Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe
-
Size
347KB
-
MD5
e67456807eec1556ff8ac3ab1fb0e730
-
SHA1
764672441abefe7fc52d44a59e9a0730a8ba1937
-
SHA256
b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218
-
SHA512
b03fc8333717f7e9ad7d2aadc10c8d01e8ff5c247fe7aec150565ace1d050f6b501c5c67eaaef524a05bb218584481b088a9834fcc09876a286e66c5dd334db0
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA1:l7TcbWXZshJX2VGd1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3352-5-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3940-11-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1700-19-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3576-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3952-30-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4524-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4568-40-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2308-50-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3412-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3924-58-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4328-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5008-76-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1792-81-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4636-95-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3968-90-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3356-105-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3392-108-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1948-120-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3580-118-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2828-130-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4888-137-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2428-146-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5072-163-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1832-168-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3664-181-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4284-200-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4008-204-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1260-211-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2100-218-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3820-231-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4828-235-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3944-248-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2176-270-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4724-274-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2384-278-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1416-282-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1280-286-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1536-293-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4872-321-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4000-325-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3580-329-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3852-333-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/992-340-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5072-356-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3632-369-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3956-373-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3972-377-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4284-387-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4104-391-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3524-404-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2580-417-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3836-439-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1572-470-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/212-492-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3356-499-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2852-554-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3064-564-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4252-574-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2828-707-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1748-732-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5108-776-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/960-938-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4384-1619-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3940 dddjj.exe 3576 fflfxxf.exe 1700 pvvvj.exe 3952 fxrrlrr.exe 4568 rfrlffx.exe 4524 xxfxrrf.exe 3412 bntnnn.exe 2308 vpvvv.exe 3924 xxrrllf.exe 4328 7ppdd.exe 1280 rrlllll.exe 5008 tbbhhb.exe 1792 fxlllrr.exe 4016 1bnhhh.exe 3968 vjvdd.exe 4636 ffxxllx.exe 3392 3djdd.exe 3356 jvddd.exe 1948 rrxrrxl.exe 3580 vjvvv.exe 2828 hnnttn.exe 4888 pjvdj.exe 2216 xfrlfff.exe 2428 nthhht.exe 2932 flxrllf.exe 1488 hbhhhh.exe 5072 pdpjd.exe 1832 hnhbtt.exe 4540 3lllfff.exe 3664 btttth.exe 3956 pvdvv.exe 4084 pppjj.exe 372 vvpjv.exe 4260 htbtnb.exe 4284 ddppp.exe 4008 frfxrrl.exe 1876 llrffff.exe 1260 ddddv.exe 3984 flxxxff.exe 2100 7xxxrxx.exe 1068 dpddj.exe 4384 ppdvv.exe 2016 xxxrrlf.exe 3820 ddppv.exe 4828 jvdvp.exe 3660 xlflrlx.exe 4072 1hnnhn.exe 4932 dvpjd.exe 3944 pddjd.exe 4596 7fllrxf.exe 4524 nhtnbt.exe 4832 vjvvd.exe 712 vvpjd.exe 3412 rrrrrrr.exe 1444 nhnhbb.exe 2176 nhhbtb.exe 4724 5pppj.exe 2384 5xxrrrr.exe 1416 hhnntt.exe 1280 pjdvv.exe 5008 ppddv.exe 1536 flrlffl.exe 3252 hbttnn.exe 4016 tttnhh.exe -
resource yara_rule behavioral2/memory/3352-5-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3940-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1700-19-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3576-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3952-24-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3952-30-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4524-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4568-40-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2308-50-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3412-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3924-58-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4328-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5008-76-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1792-81-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4636-95-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3968-90-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3356-105-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3392-108-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1948-120-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3580-118-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2828-130-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4888-137-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2428-146-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5072-163-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1832-168-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3664-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/372-190-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4284-200-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4008-204-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1260-211-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2100-218-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3820-231-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4828-235-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3944-248-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2176-270-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4724-274-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2384-278-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1416-282-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1280-286-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1536-293-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4872-321-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4000-325-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3580-329-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3852-333-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/992-340-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5072-356-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3632-369-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3956-373-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3972-377-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4284-387-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4104-391-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3524-404-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2580-417-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3836-439-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1572-470-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/212-492-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3356-499-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2852-554-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3064-564-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4252-574-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2828-707-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1748-732-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2852-748-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5108-776-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3352 wrote to memory of 3940 3352 b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe 83 PID 3352 wrote to memory of 3940 3352 b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe 83 PID 3352 wrote to memory of 3940 3352 b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe 83 PID 3940 wrote to memory of 3576 3940 dddjj.exe 84 PID 3940 wrote to memory of 3576 3940 dddjj.exe 84 PID 3940 wrote to memory of 3576 3940 dddjj.exe 84 PID 3576 wrote to memory of 1700 3576 fflfxxf.exe 85 PID 3576 wrote to memory of 1700 3576 fflfxxf.exe 85 PID 3576 wrote to memory of 1700 3576 fflfxxf.exe 85 PID 1700 wrote to memory of 3952 1700 pvvvj.exe 86 PID 1700 wrote to memory of 3952 1700 pvvvj.exe 86 PID 1700 wrote to memory of 3952 1700 pvvvj.exe 86 PID 3952 wrote to memory of 4568 3952 fxrrlrr.exe 87 PID 3952 wrote to memory of 4568 3952 fxrrlrr.exe 87 PID 3952 wrote to memory of 4568 3952 fxrrlrr.exe 87 PID 4568 wrote to memory of 4524 4568 rfrlffx.exe 88 PID 4568 wrote to memory of 4524 4568 rfrlffx.exe 88 PID 4568 wrote to memory of 4524 4568 rfrlffx.exe 88 PID 4524 wrote to memory of 3412 4524 xxfxrrf.exe 89 PID 4524 wrote to memory of 3412 4524 xxfxrrf.exe 89 PID 4524 wrote to memory of 3412 4524 xxfxrrf.exe 89 PID 3412 wrote to memory of 2308 3412 bntnnn.exe 90 PID 3412 wrote to memory of 2308 3412 bntnnn.exe 90 PID 3412 wrote to memory of 2308 3412 bntnnn.exe 90 PID 2308 wrote to memory of 3924 2308 vpvvv.exe 91 PID 2308 wrote to memory of 3924 2308 vpvvv.exe 91 PID 2308 wrote to memory of 3924 2308 vpvvv.exe 91 PID 3924 wrote to memory of 4328 3924 xxrrllf.exe 92 PID 3924 wrote to memory of 4328 3924 xxrrllf.exe 92 PID 3924 wrote to memory of 4328 3924 xxrrllf.exe 92 PID 4328 wrote to memory of 1280 4328 7ppdd.exe 93 PID 4328 wrote to memory of 1280 4328 7ppdd.exe 93 PID 4328 wrote to memory of 1280 4328 7ppdd.exe 93 PID 1280 wrote to memory of 5008 1280 rrlllll.exe 94 PID 1280 wrote to memory of 5008 1280 rrlllll.exe 94 PID 1280 wrote to memory of 5008 1280 rrlllll.exe 94 PID 5008 wrote to memory of 1792 5008 tbbhhb.exe 95 PID 5008 wrote to memory of 1792 5008 tbbhhb.exe 95 PID 5008 wrote to memory of 1792 5008 tbbhhb.exe 95 PID 1792 wrote to memory of 4016 1792 fxlllrr.exe 96 PID 1792 wrote to memory of 4016 1792 fxlllrr.exe 96 PID 1792 wrote to memory of 4016 1792 fxlllrr.exe 96 PID 4016 wrote to memory of 3968 4016 1bnhhh.exe 97 PID 4016 wrote to memory of 3968 4016 1bnhhh.exe 97 PID 4016 wrote to memory of 3968 4016 1bnhhh.exe 97 PID 3968 wrote to memory of 4636 3968 vjvdd.exe 98 PID 3968 wrote to memory of 4636 3968 vjvdd.exe 98 PID 3968 wrote to memory of 4636 3968 vjvdd.exe 98 PID 4636 wrote to memory of 3392 4636 ffxxllx.exe 99 PID 4636 wrote to memory of 3392 4636 ffxxllx.exe 99 PID 4636 wrote to memory of 3392 4636 ffxxllx.exe 99 PID 3392 wrote to memory of 3356 3392 3djdd.exe 100 PID 3392 wrote to memory of 3356 3392 3djdd.exe 100 PID 3392 wrote to memory of 3356 3392 3djdd.exe 100 PID 3356 wrote to memory of 1948 3356 jvddd.exe 101 PID 3356 wrote to memory of 1948 3356 jvddd.exe 101 PID 3356 wrote to memory of 1948 3356 jvddd.exe 101 PID 1948 wrote to memory of 3580 1948 rrxrrxl.exe 102 PID 1948 wrote to memory of 3580 1948 rrxrrxl.exe 102 PID 1948 wrote to memory of 3580 1948 rrxrrxl.exe 102 PID 3580 wrote to memory of 2828 3580 vjvvv.exe 103 PID 3580 wrote to memory of 2828 3580 vjvvv.exe 103 PID 3580 wrote to memory of 2828 3580 vjvvv.exe 103 PID 2828 wrote to memory of 4888 2828 hnnttn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe"C:\Users\Admin\AppData\Local\Temp\b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\dddjj.exec:\dddjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\fflfxxf.exec:\fflfxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\pvvvj.exec:\pvvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\fxrrlrr.exec:\fxrrlrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\rfrlffx.exec:\rfrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\xxfxrrf.exec:\xxfxrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\bntnnn.exec:\bntnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\vpvvv.exec:\vpvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\xxrrllf.exec:\xxrrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\7ppdd.exec:\7ppdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\rrlllll.exec:\rrlllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\tbbhhb.exec:\tbbhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\fxlllrr.exec:\fxlllrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\1bnhhh.exec:\1bnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\vjvdd.exec:\vjvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\ffxxllx.exec:\ffxxllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\3djdd.exec:\3djdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\jvddd.exec:\jvddd.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\rrxrrxl.exec:\rrxrrxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\vjvvv.exec:\vjvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\hnnttn.exec:\hnnttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\pjvdj.exec:\pjvdj.exe23⤵
- Executes dropped EXE
PID:4888 -
\??\c:\xfrlfff.exec:\xfrlfff.exe24⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nthhht.exec:\nthhht.exe25⤵
- Executes dropped EXE
PID:2428 -
\??\c:\flxrllf.exec:\flxrllf.exe26⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hbhhhh.exec:\hbhhhh.exe27⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pdpjd.exec:\pdpjd.exe28⤵
- Executes dropped EXE
PID:5072 -
\??\c:\hnhbtt.exec:\hnhbtt.exe29⤵
- Executes dropped EXE
PID:1832 -
\??\c:\3lllfff.exec:\3lllfff.exe30⤵
- Executes dropped EXE
PID:4540 -
\??\c:\btttth.exec:\btttth.exe31⤵
- Executes dropped EXE
PID:3664 -
\??\c:\pvdvv.exec:\pvdvv.exe32⤵
- Executes dropped EXE
PID:3956 -
\??\c:\pppjj.exec:\pppjj.exe33⤵
- Executes dropped EXE
PID:4084 -
\??\c:\vvpjv.exec:\vvpjv.exe34⤵
- Executes dropped EXE
PID:372 -
\??\c:\htbtnb.exec:\htbtnb.exe35⤵
- Executes dropped EXE
PID:4260 -
\??\c:\ddppp.exec:\ddppp.exe36⤵
- Executes dropped EXE
PID:4284 -
\??\c:\frfxrrl.exec:\frfxrrl.exe37⤵
- Executes dropped EXE
PID:4008 -
\??\c:\llrffff.exec:\llrffff.exe38⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ddddv.exec:\ddddv.exe39⤵
- Executes dropped EXE
PID:1260 -
\??\c:\flxxxff.exec:\flxxxff.exe40⤵
- Executes dropped EXE
PID:3984 -
\??\c:\7xxxrxx.exec:\7xxxrxx.exe41⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dpddj.exec:\dpddj.exe42⤵
- Executes dropped EXE
PID:1068 -
\??\c:\ppdvv.exec:\ppdvv.exe43⤵
- Executes dropped EXE
PID:4384 -
\??\c:\xxxrrlf.exec:\xxxrrlf.exe44⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ddppv.exec:\ddppv.exe45⤵
- Executes dropped EXE
PID:3820 -
\??\c:\jvdvp.exec:\jvdvp.exe46⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xlflrlx.exec:\xlflrlx.exe47⤵
- Executes dropped EXE
PID:3660 -
\??\c:\1hnnhn.exec:\1hnnhn.exe48⤵
- Executes dropped EXE
PID:4072 -
\??\c:\dvpjd.exec:\dvpjd.exe49⤵
- Executes dropped EXE
PID:4932 -
\??\c:\pddjd.exec:\pddjd.exe50⤵
- Executes dropped EXE
PID:3944 -
\??\c:\7fllrxf.exec:\7fllrxf.exe51⤵
- Executes dropped EXE
PID:4596 -
\??\c:\nhtnbt.exec:\nhtnbt.exe52⤵
- Executes dropped EXE
PID:4524 -
\??\c:\vjvvd.exec:\vjvvd.exe53⤵
- Executes dropped EXE
PID:4832 -
\??\c:\vvpjd.exec:\vvpjd.exe54⤵
- Executes dropped EXE
PID:712 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe55⤵
- Executes dropped EXE
PID:3412 -
\??\c:\nhnhbb.exec:\nhnhbb.exe56⤵
- Executes dropped EXE
PID:1444 -
\??\c:\nhhbtb.exec:\nhhbtb.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\5pppj.exec:\5pppj.exe58⤵
- Executes dropped EXE
PID:4724 -
\??\c:\5xxrrrr.exec:\5xxrrrr.exe59⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hhnntt.exec:\hhnntt.exe60⤵
- Executes dropped EXE
PID:1416 -
\??\c:\pjdvv.exec:\pjdvv.exe61⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ppddv.exec:\ppddv.exe62⤵
- Executes dropped EXE
PID:5008 -
\??\c:\flrlffl.exec:\flrlffl.exe63⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hbttnn.exec:\hbttnn.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3252 -
\??\c:\tttnhh.exec:\tttnhh.exe65⤵
- Executes dropped EXE
PID:4016 -
\??\c:\9vvpj.exec:\9vvpj.exe66⤵PID:2724
-
\??\c:\7dpjv.exec:\7dpjv.exe67⤵PID:2704
-
\??\c:\lfllfff.exec:\lfllfff.exe68⤵PID:3676
-
\??\c:\bthbtt.exec:\bthbtt.exe69⤵PID:3392
-
\??\c:\jjdvp.exec:\jjdvp.exe70⤵PID:3356
-
\??\c:\pvjjj.exec:\pvjjj.exe71⤵PID:2008
-
\??\c:\9xffflr.exec:\9xffflr.exe72⤵PID:4872
-
\??\c:\nhtbhh.exec:\nhtbhh.exe73⤵PID:4000
-
\??\c:\9vdvv.exec:\9vdvv.exe74⤵PID:3580
-
\??\c:\xrffxxr.exec:\xrffxxr.exe75⤵PID:3852
-
\??\c:\7lxrxfx.exec:\7lxrxfx.exe76⤵PID:3464
-
\??\c:\jjdpd.exec:\jjdpd.exe77⤵PID:992
-
\??\c:\flfxrxx.exec:\flfxrxx.exe78⤵PID:2216
-
\??\c:\7hnhhh.exec:\7hnhhh.exe79⤵PID:1496
-
\??\c:\5jpjj.exec:\5jpjj.exe80⤵PID:3640
-
\??\c:\vpjdd.exec:\vpjdd.exe81⤵PID:4900
-
\??\c:\rrfrxxf.exec:\rrfrxxf.exe82⤵PID:5072
-
\??\c:\hbttbb.exec:\hbttbb.exe83⤵PID:1832
-
\??\c:\pjjdv.exec:\pjjdv.exe84⤵PID:960
-
\??\c:\llffxfr.exec:\llffxfr.exe85⤵PID:2852
-
\??\c:\flxxrrx.exec:\flxxrrx.exe86⤵PID:3632
-
\??\c:\tnttnt.exec:\tnttnt.exe87⤵PID:3956
-
\??\c:\vdpjd.exec:\vdpjd.exe88⤵PID:3972
-
\??\c:\xxrfffx.exec:\xxrfffx.exe89⤵PID:4452
-
\??\c:\lfrlllf.exec:\lfrlllf.exe90⤵PID:4260
-
\??\c:\tntthh.exec:\tntthh.exe91⤵PID:4284
-
\??\c:\djvpp.exec:\djvpp.exe92⤵PID:4104
-
\??\c:\vpdvv.exec:\vpdvv.exe93⤵PID:3116
-
\??\c:\llrlfff.exec:\llrlfff.exe94⤵PID:1260
-
\??\c:\hhtnnn.exec:\hhtnnn.exe95⤵PID:3980
-
\??\c:\7hnhhh.exec:\7hnhhh.exe96⤵PID:3524
-
\??\c:\dpjdv.exec:\dpjdv.exe97⤵PID:4396
-
\??\c:\lxlrfff.exec:\lxlrfff.exe98⤵PID:4616
-
\??\c:\hbhbbb.exec:\hbhbbb.exe99⤵PID:3960
-
\??\c:\hthbtb.exec:\hthbtb.exe100⤵PID:2580
-
\??\c:\vpdvp.exec:\vpdvp.exe101⤵PID:3872
-
\??\c:\llrlllf.exec:\llrlllf.exe102⤵PID:772
-
\??\c:\nhhbtt.exec:\nhhbtt.exe103⤵PID:2848
-
\??\c:\thhthn.exec:\thhthn.exe104⤵PID:4156
-
\??\c:\3ddvv.exec:\3ddvv.exe105⤵
- System Location Discovery: System Language Discovery
PID:3124 -
\??\c:\rllfffx.exec:\rllfffx.exe106⤵PID:2624
-
\??\c:\rflffff.exec:\rflffff.exe107⤵PID:3836
-
\??\c:\9tbbbb.exec:\9tbbbb.exe108⤵PID:1016
-
\??\c:\dvpjp.exec:\dvpjp.exe109⤵PID:3596
-
\??\c:\7rxrrrr.exec:\7rxrrrr.exe110⤵PID:3056
-
\??\c:\lrffxxx.exec:\lrffxxx.exe111⤵PID:1680
-
\??\c:\bnttnn.exec:\bnttnn.exe112⤵PID:1148
-
\??\c:\3jppp.exec:\3jppp.exe113⤵PID:1108
-
\??\c:\rfrrlll.exec:\rfrrlll.exe114⤵PID:1060
-
\??\c:\xrllxxf.exec:\xrllxxf.exe115⤵PID:3864
-
\??\c:\tnhhtt.exec:\tnhhtt.exe116⤵PID:3460
-
\??\c:\vpjdd.exec:\vpjdd.exe117⤵PID:1572
-
\??\c:\rxxxffx.exec:\rxxxffx.exe118⤵PID:2192
-
\??\c:\hbnbnn.exec:\hbnbnn.exe119⤵PID:4704
-
\??\c:\9hnttt.exec:\9hnttt.exe120⤵PID:4508
-
\??\c:\7dvvj.exec:\7dvvj.exe121⤵PID:4232
-
\??\c:\ffrlllf.exec:\ffrlllf.exe122⤵PID:3432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-