Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 15:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe
-
Size
454KB
-
MD5
a319505930a36727b0caaf4835f67c4d
-
SHA1
df378a9be4fedd0ba75abc9b0aae4b98eb63a80f
-
SHA256
8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c
-
SHA512
f9ca48fdbb43b1336f9a727ec285950037bcd2294972fe4ae9c07d3f632f7fba374211379f42605b5bae927c54db08cf136d57321c57881fe2def271ae5b3742
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1A:q7Tc2NYHUrAwfMp3CD1A
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4844-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-1433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1700 hhbttt.exe 3924 lxrllxr.exe 4168 nbhbbb.exe 4344 5pppj.exe 244 dpjdv.exe 3912 nnnhhh.exe 1620 thbbtn.exe 3896 rxxxxff.exe 4080 ttttnn.exe 1916 vpvvp.exe 1420 lrrlfrl.exe 3344 rxffxff.exe 3712 7jvdv.exe 4972 dpppp.exe 4712 9xfffll.exe 4240 tnnhtb.exe 2752 pvvvv.exe 3528 llffrxl.exe 1116 hhhtnh.exe 5116 vvvvv.exe 1716 5lrrrxx.exe 2156 vvvpp.exe 2596 vdddj.exe 4460 nhtbtb.exe 2404 9vdvp.exe 4836 djjjj.exe 1192 1dppp.exe 4788 frlllrr.exe 4860 xxxxfrr.exe 3292 jjjjj.exe 3356 dpddd.exe 1884 3lffxfx.exe 5056 vjdvv.exe 1592 nthntb.exe 2436 pvdjp.exe 2372 rlffxxr.exe 4480 bhttth.exe 4064 pppjd.exe 2132 3rxrfff.exe 4048 dppdv.exe 4092 lfrlxrl.exe 2692 9dvpj.exe 632 xxxrllf.exe 5052 vvvvp.exe 2536 flrlxrf.exe 3364 hhthtn.exe 1948 pvjdv.exe 452 vpjdv.exe 4360 5rxlrrr.exe 3616 tbtttt.exe 1108 pvvjd.exe 5044 5rfxllr.exe 2024 nbhttb.exe 1472 7tbnbn.exe 3288 jdddv.exe 3280 xxfxrlf.exe 3856 ttthbb.exe 2064 hhbtnh.exe 3200 vvjdv.exe 1268 xfxrrrl.exe 312 3thhbh.exe 3604 jjpjj.exe 1888 rrrrrrr.exe 2972 lrrllrl.exe -
resource yara_rule behavioral2/memory/4844-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-696-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4844 wrote to memory of 1700 4844 8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe 83 PID 4844 wrote to memory of 1700 4844 8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe 83 PID 4844 wrote to memory of 1700 4844 8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe 83 PID 1700 wrote to memory of 3924 1700 hhbttt.exe 84 PID 1700 wrote to memory of 3924 1700 hhbttt.exe 84 PID 1700 wrote to memory of 3924 1700 hhbttt.exe 84 PID 3924 wrote to memory of 4168 3924 lxrllxr.exe 85 PID 3924 wrote to memory of 4168 3924 lxrllxr.exe 85 PID 3924 wrote to memory of 4168 3924 lxrllxr.exe 85 PID 4168 wrote to memory of 4344 4168 nbhbbb.exe 86 PID 4168 wrote to memory of 4344 4168 nbhbbb.exe 86 PID 4168 wrote to memory of 4344 4168 nbhbbb.exe 86 PID 4344 wrote to memory of 244 4344 5pppj.exe 87 PID 4344 wrote to memory of 244 4344 5pppj.exe 87 PID 4344 wrote to memory of 244 4344 5pppj.exe 87 PID 244 wrote to memory of 3912 244 dpjdv.exe 88 PID 244 wrote to memory of 3912 244 dpjdv.exe 88 PID 244 wrote to memory of 3912 244 dpjdv.exe 88 PID 3912 wrote to memory of 1620 3912 nnnhhh.exe 89 PID 3912 wrote to memory of 1620 3912 nnnhhh.exe 89 PID 3912 wrote to memory of 1620 3912 nnnhhh.exe 89 PID 1620 wrote to memory of 3896 1620 thbbtn.exe 90 PID 1620 wrote to memory of 3896 1620 thbbtn.exe 90 PID 1620 wrote to memory of 3896 1620 thbbtn.exe 90 PID 3896 wrote to memory of 4080 3896 rxxxxff.exe 91 PID 3896 wrote to memory of 4080 3896 rxxxxff.exe 91 PID 3896 wrote to memory of 4080 3896 rxxxxff.exe 91 PID 4080 wrote to memory of 1916 4080 ttttnn.exe 92 PID 4080 wrote to memory of 1916 4080 ttttnn.exe 92 PID 4080 wrote to memory of 1916 4080 ttttnn.exe 92 PID 1916 wrote to memory of 1420 1916 vpvvp.exe 93 PID 1916 wrote to memory of 1420 1916 vpvvp.exe 93 PID 1916 wrote to memory of 1420 1916 vpvvp.exe 93 PID 1420 wrote to memory of 3344 1420 lrrlfrl.exe 94 PID 1420 wrote to memory of 3344 1420 lrrlfrl.exe 94 PID 1420 wrote to memory of 3344 1420 lrrlfrl.exe 94 PID 3344 wrote to memory of 3712 3344 rxffxff.exe 95 PID 3344 wrote to memory of 3712 3344 rxffxff.exe 95 PID 3344 wrote to memory of 3712 3344 rxffxff.exe 95 PID 3712 wrote to memory of 4972 3712 7jvdv.exe 96 PID 3712 wrote to memory of 4972 3712 7jvdv.exe 96 PID 3712 wrote to memory of 4972 3712 7jvdv.exe 96 PID 4972 wrote to memory of 4712 4972 dpppp.exe 97 PID 4972 wrote to memory of 4712 4972 dpppp.exe 97 PID 4972 wrote to memory of 4712 4972 dpppp.exe 97 PID 4712 wrote to memory of 4240 4712 9xfffll.exe 98 PID 4712 wrote to memory of 4240 4712 9xfffll.exe 98 PID 4712 wrote to memory of 4240 4712 9xfffll.exe 98 PID 4240 wrote to memory of 2752 4240 tnnhtb.exe 99 PID 4240 wrote to memory of 2752 4240 tnnhtb.exe 99 PID 4240 wrote to memory of 2752 4240 tnnhtb.exe 99 PID 2752 wrote to memory of 3528 2752 pvvvv.exe 100 PID 2752 wrote to memory of 3528 2752 pvvvv.exe 100 PID 2752 wrote to memory of 3528 2752 pvvvv.exe 100 PID 3528 wrote to memory of 1116 3528 llffrxl.exe 101 PID 3528 wrote to memory of 1116 3528 llffrxl.exe 101 PID 3528 wrote to memory of 1116 3528 llffrxl.exe 101 PID 1116 wrote to memory of 5116 1116 hhhtnh.exe 102 PID 1116 wrote to memory of 5116 1116 hhhtnh.exe 102 PID 1116 wrote to memory of 5116 1116 hhhtnh.exe 102 PID 5116 wrote to memory of 1716 5116 vvvvv.exe 103 PID 5116 wrote to memory of 1716 5116 vvvvv.exe 103 PID 5116 wrote to memory of 1716 5116 vvvvv.exe 103 PID 1716 wrote to memory of 2156 1716 5lrrrxx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe"C:\Users\Admin\AppData\Local\Temp\8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\hhbttt.exec:\hhbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\lxrllxr.exec:\lxrllxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\nbhbbb.exec:\nbhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\5pppj.exec:\5pppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\dpjdv.exec:\dpjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\nnnhhh.exec:\nnnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\thbbtn.exec:\thbbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\rxxxxff.exec:\rxxxxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\ttttnn.exec:\ttttnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\vpvvp.exec:\vpvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\lrrlfrl.exec:\lrrlfrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\rxffxff.exec:\rxffxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\7jvdv.exec:\7jvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\dpppp.exec:\dpppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\9xfffll.exec:\9xfffll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\tnnhtb.exec:\tnnhtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\pvvvv.exec:\pvvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\llffrxl.exec:\llffrxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\hhhtnh.exec:\hhhtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\vvvvv.exec:\vvvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\5lrrrxx.exec:\5lrrrxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\vvvpp.exec:\vvvpp.exe23⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vdddj.exec:\vdddj.exe24⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nhtbtb.exec:\nhtbtb.exe25⤵
- Executes dropped EXE
PID:4460 -
\??\c:\9vdvp.exec:\9vdvp.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2404 -
\??\c:\djjjj.exec:\djjjj.exe27⤵
- Executes dropped EXE
PID:4836 -
\??\c:\1dppp.exec:\1dppp.exe28⤵
- Executes dropped EXE
PID:1192 -
\??\c:\frlllrr.exec:\frlllrr.exe29⤵
- Executes dropped EXE
PID:4788 -
\??\c:\xxxxfrr.exec:\xxxxfrr.exe30⤵
- Executes dropped EXE
PID:4860 -
\??\c:\jjjjj.exec:\jjjjj.exe31⤵
- Executes dropped EXE
PID:3292 -
\??\c:\dpddd.exec:\dpddd.exe32⤵
- Executes dropped EXE
PID:3356 -
\??\c:\3lffxfx.exec:\3lffxfx.exe33⤵
- Executes dropped EXE
PID:1884 -
\??\c:\vjdvv.exec:\vjdvv.exe34⤵
- Executes dropped EXE
PID:5056 -
\??\c:\nthntb.exec:\nthntb.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pvdjp.exec:\pvdjp.exe36⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rlffxxr.exec:\rlffxxr.exe37⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bhttth.exec:\bhttth.exe38⤵
- Executes dropped EXE
PID:4480 -
\??\c:\pppjd.exec:\pppjd.exe39⤵
- Executes dropped EXE
PID:4064 -
\??\c:\3rxrfff.exec:\3rxrfff.exe40⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dppdv.exec:\dppdv.exe41⤵
- Executes dropped EXE
PID:4048 -
\??\c:\lfrlxrl.exec:\lfrlxrl.exe42⤵
- Executes dropped EXE
PID:4092 -
\??\c:\9dvpj.exec:\9dvpj.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xxxrllf.exec:\xxxrllf.exe44⤵
- Executes dropped EXE
PID:632 -
\??\c:\vvvvp.exec:\vvvvp.exe45⤵
- Executes dropped EXE
PID:5052 -
\??\c:\flrlxrf.exec:\flrlxrf.exe46⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hhthtn.exec:\hhthtn.exe47⤵
- Executes dropped EXE
PID:3364 -
\??\c:\pvjdv.exec:\pvjdv.exe48⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vpjdv.exec:\vpjdv.exe49⤵
- Executes dropped EXE
PID:452 -
\??\c:\5rxlrrr.exec:\5rxlrrr.exe50⤵
- Executes dropped EXE
PID:4360 -
\??\c:\tbtttt.exec:\tbtttt.exe51⤵
- Executes dropped EXE
PID:3616 -
\??\c:\pvvjd.exec:\pvvjd.exe52⤵
- Executes dropped EXE
PID:1108 -
\??\c:\5rfxllr.exec:\5rfxllr.exe53⤵
- Executes dropped EXE
PID:5044 -
\??\c:\nbhttb.exec:\nbhttb.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\7tbnbn.exec:\7tbnbn.exe55⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jdddv.exec:\jdddv.exe56⤵
- Executes dropped EXE
PID:3288 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe57⤵
- Executes dropped EXE
PID:3280 -
\??\c:\ttthbb.exec:\ttthbb.exe58⤵
- Executes dropped EXE
PID:3856 -
\??\c:\hhbtnh.exec:\hhbtnh.exe59⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vvjdv.exec:\vvjdv.exe60⤵
- Executes dropped EXE
PID:3200 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe61⤵
- Executes dropped EXE
PID:1268 -
\??\c:\3thhbh.exec:\3thhbh.exe62⤵
- Executes dropped EXE
PID:312 -
\??\c:\jjpjj.exec:\jjpjj.exe63⤵
- Executes dropped EXE
PID:3604 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe64⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lrrllrl.exec:\lrrllrl.exe65⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hhbtnn.exec:\hhbtnn.exe66⤵PID:4080
-
\??\c:\ddvpj.exec:\ddvpj.exe67⤵PID:448
-
\??\c:\xflxfxx.exec:\xflxfxx.exe68⤵PID:1796
-
\??\c:\lxrrllf.exec:\lxrrllf.exe69⤵PID:4640
-
\??\c:\nbbthh.exec:\nbbthh.exe70⤵PID:1088
-
\??\c:\3vpjd.exec:\3vpjd.exe71⤵PID:4920
-
\??\c:\9rxfxlf.exec:\9rxfxlf.exe72⤵PID:396
-
\??\c:\rrllffx.exec:\rrllffx.exe73⤵PID:4564
-
\??\c:\5bbtnn.exec:\5bbtnn.exe74⤵PID:1020
-
\??\c:\jdddd.exec:\jdddd.exe75⤵PID:3532
-
\??\c:\lxffxxf.exec:\lxffxxf.exe76⤵PID:1116
-
\??\c:\nhnhhh.exec:\nhnhhh.exe77⤵PID:1488
-
\??\c:\vvvpj.exec:\vvvpj.exe78⤵PID:4532
-
\??\c:\rxrrlrr.exec:\rxrrlrr.exe79⤵PID:4100
-
\??\c:\hbhhht.exec:\hbhhht.exe80⤵PID:2768
-
\??\c:\pjpjd.exec:\pjpjd.exe81⤵PID:1716
-
\??\c:\9rrlflx.exec:\9rrlflx.exe82⤵PID:228
-
\??\c:\xrlllff.exec:\xrlllff.exe83⤵PID:1928
-
\??\c:\bbtttt.exec:\bbtttt.exe84⤵PID:3500
-
\??\c:\pppjd.exec:\pppjd.exe85⤵PID:3580
-
\??\c:\fxllffx.exec:\fxllffx.exe86⤵PID:3780
-
\??\c:\5hhhnt.exec:\5hhhnt.exe87⤵PID:4836
-
\??\c:\ppdpj.exec:\ppdpj.exe88⤵PID:2956
-
\??\c:\fllrrxl.exec:\fllrrxl.exe89⤵PID:5100
-
\??\c:\9bhtnh.exec:\9bhtnh.exe90⤵PID:2368
-
\??\c:\dvpjj.exec:\dvpjj.exe91⤵PID:1076
-
\??\c:\jjpjj.exec:\jjpjj.exe92⤵PID:4296
-
\??\c:\3rllffx.exec:\3rllffx.exe93⤵PID:4488
-
\??\c:\tbhtbb.exec:\tbhtbb.exe94⤵PID:5008
-
\??\c:\jpddp.exec:\jpddp.exe95⤵PID:4468
-
\??\c:\5rrllrl.exec:\5rrllrl.exe96⤵PID:1688
-
\??\c:\hhnhbb.exec:\hhnhbb.exe97⤵PID:1484
-
\??\c:\ddvpp.exec:\ddvpp.exe98⤵PID:4060
-
\??\c:\5xrlffx.exec:\5xrlffx.exe99⤵PID:368
-
\??\c:\bhhbtt.exec:\bhhbtt.exe100⤵PID:2576
-
\??\c:\tbttnt.exec:\tbttnt.exe101⤵PID:4028
-
\??\c:\jjddj.exec:\jjddj.exe102⤵PID:3800
-
\??\c:\xxfflll.exec:\xxfflll.exe103⤵PID:432
-
\??\c:\7nnhbb.exec:\7nnhbb.exe104⤵PID:3136
-
\??\c:\jdppj.exec:\jdppj.exe105⤵PID:4092
-
\??\c:\7flfxff.exec:\7flfxff.exe106⤵PID:2692
-
\??\c:\xxffxff.exec:\xxffxff.exe107⤵PID:3648
-
\??\c:\btbtbb.exec:\btbtbb.exe108⤵PID:220
-
\??\c:\dddpj.exec:\dddpj.exe109⤵PID:1180
-
\??\c:\rrfxxxl.exec:\rrfxxxl.exe110⤵PID:32
-
\??\c:\9nnhhh.exec:\9nnhhh.exe111⤵PID:4756
-
\??\c:\htttbh.exec:\htttbh.exe112⤵PID:4420
-
\??\c:\ddjjj.exec:\ddjjj.exe113⤵PID:4356
-
\??\c:\5rfxffx.exec:\5rfxffx.exe114⤵PID:628
-
\??\c:\hbbbtb.exec:\hbbbtb.exe115⤵PID:4548
-
\??\c:\1vpjj.exec:\1vpjj.exe116⤵PID:2724
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe117⤵PID:4864
-
\??\c:\hbbbbb.exec:\hbbbbb.exe118⤵PID:3188
-
\??\c:\3bhhnb.exec:\3bhhnb.exe119⤵PID:4344
-
\??\c:\djpjj.exec:\djpjj.exe120⤵PID:3240
-
\??\c:\xlllxxf.exec:\xlllxxf.exe121⤵PID:3304
-
\??\c:\hnhbtt.exec:\hnhbtt.exe122⤵PID:4232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-