Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 00:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fb8a8a8d7e2bbdf6eb599bc08418b5ddd3ebd87b3db2c8e75d1641ffa6eb67eN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
5fb8a8a8d7e2bbdf6eb599bc08418b5ddd3ebd87b3db2c8e75d1641ffa6eb67eN.exe
-
Size
454KB
-
MD5
cda94405bb42f6fb97d523c0f55937f0
-
SHA1
5f82f651bc78b49af60db54d284fe42bcdc02904
-
SHA256
5fb8a8a8d7e2bbdf6eb599bc08418b5ddd3ebd87b3db2c8e75d1641ffa6eb67e
-
SHA512
be6d6e74d4b324a3d2604ed408340ae471f5f08d26361cdb06051688e43fc8d9e926f1db96720740b1aeeac1ceb62afe0d9978ba0ad3a22d6a4385878e522c72
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetM:q7Tc2NYHUrAwfMp3CDtM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/556-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-869-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-1532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2036 frxxxxx.exe 4968 nbtnbb.exe 2104 3thbhh.exe 2376 hhhnnh.exe 3036 lrlrrfx.exe 1092 pjvpj.exe 2040 hbhhnh.exe 1280 jvvvv.exe 760 nnnhbb.exe 1916 fxxrlll.exe 5116 hbbtnn.exe 2164 lxflrxx.exe 2160 9xffxrl.exe 908 lrllffr.exe 4964 bnnhbt.exe 2716 ddjdv.exe 4472 ttttnn.exe 1360 pppjd.exe 4160 vdpvv.exe 3244 5tbttt.exe 912 lfllrrl.exe 4268 5tnhhb.exe 1800 1dpjp.exe 4448 fxlllff.exe 4536 dpvpj.exe 228 9nttnn.exe 3384 3llxrrr.exe 3536 rllllff.exe 4764 xlrxxrr.exe 4416 rllrlrl.exe 1160 nttbbb.exe 4308 3vpdj.exe 1636 dpvpj.exe 2564 1djdp.exe 2640 lrrfxlf.exe 3684 1nnbbb.exe 1888 pjjvd.exe 2168 xlllxxl.exe 1736 lffxrxl.exe 4952 nhhttn.exe 3120 7vpjd.exe 2696 vvpjv.exe 5112 fllxrlx.exe 1288 tttthn.exe 452 vvdjd.exe 4224 1jjjv.exe 3012 xlrfrll.exe 4340 hhhhbb.exe 2420 5nnhbt.exe 1028 pjvvv.exe 4884 1xrlxxr.exe 2432 htbbbb.exe 556 jddpp.exe 4908 xflfxxf.exe 2212 nthbnh.exe 4992 dppjd.exe 3760 1vdpj.exe 4528 tnnthh.exe 4444 bnnhbb.exe 2980 3jjvp.exe 2020 9djvp.exe 2556 hbbbtt.exe 3204 ntbthn.exe 1680 dpjvp.exe -
resource yara_rule behavioral2/memory/556-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-671-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 556 wrote to memory of 2036 556 5fb8a8a8d7e2bbdf6eb599bc08418b5ddd3ebd87b3db2c8e75d1641ffa6eb67eN.exe 83 PID 556 wrote to memory of 2036 556 5fb8a8a8d7e2bbdf6eb599bc08418b5ddd3ebd87b3db2c8e75d1641ffa6eb67eN.exe 83 PID 556 wrote to memory of 2036 556 5fb8a8a8d7e2bbdf6eb599bc08418b5ddd3ebd87b3db2c8e75d1641ffa6eb67eN.exe 83 PID 2036 wrote to memory of 4968 2036 frxxxxx.exe 84 PID 2036 wrote to memory of 4968 2036 frxxxxx.exe 84 PID 2036 wrote to memory of 4968 2036 frxxxxx.exe 84 PID 4968 wrote to memory of 2104 4968 nbtnbb.exe 85 PID 4968 wrote to memory of 2104 4968 nbtnbb.exe 85 PID 4968 wrote to memory of 2104 4968 nbtnbb.exe 85 PID 2104 wrote to memory of 2376 2104 3thbhh.exe 86 PID 2104 wrote to memory of 2376 2104 3thbhh.exe 86 PID 2104 wrote to memory of 2376 2104 3thbhh.exe 86 PID 2376 wrote to memory of 3036 2376 hhhnnh.exe 87 PID 2376 wrote to memory of 3036 2376 hhhnnh.exe 87 PID 2376 wrote to memory of 3036 2376 hhhnnh.exe 87 PID 3036 wrote to memory of 1092 3036 lrlrrfx.exe 88 PID 3036 wrote to memory of 1092 3036 lrlrrfx.exe 88 PID 3036 wrote to memory of 1092 3036 lrlrrfx.exe 88 PID 1092 wrote to memory of 2040 1092 pjvpj.exe 89 PID 1092 wrote to memory of 2040 1092 pjvpj.exe 89 PID 1092 wrote to memory of 2040 1092 pjvpj.exe 89 PID 2040 wrote to memory of 1280 2040 hbhhnh.exe 90 PID 2040 wrote to memory of 1280 2040 hbhhnh.exe 90 PID 2040 wrote to memory of 1280 2040 hbhhnh.exe 90 PID 1280 wrote to memory of 760 1280 jvvvv.exe 91 PID 1280 wrote to memory of 760 1280 jvvvv.exe 91 PID 1280 wrote to memory of 760 1280 jvvvv.exe 91 PID 760 wrote to memory of 1916 760 nnnhbb.exe 92 PID 760 wrote to memory of 1916 760 nnnhbb.exe 92 PID 760 wrote to memory of 1916 760 nnnhbb.exe 92 PID 1916 wrote to memory of 5116 1916 fxxrlll.exe 93 PID 1916 wrote to memory of 5116 1916 fxxrlll.exe 93 PID 1916 wrote to memory of 5116 1916 fxxrlll.exe 93 PID 5116 wrote to memory of 2164 5116 hbbtnn.exe 94 PID 5116 wrote to memory of 2164 5116 hbbtnn.exe 94 PID 5116 wrote to memory of 2164 5116 hbbtnn.exe 94 PID 2164 wrote to memory of 2160 2164 lxflrxx.exe 95 PID 2164 wrote to memory of 2160 2164 lxflrxx.exe 95 PID 2164 wrote to memory of 2160 2164 lxflrxx.exe 95 PID 2160 wrote to memory of 908 2160 9xffxrl.exe 96 PID 2160 wrote to memory of 908 2160 9xffxrl.exe 96 PID 2160 wrote to memory of 908 2160 9xffxrl.exe 96 PID 908 wrote to memory of 4964 908 lrllffr.exe 97 PID 908 wrote to memory of 4964 908 lrllffr.exe 97 PID 908 wrote to memory of 4964 908 lrllffr.exe 97 PID 4964 wrote to memory of 2716 4964 bnnhbt.exe 98 PID 4964 wrote to memory of 2716 4964 bnnhbt.exe 98 PID 4964 wrote to memory of 2716 4964 bnnhbt.exe 98 PID 2716 wrote to memory of 4472 2716 ddjdv.exe 99 PID 2716 wrote to memory of 4472 2716 ddjdv.exe 99 PID 2716 wrote to memory of 4472 2716 ddjdv.exe 99 PID 4472 wrote to memory of 1360 4472 ttttnn.exe 100 PID 4472 wrote to memory of 1360 4472 ttttnn.exe 100 PID 4472 wrote to memory of 1360 4472 ttttnn.exe 100 PID 1360 wrote to memory of 4160 1360 pppjd.exe 101 PID 1360 wrote to memory of 4160 1360 pppjd.exe 101 PID 1360 wrote to memory of 4160 1360 pppjd.exe 101 PID 4160 wrote to memory of 3244 4160 vdpvv.exe 102 PID 4160 wrote to memory of 3244 4160 vdpvv.exe 102 PID 4160 wrote to memory of 3244 4160 vdpvv.exe 102 PID 3244 wrote to memory of 912 3244 5tbttt.exe 103 PID 3244 wrote to memory of 912 3244 5tbttt.exe 103 PID 3244 wrote to memory of 912 3244 5tbttt.exe 103 PID 912 wrote to memory of 4268 912 lfllrrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fb8a8a8d7e2bbdf6eb599bc08418b5ddd3ebd87b3db2c8e75d1641ffa6eb67eN.exe"C:\Users\Admin\AppData\Local\Temp\5fb8a8a8d7e2bbdf6eb599bc08418b5ddd3ebd87b3db2c8e75d1641ffa6eb67eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\frxxxxx.exec:\frxxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\nbtnbb.exec:\nbtnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\3thbhh.exec:\3thbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\hhhnnh.exec:\hhhnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\lrlrrfx.exec:\lrlrrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\pjvpj.exec:\pjvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\hbhhnh.exec:\hbhhnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jvvvv.exec:\jvvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\nnnhbb.exec:\nnnhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\fxxrlll.exec:\fxxrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\hbbtnn.exec:\hbbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\lxflrxx.exec:\lxflrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\9xffxrl.exec:\9xffxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\lrllffr.exec:\lrllffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\bnnhbt.exec:\bnnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\ddjdv.exec:\ddjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\ttttnn.exec:\ttttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\pppjd.exec:\pppjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\vdpvv.exec:\vdpvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\5tbttt.exec:\5tbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\lfllrrl.exec:\lfllrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\5tnhhb.exec:\5tnhhb.exe23⤵
- Executes dropped EXE
PID:4268 -
\??\c:\1dpjp.exec:\1dpjp.exe24⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxlllff.exec:\fxlllff.exe25⤵
- Executes dropped EXE
PID:4448 -
\??\c:\dpvpj.exec:\dpvpj.exe26⤵
- Executes dropped EXE
PID:4536 -
\??\c:\9nttnn.exec:\9nttnn.exe27⤵
- Executes dropped EXE
PID:228 -
\??\c:\3llxrrr.exec:\3llxrrr.exe28⤵
- Executes dropped EXE
PID:3384 -
\??\c:\rllllff.exec:\rllllff.exe29⤵
- Executes dropped EXE
PID:3536 -
\??\c:\xlrxxrr.exec:\xlrxxrr.exe30⤵
- Executes dropped EXE
PID:4764 -
\??\c:\rllrlrl.exec:\rllrlrl.exe31⤵
- Executes dropped EXE
PID:4416 -
\??\c:\nttbbb.exec:\nttbbb.exe32⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3vpdj.exec:\3vpdj.exe33⤵
- Executes dropped EXE
PID:4308 -
\??\c:\dpvpj.exec:\dpvpj.exe34⤵
- Executes dropped EXE
PID:1636 -
\??\c:\1djdp.exec:\1djdp.exe35⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lrrfxlf.exec:\lrrfxlf.exe36⤵
- Executes dropped EXE
PID:2640 -
\??\c:\1nnbbb.exec:\1nnbbb.exe37⤵
- Executes dropped EXE
PID:3684 -
\??\c:\pjjvd.exec:\pjjvd.exe38⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xlllxxl.exec:\xlllxxl.exe39⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lffxrxl.exec:\lffxrxl.exe40⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nhhttn.exec:\nhhttn.exe41⤵
- Executes dropped EXE
PID:4952 -
\??\c:\7vpjd.exec:\7vpjd.exe42⤵
- Executes dropped EXE
PID:3120 -
\??\c:\vvpjv.exec:\vvpjv.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fllxrlx.exec:\fllxrlx.exe44⤵
- Executes dropped EXE
PID:5112 -
\??\c:\tttthn.exec:\tttthn.exe45⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vvdjd.exec:\vvdjd.exe46⤵
- Executes dropped EXE
PID:452 -
\??\c:\1jjjv.exec:\1jjjv.exe47⤵
- Executes dropped EXE
PID:4224 -
\??\c:\xlrfrll.exec:\xlrfrll.exe48⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hhhhbb.exec:\hhhhbb.exe49⤵
- Executes dropped EXE
PID:4340 -
\??\c:\5nnhbt.exec:\5nnhbt.exe50⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pjvvv.exec:\pjvvv.exe51⤵
- Executes dropped EXE
PID:1028 -
\??\c:\1xrlxxr.exec:\1xrlxxr.exe52⤵
- Executes dropped EXE
PID:4884 -
\??\c:\htbbbb.exec:\htbbbb.exe53⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jddpp.exec:\jddpp.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:556 -
\??\c:\xflfxxf.exec:\xflfxxf.exe55⤵
- Executes dropped EXE
PID:4908 -
\??\c:\nthbnh.exec:\nthbnh.exe56⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dppjd.exec:\dppjd.exe57⤵
- Executes dropped EXE
PID:4992 -
\??\c:\1vdpj.exec:\1vdpj.exe58⤵
- Executes dropped EXE
PID:3760 -
\??\c:\tnnthh.exec:\tnnthh.exe59⤵
- Executes dropped EXE
PID:4528 -
\??\c:\bnnhbb.exec:\bnnhbb.exe60⤵
- Executes dropped EXE
PID:4444 -
\??\c:\3jjvp.exec:\3jjvp.exe61⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9djvp.exec:\9djvp.exe62⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hbbbtt.exec:\hbbbtt.exe63⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ntbthn.exec:\ntbthn.exe64⤵
- Executes dropped EXE
PID:3204 -
\??\c:\dpjvp.exec:\dpjvp.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\frxrrrx.exec:\frxrrrx.exe66⤵PID:3780
-
\??\c:\bttbbb.exec:\bttbbb.exe67⤵PID:1916
-
\??\c:\djjdv.exec:\djjdv.exe68⤵PID:4432
-
\??\c:\pjvpp.exec:\pjvpp.exe69⤵PID:5008
-
\??\c:\1frxrrl.exec:\1frxrrl.exe70⤵PID:4420
-
\??\c:\1ttnnn.exec:\1ttnnn.exe71⤵
- System Location Discovery: System Language Discovery
PID:3300 -
\??\c:\ppvpj.exec:\ppvpj.exe72⤵PID:5092
-
\??\c:\vvdvv.exec:\vvdvv.exe73⤵PID:2300
-
\??\c:\5llfrrl.exec:\5llfrrl.exe74⤵PID:4436
-
\??\c:\3hnhhh.exec:\3hnhhh.exe75⤵PID:1156
-
\??\c:\7hhhbb.exec:\7hhhbb.exe76⤵PID:2768
-
\??\c:\9lrffxl.exec:\9lrffxl.exe77⤵PID:1580
-
\??\c:\bhtnhb.exec:\bhtnhb.exe78⤵PID:1828
-
\??\c:\htbnnb.exec:\htbnnb.exe79⤵PID:3244
-
\??\c:\djpjv.exec:\djpjv.exe80⤵PID:912
-
\??\c:\xrrlxrr.exec:\xrrlxrr.exe81⤵PID:208
-
\??\c:\nnttnn.exec:\nnttnn.exe82⤵PID:1080
-
\??\c:\dvpjd.exec:\dvpjd.exe83⤵PID:2960
-
\??\c:\djvjv.exec:\djvjv.exe84⤵PID:1776
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe85⤵PID:3764
-
\??\c:\1tnnbh.exec:\1tnnbh.exe86⤵PID:4772
-
\??\c:\jvvpd.exec:\jvvpd.exe87⤵PID:5064
-
\??\c:\rfxlxxr.exec:\rfxlxxr.exe88⤵PID:228
-
\??\c:\5tttnn.exec:\5tttnn.exe89⤵PID:1644
-
\??\c:\3jjdp.exec:\3jjdp.exe90⤵PID:3744
-
\??\c:\vjpjj.exec:\vjpjj.exe91⤵PID:4652
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe92⤵
- System Location Discovery: System Language Discovery
PID:2056 -
\??\c:\tnnhbb.exec:\tnnhbb.exe93⤵PID:3156
-
\??\c:\3vpdp.exec:\3vpdp.exe94⤵PID:2520
-
\??\c:\vppdd.exec:\vppdd.exe95⤵PID:1848
-
\??\c:\1flxlrl.exec:\1flxlrl.exe96⤵PID:2304
-
\??\c:\frxrflx.exec:\frxrflx.exe97⤵PID:392
-
\??\c:\bntnhh.exec:\bntnhh.exe98⤵PID:3944
-
\??\c:\jdvjd.exec:\jdvjd.exe99⤵PID:3508
-
\??\c:\lrxrlff.exec:\lrxrlff.exe100⤵PID:3684
-
\??\c:\tnnthh.exec:\tnnthh.exe101⤵PID:1648
-
\??\c:\3tnhtt.exec:\3tnhtt.exe102⤵PID:2168
-
\??\c:\vjpjd.exec:\vjpjd.exe103⤵PID:1736
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe104⤵PID:3140
-
\??\c:\9tnhbb.exec:\9tnhbb.exe105⤵PID:3120
-
\??\c:\bbnhbb.exec:\bbnhbb.exe106⤵PID:2696
-
\??\c:\7ppjd.exec:\7ppjd.exe107⤵PID:5112
-
\??\c:\fxfrllf.exec:\fxfrllf.exe108⤵PID:4800
-
\??\c:\hbhnht.exec:\hbhnht.exe109⤵PID:1480
-
\??\c:\bhhbtt.exec:\bhhbtt.exe110⤵PID:5096
-
\??\c:\vppdp.exec:\vppdp.exe111⤵
- System Location Discovery: System Language Discovery
PID:3184 -
\??\c:\fffffxx.exec:\fffffxx.exe112⤵PID:4340
-
\??\c:\bhnhtn.exec:\bhnhtn.exe113⤵PID:2420
-
\??\c:\vvdvp.exec:\vvdvp.exe114⤵PID:3584
-
\??\c:\llrlxrl.exec:\llrlxrl.exe115⤵PID:4408
-
\??\c:\lfxlxrf.exec:\lfxlxrf.exe116⤵PID:4944
-
\??\c:\7nnhbt.exec:\7nnhbt.exe117⤵PID:4372
-
\??\c:\jpvjp.exec:\jpvjp.exe118⤵PID:2684
-
\??\c:\lllfrxr.exec:\lllfrxr.exe119⤵PID:3516
-
\??\c:\xrrllfx.exec:\xrrllfx.exe120⤵PID:212
-
\??\c:\nnhbnh.exec:\nnhbnh.exe121⤵PID:116
-
\??\c:\pdvpv.exec:\pdvpv.exe122⤵PID:2984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-