Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe
-
Size
454KB
-
MD5
c7aa1b69f8bb514963107c152eb026b4
-
SHA1
7a72a0d432cd9031c6f1982be1ba03ea8d0a401c
-
SHA256
4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3
-
SHA512
17e595416bef1ef74d1091e8a4e6e18a79708b63df2e29a8c7eac9dd7349aae09cf4c9e8565f01a03ff15cdacdee34c03a6ab1a227c79ef7c13de1aba01cb9ff
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3964-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-793-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-1026-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-1185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-1424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-1669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 412 jpppp.exe 4324 rlrlfff.exe 4800 btbtnn.exe 2104 hnnhbb.exe 3972 nhtntn.exe 2840 lxxxrrr.exe 2420 vpppj.exe 1372 1fffxfx.exe 1528 xxlrrxx.exe 1416 hhnnnn.exe 4056 djvpv.exe 4692 9ffxlrl.exe 1876 rxlfrfx.exe 1404 vjvpd.exe 2964 pvddd.exe 4580 htbbbt.exe 5012 9ppvp.exe 400 frxrlfr.exe 2144 nthnhb.exe 3268 djvpp.exe 2952 9rrlllf.exe 2728 nhtnnb.exe 1552 5jjvp.exe 4776 flrlrrr.exe 1960 ttthbt.exe 2008 bnnhbb.exe 1832 pjvpd.exe 1012 xrlllfx.exe 2660 nttnhh.exe 3484 hbnnnn.exe 5056 9pvpj.exe 4488 fxxxxrf.exe 1924 9nnhbb.exe 892 tnbbhh.exe 740 dppjd.exe 2904 fxxrllf.exe 5000 frlfrrr.exe 1548 bnnhbt.exe 3232 9pvjp.exe 876 dpddj.exe 3424 lrxrlfx.exe 3452 tnnnhn.exe 3420 jpjvd.exe 4416 pvdvp.exe 4260 xrflllx.exe 716 1nnhbh.exe 3228 tntnnn.exe 1272 rfrrxxx.exe 4332 tntbth.exe 4072 xlfxrrl.exe 412 1jjjj.exe 2760 3ffxrrl.exe 2488 bntnnt.exe 4224 1pvdv.exe 4440 fflfxxr.exe 1196 hnbbhb.exe 4648 1jdvv.exe 2216 thhtnn.exe 3520 jjdpd.exe 3972 xrfxfxf.exe 4964 5lffxxx.exe 2840 7vdpj.exe 924 lrrrffr.exe 3816 djjdv.exe -
resource yara_rule behavioral2/memory/3964-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-1185-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3964 wrote to memory of 412 3964 4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe 83 PID 3964 wrote to memory of 412 3964 4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe 83 PID 3964 wrote to memory of 412 3964 4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe 83 PID 412 wrote to memory of 4324 412 jpppp.exe 84 PID 412 wrote to memory of 4324 412 jpppp.exe 84 PID 412 wrote to memory of 4324 412 jpppp.exe 84 PID 4324 wrote to memory of 4800 4324 rlrlfff.exe 85 PID 4324 wrote to memory of 4800 4324 rlrlfff.exe 85 PID 4324 wrote to memory of 4800 4324 rlrlfff.exe 85 PID 4800 wrote to memory of 2104 4800 btbtnn.exe 86 PID 4800 wrote to memory of 2104 4800 btbtnn.exe 86 PID 4800 wrote to memory of 2104 4800 btbtnn.exe 86 PID 2104 wrote to memory of 3972 2104 hnnhbb.exe 87 PID 2104 wrote to memory of 3972 2104 hnnhbb.exe 87 PID 2104 wrote to memory of 3972 2104 hnnhbb.exe 87 PID 3972 wrote to memory of 2840 3972 nhtntn.exe 88 PID 3972 wrote to memory of 2840 3972 nhtntn.exe 88 PID 3972 wrote to memory of 2840 3972 nhtntn.exe 88 PID 2840 wrote to memory of 2420 2840 lxxxrrr.exe 89 PID 2840 wrote to memory of 2420 2840 lxxxrrr.exe 89 PID 2840 wrote to memory of 2420 2840 lxxxrrr.exe 89 PID 2420 wrote to memory of 1372 2420 vpppj.exe 90 PID 2420 wrote to memory of 1372 2420 vpppj.exe 90 PID 2420 wrote to memory of 1372 2420 vpppj.exe 90 PID 1372 wrote to memory of 1528 1372 1fffxfx.exe 91 PID 1372 wrote to memory of 1528 1372 1fffxfx.exe 91 PID 1372 wrote to memory of 1528 1372 1fffxfx.exe 91 PID 1528 wrote to memory of 1416 1528 xxlrrxx.exe 92 PID 1528 wrote to memory of 1416 1528 xxlrrxx.exe 92 PID 1528 wrote to memory of 1416 1528 xxlrrxx.exe 92 PID 1416 wrote to memory of 4056 1416 hhnnnn.exe 93 PID 1416 wrote to memory of 4056 1416 hhnnnn.exe 93 PID 1416 wrote to memory of 4056 1416 hhnnnn.exe 93 PID 4056 wrote to memory of 4692 4056 djvpv.exe 94 PID 4056 wrote to memory of 4692 4056 djvpv.exe 94 PID 4056 wrote to memory of 4692 4056 djvpv.exe 94 PID 4692 wrote to memory of 1876 4692 9ffxlrl.exe 95 PID 4692 wrote to memory of 1876 4692 9ffxlrl.exe 95 PID 4692 wrote to memory of 1876 4692 9ffxlrl.exe 95 PID 1876 wrote to memory of 1404 1876 rxlfrfx.exe 96 PID 1876 wrote to memory of 1404 1876 rxlfrfx.exe 96 PID 1876 wrote to memory of 1404 1876 rxlfrfx.exe 96 PID 1404 wrote to memory of 2964 1404 vjvpd.exe 97 PID 1404 wrote to memory of 2964 1404 vjvpd.exe 97 PID 1404 wrote to memory of 2964 1404 vjvpd.exe 97 PID 2964 wrote to memory of 4580 2964 pvddd.exe 98 PID 2964 wrote to memory of 4580 2964 pvddd.exe 98 PID 2964 wrote to memory of 4580 2964 pvddd.exe 98 PID 4580 wrote to memory of 5012 4580 htbbbt.exe 99 PID 4580 wrote to memory of 5012 4580 htbbbt.exe 99 PID 4580 wrote to memory of 5012 4580 htbbbt.exe 99 PID 5012 wrote to memory of 400 5012 9ppvp.exe 100 PID 5012 wrote to memory of 400 5012 9ppvp.exe 100 PID 5012 wrote to memory of 400 5012 9ppvp.exe 100 PID 400 wrote to memory of 2144 400 frxrlfr.exe 101 PID 400 wrote to memory of 2144 400 frxrlfr.exe 101 PID 400 wrote to memory of 2144 400 frxrlfr.exe 101 PID 2144 wrote to memory of 3268 2144 nthnhb.exe 102 PID 2144 wrote to memory of 3268 2144 nthnhb.exe 102 PID 2144 wrote to memory of 3268 2144 nthnhb.exe 102 PID 3268 wrote to memory of 2952 3268 djvpp.exe 103 PID 3268 wrote to memory of 2952 3268 djvpp.exe 103 PID 3268 wrote to memory of 2952 3268 djvpp.exe 103 PID 2952 wrote to memory of 2728 2952 9rrlllf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe"C:\Users\Admin\AppData\Local\Temp\4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\jpppp.exec:\jpppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\rlrlfff.exec:\rlrlfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\btbtnn.exec:\btbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\hnnhbb.exec:\hnnhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\nhtntn.exec:\nhtntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\vpppj.exec:\vpppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\1fffxfx.exec:\1fffxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\xxlrrxx.exec:\xxlrrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\hhnnnn.exec:\hhnnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\djvpv.exec:\djvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\9ffxlrl.exec:\9ffxlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\rxlfrfx.exec:\rxlfrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\vjvpd.exec:\vjvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\pvddd.exec:\pvddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\htbbbt.exec:\htbbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\9ppvp.exec:\9ppvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\frxrlfr.exec:\frxrlfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\nthnhb.exec:\nthnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\djvpp.exec:\djvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\9rrlllf.exec:\9rrlllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\nhtnnb.exec:\nhtnnb.exe23⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5jjvp.exec:\5jjvp.exe24⤵
- Executes dropped EXE
PID:1552 -
\??\c:\flrlrrr.exec:\flrlrrr.exe25⤵
- Executes dropped EXE
PID:4776 -
\??\c:\ttthbt.exec:\ttthbt.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\bnnhbb.exec:\bnnhbb.exe27⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pjvpd.exec:\pjvpd.exe28⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xrlllfx.exec:\xrlllfx.exe29⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nttnhh.exec:\nttnhh.exe30⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbnnnn.exec:\hbnnnn.exe31⤵
- Executes dropped EXE
PID:3484 -
\??\c:\9pvpj.exec:\9pvpj.exe32⤵
- Executes dropped EXE
PID:5056 -
\??\c:\fxxxxrf.exec:\fxxxxrf.exe33⤵
- Executes dropped EXE
PID:4488 -
\??\c:\9nnhbb.exec:\9nnhbb.exe34⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tnbbhh.exec:\tnbbhh.exe35⤵
- Executes dropped EXE
PID:892 -
\??\c:\dppjd.exec:\dppjd.exe36⤵
- Executes dropped EXE
PID:740 -
\??\c:\fxxrllf.exec:\fxxrllf.exe37⤵
- Executes dropped EXE
PID:2904 -
\??\c:\frlfrrr.exec:\frlfrrr.exe38⤵
- Executes dropped EXE
PID:5000 -
\??\c:\bnnhbt.exec:\bnnhbt.exe39⤵
- Executes dropped EXE
PID:1548 -
\??\c:\9pvjp.exec:\9pvjp.exe40⤵
- Executes dropped EXE
PID:3232 -
\??\c:\dpddj.exec:\dpddj.exe41⤵
- Executes dropped EXE
PID:876 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe42⤵
- Executes dropped EXE
PID:3424 -
\??\c:\tnnnhn.exec:\tnnnhn.exe43⤵
- Executes dropped EXE
PID:3452 -
\??\c:\jpjvd.exec:\jpjvd.exe44⤵
- Executes dropped EXE
PID:3420 -
\??\c:\pvdvp.exec:\pvdvp.exe45⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xrflllx.exec:\xrflllx.exe46⤵
- Executes dropped EXE
PID:4260 -
\??\c:\1nnhbh.exec:\1nnhbh.exe47⤵
- Executes dropped EXE
PID:716 -
\??\c:\tntnnn.exec:\tntnnn.exe48⤵
- Executes dropped EXE
PID:3228 -
\??\c:\rfrrxxx.exec:\rfrrxxx.exe49⤵
- Executes dropped EXE
PID:1272 -
\??\c:\tntbth.exec:\tntbth.exe50⤵
- Executes dropped EXE
PID:4332 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe51⤵
- Executes dropped EXE
PID:4072 -
\??\c:\1jjjj.exec:\1jjjj.exe52⤵
- Executes dropped EXE
PID:412 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe53⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bntnnt.exec:\bntnnt.exe54⤵
- Executes dropped EXE
PID:2488 -
\??\c:\1pvdv.exec:\1pvdv.exe55⤵
- Executes dropped EXE
PID:4224 -
\??\c:\fflfxxr.exec:\fflfxxr.exe56⤵
- Executes dropped EXE
PID:4440 -
\??\c:\hnbbhb.exec:\hnbbhb.exe57⤵
- Executes dropped EXE
PID:1196 -
\??\c:\1jdvv.exec:\1jdvv.exe58⤵
- Executes dropped EXE
PID:4648 -
\??\c:\thhtnn.exec:\thhtnn.exe59⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jjdpd.exec:\jjdpd.exe60⤵
- Executes dropped EXE
PID:3520 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe61⤵
- Executes dropped EXE
PID:3972 -
\??\c:\5lffxxx.exec:\5lffxxx.exe62⤵
- Executes dropped EXE
PID:4964 -
\??\c:\7vdpj.exec:\7vdpj.exe63⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lrrrffr.exec:\lrrrffr.exe64⤵
- Executes dropped EXE
PID:924 -
\??\c:\djjdv.exec:\djjdv.exe65⤵
- Executes dropped EXE
PID:3816 -
\??\c:\vjjjd.exec:\vjjjd.exe66⤵PID:1372
-
\??\c:\fflllff.exec:\fflllff.exe67⤵PID:3384
-
\??\c:\vvjdd.exec:\vvjdd.exe68⤵PID:2272
-
\??\c:\llrxrxl.exec:\llrxrxl.exe69⤵PID:3708
-
\??\c:\hbbhhn.exec:\hbbhhn.exe70⤵PID:3956
-
\??\c:\9nnnnn.exec:\9nnnnn.exe71⤵PID:2768
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe72⤵PID:2444
-
\??\c:\9vpvv.exec:\9vpvv.exe73⤵PID:1876
-
\??\c:\lfffxxr.exec:\lfffxxr.exe74⤵PID:3904
-
\??\c:\bnhnht.exec:\bnhnht.exe75⤵PID:1664
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe76⤵
- System Location Discovery: System Language Discovery
PID:1228 -
\??\c:\bbnhnb.exec:\bbnhnb.exe77⤵PID:1584
-
\??\c:\vvpjd.exec:\vvpjd.exe78⤵PID:3156
-
\??\c:\lrxrlff.exec:\lrxrlff.exe79⤵PID:3800
-
\??\c:\hnnbtn.exec:\hnnbtn.exe80⤵PID:4828
-
\??\c:\vppdv.exec:\vppdv.exe81⤵PID:4632
-
\??\c:\3nttnt.exec:\3nttnt.exe82⤵PID:2952
-
\??\c:\pjvdp.exec:\pjvdp.exe83⤵PID:2728
-
\??\c:\djjdp.exec:\djjdp.exe84⤵PID:4208
-
\??\c:\rxfrllx.exec:\rxfrllx.exe85⤵PID:1420
-
\??\c:\9hbnht.exec:\9hbnht.exe86⤵PID:2008
-
\??\c:\pjpdv.exec:\pjpdv.exe87⤵PID:1832
-
\??\c:\rlfflxx.exec:\rlfflxx.exe88⤵PID:3968
-
\??\c:\bhhbnn.exec:\bhhbnn.exe89⤵PID:4328
-
\??\c:\1btnhh.exec:\1btnhh.exe90⤵PID:5096
-
\??\c:\vddvj.exec:\vddvj.exe91⤵PID:2876
-
\??\c:\fxxlfff.exec:\fxxlfff.exe92⤵PID:4772
-
\??\c:\btnhbt.exec:\btnhbt.exe93⤵PID:1412
-
\??\c:\thhbtn.exec:\thhbtn.exe94⤵PID:224
-
\??\c:\lrrlffx.exec:\lrrlffx.exe95⤵PID:1468
-
\??\c:\9xfflrr.exec:\9xfflrr.exe96⤵PID:4884
-
\??\c:\7tthbb.exec:\7tthbb.exe97⤵PID:1548
-
\??\c:\dvdvp.exec:\dvdvp.exe98⤵PID:960
-
\??\c:\ffxflll.exec:\ffxflll.exe99⤵PID:3232
-
\??\c:\bhhbtn.exec:\bhhbtn.exe100⤵PID:4652
-
\??\c:\hnthbb.exec:\hnthbb.exe101⤵PID:1632
-
\??\c:\vjpjj.exec:\vjpjj.exe102⤵PID:4348
-
\??\c:\fxrfxxl.exec:\fxrfxxl.exe103⤵PID:3012
-
\??\c:\nbnntt.exec:\nbnntt.exe104⤵PID:3420
-
\??\c:\tnnhtt.exec:\tnnhtt.exe105⤵PID:1000
-
\??\c:\vvjjp.exec:\vvjjp.exe106⤵PID:2860
-
\??\c:\rrrllll.exec:\rrrllll.exe107⤵PID:2376
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe108⤵PID:4428
-
\??\c:\tnnhbt.exec:\tnnhbt.exe109⤵PID:4160
-
\??\c:\3pjdv.exec:\3pjdv.exe110⤵PID:1316
-
\??\c:\lflfxxr.exec:\lflfxxr.exe111⤵PID:1892
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe112⤵PID:5104
-
\??\c:\nnnhbh.exec:\nnnhbh.exe113⤵PID:2944
-
\??\c:\dppjj.exec:\dppjj.exe114⤵PID:4332
-
\??\c:\rllfrrl.exec:\rllfrrl.exe115⤵PID:820
-
\??\c:\xlxrllf.exec:\xlxrllf.exe116⤵PID:4560
-
\??\c:\tttttt.exec:\tttttt.exe117⤵PID:232
-
\??\c:\jpjjd.exec:\jpjjd.exe118⤵PID:1920
-
\??\c:\frlfxxx.exec:\frlfxxx.exe119⤵PID:2820
-
\??\c:\hhnhhh.exec:\hhnhhh.exe120⤵PID:2788
-
\??\c:\pjdvv.exec:\pjdvv.exe121⤵PID:1196
-
\??\c:\lxfxrrx.exec:\lxfxrrx.exe122⤵PID:3860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-