Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 14:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe
-
Size
454KB
-
MD5
72da5e94ffea238f686807b1cb7d58e0
-
SHA1
f97dfa238ec70d8262d3e4bef105db3ccd33d17d
-
SHA256
88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4caf
-
SHA512
2653cfaaa075313ed4c3815f8bfd0ee1127646c5115cc1255788455aa63f906669860789f35f26c81ef2a60e3751a1d56217c5258291c0e26228e60d8b36aade
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD9:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/516-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-1005-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-1155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-1292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-1966-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3216 5ffxrrl.exe 644 xfxrrrr.exe 4328 3bhhhh.exe 1356 llxxrrr.exe 4784 nthhbh.exe 796 1rxxxrr.exe 5004 dpvvp.exe 2992 7nnhhn.exe 4280 5pjdd.exe 3144 9dddd.exe 5040 bthhhh.exe 1792 dpvjd.exe 3316 ttnnhn.exe 4468 dvvpj.exe 1672 xfllfxr.exe 3380 bhhbtt.exe 2836 ddddd.exe 4988 bthbbb.exe 4240 vpvpj.exe 1056 9lfxxxx.exe 1040 jpjjd.exe 4696 xxxxxxr.exe 4320 tbbtnt.exe 1248 thbnnh.exe 4920 htbbtb.exe 2256 lxfxxxf.exe 4416 tbtntn.exe 4632 jvddv.exe 3660 7xxxxfx.exe 4356 9flllxx.exe 1560 nbhbbt.exe 3692 hbtbnh.exe 2100 xlxxxxx.exe 2844 ffrrflr.exe 4172 hhhhhh.exe 4612 jppjd.exe 1212 3xxxxll.exe 5092 3vvpp.exe 4208 5rrrlfx.exe 1180 rlrxrrl.exe 2292 thnbbt.exe 4220 vdpjp.exe 4384 rlrrrrr.exe 2780 9bhhhh.exe 2468 jjjjj.exe 1036 jpjjj.exe 5044 9rxxffx.exe 3832 tnnhhn.exe 4340 jjdjv.exe 4288 xflffff.exe 4844 1lxrrrl.exe 516 nthnbh.exe 2520 djppp.exe 3148 7lrxxff.exe 4548 3bbbbh.exe 2540 9nnnnn.exe 1952 7pppj.exe 3556 7rlllrr.exe 3520 bhntht.exe 4500 hhbbbh.exe 2992 vpddd.exe 1944 3xrxflf.exe 2892 flllflf.exe 624 tbbttb.exe -
resource yara_rule behavioral2/memory/516-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-1005-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 516 wrote to memory of 3216 516 88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe 83 PID 516 wrote to memory of 3216 516 88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe 83 PID 516 wrote to memory of 3216 516 88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe 83 PID 3216 wrote to memory of 644 3216 5ffxrrl.exe 84 PID 3216 wrote to memory of 644 3216 5ffxrrl.exe 84 PID 3216 wrote to memory of 644 3216 5ffxrrl.exe 84 PID 644 wrote to memory of 4328 644 xfxrrrr.exe 85 PID 644 wrote to memory of 4328 644 xfxrrrr.exe 85 PID 644 wrote to memory of 4328 644 xfxrrrr.exe 85 PID 4328 wrote to memory of 1356 4328 3bhhhh.exe 86 PID 4328 wrote to memory of 1356 4328 3bhhhh.exe 86 PID 4328 wrote to memory of 1356 4328 3bhhhh.exe 86 PID 1356 wrote to memory of 4784 1356 llxxrrr.exe 87 PID 1356 wrote to memory of 4784 1356 llxxrrr.exe 87 PID 1356 wrote to memory of 4784 1356 llxxrrr.exe 87 PID 4784 wrote to memory of 796 4784 nthhbh.exe 88 PID 4784 wrote to memory of 796 4784 nthhbh.exe 88 PID 4784 wrote to memory of 796 4784 nthhbh.exe 88 PID 796 wrote to memory of 5004 796 1rxxxrr.exe 89 PID 796 wrote to memory of 5004 796 1rxxxrr.exe 89 PID 796 wrote to memory of 5004 796 1rxxxrr.exe 89 PID 5004 wrote to memory of 2992 5004 dpvvp.exe 90 PID 5004 wrote to memory of 2992 5004 dpvvp.exe 90 PID 5004 wrote to memory of 2992 5004 dpvvp.exe 90 PID 2992 wrote to memory of 4280 2992 7nnhhn.exe 91 PID 2992 wrote to memory of 4280 2992 7nnhhn.exe 91 PID 2992 wrote to memory of 4280 2992 7nnhhn.exe 91 PID 4280 wrote to memory of 3144 4280 5pjdd.exe 92 PID 4280 wrote to memory of 3144 4280 5pjdd.exe 92 PID 4280 wrote to memory of 3144 4280 5pjdd.exe 92 PID 3144 wrote to memory of 5040 3144 9dddd.exe 93 PID 3144 wrote to memory of 5040 3144 9dddd.exe 93 PID 3144 wrote to memory of 5040 3144 9dddd.exe 93 PID 5040 wrote to memory of 1792 5040 bthhhh.exe 94 PID 5040 wrote to memory of 1792 5040 bthhhh.exe 94 PID 5040 wrote to memory of 1792 5040 bthhhh.exe 94 PID 1792 wrote to memory of 3316 1792 dpvjd.exe 95 PID 1792 wrote to memory of 3316 1792 dpvjd.exe 95 PID 1792 wrote to memory of 3316 1792 dpvjd.exe 95 PID 3316 wrote to memory of 4468 3316 ttnnhn.exe 96 PID 3316 wrote to memory of 4468 3316 ttnnhn.exe 96 PID 3316 wrote to memory of 4468 3316 ttnnhn.exe 96 PID 4468 wrote to memory of 1672 4468 dvvpj.exe 97 PID 4468 wrote to memory of 1672 4468 dvvpj.exe 97 PID 4468 wrote to memory of 1672 4468 dvvpj.exe 97 PID 1672 wrote to memory of 3380 1672 xfllfxr.exe 98 PID 1672 wrote to memory of 3380 1672 xfllfxr.exe 98 PID 1672 wrote to memory of 3380 1672 xfllfxr.exe 98 PID 3380 wrote to memory of 2836 3380 bhhbtt.exe 99 PID 3380 wrote to memory of 2836 3380 bhhbtt.exe 99 PID 3380 wrote to memory of 2836 3380 bhhbtt.exe 99 PID 2836 wrote to memory of 4988 2836 ddddd.exe 100 PID 2836 wrote to memory of 4988 2836 ddddd.exe 100 PID 2836 wrote to memory of 4988 2836 ddddd.exe 100 PID 4988 wrote to memory of 4240 4988 bthbbb.exe 101 PID 4988 wrote to memory of 4240 4988 bthbbb.exe 101 PID 4988 wrote to memory of 4240 4988 bthbbb.exe 101 PID 4240 wrote to memory of 1056 4240 vpvpj.exe 102 PID 4240 wrote to memory of 1056 4240 vpvpj.exe 102 PID 4240 wrote to memory of 1056 4240 vpvpj.exe 102 PID 1056 wrote to memory of 1040 1056 9lfxxxx.exe 103 PID 1056 wrote to memory of 1040 1056 9lfxxxx.exe 103 PID 1056 wrote to memory of 1040 1056 9lfxxxx.exe 103 PID 1040 wrote to memory of 4696 1040 jpjjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe"C:\Users\Admin\AppData\Local\Temp\88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\5ffxrrl.exec:\5ffxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\xfxrrrr.exec:\xfxrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\3bhhhh.exec:\3bhhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\llxxrrr.exec:\llxxrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\nthhbh.exec:\nthhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\1rxxxrr.exec:\1rxxxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\dpvvp.exec:\dpvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\7nnhhn.exec:\7nnhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\5pjdd.exec:\5pjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\9dddd.exec:\9dddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\bthhhh.exec:\bthhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\dpvjd.exec:\dpvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\ttnnhn.exec:\ttnnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\dvvpj.exec:\dvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\xfllfxr.exec:\xfllfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\bhhbtt.exec:\bhhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\ddddd.exec:\ddddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\bthbbb.exec:\bthbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\vpvpj.exec:\vpvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\9lfxxxx.exec:\9lfxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\jpjjd.exec:\jpjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\xxxxxxr.exec:\xxxxxxr.exe23⤵
- Executes dropped EXE
PID:4696 -
\??\c:\tbbtnt.exec:\tbbtnt.exe24⤵
- Executes dropped EXE
PID:4320 -
\??\c:\thbnnh.exec:\thbnnh.exe25⤵
- Executes dropped EXE
PID:1248 -
\??\c:\htbbtb.exec:\htbbtb.exe26⤵
- Executes dropped EXE
PID:4920 -
\??\c:\lxfxxxf.exec:\lxfxxxf.exe27⤵
- Executes dropped EXE
PID:2256 -
\??\c:\tbtntn.exec:\tbtntn.exe28⤵
- Executes dropped EXE
PID:4416 -
\??\c:\jvddv.exec:\jvddv.exe29⤵
- Executes dropped EXE
PID:4632 -
\??\c:\7xxxxfx.exec:\7xxxxfx.exe30⤵
- Executes dropped EXE
PID:3660 -
\??\c:\9flllxx.exec:\9flllxx.exe31⤵
- Executes dropped EXE
PID:4356 -
\??\c:\nbhbbt.exec:\nbhbbt.exe32⤵
- Executes dropped EXE
PID:1560 -
\??\c:\hbtbnh.exec:\hbtbnh.exe33⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe34⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ffrrflr.exec:\ffrrflr.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hhhhhh.exec:\hhhhhh.exe36⤵
- Executes dropped EXE
PID:4172 -
\??\c:\jppjd.exec:\jppjd.exe37⤵
- Executes dropped EXE
PID:4612 -
\??\c:\3xxxxll.exec:\3xxxxll.exe38⤵
- Executes dropped EXE
PID:1212 -
\??\c:\3vvpp.exec:\3vvpp.exe39⤵
- Executes dropped EXE
PID:5092 -
\??\c:\5rrrlfx.exec:\5rrrlfx.exe40⤵
- Executes dropped EXE
PID:4208 -
\??\c:\rlrxrrl.exec:\rlrxrrl.exe41⤵
- Executes dropped EXE
PID:1180 -
\??\c:\thnbbt.exec:\thnbbt.exe42⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vdpjp.exec:\vdpjp.exe43⤵
- Executes dropped EXE
PID:4220 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe44⤵
- Executes dropped EXE
PID:4384 -
\??\c:\9bhhhh.exec:\9bhhhh.exe45⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jjjjj.exec:\jjjjj.exe46⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jpjjj.exec:\jpjjj.exe47⤵
- Executes dropped EXE
PID:1036 -
\??\c:\9rxxffx.exec:\9rxxffx.exe48⤵
- Executes dropped EXE
PID:5044 -
\??\c:\tnnhhn.exec:\tnnhhn.exe49⤵
- Executes dropped EXE
PID:3832 -
\??\c:\jjdjv.exec:\jjdjv.exe50⤵
- Executes dropped EXE
PID:4340 -
\??\c:\xflffff.exec:\xflffff.exe51⤵
- Executes dropped EXE
PID:4288 -
\??\c:\1lxrrrl.exec:\1lxrrrl.exe52⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nthnbh.exec:\nthnbh.exe53⤵
- Executes dropped EXE
PID:516 -
\??\c:\djppp.exec:\djppp.exe54⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7lrxxff.exec:\7lrxxff.exe55⤵
- Executes dropped EXE
PID:3148 -
\??\c:\3bbbbh.exec:\3bbbbh.exe56⤵
- Executes dropped EXE
PID:4548 -
\??\c:\9nnnnn.exec:\9nnnnn.exe57⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7pppj.exec:\7pppj.exe58⤵
- Executes dropped EXE
PID:1952 -
\??\c:\7rlllrr.exec:\7rlllrr.exe59⤵
- Executes dropped EXE
PID:3556 -
\??\c:\bhntht.exec:\bhntht.exe60⤵
- Executes dropped EXE
PID:3520 -
\??\c:\hhbbbh.exec:\hhbbbh.exe61⤵
- Executes dropped EXE
PID:4500 -
\??\c:\vpddd.exec:\vpddd.exe62⤵
- Executes dropped EXE
PID:2992 -
\??\c:\3xrxflf.exec:\3xrxflf.exe63⤵
- Executes dropped EXE
PID:1944 -
\??\c:\flllflf.exec:\flllflf.exe64⤵
- Executes dropped EXE
PID:2892 -
\??\c:\tbbttb.exec:\tbbttb.exe65⤵
- Executes dropped EXE
PID:624 -
\??\c:\dddpp.exec:\dddpp.exe66⤵PID:5088
-
\??\c:\9llxrxx.exec:\9llxrxx.exe67⤵PID:5032
-
\??\c:\5hnnnt.exec:\5hnnnt.exe68⤵PID:4856
-
\??\c:\vpjvd.exec:\vpjvd.exe69⤵PID:1872
-
\??\c:\1dddv.exec:\1dddv.exe70⤵PID:60
-
\??\c:\rxllfrr.exec:\rxllfrr.exe71⤵PID:3112
-
\??\c:\tbbbbb.exec:\tbbbbb.exe72⤵PID:1148
-
\??\c:\ttbntb.exec:\ttbntb.exe73⤵PID:4804
-
\??\c:\vjjjj.exec:\vjjjj.exe74⤵PID:3228
-
\??\c:\ffllllf.exec:\ffllllf.exe75⤵PID:3592
-
\??\c:\bbttnn.exec:\bbttnn.exe76⤵PID:648
-
\??\c:\dpdvv.exec:\dpdvv.exe77⤵PID:3036
-
\??\c:\dvvvv.exec:\dvvvv.exe78⤵PID:4808
-
\??\c:\7fllfll.exec:\7fllfll.exe79⤵PID:1448
-
\??\c:\btttnn.exec:\btttnn.exe80⤵PID:3624
-
\??\c:\3jjjj.exec:\3jjjj.exe81⤵PID:1800
-
\??\c:\rlrllll.exec:\rlrllll.exe82⤵PID:376
-
\??\c:\7hnnhb.exec:\7hnnhb.exe83⤵PID:932
-
\??\c:\nbbbbb.exec:\nbbbbb.exe84⤵
- System Location Discovery: System Language Discovery
PID:2428 -
\??\c:\7pppj.exec:\7pppj.exe85⤵PID:1164
-
\??\c:\7rffxll.exec:\7rffxll.exe86⤵PID:936
-
\??\c:\9hhhbn.exec:\9hhhbn.exe87⤵PID:4920
-
\??\c:\ddppp.exec:\ddppp.exe88⤵PID:1124
-
\??\c:\pjjjd.exec:\pjjjd.exe89⤵PID:4900
-
\??\c:\lrrllrl.exec:\lrrllrl.exe90⤵PID:3188
-
\??\c:\ttbbhh.exec:\ttbbhh.exe91⤵PID:736
-
\??\c:\jdjjd.exec:\jdjjd.exe92⤵PID:1480
-
\??\c:\1rllffr.exec:\1rllffr.exe93⤵PID:4972
-
\??\c:\frxrrrr.exec:\frxrrrr.exe94⤵PID:1876
-
\??\c:\thbhbh.exec:\thbhbh.exe95⤵PID:1560
-
\??\c:\dpddv.exec:\dpddv.exe96⤵PID:2200
-
\??\c:\9xfxxxx.exec:\9xfxxxx.exe97⤵PID:3732
-
\??\c:\lfllffx.exec:\lfllffx.exe98⤵PID:4204
-
\??\c:\nntnnt.exec:\nntnnt.exe99⤵PID:2084
-
\??\c:\jvddj.exec:\jvddj.exe100⤵PID:632
-
\??\c:\1pvdp.exec:\1pvdp.exe101⤵PID:4612
-
\??\c:\flrrxxf.exec:\flrrxxf.exe102⤵PID:1212
-
\??\c:\bnttnn.exec:\bnttnn.exe103⤵
- System Location Discovery: System Language Discovery
PID:5092 -
\??\c:\vpppv.exec:\vpppv.exe104⤵PID:3256
-
\??\c:\rxrlfxx.exec:\rxrlfxx.exe105⤵PID:3744
-
\??\c:\3xlfrrr.exec:\3xlfrrr.exe106⤵PID:4684
-
\??\c:\9thhtb.exec:\9thhtb.exe107⤵PID:3988
-
\??\c:\pvddv.exec:\pvddv.exe108⤵PID:1000
-
\??\c:\5rrrlll.exec:\5rrrlll.exe109⤵PID:3124
-
\??\c:\rrxxrxf.exec:\rrxxrxf.exe110⤵PID:3076
-
\??\c:\tttttt.exec:\tttttt.exe111⤵PID:1036
-
\??\c:\jjjdd.exec:\jjjdd.exe112⤵PID:2396
-
\??\c:\7fxxrxr.exec:\7fxxrxr.exe113⤵PID:4344
-
\??\c:\flllffx.exec:\flllffx.exe114⤵PID:212
-
\??\c:\htnnnt.exec:\htnnnt.exe115⤵PID:3728
-
\??\c:\pdppj.exec:\pdppj.exe116⤵PID:1768
-
\??\c:\7llffff.exec:\7llffff.exe117⤵PID:2276
-
\??\c:\tbbbbh.exec:\tbbbbh.exe118⤵PID:3412
-
\??\c:\pjvpp.exec:\pjvpp.exe119⤵PID:4884
-
\??\c:\lfllflf.exec:\lfllflf.exe120⤵PID:1440
-
\??\c:\5flfffl.exec:\5flfffl.exe121⤵PID:880
-
\??\c:\bttttt.exec:\bttttt.exe122⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-