Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 16:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe
-
Size
454KB
-
MD5
26840d2dd87bf7ca12964eb1529b71ab
-
SHA1
e7bc67db3b2970c83ab175b4185874dfb0adb3dc
-
SHA256
6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84
-
SHA512
e0e69348866bc3be7ee6b2e31cff3ffe5f313c526dcddc08a6f9ec32de1fa050f5973c4e7eaca2836a91f2c4b393d00052a453e86abbe018b064ca8fe3cd6da2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2276-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-1546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3584 3flxrxr.exe 4828 hbhhbh.exe 2756 vpddd.exe 3648 7jvdv.exe 2092 lrfflll.exe 776 1rxfxlf.exe 5016 nhnnhh.exe 4460 lfrllll.exe 864 3vdvp.exe 4956 1thbtb.exe 4120 9fllflf.exe 2160 7vvpp.exe 808 frxxrxr.exe 2156 jpdvp.exe 1100 1fxxrrx.exe 2300 7bnnnn.exe 4576 3vvvp.exe 4600 frxlffx.exe 3320 hhthth.exe 1828 rxxrrxr.exe 2060 hbnhbt.exe 1556 djjpj.exe 3616 rrxxffl.exe 4448 5djdv.exe 4676 rfxfflf.exe 228 thnnhn.exe 3384 xrrlffx.exe 3536 btbtnn.exe 4936 ntbbnt.exe 1868 pdjdv.exe 1128 nnnbbn.exe 440 ffrlffx.exe 1664 7ntntt.exe 392 jvdvp.exe 3968 lfrrxxf.exe 3508 5ppjj.exe 4316 xflrrxr.exe 4584 nbnnhh.exe 4640 5jpvp.exe 4572 frrllrl.exe 2364 hbbhht.exe 1292 5vvvp.exe 2400 fxxrxxf.exe 4552 5bhbbh.exe 1944 tbbbnn.exe 2172 9ppvv.exe 2420 5rfllll.exe 4264 1htntt.exe 3276 bbnhhh.exe 4348 llllffr.exe 2036 lrxxxff.exe 548 9ttnnn.exe 4968 7jpjd.exe 2104 rlrrrxf.exe 4984 nhhbbb.exe 3516 jppjd.exe 536 xrffllx.exe 4856 9ntbbb.exe 2984 5nthbh.exe 3380 pjvpv.exe 4924 llxlxlf.exe 3688 7tttnt.exe 5016 hthnbn.exe 3752 vpvpp.exe -
resource yara_rule behavioral2/memory/2276-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-730-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 3584 2276 6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe 83 PID 2276 wrote to memory of 3584 2276 6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe 83 PID 2276 wrote to memory of 3584 2276 6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe 83 PID 3584 wrote to memory of 4828 3584 3flxrxr.exe 84 PID 3584 wrote to memory of 4828 3584 3flxrxr.exe 84 PID 3584 wrote to memory of 4828 3584 3flxrxr.exe 84 PID 4828 wrote to memory of 2756 4828 hbhhbh.exe 85 PID 4828 wrote to memory of 2756 4828 hbhhbh.exe 85 PID 4828 wrote to memory of 2756 4828 hbhhbh.exe 85 PID 2756 wrote to memory of 3648 2756 vpddd.exe 86 PID 2756 wrote to memory of 3648 2756 vpddd.exe 86 PID 2756 wrote to memory of 3648 2756 vpddd.exe 86 PID 3648 wrote to memory of 2092 3648 7jvdv.exe 87 PID 3648 wrote to memory of 2092 3648 7jvdv.exe 87 PID 3648 wrote to memory of 2092 3648 7jvdv.exe 87 PID 2092 wrote to memory of 776 2092 lrfflll.exe 88 PID 2092 wrote to memory of 776 2092 lrfflll.exe 88 PID 2092 wrote to memory of 776 2092 lrfflll.exe 88 PID 776 wrote to memory of 5016 776 1rxfxlf.exe 89 PID 776 wrote to memory of 5016 776 1rxfxlf.exe 89 PID 776 wrote to memory of 5016 776 1rxfxlf.exe 89 PID 5016 wrote to memory of 4460 5016 nhnnhh.exe 90 PID 5016 wrote to memory of 4460 5016 nhnnhh.exe 90 PID 5016 wrote to memory of 4460 5016 nhnnhh.exe 90 PID 4460 wrote to memory of 864 4460 lfrllll.exe 91 PID 4460 wrote to memory of 864 4460 lfrllll.exe 91 PID 4460 wrote to memory of 864 4460 lfrllll.exe 91 PID 864 wrote to memory of 4956 864 3vdvp.exe 92 PID 864 wrote to memory of 4956 864 3vdvp.exe 92 PID 864 wrote to memory of 4956 864 3vdvp.exe 92 PID 4956 wrote to memory of 4120 4956 1thbtb.exe 93 PID 4956 wrote to memory of 4120 4956 1thbtb.exe 93 PID 4956 wrote to memory of 4120 4956 1thbtb.exe 93 PID 4120 wrote to memory of 2160 4120 9fllflf.exe 94 PID 4120 wrote to memory of 2160 4120 9fllflf.exe 94 PID 4120 wrote to memory of 2160 4120 9fllflf.exe 94 PID 2160 wrote to memory of 808 2160 7vvpp.exe 95 PID 2160 wrote to memory of 808 2160 7vvpp.exe 95 PID 2160 wrote to memory of 808 2160 7vvpp.exe 95 PID 808 wrote to memory of 2156 808 frxxrxr.exe 96 PID 808 wrote to memory of 2156 808 frxxrxr.exe 96 PID 808 wrote to memory of 2156 808 frxxrxr.exe 96 PID 2156 wrote to memory of 1100 2156 jpdvp.exe 97 PID 2156 wrote to memory of 1100 2156 jpdvp.exe 97 PID 2156 wrote to memory of 1100 2156 jpdvp.exe 97 PID 1100 wrote to memory of 2300 1100 1fxxrrx.exe 98 PID 1100 wrote to memory of 2300 1100 1fxxrrx.exe 98 PID 1100 wrote to memory of 2300 1100 1fxxrrx.exe 98 PID 2300 wrote to memory of 4576 2300 7bnnnn.exe 99 PID 2300 wrote to memory of 4576 2300 7bnnnn.exe 99 PID 2300 wrote to memory of 4576 2300 7bnnnn.exe 99 PID 4576 wrote to memory of 4600 4576 3vvvp.exe 100 PID 4576 wrote to memory of 4600 4576 3vvvp.exe 100 PID 4576 wrote to memory of 4600 4576 3vvvp.exe 100 PID 4600 wrote to memory of 3320 4600 frxlffx.exe 101 PID 4600 wrote to memory of 3320 4600 frxlffx.exe 101 PID 4600 wrote to memory of 3320 4600 frxlffx.exe 101 PID 3320 wrote to memory of 1828 3320 hhthth.exe 102 PID 3320 wrote to memory of 1828 3320 hhthth.exe 102 PID 3320 wrote to memory of 1828 3320 hhthth.exe 102 PID 1828 wrote to memory of 2060 1828 rxxrrxr.exe 103 PID 1828 wrote to memory of 2060 1828 rxxrrxr.exe 103 PID 1828 wrote to memory of 2060 1828 rxxrrxr.exe 103 PID 2060 wrote to memory of 1556 2060 hbnhbt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe"C:\Users\Admin\AppData\Local\Temp\6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\3flxrxr.exec:\3flxrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\hbhhbh.exec:\hbhhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\vpddd.exec:\vpddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7jvdv.exec:\7jvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\lrfflll.exec:\lrfflll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\1rxfxlf.exec:\1rxfxlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\nhnnhh.exec:\nhnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\lfrllll.exec:\lfrllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\3vdvp.exec:\3vdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\1thbtb.exec:\1thbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\9fllflf.exec:\9fllflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\7vvpp.exec:\7vvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\frxxrxr.exec:\frxxrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\jpdvp.exec:\jpdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\1fxxrrx.exec:\1fxxrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\7bnnnn.exec:\7bnnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\3vvvp.exec:\3vvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\frxlffx.exec:\frxlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\hhthth.exec:\hhthth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\rxxrrxr.exec:\rxxrrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\hbnhbt.exec:\hbnhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\djjpj.exec:\djjpj.exe23⤵
- Executes dropped EXE
PID:1556 -
\??\c:\rrxxffl.exec:\rrxxffl.exe24⤵
- Executes dropped EXE
PID:3616 -
\??\c:\5djdv.exec:\5djdv.exe25⤵
- Executes dropped EXE
PID:4448 -
\??\c:\rfxfflf.exec:\rfxfflf.exe26⤵
- Executes dropped EXE
PID:4676 -
\??\c:\thnnhn.exec:\thnnhn.exe27⤵
- Executes dropped EXE
PID:228 -
\??\c:\xrrlffx.exec:\xrrlffx.exe28⤵
- Executes dropped EXE
PID:3384 -
\??\c:\btbtnn.exec:\btbtnn.exe29⤵
- Executes dropped EXE
PID:3536 -
\??\c:\ntbbnt.exec:\ntbbnt.exe30⤵
- Executes dropped EXE
PID:4936 -
\??\c:\pdjdv.exec:\pdjdv.exe31⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nnnbbn.exec:\nnnbbn.exe32⤵
- Executes dropped EXE
PID:1128 -
\??\c:\ffrlffx.exec:\ffrlffx.exe33⤵
- Executes dropped EXE
PID:440 -
\??\c:\7ntntt.exec:\7ntntt.exe34⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jvdvp.exec:\jvdvp.exe35⤵
- Executes dropped EXE
PID:392 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe36⤵
- Executes dropped EXE
PID:3968 -
\??\c:\5ppjj.exec:\5ppjj.exe37⤵
- Executes dropped EXE
PID:3508 -
\??\c:\xflrrxr.exec:\xflrrxr.exe38⤵
- Executes dropped EXE
PID:4316 -
\??\c:\nbnnhh.exec:\nbnnhh.exe39⤵
- Executes dropped EXE
PID:4584 -
\??\c:\5jpvp.exec:\5jpvp.exe40⤵
- Executes dropped EXE
PID:4640 -
\??\c:\frrllrl.exec:\frrllrl.exe41⤵
- Executes dropped EXE
PID:4572 -
\??\c:\hbbhht.exec:\hbbhht.exe42⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5vvvp.exec:\5vvvp.exe43⤵
- Executes dropped EXE
PID:1292 -
\??\c:\fxxrxxf.exec:\fxxrxxf.exe44⤵
- Executes dropped EXE
PID:2400 -
\??\c:\5bhbbh.exec:\5bhbbh.exe45⤵
- Executes dropped EXE
PID:4552 -
\??\c:\tbbbnn.exec:\tbbbnn.exe46⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9ppvv.exec:\9ppvv.exe47⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5rfllll.exec:\5rfllll.exe48⤵
- Executes dropped EXE
PID:2420 -
\??\c:\1htntt.exec:\1htntt.exe49⤵
- Executes dropped EXE
PID:4264 -
\??\c:\bbnhhh.exec:\bbnhhh.exe50⤵
- Executes dropped EXE
PID:3276 -
\??\c:\llllffr.exec:\llllffr.exe51⤵
- Executes dropped EXE
PID:4348 -
\??\c:\lrxxxff.exec:\lrxxxff.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\9ttnnn.exec:\9ttnnn.exe53⤵
- Executes dropped EXE
PID:548 -
\??\c:\7jpjd.exec:\7jpjd.exe54⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rlrrrxf.exec:\rlrrrxf.exe55⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nhhbbb.exec:\nhhbbb.exe56⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jppjd.exec:\jppjd.exe57⤵
- Executes dropped EXE
PID:3516 -
\??\c:\xrffllx.exec:\xrffllx.exe58⤵
- Executes dropped EXE
PID:536 -
\??\c:\9ntbbb.exec:\9ntbbb.exe59⤵
- Executes dropped EXE
PID:4856 -
\??\c:\5nthbh.exec:\5nthbh.exe60⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pjvpv.exec:\pjvpv.exe61⤵
- Executes dropped EXE
PID:3380 -
\??\c:\llxlxlf.exec:\llxlxlf.exe62⤵
- Executes dropped EXE
PID:4924 -
\??\c:\7tttnt.exec:\7tttnt.exe63⤵
- Executes dropped EXE
PID:3688 -
\??\c:\hthnbn.exec:\hthnbn.exe64⤵
- Executes dropped EXE
PID:5016 -
\??\c:\vpvpp.exec:\vpvpp.exe65⤵
- Executes dropped EXE
PID:3752 -
\??\c:\lxxxrxx.exec:\lxxxrxx.exe66⤵PID:2780
-
\??\c:\tbtttt.exec:\tbtttt.exe67⤵PID:4100
-
\??\c:\jdddd.exec:\jdddd.exe68⤵PID:2320
-
\??\c:\rllllll.exec:\rllllll.exe69⤵PID:4420
-
\??\c:\frllllx.exec:\frllllx.exe70⤵PID:456
-
\??\c:\3nnnnt.exec:\3nnnnt.exe71⤵PID:2156
-
\??\c:\jjjjj.exec:\jjjjj.exe72⤵
- System Location Discovery: System Language Discovery
PID:1900 -
\??\c:\ffrrrxl.exec:\ffrrrxl.exe73⤵PID:4472
-
\??\c:\ntbbbn.exec:\ntbbbn.exe74⤵PID:4576
-
\??\c:\djppp.exec:\djppp.exe75⤵PID:4160
-
\??\c:\rxxfrxf.exec:\rxxfrxf.exe76⤵PID:3320
-
\??\c:\tnnnhn.exec:\tnnnhn.exe77⤵PID:4672
-
\??\c:\vpjdp.exec:\vpjdp.exe78⤵PID:2424
-
\??\c:\vdvvp.exec:\vdvvp.exe79⤵PID:852
-
\??\c:\rrrllff.exec:\rrrllff.exe80⤵PID:1440
-
\??\c:\bnbtbh.exec:\bnbtbh.exe81⤵PID:3192
-
\??\c:\jdpjd.exec:\jdpjd.exe82⤵PID:4928
-
\??\c:\3rrrlrl.exec:\3rrrlrl.exe83⤵PID:1632
-
\??\c:\nthbbt.exec:\nthbbt.exe84⤵PID:436
-
\??\c:\jpvjj.exec:\jpvjj.exe85⤵PID:3764
-
\??\c:\lxfxlxl.exec:\lxfxlxl.exe86⤵PID:4772
-
\??\c:\llrrrxx.exec:\llrrrxx.exe87⤵
- System Location Discovery: System Language Discovery
PID:3208 -
\??\c:\3htnnh.exec:\3htnnh.exe88⤵PID:2100
-
\??\c:\djdvp.exec:\djdvp.exe89⤵PID:3608
-
\??\c:\fxllllr.exec:\fxllllr.exe90⤵PID:3360
-
\??\c:\nnhnnn.exec:\nnhnnn.exe91⤵PID:3064
-
\??\c:\djvpj.exec:\djvpj.exe92⤵PID:3348
-
\??\c:\rlfxfxr.exec:\rlfxfxr.exe93⤵PID:3232
-
\??\c:\fxlrxrr.exec:\fxlrxrr.exe94⤵PID:3160
-
\??\c:\bhhhhn.exec:\bhhhhn.exe95⤵PID:1140
-
\??\c:\pjdjj.exec:\pjdjj.exe96⤵PID:1688
-
\??\c:\rlffxxx.exec:\rlffxxx.exe97⤵PID:3580
-
\??\c:\9rllffx.exec:\9rllffx.exe98⤵PID:3596
-
\??\c:\thbbtn.exec:\thbbtn.exe99⤵PID:2308
-
\??\c:\jpdvd.exec:\jpdvd.exe100⤵PID:3508
-
\??\c:\7rxxrxx.exec:\7rxxrxx.exe101⤵PID:1736
-
\??\c:\ththbb.exec:\ththbb.exe102⤵PID:3368
-
\??\c:\9nbtbb.exec:\9nbtbb.exe103⤵PID:4640
-
\??\c:\vdppv.exec:\vdppv.exe104⤵PID:3228
-
\??\c:\1xrlffl.exec:\1xrlffl.exe105⤵PID:2632
-
\??\c:\nhnnnn.exec:\nhnnnn.exe106⤵PID:1500
-
\??\c:\ttnhbt.exec:\ttnhbt.exe107⤵PID:4660
-
\??\c:\jjjdj.exec:\jjjdj.exe108⤵PID:4224
-
\??\c:\lflllll.exec:\lflllll.exe109⤵PID:3804
-
\??\c:\nbhhbb.exec:\nbhhbb.exe110⤵PID:2172
-
\??\c:\tnhbtn.exec:\tnhbtn.exe111⤵PID:2456
-
\??\c:\3vjdv.exec:\3vjdv.exe112⤵PID:4468
-
\??\c:\lrlfllr.exec:\lrlfllr.exe113⤵PID:4360
-
\??\c:\xrflrrr.exec:\xrflrrr.exe114⤵PID:3604
-
\??\c:\tnnntn.exec:\tnnntn.exe115⤵PID:4996
-
\??\c:\pjjjj.exec:\pjjjj.exe116⤵PID:3344
-
\??\c:\rlrrlll.exec:\rlrrlll.exe117⤵PID:5052
-
\??\c:\5rrllll.exec:\5rrllll.exe118⤵PID:2800
-
\??\c:\nhnhnn.exec:\nhnhnn.exe119⤵PID:4212
-
\??\c:\tnbttb.exec:\tnbttb.exe120⤵PID:2756
-
\??\c:\jddvv.exec:\jddvv.exe121⤵PID:2604
-
\??\c:\rlllfff.exec:\rlllfff.exe122⤵PID:868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-