Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 21:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe
-
Size
454KB
-
MD5
8bc6bbb8b8e2f2375732fb110ca9f6ec
-
SHA1
1e4cd5513ce1fb6a3f1de378c75c26db3296a5db
-
SHA256
fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2
-
SHA512
9a39c12d6cede91b3e8c180ccf26f5f8472eecf02070587dd1f680332a7c522dfd6943ee3b32ad36e707eb9e996708879d3e8a7468b4c059441a23c57b887830
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/736-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/608-782-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-1369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-1828-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 736 1lrfxrr.exe 2368 htnhtt.exe 1120 djjdv.exe 2600 lxrfrlf.exe 4636 xfxlfxl.exe 4832 djdvj.exe 2188 hhhtnn.exe 4824 tbhbnh.exe 4916 rxrrfxx.exe 1020 dvdjd.exe 2128 lffrlrl.exe 2020 vvddv.exe 4972 1pdvj.exe 2612 frxlfrl.exe 4328 nntnhb.exe 4836 3dppd.exe 3708 ddpdp.exe 4680 lxxrxfl.exe 948 9bbtnh.exe 4388 3rfxrfx.exe 5064 tbhbnh.exe 2656 jjvpd.exe 5040 lxlffff.exe 3820 jdjdd.exe 808 7tbthn.exe 4544 vvjdv.exe 968 7lfrlfr.exe 3252 pvvpp.exe 4944 thnnhb.exe 700 9pjdp.exe 3644 xrxrllr.exe 396 pjpjj.exe 4904 5xllxfx.exe 1680 dpdvv.exe 3892 pjjjd.exe 2956 5rxrrlx.exe 1640 tnnnhb.exe 3896 jdvpj.exe 312 lffrlrl.exe 2968 tbhbtn.exe 2324 pvvpd.exe 2592 3vvjv.exe 2412 fxxxxrl.exe 4580 1tbtnb.exe 1516 vdjpp.exe 1612 vjpjj.exe 2776 xxfxrrr.exe 2024 djpjd.exe 3140 rffxxxr.exe 2348 xfrlfxr.exe 944 tbhnhb.exe 4324 jddpd.exe 1884 fxrxxll.exe 656 5lxxrrl.exe 1872 dvvjd.exe 4220 ddpjv.exe 876 fxfxffx.exe 4492 7nbtnn.exe 3524 jvppd.exe 3164 lflxffx.exe 3724 xllfrrx.exe 4444 bntnhb.exe 212 dvvpd.exe 3968 xllfxxx.exe -
resource yara_rule behavioral2/memory/736-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-745-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3764 wrote to memory of 736 3764 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 83 PID 3764 wrote to memory of 736 3764 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 83 PID 3764 wrote to memory of 736 3764 fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe 83 PID 736 wrote to memory of 2368 736 1lrfxrr.exe 84 PID 736 wrote to memory of 2368 736 1lrfxrr.exe 84 PID 736 wrote to memory of 2368 736 1lrfxrr.exe 84 PID 2368 wrote to memory of 1120 2368 htnhtt.exe 85 PID 2368 wrote to memory of 1120 2368 htnhtt.exe 85 PID 2368 wrote to memory of 1120 2368 htnhtt.exe 85 PID 1120 wrote to memory of 2600 1120 djjdv.exe 86 PID 1120 wrote to memory of 2600 1120 djjdv.exe 86 PID 1120 wrote to memory of 2600 1120 djjdv.exe 86 PID 2600 wrote to memory of 4636 2600 lxrfrlf.exe 87 PID 2600 wrote to memory of 4636 2600 lxrfrlf.exe 87 PID 2600 wrote to memory of 4636 2600 lxrfrlf.exe 87 PID 4636 wrote to memory of 4832 4636 xfxlfxl.exe 88 PID 4636 wrote to memory of 4832 4636 xfxlfxl.exe 88 PID 4636 wrote to memory of 4832 4636 xfxlfxl.exe 88 PID 4832 wrote to memory of 2188 4832 djdvj.exe 89 PID 4832 wrote to memory of 2188 4832 djdvj.exe 89 PID 4832 wrote to memory of 2188 4832 djdvj.exe 89 PID 2188 wrote to memory of 4824 2188 hhhtnn.exe 90 PID 2188 wrote to memory of 4824 2188 hhhtnn.exe 90 PID 2188 wrote to memory of 4824 2188 hhhtnn.exe 90 PID 4824 wrote to memory of 4916 4824 tbhbnh.exe 91 PID 4824 wrote to memory of 4916 4824 tbhbnh.exe 91 PID 4824 wrote to memory of 4916 4824 tbhbnh.exe 91 PID 4916 wrote to memory of 1020 4916 rxrrfxx.exe 92 PID 4916 wrote to memory of 1020 4916 rxrrfxx.exe 92 PID 4916 wrote to memory of 1020 4916 rxrrfxx.exe 92 PID 1020 wrote to memory of 2128 1020 dvdjd.exe 93 PID 1020 wrote to memory of 2128 1020 dvdjd.exe 93 PID 1020 wrote to memory of 2128 1020 dvdjd.exe 93 PID 2128 wrote to memory of 2020 2128 lffrlrl.exe 94 PID 2128 wrote to memory of 2020 2128 lffrlrl.exe 94 PID 2128 wrote to memory of 2020 2128 lffrlrl.exe 94 PID 2020 wrote to memory of 4972 2020 vvddv.exe 95 PID 2020 wrote to memory of 4972 2020 vvddv.exe 95 PID 2020 wrote to memory of 4972 2020 vvddv.exe 95 PID 4972 wrote to memory of 2612 4972 1pdvj.exe 96 PID 4972 wrote to memory of 2612 4972 1pdvj.exe 96 PID 4972 wrote to memory of 2612 4972 1pdvj.exe 96 PID 2612 wrote to memory of 4328 2612 frxlfrl.exe 97 PID 2612 wrote to memory of 4328 2612 frxlfrl.exe 97 PID 2612 wrote to memory of 4328 2612 frxlfrl.exe 97 PID 4328 wrote to memory of 4836 4328 nntnhb.exe 98 PID 4328 wrote to memory of 4836 4328 nntnhb.exe 98 PID 4328 wrote to memory of 4836 4328 nntnhb.exe 98 PID 4836 wrote to memory of 3708 4836 3dppd.exe 99 PID 4836 wrote to memory of 3708 4836 3dppd.exe 99 PID 4836 wrote to memory of 3708 4836 3dppd.exe 99 PID 3708 wrote to memory of 4680 3708 ddpdp.exe 100 PID 3708 wrote to memory of 4680 3708 ddpdp.exe 100 PID 3708 wrote to memory of 4680 3708 ddpdp.exe 100 PID 4680 wrote to memory of 948 4680 lxxrxfl.exe 101 PID 4680 wrote to memory of 948 4680 lxxrxfl.exe 101 PID 4680 wrote to memory of 948 4680 lxxrxfl.exe 101 PID 948 wrote to memory of 4388 948 9bbtnh.exe 102 PID 948 wrote to memory of 4388 948 9bbtnh.exe 102 PID 948 wrote to memory of 4388 948 9bbtnh.exe 102 PID 4388 wrote to memory of 5064 4388 3rfxrfx.exe 103 PID 4388 wrote to memory of 5064 4388 3rfxrfx.exe 103 PID 4388 wrote to memory of 5064 4388 3rfxrfx.exe 103 PID 5064 wrote to memory of 2656 5064 tbhbnh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe"C:\Users\Admin\AppData\Local\Temp\fe130f207f478b30f7eeaf99a7a2d2668fbcdccfdf28a8a70d9c6b1f73cb82c2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\1lrfxrr.exec:\1lrfxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\htnhtt.exec:\htnhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\djjdv.exec:\djjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\xfxlfxl.exec:\xfxlfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\djdvj.exec:\djdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\hhhtnn.exec:\hhhtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\tbhbnh.exec:\tbhbnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\rxrrfxx.exec:\rxrrfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\dvdjd.exec:\dvdjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\lffrlrl.exec:\lffrlrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\vvddv.exec:\vvddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\1pdvj.exec:\1pdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\frxlfrl.exec:\frxlfrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nntnhb.exec:\nntnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\3dppd.exec:\3dppd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\ddpdp.exec:\ddpdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\lxxrxfl.exec:\lxxrxfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\9bbtnh.exec:\9bbtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\3rfxrfx.exec:\3rfxrfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\tbhbnh.exec:\tbhbnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\jjvpd.exec:\jjvpd.exe23⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lxlffff.exec:\lxlffff.exe24⤵
- Executes dropped EXE
PID:5040 -
\??\c:\jdjdd.exec:\jdjdd.exe25⤵
- Executes dropped EXE
PID:3820 -
\??\c:\7tbthn.exec:\7tbthn.exe26⤵
- Executes dropped EXE
PID:808 -
\??\c:\vvjdv.exec:\vvjdv.exe27⤵
- Executes dropped EXE
PID:4544 -
\??\c:\7lfrlfr.exec:\7lfrlfr.exe28⤵
- Executes dropped EXE
PID:968 -
\??\c:\pvvpp.exec:\pvvpp.exe29⤵
- Executes dropped EXE
PID:3252 -
\??\c:\thnnhb.exec:\thnnhb.exe30⤵
- Executes dropped EXE
PID:4944 -
\??\c:\9pjdp.exec:\9pjdp.exe31⤵
- Executes dropped EXE
PID:700 -
\??\c:\xrxrllr.exec:\xrxrllr.exe32⤵
- Executes dropped EXE
PID:3644 -
\??\c:\pjpjj.exec:\pjpjj.exe33⤵
- Executes dropped EXE
PID:396 -
\??\c:\5xllxfx.exec:\5xllxfx.exe34⤵
- Executes dropped EXE
PID:4904 -
\??\c:\dpdvv.exec:\dpdvv.exe35⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pjjjd.exec:\pjjjd.exe36⤵
- Executes dropped EXE
PID:3892 -
\??\c:\5rxrrlx.exec:\5rxrrlx.exe37⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tnnnhb.exec:\tnnnhb.exe38⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jdvpj.exec:\jdvpj.exe39⤵
- Executes dropped EXE
PID:3896 -
\??\c:\lffrlrl.exec:\lffrlrl.exe40⤵
- Executes dropped EXE
PID:312 -
\??\c:\tbhbtn.exec:\tbhbtn.exe41⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pvvpd.exec:\pvvpd.exe42⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3vvjv.exec:\3vvjv.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fxxxxrl.exec:\fxxxxrl.exe44⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1tbtnb.exec:\1tbtnb.exe45⤵
- Executes dropped EXE
PID:4580 -
\??\c:\vdjpp.exec:\vdjpp.exe46⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vjpjj.exec:\vjpjj.exe47⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\djpjd.exec:\djpjd.exe49⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rffxxxr.exec:\rffxxxr.exe50⤵
- Executes dropped EXE
PID:3140 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe51⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tbhnhb.exec:\tbhnhb.exe52⤵
- Executes dropped EXE
PID:944 -
\??\c:\jddpd.exec:\jddpd.exe53⤵
- Executes dropped EXE
PID:4324 -
\??\c:\fxrxxll.exec:\fxrxxll.exe54⤵
- Executes dropped EXE
PID:1884 -
\??\c:\5lxxrrl.exec:\5lxxrrl.exe55⤵
- Executes dropped EXE
PID:656 -
\??\c:\dvvjd.exec:\dvvjd.exe56⤵
- Executes dropped EXE
PID:1872 -
\??\c:\ddpjv.exec:\ddpjv.exe57⤵
- Executes dropped EXE
PID:4220 -
\??\c:\fxfxffx.exec:\fxfxffx.exe58⤵
- Executes dropped EXE
PID:876 -
\??\c:\7nbtnn.exec:\7nbtnn.exe59⤵
- Executes dropped EXE
PID:4492 -
\??\c:\jvppd.exec:\jvppd.exe60⤵
- Executes dropped EXE
PID:3524 -
\??\c:\lflxffx.exec:\lflxffx.exe61⤵
- Executes dropped EXE
PID:3164 -
\??\c:\xllfrrx.exec:\xllfrrx.exe62⤵
- Executes dropped EXE
PID:3724 -
\??\c:\bntnhb.exec:\bntnhb.exe63⤵
- Executes dropped EXE
PID:4444 -
\??\c:\dvvpd.exec:\dvvpd.exe64⤵
- Executes dropped EXE
PID:212 -
\??\c:\xllfxxx.exec:\xllfxxx.exe65⤵
- Executes dropped EXE
PID:3968 -
\??\c:\7tnbnh.exec:\7tnbnh.exe66⤵PID:5096
-
\??\c:\dppdv.exec:\dppdv.exe67⤵PID:2840
-
\??\c:\lrlflxx.exec:\lrlflxx.exe68⤵PID:4684
-
\??\c:\5hhbnh.exec:\5hhbnh.exe69⤵PID:3628
-
\??\c:\dppvj.exec:\dppvj.exe70⤵PID:2316
-
\??\c:\7rrfrlx.exec:\7rrfrlx.exe71⤵PID:1176
-
\??\c:\rfxrfrl.exec:\rfxrfrl.exe72⤵PID:2916
-
\??\c:\nnnbnh.exec:\nnnbnh.exe73⤵PID:4352
-
\??\c:\jvdpj.exec:\jvdpj.exe74⤵PID:644
-
\??\c:\rffrlfx.exec:\rffrlfx.exe75⤵PID:4660
-
\??\c:\bnnntb.exec:\bnnntb.exe76⤵PID:4404
-
\??\c:\pppdj.exec:\pppdj.exe77⤵PID:3256
-
\??\c:\5lxlxrf.exec:\5lxlxrf.exe78⤵PID:1080
-
\??\c:\nbbnbt.exec:\nbbnbt.exe79⤵PID:1496
-
\??\c:\3nbbht.exec:\3nbbht.exe80⤵PID:4732
-
\??\c:\vdpdj.exec:\vdpdj.exe81⤵PID:5032
-
\??\c:\xflxrlx.exec:\xflxrlx.exe82⤵PID:2472
-
\??\c:\xffxfxr.exec:\xffxfxr.exe83⤵PID:2628
-
\??\c:\nbnhnh.exec:\nbnhnh.exe84⤵PID:2932
-
\??\c:\dpdpd.exec:\dpdpd.exe85⤵PID:696
-
\??\c:\vjddp.exec:\vjddp.exe86⤵PID:1892
-
\??\c:\frfxfxx.exec:\frfxfxx.exe87⤵PID:2148
-
\??\c:\bbbntt.exec:\bbbntt.exe88⤵PID:4904
-
\??\c:\htnbnb.exec:\htnbnb.exe89⤵PID:1276
-
\??\c:\vddpd.exec:\vddpd.exe90⤵PID:3492
-
\??\c:\5lxlrfl.exec:\5lxlrfl.exe91⤵PID:4356
-
\??\c:\5hthtn.exec:\5hthtn.exe92⤵PID:3596
-
\??\c:\ddvjv.exec:\ddvjv.exe93⤵PID:2940
-
\??\c:\7flxlfr.exec:\7flxlfr.exe94⤵PID:2264
-
\??\c:\rlfxrlx.exec:\rlfxrlx.exe95⤵PID:312
-
\??\c:\nhthtb.exec:\nhthtb.exe96⤵PID:2968
-
\??\c:\pppdp.exec:\pppdp.exe97⤵PID:1112
-
\??\c:\pjjvv.exec:\pjjvv.exe98⤵PID:4956
-
\??\c:\fflxlfr.exec:\fflxlfr.exe99⤵PID:3660
-
\??\c:\htnhbt.exec:\htnhbt.exe100⤵PID:2632
-
\??\c:\1vpjv.exec:\1vpjv.exe101⤵PID:1580
-
\??\c:\fffrflr.exec:\fffrflr.exe102⤵PID:2772
-
\??\c:\1lffrfx.exec:\1lffrfx.exe103⤵PID:1200
-
\??\c:\3hbnbt.exec:\3hbnbt.exe104⤵PID:980
-
\??\c:\ddvjv.exec:\ddvjv.exe105⤵
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\xxxrfxl.exec:\xxxrfxl.exe106⤵PID:4832
-
\??\c:\bhtnbt.exec:\bhtnbt.exe107⤵PID:2348
-
\??\c:\tbnhnb.exec:\tbnhnb.exe108⤵PID:944
-
\??\c:\lxrrfrf.exec:\lxrrfrf.exe109⤵PID:4324
-
\??\c:\lflxxrl.exec:\lflxxrl.exe110⤵PID:2220
-
\??\c:\7hbthb.exec:\7hbthb.exe111⤵PID:1884
-
\??\c:\vdjvd.exec:\vdjvd.exe112⤵PID:844
-
\??\c:\fxrlfll.exec:\fxrlfll.exe113⤵PID:1020
-
\??\c:\5thbnn.exec:\5thbnn.exe114⤵PID:4420
-
\??\c:\nbbhtn.exec:\nbbhtn.exe115⤵PID:3168
-
\??\c:\3jdpv.exec:\3jdpv.exe116⤵PID:4348
-
\??\c:\xlrflxl.exec:\xlrflxl.exe117⤵PID:4492
-
\??\c:\rxxrfxl.exec:\rxxrfxl.exe118⤵PID:4464
-
\??\c:\nhbthb.exec:\nhbthb.exe119⤵PID:2028
-
\??\c:\5dvjv.exec:\5dvjv.exe120⤵PID:3164
-
\??\c:\vjpdj.exec:\vjpdj.exe121⤵PID:556
-
\??\c:\3xrflfx.exec:\3xrflfx.exe122⤵PID:4440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-