Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 14:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe
-
Size
454KB
-
MD5
a7937f4f2f9201749842748e63920370
-
SHA1
981d3c1fa0053d8d93fd0ad720676498695ea4f1
-
SHA256
23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07f
-
SHA512
62b344d5310dddfb40b79c4e637f77e91ce6d28f9d4ef6991aa790ac8557502853da371ed5c2991a2018b657533a1f72b6a9be7e7096c448d881071dd056cd86
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4116-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/592-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-835-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4052 xlxrllf.exe 4572 3vpdv.exe 4816 nbbtnn.exe 4472 rflfxxr.exe 5008 pvjdd.exe 3640 7tnnnn.exe 3540 jvdvp.exe 4452 vpjdv.exe 3472 llfllrr.exe 4772 nhhbtb.exe 1168 3jjdj.exe 212 7lrlxxr.exe 3188 xrxrxxr.exe 2420 7xfrllf.exe 3648 nnnbtt.exe 1720 vjvvv.exe 60 rxlrlff.exe 2352 vdjvd.exe 544 ppdvp.exe 2848 1lrlfrl.exe 1252 nhhhht.exe 1612 vpdjd.exe 4548 xrffxxf.exe 1840 nhtnhb.exe 3344 vppjd.exe 1844 9fllfxl.exe 2908 pjjdv.exe 4580 xxfxrlr.exe 3848 lrfxrfx.exe 592 hbhtnn.exe 872 jdpjp.exe 112 flrlrlf.exe 628 htbhhn.exe 2556 dvdvj.exe 3760 5xfrffx.exe 3720 thnnhb.exe 2404 7dvpp.exe 2356 rffxlfx.exe 2200 bbhbtn.exe 804 jdvvp.exe 4968 dpjdv.exe 2928 xrrlffx.exe 2032 7hnbnn.exe 3612 5ppjd.exe 4684 hbhhbb.exe 824 ppjvv.exe 3852 xlrlxxr.exe 4508 tbthbn.exe 4328 1jpjd.exe 4924 rfrfxrl.exe 4960 vjdjd.exe 5080 hntnhb.exe 4624 jvvpd.exe 3608 1lllxxr.exe 1384 bttnhb.exe 3444 vvvpd.exe 2400 jddpj.exe 3988 flrlxfr.exe 2708 hbtntn.exe 3824 pvjvj.exe 2116 vvdvp.exe 1716 3lrlxxf.exe 2020 nbbtnh.exe 4172 fxlfxxx.exe -
resource yara_rule behavioral2/memory/4116-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/592-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-724-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4116 wrote to memory of 4052 4116 23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe 83 PID 4116 wrote to memory of 4052 4116 23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe 83 PID 4116 wrote to memory of 4052 4116 23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe 83 PID 4052 wrote to memory of 4572 4052 xlxrllf.exe 84 PID 4052 wrote to memory of 4572 4052 xlxrllf.exe 84 PID 4052 wrote to memory of 4572 4052 xlxrllf.exe 84 PID 4572 wrote to memory of 4816 4572 3vpdv.exe 85 PID 4572 wrote to memory of 4816 4572 3vpdv.exe 85 PID 4572 wrote to memory of 4816 4572 3vpdv.exe 85 PID 4816 wrote to memory of 4472 4816 nbbtnn.exe 86 PID 4816 wrote to memory of 4472 4816 nbbtnn.exe 86 PID 4816 wrote to memory of 4472 4816 nbbtnn.exe 86 PID 4472 wrote to memory of 5008 4472 rflfxxr.exe 87 PID 4472 wrote to memory of 5008 4472 rflfxxr.exe 87 PID 4472 wrote to memory of 5008 4472 rflfxxr.exe 87 PID 5008 wrote to memory of 3640 5008 pvjdd.exe 88 PID 5008 wrote to memory of 3640 5008 pvjdd.exe 88 PID 5008 wrote to memory of 3640 5008 pvjdd.exe 88 PID 3640 wrote to memory of 3540 3640 7tnnnn.exe 89 PID 3640 wrote to memory of 3540 3640 7tnnnn.exe 89 PID 3640 wrote to memory of 3540 3640 7tnnnn.exe 89 PID 3540 wrote to memory of 4452 3540 jvdvp.exe 90 PID 3540 wrote to memory of 4452 3540 jvdvp.exe 90 PID 3540 wrote to memory of 4452 3540 jvdvp.exe 90 PID 4452 wrote to memory of 3472 4452 vpjdv.exe 91 PID 4452 wrote to memory of 3472 4452 vpjdv.exe 91 PID 4452 wrote to memory of 3472 4452 vpjdv.exe 91 PID 3472 wrote to memory of 4772 3472 llfllrr.exe 92 PID 3472 wrote to memory of 4772 3472 llfllrr.exe 92 PID 3472 wrote to memory of 4772 3472 llfllrr.exe 92 PID 4772 wrote to memory of 1168 4772 nhhbtb.exe 93 PID 4772 wrote to memory of 1168 4772 nhhbtb.exe 93 PID 4772 wrote to memory of 1168 4772 nhhbtb.exe 93 PID 1168 wrote to memory of 212 1168 3jjdj.exe 94 PID 1168 wrote to memory of 212 1168 3jjdj.exe 94 PID 1168 wrote to memory of 212 1168 3jjdj.exe 94 PID 212 wrote to memory of 3188 212 7lrlxxr.exe 95 PID 212 wrote to memory of 3188 212 7lrlxxr.exe 95 PID 212 wrote to memory of 3188 212 7lrlxxr.exe 95 PID 3188 wrote to memory of 2420 3188 xrxrxxr.exe 96 PID 3188 wrote to memory of 2420 3188 xrxrxxr.exe 96 PID 3188 wrote to memory of 2420 3188 xrxrxxr.exe 96 PID 2420 wrote to memory of 3648 2420 7xfrllf.exe 97 PID 2420 wrote to memory of 3648 2420 7xfrllf.exe 97 PID 2420 wrote to memory of 3648 2420 7xfrllf.exe 97 PID 3648 wrote to memory of 1720 3648 nnnbtt.exe 98 PID 3648 wrote to memory of 1720 3648 nnnbtt.exe 98 PID 3648 wrote to memory of 1720 3648 nnnbtt.exe 98 PID 1720 wrote to memory of 60 1720 vjvvv.exe 99 PID 1720 wrote to memory of 60 1720 vjvvv.exe 99 PID 1720 wrote to memory of 60 1720 vjvvv.exe 99 PID 60 wrote to memory of 2352 60 rxlrlff.exe 100 PID 60 wrote to memory of 2352 60 rxlrlff.exe 100 PID 60 wrote to memory of 2352 60 rxlrlff.exe 100 PID 2352 wrote to memory of 544 2352 vdjvd.exe 101 PID 2352 wrote to memory of 544 2352 vdjvd.exe 101 PID 2352 wrote to memory of 544 2352 vdjvd.exe 101 PID 544 wrote to memory of 2848 544 ppdvp.exe 102 PID 544 wrote to memory of 2848 544 ppdvp.exe 102 PID 544 wrote to memory of 2848 544 ppdvp.exe 102 PID 2848 wrote to memory of 1252 2848 1lrlfrl.exe 103 PID 2848 wrote to memory of 1252 2848 1lrlfrl.exe 103 PID 2848 wrote to memory of 1252 2848 1lrlfrl.exe 103 PID 1252 wrote to memory of 1612 1252 nhhhht.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe"C:\Users\Admin\AppData\Local\Temp\23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\xlxrllf.exec:\xlxrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\3vpdv.exec:\3vpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\nbbtnn.exec:\nbbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\rflfxxr.exec:\rflfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\pvjdd.exec:\pvjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\7tnnnn.exec:\7tnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\jvdvp.exec:\jvdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\vpjdv.exec:\vpjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\llfllrr.exec:\llfllrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\nhhbtb.exec:\nhhbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\3jjdj.exec:\3jjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\7lrlxxr.exec:\7lrlxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\xrxrxxr.exec:\xrxrxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\7xfrllf.exec:\7xfrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nnnbtt.exec:\nnnbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\vjvvv.exec:\vjvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\rxlrlff.exec:\rxlrlff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\vdjvd.exec:\vdjvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\ppdvp.exec:\ppdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\1lrlfrl.exec:\1lrlfrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nhhhht.exec:\nhhhht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\vpdjd.exec:\vpdjd.exe23⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xrffxxf.exec:\xrffxxf.exe24⤵
- Executes dropped EXE
PID:4548 -
\??\c:\nhtnhb.exec:\nhtnhb.exe25⤵
- Executes dropped EXE
PID:1840 -
\??\c:\vppjd.exec:\vppjd.exe26⤵
- Executes dropped EXE
PID:3344 -
\??\c:\9fllfxl.exec:\9fllfxl.exe27⤵
- Executes dropped EXE
PID:1844 -
\??\c:\pjjdv.exec:\pjjdv.exe28⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xxfxrlr.exec:\xxfxrlr.exe29⤵
- Executes dropped EXE
PID:4580 -
\??\c:\lrfxrfx.exec:\lrfxrfx.exe30⤵
- Executes dropped EXE
PID:3848 -
\??\c:\hbhtnn.exec:\hbhtnn.exe31⤵
- Executes dropped EXE
PID:592 -
\??\c:\jdpjp.exec:\jdpjp.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\flrlrlf.exec:\flrlrlf.exe33⤵
- Executes dropped EXE
PID:112 -
\??\c:\htbhhn.exec:\htbhhn.exe34⤵
- Executes dropped EXE
PID:628 -
\??\c:\dvdvj.exec:\dvdvj.exe35⤵
- Executes dropped EXE
PID:2556 -
\??\c:\5xfrffx.exec:\5xfrffx.exe36⤵
- Executes dropped EXE
PID:3760 -
\??\c:\thnnhb.exec:\thnnhb.exe37⤵
- Executes dropped EXE
PID:3720 -
\??\c:\7dvpp.exec:\7dvpp.exe38⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rffxlfx.exec:\rffxlfx.exe39⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bbhbtn.exec:\bbhbtn.exe40⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdvvp.exec:\jdvvp.exe41⤵
- Executes dropped EXE
PID:804 -
\??\c:\dpjdv.exec:\dpjdv.exe42⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xrrlffx.exec:\xrrlffx.exe43⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7hnbnn.exec:\7hnbnn.exe44⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5ppjd.exec:\5ppjd.exe45⤵
- Executes dropped EXE
PID:3612 -
\??\c:\hbhhbb.exec:\hbhhbb.exe46⤵
- Executes dropped EXE
PID:4684 -
\??\c:\ppjvv.exec:\ppjvv.exe47⤵
- Executes dropped EXE
PID:824 -
\??\c:\xlrlxxr.exec:\xlrlxxr.exe48⤵
- Executes dropped EXE
PID:3852 -
\??\c:\tbthbn.exec:\tbthbn.exe49⤵
- Executes dropped EXE
PID:4508 -
\??\c:\1jpjd.exec:\1jpjd.exe50⤵
- Executes dropped EXE
PID:4328 -
\??\c:\rfrfxrl.exec:\rfrfxrl.exe51⤵
- Executes dropped EXE
PID:4924 -
\??\c:\vjdjd.exec:\vjdjd.exe52⤵
- Executes dropped EXE
PID:4960 -
\??\c:\hntnhb.exec:\hntnhb.exe53⤵
- Executes dropped EXE
PID:5080 -
\??\c:\jvvpd.exec:\jvvpd.exe54⤵
- Executes dropped EXE
PID:4624 -
\??\c:\1lllxxr.exec:\1lllxxr.exe55⤵
- Executes dropped EXE
PID:3608 -
\??\c:\bttnhb.exec:\bttnhb.exe56⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vvvpd.exec:\vvvpd.exe57⤵
- Executes dropped EXE
PID:3444 -
\??\c:\jddpj.exec:\jddpj.exe58⤵
- Executes dropped EXE
PID:2400 -
\??\c:\flrlxfr.exec:\flrlxfr.exe59⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hbtntn.exec:\hbtntn.exe60⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pvjvj.exec:\pvjvj.exe61⤵
- Executes dropped EXE
PID:3824 -
\??\c:\vvdvp.exec:\vvdvp.exe62⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3lrlxxf.exec:\3lrlxxf.exe63⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nbbtnh.exec:\nbbtnh.exe64⤵
- Executes dropped EXE
PID:2020 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe65⤵
- Executes dropped EXE
PID:4172 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe66⤵PID:4308
-
\??\c:\tntnbb.exec:\tntnbb.exe67⤵PID:2252
-
\??\c:\7jpjp.exec:\7jpjp.exe68⤵PID:3004
-
\??\c:\7xxrrrl.exec:\7xxrrrl.exe69⤵PID:2388
-
\??\c:\bnntbt.exec:\bnntbt.exe70⤵PID:1964
-
\??\c:\7htnnh.exec:\7htnnh.exe71⤵PID:3024
-
\??\c:\jdpjp.exec:\jdpjp.exe72⤵PID:4048
-
\??\c:\5ffxrlf.exec:\5ffxrlf.exe73⤵PID:3096
-
\??\c:\tbtnhh.exec:\tbtnhh.exe74⤵PID:520
-
\??\c:\vppjd.exec:\vppjd.exe75⤵PID:2520
-
\??\c:\vvdvp.exec:\vvdvp.exe76⤵PID:2296
-
\??\c:\lfrrfff.exec:\lfrrfff.exe77⤵PID:1508
-
\??\c:\hnthhh.exec:\hnthhh.exe78⤵PID:2876
-
\??\c:\pddvj.exec:\pddvj.exe79⤵PID:1944
-
\??\c:\1dvpd.exec:\1dvpd.exe80⤵PID:2096
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe81⤵PID:1972
-
\??\c:\7hbtnn.exec:\7hbtnn.exe82⤵PID:4548
-
\??\c:\vjjdp.exec:\vjjdp.exe83⤵PID:1832
-
\??\c:\fxxrffx.exec:\fxxrffx.exe84⤵PID:1316
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe85⤵PID:2784
-
\??\c:\tnnntb.exec:\tnnntb.exe86⤵PID:4824
-
\??\c:\dddvj.exec:\dddvj.exe87⤵PID:728
-
\??\c:\flrlfxr.exec:\flrlfxr.exe88⤵PID:2740
-
\??\c:\bnnhtt.exec:\bnnhtt.exe89⤵PID:4324
-
\??\c:\hhtnbt.exec:\hhtnbt.exe90⤵PID:2316
-
\??\c:\jvvpd.exec:\jvvpd.exe91⤵PID:3848
-
\??\c:\fxrlfff.exec:\fxrlfff.exe92⤵PID:3372
-
\??\c:\7tbtbb.exec:\7tbtbb.exe93⤵PID:4284
-
\??\c:\7pjdp.exec:\7pjdp.exe94⤵PID:1376
-
\??\c:\jdvpj.exec:\jdvpj.exe95⤵PID:4380
-
\??\c:\rrrfrrl.exec:\rrrfrrl.exe96⤵PID:644
-
\??\c:\tnnhtt.exec:\tnnhtt.exe97⤵PID:628
-
\??\c:\vpvdj.exec:\vpvdj.exe98⤵
- System Location Discovery: System Language Discovery
PID:2556 -
\??\c:\rfxfrxx.exec:\rfxfrxx.exe99⤵PID:3760
-
\??\c:\llrffxr.exec:\llrffxr.exe100⤵PID:1372
-
\??\c:\9hbtnn.exec:\9hbtnn.exe101⤵PID:2196
-
\??\c:\pjjdv.exec:\pjjdv.exe102⤵PID:4428
-
\??\c:\rrrlffx.exec:\rrrlffx.exe103⤵PID:3676
-
\??\c:\tttnbt.exec:\tttnbt.exe104⤵PID:3104
-
\??\c:\1jvpd.exec:\1jvpd.exe105⤵PID:532
-
\??\c:\7xrlxrl.exec:\7xrlxrl.exe106⤵PID:1312
-
\??\c:\bhnnhh.exec:\bhnnhh.exe107⤵PID:2088
-
\??\c:\3tnhnn.exec:\3tnhnn.exe108⤵PID:3600
-
\??\c:\ddvpj.exec:\ddvpj.exe109⤵PID:3392
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe110⤵PID:2680
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe111⤵PID:1352
-
\??\c:\tbhtnn.exec:\tbhtnn.exe112⤵PID:624
-
\??\c:\nnhbnh.exec:\nnhbnh.exe113⤵PID:4508
-
\??\c:\dvpjp.exec:\dvpjp.exe114⤵PID:2248
-
\??\c:\7llfrlf.exec:\7llfrlf.exe115⤵PID:3880
-
\??\c:\thbtnn.exec:\thbtnn.exe116⤵PID:4120
-
\??\c:\jvdvp.exec:\jvdvp.exe117⤵PID:4756
-
\??\c:\djppj.exec:\djppj.exe118⤵PID:3616
-
\??\c:\1rfxrrl.exec:\1rfxrrl.exe119⤵PID:2076
-
\??\c:\thnhhb.exec:\thnhhb.exe120⤵
- System Location Discovery: System Language Discovery
PID:3692 -
\??\c:\tnbtnh.exec:\tnbtnh.exe121⤵PID:4564
-
\??\c:\xlrllfl.exec:\xlrllfl.exe122⤵PID:3756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-