Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 20:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe
-
Size
456KB
-
MD5
d713f0c27181112e9f2514f8bc0431d0
-
SHA1
621541a57f389516fe9d0097adb82e039d0fc1c2
-
SHA256
ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206
-
SHA512
16cff9b262f11958aa79cf354f7c0deea6244bad553d5698bc70c0b55d72e1d8f1be9abbaeb3d73b8ebee8391dff6b6190535eee973aed0f1e8861b505587a48
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/2928-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-849-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-922-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-1508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1224 rlxxffl.exe 364 hhthbt.exe 4060 vpvvv.exe 4064 fllrllf.exe 3600 7bbthh.exe 2104 1dvpj.exe 2024 rxfxxxx.exe 556 5hbttt.exe 3984 pdppp.exe 2352 lllffff.exe 1436 rrxxrrf.exe 3808 nbnhhh.exe 3276 ppddd.exe 2568 vdvpj.exe 1568 nnttnt.exe 3112 djddj.exe 1800 jpvvp.exe 4088 nttnhb.exe 3440 jdddv.exe 3208 rlrlffx.exe 3908 5jjdv.exe 2632 7flfxxr.exe 3244 tnbtbh.exe 2868 vpvvd.exe 4292 xxfxxxx.exe 1920 jddpv.exe 4972 3vdvp.exe 4080 lfffxxx.exe 2608 bntnnt.exe 2592 jvdvp.exe 4400 3rlfxxl.exe 4596 tnttnn.exe 3128 jpvpj.exe 1932 xfxrlfx.exe 4236 jvjdj.exe 4588 vjvpp.exe 1104 dvvvd.exe 1284 xfxffrr.exe 1476 hthbtt.exe 320 xlrllxx.exe 2276 vppjd.exe 2992 xxffxfx.exe 3320 tnnttb.exe 1376 jdjjd.exe 3684 xxfxxxf.exe 2760 flrllff.exe 312 bntnnn.exe 4016 pvjdd.exe 776 rlfxxxx.exe 628 5nttnt.exe 4436 ddjpp.exe 3096 lxfllxf.exe 432 5vjdd.exe 2180 ffrxlrx.exe 2280 btnhtn.exe 2340 bttnht.exe 2228 vvdjd.exe 4640 rrffxxr.exe 4064 nhtttt.exe 4040 9vjjj.exe 3752 fxfflrr.exe 3816 rrfffll.exe 2252 nhttth.exe 4512 dvddv.exe -
resource yara_rule behavioral2/memory/1224-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-922-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 1224 2928 ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe 82 PID 2928 wrote to memory of 1224 2928 ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe 82 PID 2928 wrote to memory of 1224 2928 ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe 82 PID 1224 wrote to memory of 364 1224 rlxxffl.exe 83 PID 1224 wrote to memory of 364 1224 rlxxffl.exe 83 PID 1224 wrote to memory of 364 1224 rlxxffl.exe 83 PID 364 wrote to memory of 4060 364 hhthbt.exe 84 PID 364 wrote to memory of 4060 364 hhthbt.exe 84 PID 364 wrote to memory of 4060 364 hhthbt.exe 84 PID 4060 wrote to memory of 4064 4060 vpvvv.exe 85 PID 4060 wrote to memory of 4064 4060 vpvvv.exe 85 PID 4060 wrote to memory of 4064 4060 vpvvv.exe 85 PID 4064 wrote to memory of 3600 4064 fllrllf.exe 86 PID 4064 wrote to memory of 3600 4064 fllrllf.exe 86 PID 4064 wrote to memory of 3600 4064 fllrllf.exe 86 PID 3600 wrote to memory of 2104 3600 7bbthh.exe 87 PID 3600 wrote to memory of 2104 3600 7bbthh.exe 87 PID 3600 wrote to memory of 2104 3600 7bbthh.exe 87 PID 2104 wrote to memory of 2024 2104 1dvpj.exe 88 PID 2104 wrote to memory of 2024 2104 1dvpj.exe 88 PID 2104 wrote to memory of 2024 2104 1dvpj.exe 88 PID 2024 wrote to memory of 556 2024 rxfxxxx.exe 89 PID 2024 wrote to memory of 556 2024 rxfxxxx.exe 89 PID 2024 wrote to memory of 556 2024 rxfxxxx.exe 89 PID 556 wrote to memory of 3984 556 5hbttt.exe 90 PID 556 wrote to memory of 3984 556 5hbttt.exe 90 PID 556 wrote to memory of 3984 556 5hbttt.exe 90 PID 3984 wrote to memory of 2352 3984 pdppp.exe 91 PID 3984 wrote to memory of 2352 3984 pdppp.exe 91 PID 3984 wrote to memory of 2352 3984 pdppp.exe 91 PID 2352 wrote to memory of 1436 2352 lllffff.exe 92 PID 2352 wrote to memory of 1436 2352 lllffff.exe 92 PID 2352 wrote to memory of 1436 2352 lllffff.exe 92 PID 1436 wrote to memory of 3808 1436 rrxxrrf.exe 93 PID 1436 wrote to memory of 3808 1436 rrxxrrf.exe 93 PID 1436 wrote to memory of 3808 1436 rrxxrrf.exe 93 PID 3808 wrote to memory of 3276 3808 nbnhhh.exe 94 PID 3808 wrote to memory of 3276 3808 nbnhhh.exe 94 PID 3808 wrote to memory of 3276 3808 nbnhhh.exe 94 PID 3276 wrote to memory of 2568 3276 ppddd.exe 95 PID 3276 wrote to memory of 2568 3276 ppddd.exe 95 PID 3276 wrote to memory of 2568 3276 ppddd.exe 95 PID 2568 wrote to memory of 1568 2568 vdvpj.exe 96 PID 2568 wrote to memory of 1568 2568 vdvpj.exe 96 PID 2568 wrote to memory of 1568 2568 vdvpj.exe 96 PID 1568 wrote to memory of 3112 1568 nnttnt.exe 97 PID 1568 wrote to memory of 3112 1568 nnttnt.exe 97 PID 1568 wrote to memory of 3112 1568 nnttnt.exe 97 PID 3112 wrote to memory of 1800 3112 djddj.exe 98 PID 3112 wrote to memory of 1800 3112 djddj.exe 98 PID 3112 wrote to memory of 1800 3112 djddj.exe 98 PID 1800 wrote to memory of 4088 1800 jpvvp.exe 99 PID 1800 wrote to memory of 4088 1800 jpvvp.exe 99 PID 1800 wrote to memory of 4088 1800 jpvvp.exe 99 PID 4088 wrote to memory of 3440 4088 nttnhb.exe 100 PID 4088 wrote to memory of 3440 4088 nttnhb.exe 100 PID 4088 wrote to memory of 3440 4088 nttnhb.exe 100 PID 3440 wrote to memory of 3208 3440 jdddv.exe 101 PID 3440 wrote to memory of 3208 3440 jdddv.exe 101 PID 3440 wrote to memory of 3208 3440 jdddv.exe 101 PID 3208 wrote to memory of 3908 3208 rlrlffx.exe 102 PID 3208 wrote to memory of 3908 3208 rlrlffx.exe 102 PID 3208 wrote to memory of 3908 3208 rlrlffx.exe 102 PID 3908 wrote to memory of 2632 3908 5jjdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe"C:\Users\Admin\AppData\Local\Temp\ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rlxxffl.exec:\rlxxffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\hhthbt.exec:\hhthbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\vpvvv.exec:\vpvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\fllrllf.exec:\fllrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\7bbthh.exec:\7bbthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\1dvpj.exec:\1dvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\5hbttt.exec:\5hbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\pdppp.exec:\pdppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\lllffff.exec:\lllffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rrxxrrf.exec:\rrxxrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\nbnhhh.exec:\nbnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\ppddd.exec:\ppddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\vdvpj.exec:\vdvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\nnttnt.exec:\nnttnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\djddj.exec:\djddj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\jpvvp.exec:\jpvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\nttnhb.exec:\nttnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\jdddv.exec:\jdddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\rlrlffx.exec:\rlrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\5jjdv.exec:\5jjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\7flfxxr.exec:\7flfxxr.exe23⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tnbtbh.exec:\tnbtbh.exe24⤵
- Executes dropped EXE
PID:3244 -
\??\c:\vpvvd.exec:\vpvvd.exe25⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe26⤵
- Executes dropped EXE
PID:4292 -
\??\c:\jddpv.exec:\jddpv.exe27⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3vdvp.exec:\3vdvp.exe28⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lfffxxx.exec:\lfffxxx.exe29⤵
- Executes dropped EXE
PID:4080 -
\??\c:\bntnnt.exec:\bntnnt.exe30⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jvdvp.exec:\jvdvp.exe31⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3rlfxxl.exec:\3rlfxxl.exe32⤵
- Executes dropped EXE
PID:4400 -
\??\c:\tnttnn.exec:\tnttnn.exe33⤵
- Executes dropped EXE
PID:4596 -
\??\c:\jpvpj.exec:\jpvpj.exe34⤵
- Executes dropped EXE
PID:3128 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe35⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jvjdj.exec:\jvjdj.exe36⤵
- Executes dropped EXE
PID:4236 -
\??\c:\vjvpp.exec:\vjvpp.exe37⤵
- Executes dropped EXE
PID:4588 -
\??\c:\dvvvd.exec:\dvvvd.exe38⤵
- Executes dropped EXE
PID:1104 -
\??\c:\xfxffrr.exec:\xfxffrr.exe39⤵
- Executes dropped EXE
PID:1284 -
\??\c:\hthbtt.exec:\hthbtt.exe40⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xlrllxx.exec:\xlrllxx.exe41⤵
- Executes dropped EXE
PID:320 -
\??\c:\vppjd.exec:\vppjd.exe42⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xxffxfx.exec:\xxffxfx.exe43⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tnnttb.exec:\tnnttb.exe44⤵
- Executes dropped EXE
PID:3320 -
\??\c:\jdjjd.exec:\jdjjd.exe45⤵
- Executes dropped EXE
PID:1376 -
\??\c:\xxfxxxf.exec:\xxfxxxf.exe46⤵
- Executes dropped EXE
PID:3684 -
\??\c:\flrllff.exec:\flrllff.exe47⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bntnnn.exec:\bntnnn.exe48⤵
- Executes dropped EXE
PID:312 -
\??\c:\pvjdd.exec:\pvjdd.exe49⤵
- Executes dropped EXE
PID:4016 -
\??\c:\rlfxxxx.exec:\rlfxxxx.exe50⤵
- Executes dropped EXE
PID:776 -
\??\c:\5nttnt.exec:\5nttnt.exe51⤵
- Executes dropped EXE
PID:628 -
\??\c:\ddjpp.exec:\ddjpp.exe52⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lxfllxf.exec:\lxfllxf.exe53⤵
- Executes dropped EXE
PID:3096 -
\??\c:\bhbhnb.exec:\bhbhnb.exe54⤵PID:4380
-
\??\c:\5vjdd.exec:\5vjdd.exe55⤵
- Executes dropped EXE
PID:432 -
\??\c:\ffrxlrx.exec:\ffrxlrx.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\btnhtn.exec:\btnhtn.exe57⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bttnht.exec:\bttnht.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vvdjd.exec:\vvdjd.exe59⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rrffxxr.exec:\rrffxxr.exe60⤵
- Executes dropped EXE
PID:4640 -
\??\c:\nhtttt.exec:\nhtttt.exe61⤵
- Executes dropped EXE
PID:4064 -
\??\c:\9vjjj.exec:\9vjjj.exe62⤵
- Executes dropped EXE
PID:4040 -
\??\c:\fxfflrr.exec:\fxfflrr.exe63⤵
- Executes dropped EXE
PID:3752 -
\??\c:\rrfffll.exec:\rrfffll.exe64⤵
- Executes dropped EXE
PID:3816 -
\??\c:\nhttth.exec:\nhttth.exe65⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dvddv.exec:\dvddv.exe66⤵
- Executes dropped EXE
PID:4512 -
\??\c:\vdddv.exec:\vdddv.exe67⤵PID:5036
-
\??\c:\frllflf.exec:\frllflf.exe68⤵PID:3648
-
\??\c:\bbnhhn.exec:\bbnhhn.exe69⤵PID:3984
-
\??\c:\vvdvj.exec:\vvdvj.exe70⤵PID:1852
-
\??\c:\xrfffrr.exec:\xrfffrr.exe71⤵PID:2704
-
\??\c:\hnbhtb.exec:\hnbhtb.exe72⤵PID:3044
-
\??\c:\jvjjd.exec:\jvjjd.exe73⤵PID:3492
-
\??\c:\llrrrrr.exec:\llrrrrr.exe74⤵PID:2624
-
\??\c:\rrfllxf.exec:\rrfllxf.exe75⤵PID:2388
-
\??\c:\bhnttt.exec:\bhnttt.exe76⤵PID:2544
-
\??\c:\dvpjd.exec:\dvpjd.exe77⤵PID:5052
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe78⤵PID:3112
-
\??\c:\tbhhhh.exec:\tbhhhh.exe79⤵PID:4624
-
\??\c:\pvddd.exec:\pvddd.exe80⤵PID:4608
-
\??\c:\vvjpp.exec:\vvjpp.exe81⤵PID:4408
-
\??\c:\xrfxrrx.exec:\xrfxrrx.exe82⤵PID:1960
-
\??\c:\bhhnht.exec:\bhhnht.exe83⤵PID:996
-
\??\c:\vdjjd.exec:\vdjjd.exe84⤵PID:464
-
\??\c:\lrffxll.exec:\lrffxll.exe85⤵PID:1652
-
\??\c:\ttbbhn.exec:\ttbbhn.exe86⤵PID:3880
-
\??\c:\hnttbh.exec:\hnttbh.exe87⤵PID:1524
-
\??\c:\jdpdd.exec:\jdpdd.exe88⤵PID:1720
-
\??\c:\ffllfll.exec:\ffllfll.exe89⤵PID:2628
-
\??\c:\hhtnnn.exec:\hhtnnn.exe90⤵PID:2336
-
\??\c:\djvvv.exec:\djvvv.exe91⤵PID:1352
-
\??\c:\llrxxxf.exec:\llrxxxf.exe92⤵PID:1892
-
\??\c:\rxfflfl.exec:\rxfflfl.exe93⤵PID:1028
-
\??\c:\thbbtn.exec:\thbbtn.exe94⤵PID:4880
-
\??\c:\ppddd.exec:\ppddd.exe95⤵PID:2412
-
\??\c:\7xlllll.exec:\7xlllll.exe96⤵PID:1904
-
\??\c:\tnbbtb.exec:\tnbbtb.exe97⤵PID:2608
-
\??\c:\nhnnnn.exec:\nhnnnn.exe98⤵PID:116
-
\??\c:\pjjjp.exec:\pjjjp.exe99⤵PID:2084
-
\??\c:\xrxffll.exec:\xrxffll.exe100⤵PID:1860
-
\??\c:\xrxxrll.exec:\xrxxrll.exe101⤵PID:4596
-
\??\c:\ttbbbh.exec:\ttbbbh.exe102⤵PID:4168
-
\??\c:\jjvdv.exec:\jjvdv.exe103⤵PID:1932
-
\??\c:\fxrrrxl.exec:\fxrrrxl.exe104⤵PID:3496
-
\??\c:\hhtnnn.exec:\hhtnnn.exe105⤵PID:1964
-
\??\c:\nbhhhn.exec:\nbhhhn.exe106⤵PID:4588
-
\??\c:\vdvdp.exec:\vdvdp.exe107⤵PID:1104
-
\??\c:\fxrllll.exec:\fxrllll.exe108⤵PID:4284
-
\??\c:\htbhnt.exec:\htbhnt.exe109⤵PID:3748
-
\??\c:\9jvpd.exec:\9jvpd.exe110⤵PID:1040
-
\??\c:\dvvvv.exec:\dvvvv.exe111⤵PID:1636
-
\??\c:\llrrrxl.exec:\llrrrxl.exe112⤵PID:1400
-
\??\c:\tbnttt.exec:\tbnttt.exe113⤵PID:220
-
\??\c:\pvddd.exec:\pvddd.exe114⤵PID:916
-
\??\c:\jjvdv.exec:\jjvdv.exe115⤵PID:4876
-
\??\c:\1rfffrr.exec:\1rfffrr.exe116⤵PID:3520
-
\??\c:\tnbbhh.exec:\tnbbhh.exe117⤵PID:3720
-
\??\c:\pdppv.exec:\pdppv.exe118⤵PID:760
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe119⤵PID:4460
-
\??\c:\htnnnn.exec:\htnnnn.exe120⤵PID:1748
-
\??\c:\5jppj.exec:\5jppj.exe121⤵PID:4376
-
\??\c:\1xfffll.exec:\1xfffll.exe122⤵PID:3096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-