Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe
-
Size
454KB
-
MD5
dc7cc407183f084c26292a5b110276a3
-
SHA1
21619b269ef5d7ea50a7e21b7a9e4150939bfd66
-
SHA256
b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef
-
SHA512
41eda05c2d050afcb235d61e8ecc828f3624e7a760b175971189b16160898519c69f4a21c6b7aa105cdfdbea9c39f46dbbf82b66aa283c89a19a355b9845696b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/884-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/336-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/560-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/896-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-934-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-1152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-1300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4008 djvpj.exe 4076 rlxlxrl.exe 4000 rlrrrff.exe 3012 vjppp.exe 3392 ffffflf.exe 2928 tnnbbt.exe 5028 rxlfffx.exe 4044 ppjvv.exe 336 fffrxrr.exe 1100 ttttnb.exe 2788 llxfllx.exe 3828 bhhbbb.exe 2400 rlrxxxf.exe 3088 hhhbtn.exe 672 jvvvp.exe 5032 7hnntb.exe 4388 bnhttb.exe 540 llfxxxr.exe 3484 ttbhnt.exe 3416 pvddd.exe 4464 llrxxff.exe 3096 hbntht.exe 1312 djpjp.exe 5020 ffflrrr.exe 3940 3lxxxff.exe 1488 rlxfflr.exe 4308 nthbhb.exe 1308 pjddd.exe 1536 lrxflrx.exe 516 lxffxfx.exe 4244 btnnhn.exe 4952 thbbbb.exe 4872 3jjpp.exe 2072 xlrllrl.exe 116 tbnnbt.exe 4200 vvpdj.exe 1340 fllxlxl.exe 4672 7hhbth.exe 1036 7vdvv.exe 4052 bbtnnh.exe 4840 thnhhh.exe 3080 vdjdv.exe 2104 fxxxxfx.exe 1072 vpddj.exe 2176 vjvpj.exe 3944 lxlfrff.exe 1304 bhnhhh.exe 2348 jppdv.exe 3652 rllfrrf.exe 2036 nbnnnn.exe 2396 jvvpp.exe 2716 xxllrff.exe 4444 hnbhbb.exe 3128 nhbbbh.exe 4512 vpddd.exe 428 lxllrlr.exe 1372 nnnnbb.exe 1160 vjpvd.exe 1812 lflrrxf.exe 468 7bhntb.exe 2360 pvjvv.exe 2688 xxlffll.exe 2972 1lfxflr.exe 1180 htbhhn.exe -
resource yara_rule behavioral2/memory/884-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/336-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/560-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/896-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-927-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 884 wrote to memory of 4008 884 b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe 82 PID 884 wrote to memory of 4008 884 b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe 82 PID 884 wrote to memory of 4008 884 b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe 82 PID 4008 wrote to memory of 4076 4008 djvpj.exe 83 PID 4008 wrote to memory of 4076 4008 djvpj.exe 83 PID 4008 wrote to memory of 4076 4008 djvpj.exe 83 PID 4076 wrote to memory of 4000 4076 rlxlxrl.exe 84 PID 4076 wrote to memory of 4000 4076 rlxlxrl.exe 84 PID 4076 wrote to memory of 4000 4076 rlxlxrl.exe 84 PID 4000 wrote to memory of 3012 4000 rlrrrff.exe 85 PID 4000 wrote to memory of 3012 4000 rlrrrff.exe 85 PID 4000 wrote to memory of 3012 4000 rlrrrff.exe 85 PID 3012 wrote to memory of 3392 3012 vjppp.exe 86 PID 3012 wrote to memory of 3392 3012 vjppp.exe 86 PID 3012 wrote to memory of 3392 3012 vjppp.exe 86 PID 3392 wrote to memory of 2928 3392 ffffflf.exe 87 PID 3392 wrote to memory of 2928 3392 ffffflf.exe 87 PID 3392 wrote to memory of 2928 3392 ffffflf.exe 87 PID 2928 wrote to memory of 5028 2928 tnnbbt.exe 88 PID 2928 wrote to memory of 5028 2928 tnnbbt.exe 88 PID 2928 wrote to memory of 5028 2928 tnnbbt.exe 88 PID 5028 wrote to memory of 4044 5028 rxlfffx.exe 89 PID 5028 wrote to memory of 4044 5028 rxlfffx.exe 89 PID 5028 wrote to memory of 4044 5028 rxlfffx.exe 89 PID 4044 wrote to memory of 336 4044 ppjvv.exe 90 PID 4044 wrote to memory of 336 4044 ppjvv.exe 90 PID 4044 wrote to memory of 336 4044 ppjvv.exe 90 PID 336 wrote to memory of 1100 336 fffrxrr.exe 91 PID 336 wrote to memory of 1100 336 fffrxrr.exe 91 PID 336 wrote to memory of 1100 336 fffrxrr.exe 91 PID 1100 wrote to memory of 2788 1100 ttttnb.exe 92 PID 1100 wrote to memory of 2788 1100 ttttnb.exe 92 PID 1100 wrote to memory of 2788 1100 ttttnb.exe 92 PID 2788 wrote to memory of 3828 2788 llxfllx.exe 93 PID 2788 wrote to memory of 3828 2788 llxfllx.exe 93 PID 2788 wrote to memory of 3828 2788 llxfllx.exe 93 PID 3828 wrote to memory of 2400 3828 bhhbbb.exe 94 PID 3828 wrote to memory of 2400 3828 bhhbbb.exe 94 PID 3828 wrote to memory of 2400 3828 bhhbbb.exe 94 PID 2400 wrote to memory of 3088 2400 rlrxxxf.exe 95 PID 2400 wrote to memory of 3088 2400 rlrxxxf.exe 95 PID 2400 wrote to memory of 3088 2400 rlrxxxf.exe 95 PID 3088 wrote to memory of 672 3088 hhhbtn.exe 96 PID 3088 wrote to memory of 672 3088 hhhbtn.exe 96 PID 3088 wrote to memory of 672 3088 hhhbtn.exe 96 PID 672 wrote to memory of 5032 672 jvvvp.exe 97 PID 672 wrote to memory of 5032 672 jvvvp.exe 97 PID 672 wrote to memory of 5032 672 jvvvp.exe 97 PID 5032 wrote to memory of 4388 5032 7hnntb.exe 98 PID 5032 wrote to memory of 4388 5032 7hnntb.exe 98 PID 5032 wrote to memory of 4388 5032 7hnntb.exe 98 PID 4388 wrote to memory of 540 4388 bnhttb.exe 99 PID 4388 wrote to memory of 540 4388 bnhttb.exe 99 PID 4388 wrote to memory of 540 4388 bnhttb.exe 99 PID 540 wrote to memory of 3484 540 llfxxxr.exe 100 PID 540 wrote to memory of 3484 540 llfxxxr.exe 100 PID 540 wrote to memory of 3484 540 llfxxxr.exe 100 PID 3484 wrote to memory of 3416 3484 ttbhnt.exe 101 PID 3484 wrote to memory of 3416 3484 ttbhnt.exe 101 PID 3484 wrote to memory of 3416 3484 ttbhnt.exe 101 PID 3416 wrote to memory of 4464 3416 pvddd.exe 102 PID 3416 wrote to memory of 4464 3416 pvddd.exe 102 PID 3416 wrote to memory of 4464 3416 pvddd.exe 102 PID 4464 wrote to memory of 3096 4464 llrxxff.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe"C:\Users\Admin\AppData\Local\Temp\b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\djvpj.exec:\djvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\rlxlxrl.exec:\rlxlxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\rlrrrff.exec:\rlrrrff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\vjppp.exec:\vjppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\ffffflf.exec:\ffffflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\tnnbbt.exec:\tnnbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rxlfffx.exec:\rxlfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\ppjvv.exec:\ppjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\fffrxrr.exec:\fffrxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\ttttnb.exec:\ttttnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\llxfllx.exec:\llxfllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bhhbbb.exec:\bhhbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\rlrxxxf.exec:\rlrxxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hhhbtn.exec:\hhhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\jvvvp.exec:\jvvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\7hnntb.exec:\7hnntb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\bnhttb.exec:\bnhttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\llfxxxr.exec:\llfxxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\ttbhnt.exec:\ttbhnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\pvddd.exec:\pvddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\llrxxff.exec:\llrxxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\hbntht.exec:\hbntht.exe23⤵
- Executes dropped EXE
PID:3096 -
\??\c:\djpjp.exec:\djpjp.exe24⤵
- Executes dropped EXE
PID:1312 -
\??\c:\ffflrrr.exec:\ffflrrr.exe25⤵
- Executes dropped EXE
PID:5020 -
\??\c:\3lxxxff.exec:\3lxxxff.exe26⤵
- Executes dropped EXE
PID:3940 -
\??\c:\rlxfflr.exec:\rlxfflr.exe27⤵
- Executes dropped EXE
PID:1488 -
\??\c:\nthbhb.exec:\nthbhb.exe28⤵
- Executes dropped EXE
PID:4308 -
\??\c:\pjddd.exec:\pjddd.exe29⤵
- Executes dropped EXE
PID:1308 -
\??\c:\lrxflrx.exec:\lrxflrx.exe30⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lxffxfx.exec:\lxffxfx.exe31⤵
- Executes dropped EXE
PID:516 -
\??\c:\btnnhn.exec:\btnnhn.exe32⤵
- Executes dropped EXE
PID:4244 -
\??\c:\thbbbb.exec:\thbbbb.exe33⤵
- Executes dropped EXE
PID:4952 -
\??\c:\3jjpp.exec:\3jjpp.exe34⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xlrllrl.exec:\xlrllrl.exe35⤵
- Executes dropped EXE
PID:2072 -
\??\c:\tbnnbt.exec:\tbnnbt.exe36⤵
- Executes dropped EXE
PID:116 -
\??\c:\vvpdj.exec:\vvpdj.exe37⤵
- Executes dropped EXE
PID:4200 -
\??\c:\fllxlxl.exec:\fllxlxl.exe38⤵
- Executes dropped EXE
PID:1340 -
\??\c:\7hhbth.exec:\7hhbth.exe39⤵
- Executes dropped EXE
PID:4672 -
\??\c:\7vdvv.exec:\7vdvv.exe40⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bbtnnh.exec:\bbtnnh.exe41⤵
- Executes dropped EXE
PID:4052 -
\??\c:\thnhhh.exec:\thnhhh.exe42⤵
- Executes dropped EXE
PID:4840 -
\??\c:\vdjdv.exec:\vdjdv.exe43⤵
- Executes dropped EXE
PID:3080 -
\??\c:\fxxxxfx.exec:\fxxxxfx.exe44⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vpddj.exec:\vpddj.exe45⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vjvpj.exec:\vjvpj.exe46⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lxlfrff.exec:\lxlfrff.exe47⤵
- Executes dropped EXE
PID:3944 -
\??\c:\bhnhhh.exec:\bhnhhh.exe48⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jppdv.exec:\jppdv.exe49⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rllfrrf.exec:\rllfrrf.exe50⤵
- Executes dropped EXE
PID:3652 -
\??\c:\nbnnnn.exec:\nbnnnn.exe51⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jvvpp.exec:\jvvpp.exe52⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xxllrff.exec:\xxllrff.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hnbhbb.exec:\hnbhbb.exe54⤵
- Executes dropped EXE
PID:4444 -
\??\c:\nhbbbh.exec:\nhbbbh.exe55⤵
- Executes dropped EXE
PID:3128 -
\??\c:\vpddd.exec:\vpddd.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4512 -
\??\c:\lxllrlr.exec:\lxllrlr.exe57⤵
- Executes dropped EXE
PID:428 -
\??\c:\nnnnbb.exec:\nnnnbb.exe58⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vjpvd.exec:\vjpvd.exe59⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lflrrxf.exec:\lflrrxf.exe60⤵
- Executes dropped EXE
PID:1812 -
\??\c:\7bhntb.exec:\7bhntb.exe61⤵
- Executes dropped EXE
PID:468 -
\??\c:\pvjvv.exec:\pvjvv.exe62⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xxlffll.exec:\xxlffll.exe63⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1lfxflr.exec:\1lfxflr.exe64⤵
- Executes dropped EXE
PID:2972 -
\??\c:\htbhhn.exec:\htbhhn.exe65⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pvjjj.exec:\pvjjj.exe66⤵PID:3736
-
\??\c:\xxlllll.exec:\xxlllll.exe67⤵PID:2788
-
\??\c:\ttbttn.exec:\ttbttn.exe68⤵PID:3932
-
\??\c:\dppjj.exec:\dppjj.exe69⤵PID:2504
-
\??\c:\xllllll.exec:\xllllll.exe70⤵PID:2044
-
\??\c:\bbnttb.exec:\bbnttb.exe71⤵PID:3824
-
\??\c:\1vvpj.exec:\1vvpj.exe72⤵PID:3668
-
\??\c:\vpppp.exec:\vpppp.exe73⤵PID:5032
-
\??\c:\7frrflx.exec:\7frrflx.exe74⤵PID:3368
-
\??\c:\ttbtnn.exec:\ttbtnn.exe75⤵PID:1984
-
\??\c:\jjjvv.exec:\jjjvv.exe76⤵PID:4892
-
\??\c:\lfrlfff.exec:\lfrlfff.exe77⤵PID:452
-
\??\c:\5tbbtt.exec:\5tbbtt.exe78⤵PID:1204
-
\??\c:\jvdvp.exec:\jvdvp.exe79⤵PID:560
-
\??\c:\5xllxff.exec:\5xllxff.exe80⤵PID:4836
-
\??\c:\hbbnhb.exec:\hbbnhb.exe81⤵PID:1080
-
\??\c:\vpdjp.exec:\vpdjp.exe82⤵PID:772
-
\??\c:\xxllxlx.exec:\xxllxlx.exe83⤵PID:2344
-
\??\c:\tbnnhn.exec:\tbnnhn.exe84⤵PID:3784
-
\??\c:\jjddd.exec:\jjddd.exe85⤵PID:4072
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe86⤵PID:3100
-
\??\c:\tnbtnt.exec:\tnbtnt.exe87⤵PID:2216
-
\??\c:\3pdjj.exec:\3pdjj.exe88⤵PID:4084
-
\??\c:\ffxrrrf.exec:\ffxrrrf.exe89⤵PID:1536
-
\??\c:\llfxxxf.exec:\llfxxxf.exe90⤵PID:4236
-
\??\c:\9tbtnt.exec:\9tbtnt.exe91⤵PID:2844
-
\??\c:\7jppp.exec:\7jppp.exe92⤵PID:3664
-
\??\c:\lxxxrlf.exec:\lxxxrlf.exe93⤵PID:4480
-
\??\c:\hnntht.exec:\hnntht.exe94⤵PID:896
-
\??\c:\dvjjv.exec:\dvjjv.exe95⤵PID:4916
-
\??\c:\rlllxff.exec:\rlllxff.exe96⤵PID:3540
-
\??\c:\jjjjj.exec:\jjjjj.exe97⤵PID:2596
-
\??\c:\jjvdd.exec:\jjvdd.exe98⤵PID:2112
-
\??\c:\rxrxlrf.exec:\rxrxlrf.exe99⤵PID:632
-
\??\c:\pdppp.exec:\pdppp.exe100⤵PID:4736
-
\??\c:\lxrlfff.exec:\lxrlfff.exe101⤵PID:464
-
\??\c:\1hhnnb.exec:\1hhnnb.exe102⤵PID:1444
-
\??\c:\vpvdd.exec:\vpvdd.exe103⤵PID:660
-
\??\c:\lrxfllx.exec:\lrxfllx.exe104⤵PID:3148
-
\??\c:\xxffxxf.exec:\xxffxxf.exe105⤵PID:4564
-
\??\c:\tntbnt.exec:\tntbnt.exe106⤵
- System Location Discovery: System Language Discovery
PID:544 -
\??\c:\vjjdv.exec:\vjjdv.exe107⤵PID:4676
-
\??\c:\lxxrlxr.exec:\lxxrlxr.exe108⤵PID:2840
-
\??\c:\hhbbbt.exec:\hhbbbt.exe109⤵PID:764
-
\??\c:\ddjdd.exec:\ddjdd.exe110⤵PID:1188
-
\??\c:\vpvvv.exec:\vpvvv.exe111⤵PID:3652
-
\??\c:\frllllf.exec:\frllllf.exe112⤵PID:3336
-
\??\c:\bnttnn.exec:\bnttnn.exe113⤵PID:4588
-
\??\c:\pppjj.exec:\pppjj.exe114⤵PID:2716
-
\??\c:\ffrrxxx.exec:\ffrrxxx.exe115⤵PID:448
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe116⤵PID:3016
-
\??\c:\djddv.exec:\djddv.exe117⤵PID:2832
-
\??\c:\flfffff.exec:\flfffff.exe118⤵PID:1468
-
\??\c:\tnbhnb.exec:\tnbhnb.exe119⤵PID:3648
-
\??\c:\djpjd.exec:\djpjd.exe120⤵PID:2520
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe121⤵PID:2000
-
\??\c:\bthhhh.exec:\bthhhh.exe122⤵PID:404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-