Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 15:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28857db9ea15c7fa96e023a0735b15b8dcca8cb5b4219a6654ea32317cc9a75aN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
28857db9ea15c7fa96e023a0735b15b8dcca8cb5b4219a6654ea32317cc9a75aN.exe
-
Size
454KB
-
MD5
2b8ef14060fa6028f98ee553bf7f6270
-
SHA1
a45dcc008dc5467cb8f4f8e6690886dc9689e1a5
-
SHA256
28857db9ea15c7fa96e023a0735b15b8dcca8cb5b4219a6654ea32317cc9a75a
-
SHA512
25943d7430bd5ca39d8fe88b9d8ef97c9863b43bbb12022d000c3c96257a2648fc8d19cf8f6912a693a281a7496cd5b66e13689c0adc5ac0c3db6e358ffa8f1f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5008-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/984-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-1187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-1194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-1223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1712 rllffxr.exe 4800 bbbhtb.exe 3064 fflfxrl.exe 3432 hnhttb.exe 984 xfxrrll.exe 2316 xxrrfxf.exe 2776 djvjd.exe 1616 vjpjd.exe 4336 lxfxllf.exe 3680 9hbtnh.exe 2580 jdpjj.exe 3516 7xfrlfx.exe 2544 nbhbbt.exe 2828 nhhbnh.exe 2680 7tbnnh.exe 668 bhbnbt.exe 4820 jjjvp.exe 4752 7xrfxrx.exe 1804 3tttnh.exe 3256 pvpjv.exe 4216 lflxrlx.exe 3416 hhnbnb.exe 3188 pvvjv.exe 2440 xrlfrlf.exe 2584 7hbthb.exe 3080 dpvjv.exe 4736 lrlfrll.exe 2844 3ttnbt.exe 516 1jdpd.exe 2976 jvvjj.exe 3952 rlfxlfr.exe 644 thtnbb.exe 440 vpvjj.exe 4956 3rlxllx.exe 4908 thhbnh.exe 1980 jjdpj.exe 4064 jvpvj.exe 684 xxxlxxr.exe 3652 tttnbb.exe 852 tbbthh.exe 4844 9pdpd.exe 3936 jjpdv.exe 3616 fllxlfr.exe 1072 5tnbnn.exe 2500 bbbnnb.exe 3044 7ppjd.exe 2136 rfrlffx.exe 224 1flfxxx.exe 4576 hbhnnh.exe 856 7jjvd.exe 5048 5dvjv.exe 3036 frxlxrl.exe 1292 xxlfrlf.exe 4528 thhbtt.exe 672 thnhbt.exe 3940 vjvpj.exe 3260 lfrrffl.exe 544 3hbthh.exe 3016 vjdpp.exe 2008 5flxlfr.exe 4124 thhbtn.exe 3680 thhthh.exe 1392 nnntnt.exe 2460 5ddvj.exe -
resource yara_rule behavioral2/memory/1712-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/984-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-592-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5008 wrote to memory of 1712 5008 28857db9ea15c7fa96e023a0735b15b8dcca8cb5b4219a6654ea32317cc9a75aN.exe 84 PID 5008 wrote to memory of 1712 5008 28857db9ea15c7fa96e023a0735b15b8dcca8cb5b4219a6654ea32317cc9a75aN.exe 84 PID 5008 wrote to memory of 1712 5008 28857db9ea15c7fa96e023a0735b15b8dcca8cb5b4219a6654ea32317cc9a75aN.exe 84 PID 1712 wrote to memory of 4800 1712 rllffxr.exe 85 PID 1712 wrote to memory of 4800 1712 rllffxr.exe 85 PID 1712 wrote to memory of 4800 1712 rllffxr.exe 85 PID 4800 wrote to memory of 3064 4800 bbbhtb.exe 86 PID 4800 wrote to memory of 3064 4800 bbbhtb.exe 86 PID 4800 wrote to memory of 3064 4800 bbbhtb.exe 86 PID 3064 wrote to memory of 3432 3064 fflfxrl.exe 87 PID 3064 wrote to memory of 3432 3064 fflfxrl.exe 87 PID 3064 wrote to memory of 3432 3064 fflfxrl.exe 87 PID 3432 wrote to memory of 984 3432 hnhttb.exe 88 PID 3432 wrote to memory of 984 3432 hnhttb.exe 88 PID 3432 wrote to memory of 984 3432 hnhttb.exe 88 PID 984 wrote to memory of 2316 984 xfxrrll.exe 89 PID 984 wrote to memory of 2316 984 xfxrrll.exe 89 PID 984 wrote to memory of 2316 984 xfxrrll.exe 89 PID 2316 wrote to memory of 2776 2316 xxrrfxf.exe 90 PID 2316 wrote to memory of 2776 2316 xxrrfxf.exe 90 PID 2316 wrote to memory of 2776 2316 xxrrfxf.exe 90 PID 2776 wrote to memory of 1616 2776 djvjd.exe 91 PID 2776 wrote to memory of 1616 2776 djvjd.exe 91 PID 2776 wrote to memory of 1616 2776 djvjd.exe 91 PID 1616 wrote to memory of 4336 1616 vjpjd.exe 92 PID 1616 wrote to memory of 4336 1616 vjpjd.exe 92 PID 1616 wrote to memory of 4336 1616 vjpjd.exe 92 PID 4336 wrote to memory of 3680 4336 lxfxllf.exe 145 PID 4336 wrote to memory of 3680 4336 lxfxllf.exe 145 PID 4336 wrote to memory of 3680 4336 lxfxllf.exe 145 PID 3680 wrote to memory of 2580 3680 9hbtnh.exe 94 PID 3680 wrote to memory of 2580 3680 9hbtnh.exe 94 PID 3680 wrote to memory of 2580 3680 9hbtnh.exe 94 PID 2580 wrote to memory of 3516 2580 jdpjj.exe 95 PID 2580 wrote to memory of 3516 2580 jdpjj.exe 95 PID 2580 wrote to memory of 3516 2580 jdpjj.exe 95 PID 3516 wrote to memory of 2544 3516 7xfrlfx.exe 96 PID 3516 wrote to memory of 2544 3516 7xfrlfx.exe 96 PID 3516 wrote to memory of 2544 3516 7xfrlfx.exe 96 PID 2544 wrote to memory of 2828 2544 nbhbbt.exe 97 PID 2544 wrote to memory of 2828 2544 nbhbbt.exe 97 PID 2544 wrote to memory of 2828 2544 nbhbbt.exe 97 PID 2828 wrote to memory of 2680 2828 nhhbnh.exe 98 PID 2828 wrote to memory of 2680 2828 nhhbnh.exe 98 PID 2828 wrote to memory of 2680 2828 nhhbnh.exe 98 PID 2680 wrote to memory of 668 2680 7tbnnh.exe 99 PID 2680 wrote to memory of 668 2680 7tbnnh.exe 99 PID 2680 wrote to memory of 668 2680 7tbnnh.exe 99 PID 668 wrote to memory of 4820 668 bhbnbt.exe 100 PID 668 wrote to memory of 4820 668 bhbnbt.exe 100 PID 668 wrote to memory of 4820 668 bhbnbt.exe 100 PID 4820 wrote to memory of 4752 4820 jjjvp.exe 101 PID 4820 wrote to memory of 4752 4820 jjjvp.exe 101 PID 4820 wrote to memory of 4752 4820 jjjvp.exe 101 PID 4752 wrote to memory of 1804 4752 7xrfxrx.exe 102 PID 4752 wrote to memory of 1804 4752 7xrfxrx.exe 102 PID 4752 wrote to memory of 1804 4752 7xrfxrx.exe 102 PID 1804 wrote to memory of 3256 1804 3tttnh.exe 103 PID 1804 wrote to memory of 3256 1804 3tttnh.exe 103 PID 1804 wrote to memory of 3256 1804 3tttnh.exe 103 PID 3256 wrote to memory of 4216 3256 pvpjv.exe 104 PID 3256 wrote to memory of 4216 3256 pvpjv.exe 104 PID 3256 wrote to memory of 4216 3256 pvpjv.exe 104 PID 4216 wrote to memory of 3416 4216 lflxrlx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\28857db9ea15c7fa96e023a0735b15b8dcca8cb5b4219a6654ea32317cc9a75aN.exe"C:\Users\Admin\AppData\Local\Temp\28857db9ea15c7fa96e023a0735b15b8dcca8cb5b4219a6654ea32317cc9a75aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\rllffxr.exec:\rllffxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\bbbhtb.exec:\bbbhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\fflfxrl.exec:\fflfxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hnhttb.exec:\hnhttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\xfxrrll.exec:\xfxrrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\xxrrfxf.exec:\xxrrfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\djvjd.exec:\djvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vjpjd.exec:\vjpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\lxfxllf.exec:\lxfxllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\9hbtnh.exec:\9hbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\jdpjj.exec:\jdpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\7xfrlfx.exec:\7xfrlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\nbhbbt.exec:\nbhbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\nhhbnh.exec:\nhhbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\7tbnnh.exec:\7tbnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bhbnbt.exec:\bhbnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\jjjvp.exec:\jjjvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\7xrfxrx.exec:\7xrfxrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\3tttnh.exec:\3tttnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\pvpjv.exec:\pvpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\lflxrlx.exec:\lflxrlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\hhnbnb.exec:\hhnbnb.exe23⤵
- Executes dropped EXE
PID:3416 -
\??\c:\pvvjv.exec:\pvvjv.exe24⤵
- Executes dropped EXE
PID:3188 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe25⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7hbthb.exec:\7hbthb.exe26⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpvjv.exec:\dpvjv.exe27⤵
- Executes dropped EXE
PID:3080 -
\??\c:\lrlfrll.exec:\lrlfrll.exe28⤵
- Executes dropped EXE
PID:4736 -
\??\c:\3ttnbt.exec:\3ttnbt.exe29⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1jdpd.exec:\1jdpd.exe30⤵
- Executes dropped EXE
PID:516 -
\??\c:\jvvjj.exec:\jvvjj.exe31⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe32⤵
- Executes dropped EXE
PID:3952 -
\??\c:\thtnbb.exec:\thtnbb.exe33⤵
- Executes dropped EXE
PID:644 -
\??\c:\vpvjj.exec:\vpvjj.exe34⤵
- Executes dropped EXE
PID:440 -
\??\c:\3rlxllx.exec:\3rlxllx.exe35⤵
- Executes dropped EXE
PID:4956 -
\??\c:\thhbnh.exec:\thhbnh.exe36⤵
- Executes dropped EXE
PID:4908 -
\??\c:\jjdpj.exec:\jjdpj.exe37⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jvpvj.exec:\jvpvj.exe38⤵
- Executes dropped EXE
PID:4064 -
\??\c:\xxxlxxr.exec:\xxxlxxr.exe39⤵
- Executes dropped EXE
PID:684 -
\??\c:\tttnbb.exec:\tttnbb.exe40⤵
- Executes dropped EXE
PID:3652 -
\??\c:\tbbthh.exec:\tbbthh.exe41⤵
- Executes dropped EXE
PID:852 -
\??\c:\9pdpd.exec:\9pdpd.exe42⤵
- Executes dropped EXE
PID:4844 -
\??\c:\jjpdv.exec:\jjpdv.exe43⤵
- Executes dropped EXE
PID:3936 -
\??\c:\fllxlfr.exec:\fllxlfr.exe44⤵
- Executes dropped EXE
PID:3616 -
\??\c:\5tnbnn.exec:\5tnbnn.exe45⤵
- Executes dropped EXE
PID:1072 -
\??\c:\bbbnnb.exec:\bbbnnb.exe46⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7ppjd.exec:\7ppjd.exe47⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rfrlffx.exec:\rfrlffx.exe48⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1flfxxx.exec:\1flfxxx.exe49⤵
- Executes dropped EXE
PID:224 -
\??\c:\hbhnnh.exec:\hbhnnh.exe50⤵
- Executes dropped EXE
PID:4576 -
\??\c:\7jjvd.exec:\7jjvd.exe51⤵
- Executes dropped EXE
PID:856 -
\??\c:\5dvjv.exec:\5dvjv.exe52⤵
- Executes dropped EXE
PID:5048 -
\??\c:\frxlxrl.exec:\frxlxrl.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xxlfrlf.exec:\xxlfrlf.exe54⤵
- Executes dropped EXE
PID:1292 -
\??\c:\thhbtt.exec:\thhbtt.exe55⤵
- Executes dropped EXE
PID:4528 -
\??\c:\thnhbt.exec:\thnhbt.exe56⤵
- Executes dropped EXE
PID:672 -
\??\c:\vjvpj.exec:\vjvpj.exe57⤵
- Executes dropped EXE
PID:3940 -
\??\c:\lfrrffl.exec:\lfrrffl.exe58⤵
- Executes dropped EXE
PID:3260 -
\??\c:\3hbthh.exec:\3hbthh.exe59⤵
- Executes dropped EXE
PID:544 -
\??\c:\vjdpp.exec:\vjdpp.exe60⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5flxlfr.exec:\5flxlfr.exe61⤵
- Executes dropped EXE
PID:2008 -
\??\c:\thhbtn.exec:\thhbtn.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4124 -
\??\c:\thhthh.exec:\thhthh.exe63⤵
- Executes dropped EXE
PID:3680 -
\??\c:\nnntnt.exec:\nnntnt.exe64⤵
- Executes dropped EXE
PID:1392 -
\??\c:\5ddvj.exec:\5ddvj.exe65⤵
- Executes dropped EXE
PID:2460 -
\??\c:\ntbhhb.exec:\ntbhhb.exe66⤵PID:3600
-
\??\c:\flxrffx.exec:\flxrffx.exe67⤵PID:2544
-
\??\c:\1bhbbb.exec:\1bhbbb.exe68⤵PID:2720
-
\??\c:\dvdpj.exec:\dvdpj.exe69⤵PID:2628
-
\??\c:\3vjvp.exec:\3vjvp.exe70⤵PID:4896
-
\??\c:\rllffxx.exec:\rllffxx.exe71⤵PID:1860
-
\??\c:\1nnhbb.exec:\1nnhbb.exe72⤵PID:2332
-
\??\c:\ppppv.exec:\ppppv.exe73⤵PID:5116
-
\??\c:\xfxlxrx.exec:\xfxlxrx.exe74⤵PID:4556
-
\??\c:\nhhhbh.exec:\nhhhbh.exe75⤵PID:2728
-
\??\c:\bthbtt.exec:\bthbtt.exe76⤵PID:3984
-
\??\c:\9jjdv.exec:\9jjdv.exe77⤵PID:1048
-
\??\c:\fxxrxlf.exec:\fxxrxlf.exe78⤵PID:1716
-
\??\c:\hhnnbh.exec:\hhnnbh.exe79⤵PID:3540
-
\??\c:\5ppdj.exec:\5ppdj.exe80⤵PID:3956
-
\??\c:\frxrrfx.exec:\frxrrfx.exe81⤵PID:3988
-
\??\c:\nhbbtt.exec:\nhbbtt.exe82⤵PID:448
-
\??\c:\3hntth.exec:\3hntth.exe83⤵PID:316
-
\??\c:\ppjvv.exec:\ppjvv.exe84⤵PID:2496
-
\??\c:\rflffff.exec:\rflffff.exe85⤵PID:3080
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe86⤵PID:2516
-
\??\c:\tnnhhh.exec:\tnnhhh.exe87⤵PID:4076
-
\??\c:\jdvpj.exec:\jdvpj.exe88⤵PID:516
-
\??\c:\1frlllf.exec:\1frlllf.exe89⤵PID:2568
-
\??\c:\fffxrrx.exec:\fffxrrx.exe90⤵PID:760
-
\??\c:\ttbntt.exec:\ttbntt.exe91⤵PID:1200
-
\??\c:\vvvpp.exec:\vvvpp.exe92⤵PID:1660
-
\??\c:\dpjdj.exec:\dpjdj.exe93⤵PID:2928
-
\??\c:\lxllxrr.exec:\lxllxrr.exe94⤵PID:2100
-
\??\c:\hbnhht.exec:\hbnhht.exe95⤵PID:4628
-
\??\c:\1nhbtt.exec:\1nhbtt.exe96⤵PID:1280
-
\??\c:\jpvvj.exec:\jpvvj.exe97⤵PID:1484
-
\??\c:\jpjdd.exec:\jpjdd.exe98⤵PID:4204
-
\??\c:\rlrrlll.exec:\rlrrlll.exe99⤵PID:684
-
\??\c:\nnbtbt.exec:\nnbtbt.exe100⤵PID:812
-
\??\c:\ddppv.exec:\ddppv.exe101⤵PID:1268
-
\??\c:\rllrlll.exec:\rllrlll.exe102⤵PID:4360
-
\??\c:\bhnnhh.exec:\bhnnhh.exe103⤵PID:2208
-
\??\c:\nbthtb.exec:\nbthtb.exe104⤵PID:2712
-
\??\c:\9jdjp.exec:\9jdjp.exe105⤵PID:3156
-
\??\c:\9xrlffr.exec:\9xrlffr.exe106⤵PID:4428
-
\??\c:\1nnnhn.exec:\1nnnhn.exe107⤵PID:4404
-
\??\c:\vvjdj.exec:\vvjdj.exe108⤵PID:2252
-
\??\c:\pjdvv.exec:\pjdvv.exe109⤵PID:1544
-
\??\c:\xxxxrff.exec:\xxxxrff.exe110⤵PID:3364
-
\??\c:\9hhbtt.exec:\9hhbtt.exe111⤵PID:3604
-
\??\c:\5vvjd.exec:\5vvjd.exe112⤵PID:856
-
\??\c:\pvvvp.exec:\pvvvp.exe113⤵PID:3024
-
\??\c:\xlxfxrx.exec:\xlxfxrx.exe114⤵PID:4656
-
\??\c:\3tnbbb.exec:\3tnbbb.exe115⤵PID:1704
-
\??\c:\pjjjj.exec:\pjjjj.exe116⤵PID:4116
-
\??\c:\jjpvp.exec:\jjpvp.exe117⤵PID:2576
-
\??\c:\flfxffl.exec:\flfxffl.exe118⤵PID:1880
-
\??\c:\bnbttt.exec:\bnbttt.exe119⤵PID:468
-
\??\c:\nhhnhh.exec:\nhhnhh.exe120⤵PID:5072
-
\??\c:\ddvdv.exec:\ddvdv.exe121⤵PID:904
-
\??\c:\rxllfff.exec:\rxllfff.exe122⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-