\c:\3llfxxx.exec:\3llfxxx.exe116⤵PID:1264
-
\??\c:\3rxxflx.exec:\3rxxflx.exe117⤵PID:4860
-
\??\c:\hthbtt.exec:\hthbtt.exe118⤵PID:3152
-
\??\c:\vjdvd.exec:\vjdvd.exe119⤵PID:1932
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe120⤵PID:4056
-
\??\c:\btbnnn.exec:\btbnnn.exe121⤵PID:4940
-
\??\c:\dpvpj.exec:\dpvpj.exe122⤵PID:4484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-