Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe
-
Size
453KB
-
MD5
df2cf06e57c16f7af9c8c7924a9916ef
-
SHA1
cad7859621cabac31e7d83a62a921d898d1482cf
-
SHA256
64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c
-
SHA512
35e3cbfd2f521438225a6e60e88cea3bd9929091c69592c6439b76abeefb31a3b708da9fb9371bea115154bac7ea3c6a414773fbea85962bc3be965bd508fadf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1196-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/828-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-1321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4500 lrffxxx.exe 684 dppvp.exe 3696 xxllrrf.exe 1928 rrxlrrx.exe 5020 5ffflrx.exe 3916 tthhtb.exe 4740 bbhbbb.exe 3428 ppvdv.exe 4756 llllxxr.exe 1236 bnhbtn.exe 1376 tnhbtt.exe 1760 lflfxrx.exe 2608 ppvdv.exe 2076 3ttnnn.exe 860 pvjdv.exe 2836 dppjd.exe 3204 vdvpj.exe 1512 fllffll.exe 1332 nnttnn.exe 2404 xxxxrlf.exe 2388 xfllllx.exe 3500 vvpjj.exe 2812 lxxxrrl.exe 828 9hbbhh.exe 4724 lrxlxlx.exe 3168 hbbnhb.exe 396 bhnhbt.exe 1280 pppjd.exe 8 nnttbb.exe 2684 3ffflll.exe 4720 dvppj.exe 2916 djvjd.exe 1696 nnbttn.exe 5076 vppjv.exe 540 fxxfxxl.exe 4184 xrrlxlx.exe 4936 hhnbhb.exe 3236 fffxrll.exe 5016 bbtnhh.exe 944 jvvpp.exe 4560 tbbttt.exe 1756 9hbtnn.exe 4748 lxxrllf.exe 3668 rfxlrrf.exe 2672 bbtnhb.exe 2052 djjvp.exe 2224 rlfxxxr.exe 1132 bbnhhh.exe 2616 hntttb.exe 3124 xlllflf.exe 4088 bntnnn.exe 1804 ppjdp.exe 1644 pjjvp.exe 5020 flfffll.exe 2180 1hhbtn.exe 3916 7jpjj.exe 1900 xllxrlf.exe 1116 nhhtnb.exe 3516 9ttnhh.exe 4440 dvjdd.exe 4804 1lrlrxx.exe 1244 nbnbbt.exe 1532 dppdd.exe 2516 9xxrrrr.exe -
resource yara_rule behavioral2/memory/1196-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/828-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-695-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 4500 1196 64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe 83 PID 1196 wrote to memory of 4500 1196 64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe 83 PID 1196 wrote to memory of 4500 1196 64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe 83 PID 4500 wrote to memory of 684 4500 lrffxxx.exe 84 PID 4500 wrote to memory of 684 4500 lrffxxx.exe 84 PID 4500 wrote to memory of 684 4500 lrffxxx.exe 84 PID 684 wrote to memory of 3696 684 dppvp.exe 85 PID 684 wrote to memory of 3696 684 dppvp.exe 85 PID 684 wrote to memory of 3696 684 dppvp.exe 85 PID 3696 wrote to memory of 1928 3696 xxllrrf.exe 86 PID 3696 wrote to memory of 1928 3696 xxllrrf.exe 86 PID 3696 wrote to memory of 1928 3696 xxllrrf.exe 86 PID 1928 wrote to memory of 5020 1928 rrxlrrx.exe 87 PID 1928 wrote to memory of 5020 1928 rrxlrrx.exe 87 PID 1928 wrote to memory of 5020 1928 rrxlrrx.exe 87 PID 5020 wrote to memory of 3916 5020 5ffflrx.exe 88 PID 5020 wrote to memory of 3916 5020 5ffflrx.exe 88 PID 5020 wrote to memory of 3916 5020 5ffflrx.exe 88 PID 3916 wrote to memory of 4740 3916 tthhtb.exe 89 PID 3916 wrote to memory of 4740 3916 tthhtb.exe 89 PID 3916 wrote to memory of 4740 3916 tthhtb.exe 89 PID 4740 wrote to memory of 3428 4740 bbhbbb.exe 90 PID 4740 wrote to memory of 3428 4740 bbhbbb.exe 90 PID 4740 wrote to memory of 3428 4740 bbhbbb.exe 90 PID 3428 wrote to memory of 4756 3428 ppvdv.exe 91 PID 3428 wrote to memory of 4756 3428 ppvdv.exe 91 PID 3428 wrote to memory of 4756 3428 ppvdv.exe 91 PID 4756 wrote to memory of 1236 4756 llllxxr.exe 92 PID 4756 wrote to memory of 1236 4756 llllxxr.exe 92 PID 4756 wrote to memory of 1236 4756 llllxxr.exe 92 PID 1236 wrote to memory of 1376 1236 bnhbtn.exe 93 PID 1236 wrote to memory of 1376 1236 bnhbtn.exe 93 PID 1236 wrote to memory of 1376 1236 bnhbtn.exe 93 PID 1376 wrote to memory of 1760 1376 tnhbtt.exe 94 PID 1376 wrote to memory of 1760 1376 tnhbtt.exe 94 PID 1376 wrote to memory of 1760 1376 tnhbtt.exe 94 PID 1760 wrote to memory of 2608 1760 lflfxrx.exe 95 PID 1760 wrote to memory of 2608 1760 lflfxrx.exe 95 PID 1760 wrote to memory of 2608 1760 lflfxrx.exe 95 PID 2608 wrote to memory of 2076 2608 ppvdv.exe 96 PID 2608 wrote to memory of 2076 2608 ppvdv.exe 96 PID 2608 wrote to memory of 2076 2608 ppvdv.exe 96 PID 2076 wrote to memory of 860 2076 3ttnnn.exe 97 PID 2076 wrote to memory of 860 2076 3ttnnn.exe 97 PID 2076 wrote to memory of 860 2076 3ttnnn.exe 97 PID 860 wrote to memory of 2836 860 pvjdv.exe 98 PID 860 wrote to memory of 2836 860 pvjdv.exe 98 PID 860 wrote to memory of 2836 860 pvjdv.exe 98 PID 2836 wrote to memory of 3204 2836 dppjd.exe 99 PID 2836 wrote to memory of 3204 2836 dppjd.exe 99 PID 2836 wrote to memory of 3204 2836 dppjd.exe 99 PID 3204 wrote to memory of 1512 3204 vdvpj.exe 100 PID 3204 wrote to memory of 1512 3204 vdvpj.exe 100 PID 3204 wrote to memory of 1512 3204 vdvpj.exe 100 PID 1512 wrote to memory of 1332 1512 fllffll.exe 101 PID 1512 wrote to memory of 1332 1512 fllffll.exe 101 PID 1512 wrote to memory of 1332 1512 fllffll.exe 101 PID 1332 wrote to memory of 2404 1332 nnttnn.exe 102 PID 1332 wrote to memory of 2404 1332 nnttnn.exe 102 PID 1332 wrote to memory of 2404 1332 nnttnn.exe 102 PID 2404 wrote to memory of 2388 2404 xxxxrlf.exe 103 PID 2404 wrote to memory of 2388 2404 xxxxrlf.exe 103 PID 2404 wrote to memory of 2388 2404 xxxxrlf.exe 103 PID 2388 wrote to memory of 3500 2388 xfllllx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe"C:\Users\Admin\AppData\Local\Temp\64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\lrffxxx.exec:\lrffxxx.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\dppvp.exec:\dppvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\xxllrrf.exec:\xxllrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\rrxlrrx.exec:\rrxlrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\5ffflrx.exec:\5ffflrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\tthhtb.exec:\tthhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\bbhbbb.exec:\bbhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\ppvdv.exec:\ppvdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\llllxxr.exec:\llllxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\bnhbtn.exec:\bnhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\tnhbtt.exec:\tnhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\lflfxrx.exec:\lflfxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\ppvdv.exec:\ppvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\3ttnnn.exec:\3ttnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\pvjdv.exec:\pvjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\dppjd.exec:\dppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\vdvpj.exec:\vdvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\fllffll.exec:\fllffll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\nnttnn.exec:\nnttnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\xxxxrlf.exec:\xxxxrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\xfllllx.exec:\xfllllx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\vvpjj.exec:\vvpjj.exe23⤵
- Executes dropped EXE
PID:3500 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe24⤵
- Executes dropped EXE
PID:2812 -
\??\c:\9hbbhh.exec:\9hbbhh.exe25⤵
- Executes dropped EXE
PID:828 -
\??\c:\lrxlxlx.exec:\lrxlxlx.exe26⤵
- Executes dropped EXE
PID:4724 -
\??\c:\hbbnhb.exec:\hbbnhb.exe27⤵
- Executes dropped EXE
PID:3168 -
\??\c:\bhnhbt.exec:\bhnhbt.exe28⤵
- Executes dropped EXE
PID:396 -
\??\c:\pppjd.exec:\pppjd.exe29⤵
- Executes dropped EXE
PID:1280 -
\??\c:\nnttbb.exec:\nnttbb.exe30⤵
- Executes dropped EXE
PID:8 -
\??\c:\3ffflll.exec:\3ffflll.exe31⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dvppj.exec:\dvppj.exe32⤵
- Executes dropped EXE
PID:4720 -
\??\c:\djvjd.exec:\djvjd.exe33⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nnbttn.exec:\nnbttn.exe34⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vppjv.exec:\vppjv.exe35⤵
- Executes dropped EXE
PID:5076 -
\??\c:\fxxfxxl.exec:\fxxfxxl.exe36⤵
- Executes dropped EXE
PID:540 -
\??\c:\xrrlxlx.exec:\xrrlxlx.exe37⤵
- Executes dropped EXE
PID:4184 -
\??\c:\hhnbhb.exec:\hhnbhb.exe38⤵
- Executes dropped EXE
PID:4936 -
\??\c:\fffxrll.exec:\fffxrll.exe39⤵
- Executes dropped EXE
PID:3236 -
\??\c:\bbtnhh.exec:\bbtnhh.exe40⤵
- Executes dropped EXE
PID:5016 -
\??\c:\jvvpp.exec:\jvvpp.exe41⤵
- Executes dropped EXE
PID:944 -
\??\c:\tbbttt.exec:\tbbttt.exe42⤵
- Executes dropped EXE
PID:4560 -
\??\c:\9hbtnn.exec:\9hbtnn.exe43⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lxxrllf.exec:\lxxrllf.exe44⤵
- Executes dropped EXE
PID:4748 -
\??\c:\rfxlrrf.exec:\rfxlrrf.exe45⤵
- Executes dropped EXE
PID:3668 -
\??\c:\bbtnhb.exec:\bbtnhb.exe46⤵
- Executes dropped EXE
PID:2672 -
\??\c:\djjvp.exec:\djjvp.exe47⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe48⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bbnhhh.exec:\bbnhhh.exe49⤵
- Executes dropped EXE
PID:1132 -
\??\c:\hntttb.exec:\hntttb.exe50⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xlllflf.exec:\xlllflf.exe51⤵
- Executes dropped EXE
PID:3124 -
\??\c:\bntnnn.exec:\bntnnn.exe52⤵
- Executes dropped EXE
PID:4088 -
\??\c:\ppjdp.exec:\ppjdp.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1804 -
\??\c:\pjjvp.exec:\pjjvp.exe54⤵
- Executes dropped EXE
PID:1644 -
\??\c:\flfffll.exec:\flfffll.exe55⤵
- Executes dropped EXE
PID:5020 -
\??\c:\1hhbtn.exec:\1hhbtn.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\7jpjj.exec:\7jpjj.exe57⤵
- Executes dropped EXE
PID:3916 -
\??\c:\xllxrlf.exec:\xllxrlf.exe58⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nhhtnb.exec:\nhhtnb.exe59⤵
- Executes dropped EXE
PID:1116 -
\??\c:\9ttnhh.exec:\9ttnhh.exe60⤵
- Executes dropped EXE
PID:3516 -
\??\c:\dvjdd.exec:\dvjdd.exe61⤵
- Executes dropped EXE
PID:4440 -
\??\c:\1lrlrxx.exec:\1lrlrxx.exe62⤵
- Executes dropped EXE
PID:4804 -
\??\c:\nbnbbt.exec:\nbnbbt.exe63⤵
- Executes dropped EXE
PID:1244 -
\??\c:\dppdd.exec:\dppdd.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\9xxrrrr.exec:\9xxrrrr.exe65⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5bhbbb.exec:\5bhbbb.exe66⤵PID:3956
-
\??\c:\1hbnnn.exec:\1hbnnn.exe67⤵PID:2676
-
\??\c:\ppppv.exec:\ppppv.exe68⤵
- System Location Discovery: System Language Discovery
PID:5012 -
\??\c:\llfxllx.exec:\llfxllx.exe69⤵PID:4192
-
\??\c:\bbbbtt.exec:\bbbbtt.exe70⤵PID:1456
-
\??\c:\btbtbb.exec:\btbtbb.exe71⤵PID:4552
-
\??\c:\ppvdd.exec:\ppvdd.exe72⤵PID:4532
-
\??\c:\flxffxx.exec:\flxffxx.exe73⤵PID:1792
-
\??\c:\bntthh.exec:\bntthh.exe74⤵PID:3764
-
\??\c:\ttbbhh.exec:\ttbbhh.exe75⤵PID:836
-
\??\c:\jdjvv.exec:\jdjvv.exe76⤵PID:3636
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe77⤵PID:232
-
\??\c:\hthttn.exec:\hthttn.exe78⤵PID:2272
-
\??\c:\9jdvv.exec:\9jdvv.exe79⤵PID:2004
-
\??\c:\fflxlrf.exec:\fflxlrf.exe80⤵PID:4672
-
\??\c:\hhhbbt.exec:\hhhbbt.exe81⤵PID:3576
-
\??\c:\7dppj.exec:\7dppj.exe82⤵PID:2520
-
\??\c:\ppvvd.exec:\ppvvd.exe83⤵PID:704
-
\??\c:\rrrrllf.exec:\rrrrllf.exe84⤵PID:2740
-
\??\c:\bbtnhh.exec:\bbtnhh.exe85⤵PID:1880
-
\??\c:\3jppj.exec:\3jppj.exe86⤵PID:2384
-
\??\c:\lrrrllf.exec:\lrrrllf.exe87⤵
- System Location Discovery: System Language Discovery
PID:4844 -
\??\c:\tbtnnn.exec:\tbtnnn.exe88⤵PID:2116
-
\??\c:\jpdvd.exec:\jpdvd.exe89⤵PID:1280
-
\??\c:\lxfxrll.exec:\lxfxrll.exe90⤵PID:2436
-
\??\c:\rxxrrxr.exec:\rxxrrxr.exe91⤵PID:1628
-
\??\c:\tnhbbb.exec:\tnhbbb.exe92⤵PID:3376
-
\??\c:\ddjjd.exec:\ddjjd.exe93⤵PID:3004
-
\??\c:\xxfffff.exec:\xxfffff.exe94⤵PID:536
-
\??\c:\5tnhbb.exec:\5tnhbb.exe95⤵
- System Location Discovery: System Language Discovery
PID:4204 -
\??\c:\dpvvj.exec:\dpvvj.exe96⤵PID:992
-
\??\c:\rxxrrxx.exec:\rxxrrxx.exe97⤵PID:448
-
\??\c:\9ffxxrx.exec:\9ffxxrx.exe98⤵PID:1696
-
\??\c:\3httbb.exec:\3httbb.exe99⤵PID:5076
-
\??\c:\dvjjj.exec:\dvjjj.exe100⤵PID:1092
-
\??\c:\jpjjp.exec:\jpjjp.exe101⤵PID:4020
-
\??\c:\xxfflrl.exec:\xxfflrl.exe102⤵PID:4936
-
\??\c:\bbhhhh.exec:\bbhhhh.exe103⤵PID:3236
-
\??\c:\ddjdv.exec:\ddjdv.exe104⤵PID:5016
-
\??\c:\1lflrrf.exec:\1lflrrf.exe105⤵PID:944
-
\??\c:\9flllll.exec:\9flllll.exe106⤵PID:1960
-
\??\c:\nbtbth.exec:\nbtbth.exe107⤵PID:1756
-
\??\c:\dpvvv.exec:\dpvvv.exe108⤵PID:2392
-
\??\c:\llrrrrr.exec:\llrrrrr.exe109⤵PID:2044
-
\??\c:\hntbtn.exec:\hntbtn.exe110⤵PID:3304
-
\??\c:\1jjdd.exec:\1jjdd.exe111⤵PID:2052
-
\??\c:\xrrlffx.exec:\xrrlffx.exe112⤵PID:1008
-
\??\c:\lrrffll.exec:\lrrffll.exe113⤵PID:3256
-
\??\c:\5tnnnt.exec:\5tnnnt.exe114⤵PID:2616
-
\??\c:\tbbtnt.exec:\tbbtnt.exe115⤵PID:2664
-
\??\c:\djjjd.exec:\djjjd.exe116⤵PID:4752
-
\??\c:\fflllll.exec:\fflllll.exe117⤵PID:3800
-
\??\c:\7hnhbh.exec:\7hnhbh.exe118⤵PID:4032
-
\??\c:\ttnttt.exec:\ttnttt.exe119⤵PID:1484
-
\??\c:\dvdjv.exec:\dvdjv.exe120⤵PID:1500
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe121⤵PID:464
-
\??\c:\rllllll.exec:\rllllll.exe122⤵PID:3744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-