Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 01:50
Behavioral task
behavioral1
Sample
750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe
-
Size
332KB
-
MD5
e11cd07de57c4fad1a33b26e6963586c
-
SHA1
8fb5dc6c0e90ba0aca2efd61a605f1533e961b50
-
SHA256
750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5
-
SHA512
024377bfd910583aa873f93e642525120a818ab684e4f6eb3b2cae4fa75031c2bdba03213aa49facbf784e54798189093a2fd86340dece43da75c3a256ec921e
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeK:R4wFHoSHYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1624-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2896-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1864-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1620-1085-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-1157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-1225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 908 9jdvj.exe 1624 rlfxxxl.exe 3748 nnnnhb.exe 4832 ttnhbt.exe 5096 dvdvp.exe 4608 3xfxllx.exe 2012 3rlfrlf.exe 4568 7tthbt.exe 2252 xllfxrl.exe 2188 rlrlffx.exe 4296 ppjdv.exe 3900 jdjjv.exe 3456 7nhbtt.exe 2988 jppjv.exe 1420 rfrlfxr.exe 4864 dvpdp.exe 220 fxxlrrf.exe 3080 xrrlffr.exe 2072 dpjdv.exe 3020 bbtbtb.exe 3340 vjvvv.exe 1720 bthhbh.exe 1228 jdvpj.exe 3512 rrlrlff.exe 4372 bhnntb.exe 1068 nbnhbb.exe 2784 pjppj.exe 1992 3lxrrll.exe 4580 rffxflx.exe 1848 bbhnhn.exe 1824 fflfxxf.exe 636 hhbbhn.exe 5076 lflfxxx.exe 4948 tbnnnt.exe 2896 xxfxxxf.exe 1644 dpvdd.exe 2776 9rlllrr.exe 1804 bhhnnb.exe 1300 bbhnht.exe 3644 jpddd.exe 464 lxlrrxx.exe 3428 nnhntt.exe 5080 tnnttb.exe 316 djvvp.exe 4276 3lrlflf.exe 4972 llrlffx.exe 1488 hnttnt.exe 3636 7dddd.exe 4180 3jjdv.exe 4912 llxxxfr.exe 2720 thhhhn.exe 4600 1ppvv.exe 2428 llxxfff.exe 1800 xfrxxfl.exe 2224 btttnn.exe 1724 1vvvj.exe 4548 jjvdj.exe 4828 xflfrxx.exe 4608 tnbbbb.exe 1984 pdpjj.exe 4360 jvjdj.exe 2980 htbhbh.exe 968 nhnhbt.exe 4688 5pvpv.exe -
resource yara_rule behavioral2/memory/1980-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b5c-3.dat upx behavioral2/memory/908-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023bd2-9.dat upx behavioral2/memory/1624-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bd3-15.dat upx behavioral2/memory/4832-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bd9-24.dat upx behavioral2/memory/4608-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2012-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bde-40.dat upx behavioral2/memory/4568-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bdd-35.dat upx behavioral2/files/0x0008000000023bdc-30.dat upx behavioral2/memory/5096-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bd7-20.dat upx behavioral2/memory/908-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1980-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c0e-45.dat upx behavioral2/memory/2252-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c0f-50.dat upx behavioral2/memory/2188-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c10-54.dat upx behavioral2/files/0x0008000000023c11-59.dat upx behavioral2/memory/4296-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2188-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c12-64.dat upx behavioral2/files/0x0008000000023c13-68.dat upx behavioral2/memory/3456-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2988-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c18-73.dat upx behavioral2/files/0x0008000000023c19-78.dat upx behavioral2/memory/1420-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c1a-83.dat upx behavioral2/memory/220-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c2c-89.dat upx behavioral2/memory/4864-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c32-93.dat upx behavioral2/memory/3080-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023bae-98.dat upx behavioral2/files/0x0008000000023c33-102.dat upx behavioral2/memory/3340-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3020-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c34-108.dat upx behavioral2/memory/1720-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c36-112.dat upx behavioral2/memory/1228-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c37-117.dat upx behavioral2/files/0x000b000000023c4c-123.dat upx behavioral2/memory/3512-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0016000000023c4d-128.dat upx behavioral2/files/0x0008000000023c53-132.dat upx behavioral2/memory/4372-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c57-137.dat upx behavioral2/memory/1992-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c63-141.dat upx behavioral2/memory/1992-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c64-147.dat upx behavioral2/memory/4580-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c65-151.dat upx behavioral2/files/0x0008000000023c66-157.dat upx behavioral2/memory/1824-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2896-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1300-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1980 wrote to memory of 908 1980 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 82 PID 1980 wrote to memory of 908 1980 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 82 PID 1980 wrote to memory of 908 1980 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 82 PID 908 wrote to memory of 1624 908 9jdvj.exe 83 PID 908 wrote to memory of 1624 908 9jdvj.exe 83 PID 908 wrote to memory of 1624 908 9jdvj.exe 83 PID 1624 wrote to memory of 3748 1624 rlfxxxl.exe 84 PID 1624 wrote to memory of 3748 1624 rlfxxxl.exe 84 PID 1624 wrote to memory of 3748 1624 rlfxxxl.exe 84 PID 3748 wrote to memory of 4832 3748 nnnnhb.exe 85 PID 3748 wrote to memory of 4832 3748 nnnnhb.exe 85 PID 3748 wrote to memory of 4832 3748 nnnnhb.exe 85 PID 4832 wrote to memory of 5096 4832 ttnhbt.exe 86 PID 4832 wrote to memory of 5096 4832 ttnhbt.exe 86 PID 4832 wrote to memory of 5096 4832 ttnhbt.exe 86 PID 5096 wrote to memory of 4608 5096 dvdvp.exe 87 PID 5096 wrote to memory of 4608 5096 dvdvp.exe 87 PID 5096 wrote to memory of 4608 5096 dvdvp.exe 87 PID 4608 wrote to memory of 2012 4608 3xfxllx.exe 88 PID 4608 wrote to memory of 2012 4608 3xfxllx.exe 88 PID 4608 wrote to memory of 2012 4608 3xfxllx.exe 88 PID 2012 wrote to memory of 4568 2012 3rlfrlf.exe 89 PID 2012 wrote to memory of 4568 2012 3rlfrlf.exe 89 PID 2012 wrote to memory of 4568 2012 3rlfrlf.exe 89 PID 4568 wrote to memory of 2252 4568 7tthbt.exe 90 PID 4568 wrote to memory of 2252 4568 7tthbt.exe 90 PID 4568 wrote to memory of 2252 4568 7tthbt.exe 90 PID 2252 wrote to memory of 2188 2252 xllfxrl.exe 91 PID 2252 wrote to memory of 2188 2252 xllfxrl.exe 91 PID 2252 wrote to memory of 2188 2252 xllfxrl.exe 91 PID 2188 wrote to memory of 4296 2188 rlrlffx.exe 92 PID 2188 wrote to memory of 4296 2188 rlrlffx.exe 92 PID 2188 wrote to memory of 4296 2188 rlrlffx.exe 92 PID 4296 wrote to memory of 3900 4296 ppjdv.exe 93 PID 4296 wrote to memory of 3900 4296 ppjdv.exe 93 PID 4296 wrote to memory of 3900 4296 ppjdv.exe 93 PID 3900 wrote to memory of 3456 3900 jdjjv.exe 94 PID 3900 wrote to memory of 3456 3900 jdjjv.exe 94 PID 3900 wrote to memory of 3456 3900 jdjjv.exe 94 PID 3456 wrote to memory of 2988 3456 7nhbtt.exe 95 PID 3456 wrote to memory of 2988 3456 7nhbtt.exe 95 PID 3456 wrote to memory of 2988 3456 7nhbtt.exe 95 PID 2988 wrote to memory of 1420 2988 jppjv.exe 96 PID 2988 wrote to memory of 1420 2988 jppjv.exe 96 PID 2988 wrote to memory of 1420 2988 jppjv.exe 96 PID 1420 wrote to memory of 4864 1420 rfrlfxr.exe 97 PID 1420 wrote to memory of 4864 1420 rfrlfxr.exe 97 PID 1420 wrote to memory of 4864 1420 rfrlfxr.exe 97 PID 4864 wrote to memory of 220 4864 dvpdp.exe 98 PID 4864 wrote to memory of 220 4864 dvpdp.exe 98 PID 4864 wrote to memory of 220 4864 dvpdp.exe 98 PID 220 wrote to memory of 3080 220 fxxlrrf.exe 99 PID 220 wrote to memory of 3080 220 fxxlrrf.exe 99 PID 220 wrote to memory of 3080 220 fxxlrrf.exe 99 PID 3080 wrote to memory of 2072 3080 xrrlffr.exe 100 PID 3080 wrote to memory of 2072 3080 xrrlffr.exe 100 PID 3080 wrote to memory of 2072 3080 xrrlffr.exe 100 PID 2072 wrote to memory of 3020 2072 dpjdv.exe 101 PID 2072 wrote to memory of 3020 2072 dpjdv.exe 101 PID 2072 wrote to memory of 3020 2072 dpjdv.exe 101 PID 3020 wrote to memory of 3340 3020 bbtbtb.exe 102 PID 3020 wrote to memory of 3340 3020 bbtbtb.exe 102 PID 3020 wrote to memory of 3340 3020 bbtbtb.exe 102 PID 3340 wrote to memory of 1720 3340 vjvvv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe"C:\Users\Admin\AppData\Local\Temp\750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\9jdvj.exec:\9jdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\rlfxxxl.exec:\rlfxxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\nnnnhb.exec:\nnnnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\ttnhbt.exec:\ttnhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\dvdvp.exec:\dvdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\3xfxllx.exec:\3xfxllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\3rlfrlf.exec:\3rlfrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\7tthbt.exec:\7tthbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\xllfxrl.exec:\xllfxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\rlrlffx.exec:\rlrlffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\ppjdv.exec:\ppjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\jdjjv.exec:\jdjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\7nhbtt.exec:\7nhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\jppjv.exec:\jppjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rfrlfxr.exec:\rfrlfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\dvpdp.exec:\dvpdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\fxxlrrf.exec:\fxxlrrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\xrrlffr.exec:\xrrlffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\dpjdv.exec:\dpjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\bbtbtb.exec:\bbtbtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\vjvvv.exec:\vjvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\bthhbh.exec:\bthhbh.exe23⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jdvpj.exec:\jdvpj.exe24⤵
- Executes dropped EXE
PID:1228 -
\??\c:\rrlrlff.exec:\rrlrlff.exe25⤵
- Executes dropped EXE
PID:3512 -
\??\c:\bhnntb.exec:\bhnntb.exe26⤵
- Executes dropped EXE
PID:4372 -
\??\c:\nbnhbb.exec:\nbnhbb.exe27⤵
- Executes dropped EXE
PID:1068 -
\??\c:\pjppj.exec:\pjppj.exe28⤵
- Executes dropped EXE
PID:2784 -
\??\c:\3lxrrll.exec:\3lxrrll.exe29⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rffxflx.exec:\rffxflx.exe30⤵
- Executes dropped EXE
PID:4580 -
\??\c:\bbhnhn.exec:\bbhnhn.exe31⤵
- Executes dropped EXE
PID:1848 -
\??\c:\fflfxxf.exec:\fflfxxf.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1824 -
\??\c:\hhbbhn.exec:\hhbbhn.exe33⤵
- Executes dropped EXE
PID:636 -
\??\c:\lflfxxx.exec:\lflfxxx.exe34⤵
- Executes dropped EXE
PID:5076 -
\??\c:\tbnnnt.exec:\tbnnnt.exe35⤵
- Executes dropped EXE
PID:4948 -
\??\c:\xxfxxxf.exec:\xxfxxxf.exe36⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dpvdd.exec:\dpvdd.exe37⤵
- Executes dropped EXE
PID:1644 -
\??\c:\9rlllrr.exec:\9rlllrr.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\bhhnnb.exec:\bhhnnb.exe39⤵
- Executes dropped EXE
PID:1804 -
\??\c:\bbhnht.exec:\bbhnht.exe40⤵
- Executes dropped EXE
PID:1300 -
\??\c:\jpddd.exec:\jpddd.exe41⤵
- Executes dropped EXE
PID:3644 -
\??\c:\lxlrrxx.exec:\lxlrrxx.exe42⤵
- Executes dropped EXE
PID:464 -
\??\c:\nnhntt.exec:\nnhntt.exe43⤵
- Executes dropped EXE
PID:3428 -
\??\c:\tnnttb.exec:\tnnttb.exe44⤵
- Executes dropped EXE
PID:5080 -
\??\c:\djvvp.exec:\djvvp.exe45⤵
- Executes dropped EXE
PID:316 -
\??\c:\3lrlflf.exec:\3lrlflf.exe46⤵
- Executes dropped EXE
PID:4276 -
\??\c:\llrlffx.exec:\llrlffx.exe47⤵
- Executes dropped EXE
PID:4972 -
\??\c:\hnttnt.exec:\hnttnt.exe48⤵
- Executes dropped EXE
PID:1488 -
\??\c:\7dddd.exec:\7dddd.exe49⤵
- Executes dropped EXE
PID:3636 -
\??\c:\3jjdv.exec:\3jjdv.exe50⤵
- Executes dropped EXE
PID:4180 -
\??\c:\llxxxfr.exec:\llxxxfr.exe51⤵
- Executes dropped EXE
PID:4912 -
\??\c:\thhhhn.exec:\thhhhn.exe52⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bbttnn.exec:\bbttnn.exe53⤵PID:4392
-
\??\c:\1ppvv.exec:\1ppvv.exe54⤵
- Executes dropped EXE
PID:4600 -
\??\c:\llxxfff.exec:\llxxfff.exe55⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xfrxxfl.exec:\xfrxxfl.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\btttnn.exec:\btttnn.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2224 -
\??\c:\1vvvj.exec:\1vvvj.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jjvdj.exec:\jjvdj.exe59⤵
- Executes dropped EXE
PID:4548 -
\??\c:\xflfrxx.exec:\xflfrxx.exe60⤵
- Executes dropped EXE
PID:4828 -
\??\c:\tnbbbb.exec:\tnbbbb.exe61⤵
- Executes dropped EXE
PID:4608 -
\??\c:\pdpjj.exec:\pdpjj.exe62⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jvjdj.exec:\jvjdj.exe63⤵
- Executes dropped EXE
PID:4360 -
\??\c:\htbhbh.exec:\htbhbh.exe64⤵
- Executes dropped EXE
PID:2980 -
\??\c:\nhnhbt.exec:\nhnhbt.exe65⤵
- Executes dropped EXE
PID:968 -
\??\c:\5pvpv.exec:\5pvpv.exe66⤵
- Executes dropped EXE
PID:4688 -
\??\c:\fxlxxfx.exec:\fxlxxfx.exe67⤵PID:4840
-
\??\c:\hhnhhh.exec:\hhnhhh.exe68⤵PID:3092
-
\??\c:\thbbbh.exec:\thbbbh.exe69⤵PID:116
-
\??\c:\dvpjd.exec:\dvpjd.exe70⤵PID:4992
-
\??\c:\xrlfflr.exec:\xrlfflr.exe71⤵PID:5052
-
\??\c:\9lrfflf.exec:\9lrfflf.exe72⤵PID:680
-
\??\c:\nnhnnn.exec:\nnhnnn.exe73⤵PID:816
-
\??\c:\bbhhbb.exec:\bbhhbb.exe74⤵PID:1744
-
\??\c:\ddvvd.exec:\ddvvd.exe75⤵PID:4268
-
\??\c:\lffxrrr.exec:\lffxrrr.exe76⤵PID:1420
-
\??\c:\llfrllr.exec:\llfrllr.exe77⤵PID:1920
-
\??\c:\5hhbbt.exec:\5hhbbt.exe78⤵PID:5020
-
\??\c:\tnbbbb.exec:\tnbbbb.exe79⤵PID:5036
-
\??\c:\ddvpj.exec:\ddvpj.exe80⤵PID:852
-
\??\c:\llxxlxr.exec:\llxxlxr.exe81⤵PID:2184
-
\??\c:\hhnbth.exec:\hhnbth.exe82⤵PID:3968
-
\??\c:\nbntnn.exec:\nbntnn.exe83⤵PID:5060
-
\??\c:\pdpvp.exec:\pdpvp.exe84⤵PID:3376
-
\??\c:\rxxfxrx.exec:\rxxfxrx.exe85⤵PID:4772
-
\??\c:\ttttbh.exec:\ttttbh.exe86⤵PID:876
-
\??\c:\3thbnh.exec:\3thbnh.exe87⤵PID:4556
-
\??\c:\jvjpj.exec:\jvjpj.exe88⤵PID:2488
-
\??\c:\xrrrlxx.exec:\xrrrlxx.exe89⤵PID:3776
-
\??\c:\frfxxxr.exec:\frfxxxr.exe90⤵PID:3584
-
\??\c:\bnnhbh.exec:\bnnhbh.exe91⤵PID:4372
-
\??\c:\pvjvp.exec:\pvjvp.exe92⤵PID:1732
-
\??\c:\9pjpj.exec:\9pjpj.exe93⤵PID:4636
-
\??\c:\rrffrrr.exec:\rrffrrr.exe94⤵PID:3296
-
\??\c:\7hbhnn.exec:\7hbhnn.exe95⤵PID:1856
-
\??\c:\hhtnhh.exec:\hhtnhh.exe96⤵PID:4580
-
\??\c:\jvddv.exec:\jvddv.exe97⤵PID:2640
-
\??\c:\lxfxllf.exec:\lxfxllf.exe98⤵PID:4604
-
\??\c:\xlrxxff.exec:\xlrxxff.exe99⤵PID:3916
-
\??\c:\9nttbb.exec:\9nttbb.exe100⤵PID:1760
-
\??\c:\vpvdd.exec:\vpvdd.exe101⤵PID:740
-
\??\c:\vjjdv.exec:\vjjdv.exe102⤵PID:5076
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe103⤵PID:3332
-
\??\c:\nnbbhb.exec:\nnbbhb.exe104⤵PID:2896
-
\??\c:\vppjv.exec:\vppjv.exe105⤵PID:2132
-
\??\c:\jvjdd.exec:\jvjdd.exe106⤵PID:3480
-
\??\c:\rxxllxx.exec:\rxxllxx.exe107⤵PID:2660
-
\??\c:\flxxrrr.exec:\flxxrrr.exe108⤵PID:1676
-
\??\c:\bbhbbb.exec:\bbhbbb.exe109⤵PID:2368
-
\??\c:\dvvdp.exec:\dvvdp.exe110⤵PID:2588
-
\??\c:\xlfrfxr.exec:\xlfrfxr.exe111⤵PID:3416
-
\??\c:\fxffxfx.exec:\fxffxfx.exe112⤵PID:1940
-
\??\c:\tnbtbn.exec:\tnbtbn.exe113⤵PID:380
-
\??\c:\dvpjd.exec:\dvpjd.exe114⤵PID:3108
-
\??\c:\vjpjj.exec:\vjpjj.exe115⤵PID:2384
-
\??\c:\fxxxxfx.exec:\fxxxxfx.exe116⤵PID:4972
-
\??\c:\7nnnhh.exec:\7nnnhh.exe117⤵PID:1124
-
\??\c:\dvpjp.exec:\dvpjp.exe118⤵PID:2120
-
\??\c:\vpjdv.exec:\vpjdv.exe119⤵PID:1596
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe120⤵PID:2064
-
\??\c:\lllllxx.exec:\lllllxx.exe121⤵PID:4368
-
\??\c:\tbbbbh.exec:\tbbbbh.exe122⤵PID:1020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-