Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36108572de8ddd10dcc98714d76e7c8ab8a4c21e2dd693f9eb6dc18e1073755eN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
36108572de8ddd10dcc98714d76e7c8ab8a4c21e2dd693f9eb6dc18e1073755eN.exe
-
Size
347KB
-
MD5
a12abc64a059e3577ecc82cf813f1dd0
-
SHA1
51413528022f304de751bd671bd21bab38bb170f
-
SHA256
36108572de8ddd10dcc98714d76e7c8ab8a4c21e2dd693f9eb6dc18e1073755e
-
SHA512
9d568cba1d1c3acacbf62391119ef7fdfa81629127341423071c73631650a5fd15d738b97a21078bc3c30644be912b3f72380208407d3de0e7c76bfdabdddee5
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAp:l7TcbWXZshJX2VGdp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3276-4-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4916-9-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4748-15-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3628-23-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/924-29-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1272-33-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1972-39-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4840-46-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2152-55-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4856-66-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4576-76-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/660-84-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3472-91-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1236-90-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/424-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4844-108-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1480-117-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4044-133-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1176-138-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2568-115-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4980-153-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3268-160-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3648-168-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1492-177-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4836-191-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1060-195-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4600-202-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/220-211-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4200-215-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4308-219-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3152-229-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4396-233-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4484-237-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2372-241-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1692-254-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3348-270-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4856-274-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1960-281-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2940-297-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3392-301-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2480-308-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4936-315-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/528-322-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3476-326-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1368-351-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3144-361-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1216-375-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2304-398-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4840-441-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1668-448-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/932-458-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4352-492-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4160-496-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3956-551-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/620-615-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1516-640-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2140-650-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3932-840-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4432-949-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3380-1077-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2300-1449-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2152-1613-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4916 fxllllx.exe 4748 vpjdv.exe 3628 fxxllxf.exe 924 rfffxxx.exe 1272 vjddv.exe 1972 hnhhnn.exe 4840 rrrrlrr.exe 3836 hhbbtn.exe 2152 lrrrlrx.exe 3348 3xffflf.exe 4856 9fllrrl.exe 1584 nntnnn.exe 4576 3dvvp.exe 660 rfrrrxx.exe 1236 7vjpd.exe 3472 3jddv.exe 424 bbhhtt.exe 4844 jvjpv.exe 1480 ffrxllr.exe 2568 bthhtn.exe 760 lrfxfff.exe 3204 nntnnh.exe 4044 frxrrrr.exe 1176 xxrrffr.exe 2936 bhttnn.exe 4980 vvpvv.exe 3268 ddjvj.exe 5036 dvdvd.exe 3648 3lxxrxx.exe 1492 lllllrr.exe 3416 pjppp.exe 2972 5lrlllf.exe 4836 hhhbtt.exe 1060 jdpjj.exe 1976 3frrflr.exe 4600 hhbbtb.exe 2720 nnbbtb.exe 4804 vppjj.exe 220 rxxrrff.exe 4200 hhnnhn.exe 4308 pvvvd.exe 4304 tttbhh.exe 4812 7nnhhn.exe 3152 xrxrrrl.exe 4396 tnttnn.exe 4484 pjpdd.exe 2372 jdvjv.exe 2704 xflllrr.exe 1008 tnhhhn.exe 1332 xxfrrrr.exe 1692 jdddd.exe 4840 rlxrrxx.exe 4336 hnbbbb.exe 1668 bbbbbh.exe 744 jjddp.exe 3348 ddpjj.exe 4856 lrrxfll.exe 4692 hhhbbb.exe 1960 vpvjp.exe 3968 xrlflrx.exe 5040 tthbbb.exe 1200 nnbbhn.exe 2212 vdvpj.exe 2940 5fxrlll.exe -
resource yara_rule behavioral2/memory/3276-4-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4916-9-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4748-15-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3628-23-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/924-29-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1272-33-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1972-39-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4840-46-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2152-55-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4856-66-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4576-76-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/660-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3472-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1236-90-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/424-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4844-108-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1480-109-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1480-117-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3204-127-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4044-133-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1176-138-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2568-115-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4980-153-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3268-160-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3648-168-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1492-177-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4836-187-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4836-191-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1060-195-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4600-202-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/220-211-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4200-215-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4308-219-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3152-229-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4396-233-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4484-237-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2372-241-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1692-254-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3348-270-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4856-274-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1960-281-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2940-297-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3392-301-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2480-308-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4936-315-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/528-322-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3476-326-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1368-351-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3144-361-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/116-362-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1216-375-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1428-382-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2304-398-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4840-441-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1668-448-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/932-458-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4352-492-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4160-496-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3956-551-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/620-615-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1516-640-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2140-650-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3932-840-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4432-949-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3276 wrote to memory of 4916 3276 36108572de8ddd10dcc98714d76e7c8ab8a4c21e2dd693f9eb6dc18e1073755eN.exe 83 PID 3276 wrote to memory of 4916 3276 36108572de8ddd10dcc98714d76e7c8ab8a4c21e2dd693f9eb6dc18e1073755eN.exe 83 PID 3276 wrote to memory of 4916 3276 36108572de8ddd10dcc98714d76e7c8ab8a4c21e2dd693f9eb6dc18e1073755eN.exe 83 PID 4916 wrote to memory of 4748 4916 fxllllx.exe 84 PID 4916 wrote to memory of 4748 4916 fxllllx.exe 84 PID 4916 wrote to memory of 4748 4916 fxllllx.exe 84 PID 4748 wrote to memory of 3628 4748 vpjdv.exe 85 PID 4748 wrote to memory of 3628 4748 vpjdv.exe 85 PID 4748 wrote to memory of 3628 4748 vpjdv.exe 85 PID 3628 wrote to memory of 924 3628 fxxllxf.exe 86 PID 3628 wrote to memory of 924 3628 fxxllxf.exe 86 PID 3628 wrote to memory of 924 3628 fxxllxf.exe 86 PID 924 wrote to memory of 1272 924 rfffxxx.exe 87 PID 924 wrote to memory of 1272 924 rfffxxx.exe 87 PID 924 wrote to memory of 1272 924 rfffxxx.exe 87 PID 1272 wrote to memory of 1972 1272 vjddv.exe 88 PID 1272 wrote to memory of 1972 1272 vjddv.exe 88 PID 1272 wrote to memory of 1972 1272 vjddv.exe 88 PID 1972 wrote to memory of 4840 1972 hnhhnn.exe 89 PID 1972 wrote to memory of 4840 1972 hnhhnn.exe 89 PID 1972 wrote to memory of 4840 1972 hnhhnn.exe 89 PID 4840 wrote to memory of 3836 4840 rrrrlrr.exe 90 PID 4840 wrote to memory of 3836 4840 rrrrlrr.exe 90 PID 4840 wrote to memory of 3836 4840 rrrrlrr.exe 90 PID 3836 wrote to memory of 2152 3836 hhbbtn.exe 91 PID 3836 wrote to memory of 2152 3836 hhbbtn.exe 91 PID 3836 wrote to memory of 2152 3836 hhbbtn.exe 91 PID 2152 wrote to memory of 3348 2152 lrrrlrx.exe 92 PID 2152 wrote to memory of 3348 2152 lrrrlrx.exe 92 PID 2152 wrote to memory of 3348 2152 lrrrlrx.exe 92 PID 3348 wrote to memory of 4856 3348 3xffflf.exe 93 PID 3348 wrote to memory of 4856 3348 3xffflf.exe 93 PID 3348 wrote to memory of 4856 3348 3xffflf.exe 93 PID 4856 wrote to memory of 1584 4856 9fllrrl.exe 94 PID 4856 wrote to memory of 1584 4856 9fllrrl.exe 94 PID 4856 wrote to memory of 1584 4856 9fllrrl.exe 94 PID 1584 wrote to memory of 4576 1584 nntnnn.exe 95 PID 1584 wrote to memory of 4576 1584 nntnnn.exe 95 PID 1584 wrote to memory of 4576 1584 nntnnn.exe 95 PID 4576 wrote to memory of 660 4576 3dvvp.exe 96 PID 4576 wrote to memory of 660 4576 3dvvp.exe 96 PID 4576 wrote to memory of 660 4576 3dvvp.exe 96 PID 660 wrote to memory of 1236 660 rfrrrxx.exe 97 PID 660 wrote to memory of 1236 660 rfrrrxx.exe 97 PID 660 wrote to memory of 1236 660 rfrrrxx.exe 97 PID 1236 wrote to memory of 3472 1236 7vjpd.exe 98 PID 1236 wrote to memory of 3472 1236 7vjpd.exe 98 PID 1236 wrote to memory of 3472 1236 7vjpd.exe 98 PID 3472 wrote to memory of 424 3472 3jddv.exe 99 PID 3472 wrote to memory of 424 3472 3jddv.exe 99 PID 3472 wrote to memory of 424 3472 3jddv.exe 99 PID 424 wrote to memory of 4844 424 bbhhtt.exe 100 PID 424 wrote to memory of 4844 424 bbhhtt.exe 100 PID 424 wrote to memory of 4844 424 bbhhtt.exe 100 PID 4844 wrote to memory of 1480 4844 jvjpv.exe 101 PID 4844 wrote to memory of 1480 4844 jvjpv.exe 101 PID 4844 wrote to memory of 1480 4844 jvjpv.exe 101 PID 1480 wrote to memory of 2568 1480 ffrxllr.exe 102 PID 1480 wrote to memory of 2568 1480 ffrxllr.exe 102 PID 1480 wrote to memory of 2568 1480 ffrxllr.exe 102 PID 2568 wrote to memory of 760 2568 bthhtn.exe 103 PID 2568 wrote to memory of 760 2568 bthhtn.exe 103 PID 2568 wrote to memory of 760 2568 bthhtn.exe 103 PID 760 wrote to memory of 3204 760 lrfxfff.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\36108572de8ddd10dcc98714d76e7c8ab8a4c21e2dd693f9eb6dc18e1073755eN.exe"C:\Users\Admin\AppData\Local\Temp\36108572de8ddd10dcc98714d76e7c8ab8a4c21e2dd693f9eb6dc18e1073755eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\fxllllx.exec:\fxllllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\vpjdv.exec:\vpjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\fxxllxf.exec:\fxxllxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\rfffxxx.exec:\rfffxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\vjddv.exec:\vjddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\hnhhnn.exec:\hnhhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\hhbbtn.exec:\hhbbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\lrrrlrx.exec:\lrrrlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\3xffflf.exec:\3xffflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\9fllrrl.exec:\9fllrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\nntnnn.exec:\nntnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\3dvvp.exec:\3dvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\rfrrrxx.exec:\rfrrrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\7vjpd.exec:\7vjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\3jddv.exec:\3jddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\bbhhtt.exec:\bbhhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
\??\c:\jvjpv.exec:\jvjpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\ffrxllr.exec:\ffrxllr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\bthhtn.exec:\bthhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lrfxfff.exec:\lrfxfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\nntnnh.exec:\nntnnh.exe23⤵
- Executes dropped EXE
PID:3204 -
\??\c:\frxrrrr.exec:\frxrrrr.exe24⤵
- Executes dropped EXE
PID:4044 -
\??\c:\xxrrffr.exec:\xxrrffr.exe25⤵
- Executes dropped EXE
PID:1176 -
\??\c:\bhttnn.exec:\bhttnn.exe26⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vvpvv.exec:\vvpvv.exe27⤵
- Executes dropped EXE
PID:4980 -
\??\c:\ddjvj.exec:\ddjvj.exe28⤵
- Executes dropped EXE
PID:3268 -
\??\c:\dvdvd.exec:\dvdvd.exe29⤵
- Executes dropped EXE
PID:5036 -
\??\c:\3lxxrxx.exec:\3lxxrxx.exe30⤵
- Executes dropped EXE
PID:3648 -
\??\c:\lllllrr.exec:\lllllrr.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1492 -
\??\c:\pjppp.exec:\pjppp.exe32⤵
- Executes dropped EXE
PID:3416 -
\??\c:\5lrlllf.exec:\5lrlllf.exe33⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hhhbtt.exec:\hhhbtt.exe34⤵
- Executes dropped EXE
PID:4836 -
\??\c:\jdpjj.exec:\jdpjj.exe35⤵
- Executes dropped EXE
PID:1060 -
\??\c:\3frrflr.exec:\3frrflr.exe36⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hhbbtb.exec:\hhbbtb.exe37⤵
- Executes dropped EXE
PID:4600 -
\??\c:\nnbbtb.exec:\nnbbtb.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vppjj.exec:\vppjj.exe39⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rxxrrff.exec:\rxxrrff.exe40⤵
- Executes dropped EXE
PID:220 -
\??\c:\hhnnhn.exec:\hhnnhn.exe41⤵
- Executes dropped EXE
PID:4200 -
\??\c:\pvvvd.exec:\pvvvd.exe42⤵
- Executes dropped EXE
PID:4308 -
\??\c:\tttbhh.exec:\tttbhh.exe43⤵
- Executes dropped EXE
PID:4304 -
\??\c:\7nnhhn.exec:\7nnhhn.exe44⤵
- Executes dropped EXE
PID:4812 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe45⤵
- Executes dropped EXE
PID:3152 -
\??\c:\tnttnn.exec:\tnttnn.exe46⤵
- Executes dropped EXE
PID:4396 -
\??\c:\pjpdd.exec:\pjpdd.exe47⤵
- Executes dropped EXE
PID:4484 -
\??\c:\jdvjv.exec:\jdvjv.exe48⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xflllrr.exec:\xflllrr.exe49⤵
- Executes dropped EXE
PID:2704 -
\??\c:\tnhhhn.exec:\tnhhhn.exe50⤵
- Executes dropped EXE
PID:1008 -
\??\c:\xxfrrrr.exec:\xxfrrrr.exe51⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jdddd.exec:\jdddd.exe52⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rlxrrxx.exec:\rlxrrxx.exe53⤵
- Executes dropped EXE
PID:4840 -
\??\c:\hnbbbb.exec:\hnbbbb.exe54⤵
- Executes dropped EXE
PID:4336 -
\??\c:\bbbbbh.exec:\bbbbbh.exe55⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jjddp.exec:\jjddp.exe56⤵
- Executes dropped EXE
PID:744 -
\??\c:\ddpjj.exec:\ddpjj.exe57⤵
- Executes dropped EXE
PID:3348 -
\??\c:\lrrxfll.exec:\lrrxfll.exe58⤵
- Executes dropped EXE
PID:4856 -
\??\c:\hhhbbb.exec:\hhhbbb.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4692 -
\??\c:\vpvjp.exec:\vpvjp.exe60⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xrlflrx.exec:\xrlflrx.exe61⤵
- Executes dropped EXE
PID:3968 -
\??\c:\tthbbb.exec:\tthbbb.exe62⤵
- Executes dropped EXE
PID:5040 -
\??\c:\nnbbhn.exec:\nnbbhn.exe63⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vdvpj.exec:\vdvpj.exe64⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5fxrlll.exec:\5fxrlll.exe65⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rfrlffr.exec:\rfrlffr.exe66⤵PID:3392
-
\??\c:\hbnhhh.exec:\hbnhhh.exe67⤵PID:648
-
\??\c:\fflllrr.exec:\fflllrr.exe68⤵PID:2480
-
\??\c:\btbtnn.exec:\btbtnn.exe69⤵PID:968
-
\??\c:\7jjvj.exec:\7jjvj.exe70⤵PID:4936
-
\??\c:\pvjdd.exec:\pvjdd.exe71⤵PID:3180
-
\??\c:\rrxrxxx.exec:\rrxrxxx.exe72⤵PID:528
-
\??\c:\thtntn.exec:\thtntn.exe73⤵PID:3476
-
\??\c:\vpvdd.exec:\vpvdd.exe74⤵PID:432
-
\??\c:\rllxxxx.exec:\rllxxxx.exe75⤵PID:4128
-
\??\c:\htbbbb.exec:\htbbbb.exe76⤵PID:4364
-
\??\c:\ddpjd.exec:\ddpjd.exe77⤵PID:1176
-
\??\c:\lfrlfff.exec:\lfrlfff.exe78⤵PID:2976
-
\??\c:\rxlxfxr.exec:\rxlxfxr.exe79⤵PID:4568
-
\??\c:\nttbtn.exec:\nttbtn.exe80⤵PID:4980
-
\??\c:\jdppp.exec:\jdppp.exe81⤵PID:1368
-
\??\c:\rllxffx.exec:\rllxffx.exe82⤵PID:2036
-
\??\c:\hhhhhh.exec:\hhhhhh.exe83⤵PID:4984
-
\??\c:\pvjjj.exec:\pvjjj.exe84⤵PID:3144
-
\??\c:\fffllrr.exec:\fffllrr.exe85⤵PID:116
-
\??\c:\5fffrxf.exec:\5fffrxf.exe86⤵PID:3024
-
\??\c:\btbttt.exec:\btbttt.exe87⤵PID:1532
-
\??\c:\djvvv.exec:\djvvv.exe88⤵PID:1216
-
\??\c:\lrfxrxx.exec:\lrfxrxx.exe89⤵
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\lfxfxlr.exec:\lfxfxlr.exe90⤵PID:2612
-
\??\c:\thhhbh.exec:\thhhbh.exe91⤵PID:1428
-
\??\c:\jpjjd.exec:\jpjjd.exe92⤵PID:464
-
\??\c:\djvpj.exec:\djvpj.exe93⤵PID:4784
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe94⤵PID:3488
-
\??\c:\1ttbth.exec:\1ttbth.exe95⤵PID:2304
-
\??\c:\dvjdp.exec:\dvjdp.exe96⤵PID:4424
-
\??\c:\ddjjj.exec:\ddjjj.exe97⤵PID:5060
-
\??\c:\ffrrllf.exec:\ffrrllf.exe98⤵PID:4916
-
\??\c:\tntnhb.exec:\tntnhb.exe99⤵PID:1744
-
\??\c:\3ppjd.exec:\3ppjd.exe100⤵PID:3152
-
\??\c:\lllxxrf.exec:\lllxxrf.exe101⤵PID:2300
-
\??\c:\lfffffx.exec:\lfffffx.exe102⤵PID:4548
-
\??\c:\nhhhnn.exec:\nhhhnn.exe103⤵PID:924
-
\??\c:\dvpjd.exec:\dvpjd.exe104⤵PID:2072
-
\??\c:\rfrxxxx.exec:\rfrxxxx.exe105⤵PID:3236
-
\??\c:\hnnnnn.exec:\hnnnnn.exe106⤵PID:4868
-
\??\c:\3ppjd.exec:\3ppjd.exe107⤵PID:3016
-
\??\c:\7pddv.exec:\7pddv.exe108⤵PID:3940
-
\??\c:\xxrlllf.exec:\xxrlllf.exe109⤵PID:4840
-
\??\c:\1fxxrrl.exec:\1fxxrrl.exe110⤵PID:4336
-
\??\c:\hthbbb.exec:\hthbbb.exe111⤵PID:1668
-
\??\c:\pdjjv.exec:\pdjjv.exe112⤵PID:744
-
\??\c:\5xxrrlf.exec:\5xxrrlf.exe113⤵PID:3348
-
\??\c:\xrlffff.exec:\xrlffff.exe114⤵PID:932
-
\??\c:\hbbhbb.exec:\hbbhbb.exe115⤵PID:2468
-
\??\c:\vpvpp.exec:\vpvpp.exe116⤵PID:1584
-
\??\c:\lxrrlrr.exec:\lxrrlrr.exe117⤵PID:3568
-
\??\c:\lfrllll.exec:\lfrllll.exe118⤵PID:444
-
\??\c:\bbbbbh.exec:\bbbbbh.exe119⤵PID:5040
-
\??\c:\ppjdv.exec:\ppjdv.exe120⤵PID:1200
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe121⤵PID:1376
-
\??\c:\xfrlfff.exec:\xfrlfff.exe122⤵PID:1464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-