Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe
-
Size
454KB
-
MD5
5e5624f7910825b71643e006a8818880
-
SHA1
6613de48d515c8a7f32e3b5d5db0628350083b32
-
SHA256
4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092
-
SHA512
e8d87a1c6e58cd293bf6d10fc9092eac50bc1c03441512aedd866a3a881d9b726841fcd23dd95b44ba15b263a02462259041780745f81a80d7646a72ed17efa5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4768-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2668-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-922-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-1029-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-1189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4100 flfxllx.exe 1096 hnhbtn.exe 4300 bttttt.exe 1112 1jdpp.exe 1460 rrxlxrf.exe 1288 9rrfrlf.exe 2440 btthbt.exe 5092 vvdvp.exe 3644 9xxxllx.exe 468 xlxrfxr.exe 3144 tbbthb.exe 4408 pdpdd.exe 3228 pjpjd.exe 3632 ffxlxrl.exe 384 nbhbnh.exe 3172 httnbt.exe 3952 ddjdp.exe 4472 rlxlffr.exe 3664 9bbnbn.exe 2972 tththb.exe 116 dddvj.exe 4588 lrxlfxl.exe 1284 3fxrrrr.exe 1132 7hbtnh.exe 2384 pddpj.exe 1404 jdpjp.exe 1700 xxxlfxl.exe 1836 tnnbth.exe 868 nbnhhb.exe 2496 pddpd.exe 3880 rlrllff.exe 2768 xllxrlx.exe 4192 thbtnh.exe 3148 dvvpd.exe 2700 jpdvj.exe 2692 frfxxrl.exe 2348 lrlfrll.exe 3540 bbnbnh.exe 3512 vjjdj.exe 3988 pvvjd.exe 2236 xrxrlfx.exe 1640 bhthtn.exe 3200 7ppjp.exe 4272 vdjdp.exe 5008 frfrrlx.exe 2556 frlfrlr.exe 2492 tntnhn.exe 4084 jdjvp.exe 4200 dvvpj.exe 1168 frrxrrl.exe 3164 nhhbnh.exe 3792 ttbthb.exe 2968 3vpdd.exe 1844 fxrlffx.exe 4984 fxxlfxl.exe 4080 btbbbb.exe 2988 djvpj.exe 1100 jjpvp.exe 4392 lrxlfxr.exe 4436 tththh.exe 3316 thnhbt.exe 2896 vjpjv.exe 1096 1fffxxl.exe 4300 xxfxlrf.exe -
resource yara_rule behavioral2/memory/4768-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-922-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-1029-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 4100 4768 4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe 82 PID 4768 wrote to memory of 4100 4768 4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe 82 PID 4768 wrote to memory of 4100 4768 4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe 82 PID 4100 wrote to memory of 1096 4100 flfxllx.exe 144 PID 4100 wrote to memory of 1096 4100 flfxllx.exe 144 PID 4100 wrote to memory of 1096 4100 flfxllx.exe 144 PID 1096 wrote to memory of 4300 1096 hnhbtn.exe 84 PID 1096 wrote to memory of 4300 1096 hnhbtn.exe 84 PID 1096 wrote to memory of 4300 1096 hnhbtn.exe 84 PID 4300 wrote to memory of 1112 4300 bttttt.exe 85 PID 4300 wrote to memory of 1112 4300 bttttt.exe 85 PID 4300 wrote to memory of 1112 4300 bttttt.exe 85 PID 1112 wrote to memory of 1460 1112 1jdpp.exe 86 PID 1112 wrote to memory of 1460 1112 1jdpp.exe 86 PID 1112 wrote to memory of 1460 1112 1jdpp.exe 86 PID 1460 wrote to memory of 1288 1460 rrxlxrf.exe 87 PID 1460 wrote to memory of 1288 1460 rrxlxrf.exe 87 PID 1460 wrote to memory of 1288 1460 rrxlxrf.exe 87 PID 1288 wrote to memory of 2440 1288 9rrfrlf.exe 88 PID 1288 wrote to memory of 2440 1288 9rrfrlf.exe 88 PID 1288 wrote to memory of 2440 1288 9rrfrlf.exe 88 PID 2440 wrote to memory of 5092 2440 btthbt.exe 89 PID 2440 wrote to memory of 5092 2440 btthbt.exe 89 PID 2440 wrote to memory of 5092 2440 btthbt.exe 89 PID 5092 wrote to memory of 3644 5092 vvdvp.exe 90 PID 5092 wrote to memory of 3644 5092 vvdvp.exe 90 PID 5092 wrote to memory of 3644 5092 vvdvp.exe 90 PID 3644 wrote to memory of 468 3644 9xxxllx.exe 91 PID 3644 wrote to memory of 468 3644 9xxxllx.exe 91 PID 3644 wrote to memory of 468 3644 9xxxllx.exe 91 PID 468 wrote to memory of 3144 468 xlxrfxr.exe 92 PID 468 wrote to memory of 3144 468 xlxrfxr.exe 92 PID 468 wrote to memory of 3144 468 xlxrfxr.exe 92 PID 3144 wrote to memory of 4408 3144 tbbthb.exe 93 PID 3144 wrote to memory of 4408 3144 tbbthb.exe 93 PID 3144 wrote to memory of 4408 3144 tbbthb.exe 93 PID 4408 wrote to memory of 3228 4408 pdpdd.exe 94 PID 4408 wrote to memory of 3228 4408 pdpdd.exe 94 PID 4408 wrote to memory of 3228 4408 pdpdd.exe 94 PID 3228 wrote to memory of 3632 3228 pjpjd.exe 95 PID 3228 wrote to memory of 3632 3228 pjpjd.exe 95 PID 3228 wrote to memory of 3632 3228 pjpjd.exe 95 PID 3632 wrote to memory of 384 3632 ffxlxrl.exe 96 PID 3632 wrote to memory of 384 3632 ffxlxrl.exe 96 PID 3632 wrote to memory of 384 3632 ffxlxrl.exe 96 PID 384 wrote to memory of 3172 384 nbhbnh.exe 97 PID 384 wrote to memory of 3172 384 nbhbnh.exe 97 PID 384 wrote to memory of 3172 384 nbhbnh.exe 97 PID 3172 wrote to memory of 3952 3172 httnbt.exe 98 PID 3172 wrote to memory of 3952 3172 httnbt.exe 98 PID 3172 wrote to memory of 3952 3172 httnbt.exe 98 PID 3952 wrote to memory of 4472 3952 ddjdp.exe 99 PID 3952 wrote to memory of 4472 3952 ddjdp.exe 99 PID 3952 wrote to memory of 4472 3952 ddjdp.exe 99 PID 4472 wrote to memory of 3664 4472 rlxlffr.exe 100 PID 4472 wrote to memory of 3664 4472 rlxlffr.exe 100 PID 4472 wrote to memory of 3664 4472 rlxlffr.exe 100 PID 3664 wrote to memory of 2972 3664 9bbnbn.exe 101 PID 3664 wrote to memory of 2972 3664 9bbnbn.exe 101 PID 3664 wrote to memory of 2972 3664 9bbnbn.exe 101 PID 2972 wrote to memory of 116 2972 tththb.exe 102 PID 2972 wrote to memory of 116 2972 tththb.exe 102 PID 2972 wrote to memory of 116 2972 tththb.exe 102 PID 116 wrote to memory of 4588 116 dddvj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe"C:\Users\Admin\AppData\Local\Temp\4066b181ba33c410b096619d6ffdeecac499f18e4b39943a3a10ceaf82afa092N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\flfxllx.exec:\flfxllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\hnhbtn.exec:\hnhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\bttttt.exec:\bttttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\1jdpp.exec:\1jdpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\rrxlxrf.exec:\rrxlxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\9rrfrlf.exec:\9rrfrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\btthbt.exec:\btthbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\vvdvp.exec:\vvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\9xxxllx.exec:\9xxxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\xlxrfxr.exec:\xlxrfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\tbbthb.exec:\tbbthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\pdpdd.exec:\pdpdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\pjpjd.exec:\pjpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\ffxlxrl.exec:\ffxlxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\nbhbnh.exec:\nbhbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\httnbt.exec:\httnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\ddjdp.exec:\ddjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\rlxlffr.exec:\rlxlffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\9bbnbn.exec:\9bbnbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\tththb.exec:\tththb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\dddvj.exec:\dddvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\lrxlfxl.exec:\lrxlfxl.exe23⤵
- Executes dropped EXE
PID:4588 -
\??\c:\3fxrrrr.exec:\3fxrrrr.exe24⤵
- Executes dropped EXE
PID:1284 -
\??\c:\7hbtnh.exec:\7hbtnh.exe25⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pddpj.exec:\pddpj.exe26⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jdpjp.exec:\jdpjp.exe27⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tnnbth.exec:\tnnbth.exe29⤵
- Executes dropped EXE
PID:1836 -
\??\c:\nbnhhb.exec:\nbnhhb.exe30⤵
- Executes dropped EXE
PID:868 -
\??\c:\pddpd.exec:\pddpd.exe31⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rlrllff.exec:\rlrllff.exe32⤵
- Executes dropped EXE
PID:3880 -
\??\c:\xllxrlx.exec:\xllxrlx.exe33⤵
- Executes dropped EXE
PID:2768 -
\??\c:\thbtnh.exec:\thbtnh.exe34⤵
- Executes dropped EXE
PID:4192 -
\??\c:\dvvpd.exec:\dvvpd.exe35⤵
- Executes dropped EXE
PID:3148 -
\??\c:\jpdvj.exec:\jpdvj.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\frfxxrl.exec:\frfxxrl.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lrlfrll.exec:\lrlfrll.exe38⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bbnbnh.exec:\bbnbnh.exe39⤵
- Executes dropped EXE
PID:3540 -
\??\c:\vjjdj.exec:\vjjdj.exe40⤵
- Executes dropped EXE
PID:3512 -
\??\c:\pvvjd.exec:\pvvjd.exe41⤵
- Executes dropped EXE
PID:3988 -
\??\c:\xrxrlfx.exec:\xrxrlfx.exe42⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bhthtn.exec:\bhthtn.exe43⤵
- Executes dropped EXE
PID:1640 -
\??\c:\7ppjp.exec:\7ppjp.exe44⤵
- Executes dropped EXE
PID:3200 -
\??\c:\vdjdp.exec:\vdjdp.exe45⤵
- Executes dropped EXE
PID:4272 -
\??\c:\frfrrlx.exec:\frfrrlx.exe46⤵
- Executes dropped EXE
PID:5008 -
\??\c:\frlfrlr.exec:\frlfrlr.exe47⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tntnhn.exec:\tntnhn.exe48⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jdjvp.exec:\jdjvp.exe49⤵
- Executes dropped EXE
PID:4084 -
\??\c:\dvvpj.exec:\dvvpj.exe50⤵
- Executes dropped EXE
PID:4200 -
\??\c:\frrxrrl.exec:\frrxrrl.exe51⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nhhbnh.exec:\nhhbnh.exe52⤵
- Executes dropped EXE
PID:3164 -
\??\c:\ttbthb.exec:\ttbthb.exe53⤵
- Executes dropped EXE
PID:3792 -
\??\c:\3vpdd.exec:\3vpdd.exe54⤵
- Executes dropped EXE
PID:2968 -
\??\c:\fxrlffx.exec:\fxrlffx.exe55⤵
- Executes dropped EXE
PID:1844 -
\??\c:\fxxlfxl.exec:\fxxlfxl.exe56⤵
- Executes dropped EXE
PID:4984 -
\??\c:\btbbbb.exec:\btbbbb.exe57⤵
- Executes dropped EXE
PID:4080 -
\??\c:\djvpj.exec:\djvpj.exe58⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jjpvp.exec:\jjpvp.exe59⤵
- Executes dropped EXE
PID:1100 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe60⤵
- Executes dropped EXE
PID:4392 -
\??\c:\tththh.exec:\tththh.exe61⤵
- Executes dropped EXE
PID:4436 -
\??\c:\thnhbt.exec:\thnhbt.exe62⤵
- Executes dropped EXE
PID:3316 -
\??\c:\vjpjv.exec:\vjpjv.exe63⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1fffxxl.exec:\1fffxxl.exe64⤵
- Executes dropped EXE
PID:1096 -
\??\c:\xxfxlrf.exec:\xxfxlrf.exe65⤵
- Executes dropped EXE
PID:4300 -
\??\c:\tnnhbn.exec:\tnnhbn.exe66⤵PID:3312
-
\??\c:\jddvp.exec:\jddvp.exe67⤵PID:3604
-
\??\c:\vppjd.exec:\vppjd.exe68⤵PID:1604
-
\??\c:\lxlfrlr.exec:\lxlfrlr.exe69⤵PID:4688
-
\??\c:\hbhhhb.exec:\hbhhhb.exe70⤵PID:404
-
\??\c:\btthbb.exec:\btthbb.exe71⤵PID:2732
-
\??\c:\ddjdv.exec:\ddjdv.exe72⤵PID:2340
-
\??\c:\1lxrllf.exec:\1lxrllf.exe73⤵PID:2200
-
\??\c:\rxfxxrx.exec:\rxfxxrx.exe74⤵PID:4428
-
\??\c:\hnttnh.exec:\hnttnh.exe75⤵PID:1912
-
\??\c:\jvvpj.exec:\jvvpj.exe76⤵PID:3032
-
\??\c:\vppjp.exec:\vppjp.exe77⤵PID:2424
-
\??\c:\frxrlfx.exec:\frxrlfx.exe78⤵PID:4508
-
\??\c:\nbnbtn.exec:\nbnbtn.exe79⤵PID:5032
-
\??\c:\1djvp.exec:\1djvp.exe80⤵PID:348
-
\??\c:\1xlfxlf.exec:\1xlfxlf.exe81⤵PID:2736
-
\??\c:\nbthnt.exec:\nbthnt.exe82⤵PID:3888
-
\??\c:\ddddd.exec:\ddddd.exe83⤵PID:3448
-
\??\c:\xlrrllx.exec:\xlrrllx.exe84⤵PID:4536
-
\??\c:\bhbnnh.exec:\bhbnnh.exe85⤵PID:860
-
\??\c:\vddjd.exec:\vddjd.exe86⤵PID:2876
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe87⤵PID:4120
-
\??\c:\3lfxrrl.exec:\3lfxrrl.exe88⤵PID:4564
-
\??\c:\nbhbtn.exec:\nbhbtn.exe89⤵PID:4424
-
\??\c:\djvpp.exec:\djvpp.exe90⤵PID:1104
-
\??\c:\lflfxlf.exec:\lflfxlf.exe91⤵PID:3128
-
\??\c:\tnnhbb.exec:\tnnhbb.exe92⤵PID:4908
-
\??\c:\jvdvv.exec:\jvdvv.exe93⤵PID:4972
-
\??\c:\rrllllx.exec:\rrllllx.exe94⤵PID:2436
-
\??\c:\ntbttn.exec:\ntbttn.exe95⤵PID:4676
-
\??\c:\jvppj.exec:\jvppj.exe96⤵PID:1108
-
\??\c:\lfxrffr.exec:\lfxrffr.exe97⤵PID:2348
-
\??\c:\hbnhtn.exec:\hbnhtn.exe98⤵PID:3512
-
\??\c:\pjvvj.exec:\pjvvj.exe99⤵PID:1648
-
\??\c:\hbhbtn.exec:\hbhbtn.exe100⤵
- System Location Discovery: System Language Discovery
PID:1640 -
\??\c:\ththhb.exec:\ththhb.exe101⤵PID:1996
-
\??\c:\rxxlfxr.exec:\rxxlfxr.exe102⤵PID:5008
-
\??\c:\ddddv.exec:\ddddv.exe103⤵PID:4164
-
\??\c:\ppvpp.exec:\ppvpp.exe104⤵PID:4056
-
\??\c:\hbhhnn.exec:\hbhhnn.exe105⤵PID:3436
-
\??\c:\jpjpp.exec:\jpjpp.exe106⤵PID:1168
-
\??\c:\htbtnn.exec:\htbtnn.exe107⤵PID:1368
-
\??\c:\jvdpj.exec:\jvdpj.exe108⤵PID:1780
-
\??\c:\hbhbtn.exec:\hbhbtn.exe109⤵PID:2968
-
\??\c:\jdjdv.exec:\jdjdv.exe110⤵PID:2976
-
\??\c:\lfrrllf.exec:\lfrrllf.exe111⤵
- System Location Discovery: System Language Discovery
PID:2068 -
\??\c:\vdjdv.exec:\vdjdv.exe112⤵PID:4364
-
\??\c:\jpdvp.exec:\jpdvp.exe113⤵PID:4080
-
\??\c:\lflffff.exec:\lflffff.exe114⤵PID:4020
-
\??\c:\ttbtbb.exec:\ttbtbb.exe115⤵PID:4388
-
\??\c:\pvvpv.exec:\pvvpv.exe116⤵PID:2764
-
\??\c:\tnbtbt.exec:\tnbtbt.exe117⤵PID:2504
-
\??\c:\ppvdj.exec:\ppvdj.exe118⤵PID:1816
-
\??\c:\vpvvd.exec:\vpvvd.exe119⤵PID:3152
-
\??\c:\nbhbbt.exec:\nbhbbt.exe120⤵PID:1020
-
\??\c:\dvpjj.exec:\dvpjj.exe121⤵PID:676
-
\??\c:\rllfxrl.exec:\rllfxrl.exe122⤵PID:3376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-