Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 16:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe
-
Size
454KB
-
MD5
4a708c5f273a8507099a1ac209af1405
-
SHA1
cd746a14c31b2543c2bf46c1edce499b13e76f85
-
SHA256
3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b
-
SHA512
b2bbbc21a0777896976654489e4a3762fd9fd50c43ce6a540fbb1c97671584a3aaae3d5da7f6e446217fc9d610ac78c41201fc4141354831f4233af85b2e9e86
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4852-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/728-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/324-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-935-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-951-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-979-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-1004-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-1573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-1637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5036 ffrllfx.exe 4028 pjjjj.exe 832 ddddv.exe 4676 tnbbbb.exe 1064 frrrrrr.exe 2940 vvvdd.exe 3448 hnnhbb.exe 2952 rfxrrrr.exe 1776 thnnhn.exe 2908 ddvdv.exe 4924 nnnthh.exe 116 rfllflf.exe 5068 pvppj.exe 3756 9lxrfxx.exe 2628 vdpvv.exe 2140 xlllflf.exe 2428 9ttnnn.exe 1612 jdjjv.exe 728 frlfflr.exe 228 tntttt.exe 732 dvppj.exe 4668 djdvp.exe 4780 rxrllrl.exe 3568 bbbnnn.exe 4424 bnhhbn.exe 1120 ppjjp.exe 3892 fflfflf.exe 4356 ntnhbb.exe 2740 bbbhhn.exe 1916 jjjdv.exe 4104 rrxrllf.exe 4580 5fllrxf.exe 764 tbtnbb.exe 1320 7vpjd.exe 1716 jddvv.exe 4996 llxrllf.exe 4528 tbbnnh.exe 2680 pvvpv.exe 5080 vjppp.exe 3140 ffrlrxr.exe 4296 nntnhh.exe 2604 hbtthh.exe 1944 vddvp.exe 3912 9frlxlf.exe 3248 lxxxxxr.exe 1728 bbttnh.exe 2196 vpppj.exe 4184 rllfxxr.exe 4412 xxfffff.exe 2872 ntntnb.exe 1252 7jddv.exe 4692 flxrfxr.exe 2192 nnhhbb.exe 3648 vddjp.exe 2644 7flffff.exe 4500 thnnnn.exe 4832 pvvjd.exe 1632 fxfllll.exe 3780 tnnbnh.exe 3852 vjjjj.exe 860 ffxlllf.exe 1596 hhnntb.exe 2316 5jdpd.exe 3492 llxrfxl.exe -
resource yara_rule behavioral2/memory/5036-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/728-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/324-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-935-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-951-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 5036 4852 3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe 83 PID 4852 wrote to memory of 5036 4852 3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe 83 PID 4852 wrote to memory of 5036 4852 3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe 83 PID 5036 wrote to memory of 4028 5036 ffrllfx.exe 84 PID 5036 wrote to memory of 4028 5036 ffrllfx.exe 84 PID 5036 wrote to memory of 4028 5036 ffrllfx.exe 84 PID 4028 wrote to memory of 832 4028 pjjjj.exe 85 PID 4028 wrote to memory of 832 4028 pjjjj.exe 85 PID 4028 wrote to memory of 832 4028 pjjjj.exe 85 PID 832 wrote to memory of 4676 832 ddddv.exe 86 PID 832 wrote to memory of 4676 832 ddddv.exe 86 PID 832 wrote to memory of 4676 832 ddddv.exe 86 PID 4676 wrote to memory of 1064 4676 tnbbbb.exe 87 PID 4676 wrote to memory of 1064 4676 tnbbbb.exe 87 PID 4676 wrote to memory of 1064 4676 tnbbbb.exe 87 PID 1064 wrote to memory of 2940 1064 frrrrrr.exe 88 PID 1064 wrote to memory of 2940 1064 frrrrrr.exe 88 PID 1064 wrote to memory of 2940 1064 frrrrrr.exe 88 PID 2940 wrote to memory of 3448 2940 vvvdd.exe 89 PID 2940 wrote to memory of 3448 2940 vvvdd.exe 89 PID 2940 wrote to memory of 3448 2940 vvvdd.exe 89 PID 3448 wrote to memory of 2952 3448 hnnhbb.exe 90 PID 3448 wrote to memory of 2952 3448 hnnhbb.exe 90 PID 3448 wrote to memory of 2952 3448 hnnhbb.exe 90 PID 2952 wrote to memory of 1776 2952 rfxrrrr.exe 91 PID 2952 wrote to memory of 1776 2952 rfxrrrr.exe 91 PID 2952 wrote to memory of 1776 2952 rfxrrrr.exe 91 PID 1776 wrote to memory of 2908 1776 thnnhn.exe 92 PID 1776 wrote to memory of 2908 1776 thnnhn.exe 92 PID 1776 wrote to memory of 2908 1776 thnnhn.exe 92 PID 2908 wrote to memory of 4924 2908 ddvdv.exe 93 PID 2908 wrote to memory of 4924 2908 ddvdv.exe 93 PID 2908 wrote to memory of 4924 2908 ddvdv.exe 93 PID 4924 wrote to memory of 116 4924 nnnthh.exe 94 PID 4924 wrote to memory of 116 4924 nnnthh.exe 94 PID 4924 wrote to memory of 116 4924 nnnthh.exe 94 PID 116 wrote to memory of 5068 116 rfllflf.exe 95 PID 116 wrote to memory of 5068 116 rfllflf.exe 95 PID 116 wrote to memory of 5068 116 rfllflf.exe 95 PID 5068 wrote to memory of 3756 5068 pvppj.exe 96 PID 5068 wrote to memory of 3756 5068 pvppj.exe 96 PID 5068 wrote to memory of 3756 5068 pvppj.exe 96 PID 3756 wrote to memory of 2628 3756 9lxrfxx.exe 97 PID 3756 wrote to memory of 2628 3756 9lxrfxx.exe 97 PID 3756 wrote to memory of 2628 3756 9lxrfxx.exe 97 PID 2628 wrote to memory of 2140 2628 vdpvv.exe 98 PID 2628 wrote to memory of 2140 2628 vdpvv.exe 98 PID 2628 wrote to memory of 2140 2628 vdpvv.exe 98 PID 2140 wrote to memory of 2428 2140 xlllflf.exe 99 PID 2140 wrote to memory of 2428 2140 xlllflf.exe 99 PID 2140 wrote to memory of 2428 2140 xlllflf.exe 99 PID 2428 wrote to memory of 1612 2428 9ttnnn.exe 100 PID 2428 wrote to memory of 1612 2428 9ttnnn.exe 100 PID 2428 wrote to memory of 1612 2428 9ttnnn.exe 100 PID 1612 wrote to memory of 728 1612 jdjjv.exe 101 PID 1612 wrote to memory of 728 1612 jdjjv.exe 101 PID 1612 wrote to memory of 728 1612 jdjjv.exe 101 PID 728 wrote to memory of 228 728 frlfflr.exe 102 PID 728 wrote to memory of 228 728 frlfflr.exe 102 PID 728 wrote to memory of 228 728 frlfflr.exe 102 PID 228 wrote to memory of 732 228 tntttt.exe 103 PID 228 wrote to memory of 732 228 tntttt.exe 103 PID 228 wrote to memory of 732 228 tntttt.exe 103 PID 732 wrote to memory of 4668 732 dvppj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe"C:\Users\Admin\AppData\Local\Temp\3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\ffrllfx.exec:\ffrllfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\pjjjj.exec:\pjjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\ddddv.exec:\ddddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\tnbbbb.exec:\tnbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\frrrrrr.exec:\frrrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\vvvdd.exec:\vvvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\hnnhbb.exec:\hnnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\rfxrrrr.exec:\rfxrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\thnnhn.exec:\thnnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\ddvdv.exec:\ddvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\nnnthh.exec:\nnnthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\rfllflf.exec:\rfllflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\pvppj.exec:\pvppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\9lxrfxx.exec:\9lxrfxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\vdpvv.exec:\vdpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\xlllflf.exec:\xlllflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\9ttnnn.exec:\9ttnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\jdjjv.exec:\jdjjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\frlfflr.exec:\frlfflr.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\tntttt.exec:\tntttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\dvppj.exec:\dvppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\djdvp.exec:\djdvp.exe23⤵
- Executes dropped EXE
PID:4668 -
\??\c:\rxrllrl.exec:\rxrllrl.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4780 -
\??\c:\bbbnnn.exec:\bbbnnn.exe25⤵
- Executes dropped EXE
PID:3568 -
\??\c:\bnhhbn.exec:\bnhhbn.exe26⤵
- Executes dropped EXE
PID:4424 -
\??\c:\ppjjp.exec:\ppjjp.exe27⤵
- Executes dropped EXE
PID:1120 -
\??\c:\fflfflf.exec:\fflfflf.exe28⤵
- Executes dropped EXE
PID:3892 -
\??\c:\ntnhbb.exec:\ntnhbb.exe29⤵
- Executes dropped EXE
PID:4356 -
\??\c:\bbbhhn.exec:\bbbhhn.exe30⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jjjdv.exec:\jjjdv.exe31⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rrxrllf.exec:\rrxrllf.exe32⤵
- Executes dropped EXE
PID:4104 -
\??\c:\5fllrxf.exec:\5fllrxf.exe33⤵
- Executes dropped EXE
PID:4580 -
\??\c:\tbtnbb.exec:\tbtnbb.exe34⤵
- Executes dropped EXE
PID:764 -
\??\c:\7vpjd.exec:\7vpjd.exe35⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jddvv.exec:\jddvv.exe36⤵
- Executes dropped EXE
PID:1716 -
\??\c:\llxrllf.exec:\llxrllf.exe37⤵
- Executes dropped EXE
PID:4996 -
\??\c:\tbbnnh.exec:\tbbnnh.exe38⤵
- Executes dropped EXE
PID:4528 -
\??\c:\pvvpv.exec:\pvvpv.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vjppp.exec:\vjppp.exe40⤵
- Executes dropped EXE
PID:5080 -
\??\c:\ffrlrxr.exec:\ffrlrxr.exe41⤵
- Executes dropped EXE
PID:3140 -
\??\c:\nntnhh.exec:\nntnhh.exe42⤵
- Executes dropped EXE
PID:4296 -
\??\c:\hbtthh.exec:\hbtthh.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vddvp.exec:\vddvp.exe44⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9frlxlf.exec:\9frlxlf.exe45⤵
- Executes dropped EXE
PID:3912 -
\??\c:\lxxxxxr.exec:\lxxxxxr.exe46⤵
- Executes dropped EXE
PID:3248 -
\??\c:\bbttnh.exec:\bbttnh.exe47⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vpppj.exec:\vpppj.exe48⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rllfxxr.exec:\rllfxxr.exe49⤵
- Executes dropped EXE
PID:4184 -
\??\c:\xxfffff.exec:\xxfffff.exe50⤵
- Executes dropped EXE
PID:4412 -
\??\c:\ntntnb.exec:\ntntnb.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7jddv.exec:\7jddv.exe52⤵
- Executes dropped EXE
PID:1252 -
\??\c:\flxrfxr.exec:\flxrfxr.exe53⤵
- Executes dropped EXE
PID:4692 -
\??\c:\nnhhbb.exec:\nnhhbb.exe54⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vddjp.exec:\vddjp.exe55⤵
- Executes dropped EXE
PID:3648 -
\??\c:\7flffff.exec:\7flffff.exe56⤵
- Executes dropped EXE
PID:2644 -
\??\c:\thnnnn.exec:\thnnnn.exe57⤵
- Executes dropped EXE
PID:4500 -
\??\c:\pvvjd.exec:\pvvjd.exe58⤵
- Executes dropped EXE
PID:4832 -
\??\c:\fxfllll.exec:\fxfllll.exe59⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tnnbnh.exec:\tnnbnh.exe60⤵
- Executes dropped EXE
PID:3780 -
\??\c:\vjjjj.exec:\vjjjj.exe61⤵
- Executes dropped EXE
PID:3852 -
\??\c:\ffxlllf.exec:\ffxlllf.exe62⤵
- Executes dropped EXE
PID:860 -
\??\c:\hhnntb.exec:\hhnntb.exe63⤵
- Executes dropped EXE
PID:1596 -
\??\c:\5jdpd.exec:\5jdpd.exe64⤵
- Executes dropped EXE
PID:2316 -
\??\c:\llxrfxl.exec:\llxrfxl.exe65⤵
- Executes dropped EXE
PID:3492 -
\??\c:\9htbhh.exec:\9htbhh.exe66⤵PID:3496
-
\??\c:\5vpdv.exec:\5vpdv.exe67⤵PID:2596
-
\??\c:\5rxrrfx.exec:\5rxrrfx.exe68⤵PID:3772
-
\??\c:\nnhbtt.exec:\nnhbtt.exe69⤵PID:2824
-
\??\c:\vvvpj.exec:\vvvpj.exe70⤵PID:1636
-
\??\c:\rrllffx.exec:\rrllffx.exe71⤵PID:1000
-
\??\c:\thhhtt.exec:\thhhtt.exe72⤵PID:4800
-
\??\c:\jjjjd.exec:\jjjjd.exe73⤵PID:1680
-
\??\c:\fxrfxrl.exec:\fxrfxrl.exe74⤵PID:64
-
\??\c:\tnnhbb.exec:\tnnhbb.exe75⤵PID:4560
-
\??\c:\dvvpd.exec:\dvvpd.exe76⤵PID:3512
-
\??\c:\rlxxrlf.exec:\rlxxrlf.exe77⤵PID:5108
-
\??\c:\ttnhtb.exec:\ttnhtb.exe78⤵PID:3276
-
\??\c:\lfrllff.exec:\lfrllff.exe79⤵PID:1044
-
\??\c:\vdjdd.exec:\vdjdd.exe80⤵PID:1640
-
\??\c:\frrrrll.exec:\frrrrll.exe81⤵PID:3960
-
\??\c:\hhhtth.exec:\hhhtth.exe82⤵PID:1224
-
\??\c:\ffxlxrx.exec:\ffxlxrx.exe83⤵PID:3672
-
\??\c:\lrxlrxl.exec:\lrxlrxl.exe84⤵PID:1104
-
\??\c:\bhbthb.exec:\bhbthb.exe85⤵PID:4648
-
\??\c:\9ppjj.exec:\9ppjj.exe86⤵PID:3016
-
\??\c:\lffxlfx.exec:\lffxlfx.exe87⤵PID:2348
-
\??\c:\hhhbnn.exec:\hhhbnn.exe88⤵PID:3572
-
\??\c:\hntnhh.exec:\hntnhh.exe89⤵PID:3012
-
\??\c:\vddvp.exec:\vddvp.exe90⤵PID:1972
-
\??\c:\rlfxrfx.exec:\rlfxrfx.exe91⤵PID:3032
-
\??\c:\ffrlrll.exec:\ffrlrll.exe92⤵PID:4004
-
\??\c:\3nhbtt.exec:\3nhbtt.exe93⤵PID:3176
-
\??\c:\jddvv.exec:\jddvv.exe94⤵PID:4104
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe95⤵
- System Location Discovery: System Language Discovery
PID:764 -
\??\c:\bnnbnn.exec:\bnnbnn.exe96⤵PID:1164
-
\??\c:\vppvp.exec:\vppvp.exe97⤵PID:3384
-
\??\c:\vvvvd.exec:\vvvvd.exe98⤵PID:1500
-
\??\c:\1lffrlf.exec:\1lffrlf.exe99⤵PID:4528
-
\??\c:\btnhbb.exec:\btnhbb.exe100⤵PID:5080
-
\??\c:\1jjdp.exec:\1jjdp.exe101⤵PID:3140
-
\??\c:\jppjj.exec:\jppjj.exe102⤵PID:1228
-
\??\c:\rxrlflf.exec:\rxrlflf.exe103⤵PID:4672
-
\??\c:\thhbbn.exec:\thhbbn.exe104⤵PID:2344
-
\??\c:\1vjdp.exec:\1vjdp.exe105⤵PID:2932
-
\??\c:\rlllflf.exec:\rlllflf.exe106⤵PID:3912
-
\??\c:\xffxxrl.exec:\xffxxrl.exe107⤵PID:1552
-
\??\c:\tbbbbb.exec:\tbbbbb.exe108⤵PID:1468
-
\??\c:\vpdpd.exec:\vpdpd.exe109⤵PID:2196
-
\??\c:\fxrfrxx.exec:\fxrfrxx.exe110⤵PID:4404
-
\??\c:\tnhbnn.exec:\tnhbnn.exe111⤵PID:2008
-
\??\c:\dvvvj.exec:\dvvvj.exe112⤵PID:4940
-
\??\c:\llfxrlx.exec:\llfxrlx.exe113⤵PID:456
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe114⤵PID:3872
-
\??\c:\hhnnnb.exec:\hhnnnb.exe115⤵PID:2444
-
\??\c:\jdppp.exec:\jdppp.exe116⤵PID:324
-
\??\c:\3lxxlrl.exec:\3lxxlrl.exe117⤵PID:1856
-
\??\c:\1tnnhn.exec:\1tnnhn.exe118⤵PID:2860
-
\??\c:\vvpjd.exec:\vvpjd.exe119⤵PID:5112
-
\??\c:\9vvpv.exec:\9vvpv.exe120⤵PID:3100
-
\??\c:\fxrlrrl.exec:\fxrlrrl.exe121⤵PID:4440
-
\??\c:\ththbh.exec:\ththbh.exe122⤵PID:2472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-