Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 01:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe
-
Size
453KB
-
MD5
61b00eb098a5eef8c13c0b6d73b706d0
-
SHA1
0e9c63fa4b9c74dc77421e2af9cd936173d321c0
-
SHA256
a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659
-
SHA512
81df39cd04a071d7876cd198328a34749d243d05a6ee2232f1e23d0940fb9d691ce116dfdce7d728054a3c021cc48a688c0f94074c1971fd69f1313edd92615e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1868-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-756-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-867-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-1181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-1378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-1430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-1823-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3156 rrfrxxf.exe 3128 1pvpd.exe 1740 1ppjj.exe 3476 fffxrrl.exe 952 jpjjv.exe 2408 hbbbhh.exe 3548 fffxrrl.exe 876 llxffxl.exe 1580 llfrlfx.exe 3936 btthhb.exe 4636 pddvp.exe 5064 lxxrllf.exe 4524 9nbtnh.exe 3932 tnbtbt.exe 2452 xfxxxlx.exe 2716 3flfxrl.exe 4492 pdpjd.exe 2944 hbbtht.exe 2660 vdvdd.exe 4128 xfxrrrf.exe 4536 lffxxrf.exe 3664 nnbbtn.exe 3824 jdpdv.exe 1432 thbthb.exe 2884 jpdpd.exe 1748 rfrfrlx.exe 2740 rllxfxl.exe 60 nntthh.exe 3452 vdvpd.exe 4424 xxrfxrf.exe 4868 nhbbbt.exe 432 7vpdv.exe 1092 nhbnhb.exe 3100 rffxlfr.exe 4580 1hhbtt.exe 3604 pvjdp.exe 2228 lxrlfxl.exe 5100 jddpv.exe 3424 rxlfxrl.exe 4300 llfrlfx.exe 4344 hbnbtn.exe 3968 vddpd.exe 1900 jddvj.exe 1036 hnhthb.exe 2324 bhbnhb.exe 2360 vjjdp.exe 1516 5fxxrxr.exe 4276 rllxrlr.exe 4916 hththb.exe 2024 ppjdp.exe 3924 vjvpv.exe 3948 llrlxxr.exe 2412 bbhnhb.exe 4396 jjjjd.exe 5044 xrrlfxr.exe 872 3rlfrrf.exe 212 bnhbtn.exe 4252 pdvpj.exe 2236 5pvpj.exe 1520 llxlrxl.exe 1544 tnbtnh.exe 2684 7nbtnn.exe 4312 jjpjp.exe 1580 frrlffx.exe -
resource yara_rule behavioral2/memory/1868-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-867-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xffllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 3156 1868 a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe 83 PID 1868 wrote to memory of 3156 1868 a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe 83 PID 1868 wrote to memory of 3156 1868 a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe 83 PID 3156 wrote to memory of 3128 3156 rrfrxxf.exe 84 PID 3156 wrote to memory of 3128 3156 rrfrxxf.exe 84 PID 3156 wrote to memory of 3128 3156 rrfrxxf.exe 84 PID 3128 wrote to memory of 1740 3128 1pvpd.exe 85 PID 3128 wrote to memory of 1740 3128 1pvpd.exe 85 PID 3128 wrote to memory of 1740 3128 1pvpd.exe 85 PID 1740 wrote to memory of 3476 1740 1ppjj.exe 86 PID 1740 wrote to memory of 3476 1740 1ppjj.exe 86 PID 1740 wrote to memory of 3476 1740 1ppjj.exe 86 PID 3476 wrote to memory of 952 3476 fffxrrl.exe 87 PID 3476 wrote to memory of 952 3476 fffxrrl.exe 87 PID 3476 wrote to memory of 952 3476 fffxrrl.exe 87 PID 952 wrote to memory of 2408 952 jpjjv.exe 88 PID 952 wrote to memory of 2408 952 jpjjv.exe 88 PID 952 wrote to memory of 2408 952 jpjjv.exe 88 PID 2408 wrote to memory of 3548 2408 hbbbhh.exe 89 PID 2408 wrote to memory of 3548 2408 hbbbhh.exe 89 PID 2408 wrote to memory of 3548 2408 hbbbhh.exe 89 PID 3548 wrote to memory of 876 3548 fffxrrl.exe 90 PID 3548 wrote to memory of 876 3548 fffxrrl.exe 90 PID 3548 wrote to memory of 876 3548 fffxrrl.exe 90 PID 876 wrote to memory of 1580 876 llxffxl.exe 91 PID 876 wrote to memory of 1580 876 llxffxl.exe 91 PID 876 wrote to memory of 1580 876 llxffxl.exe 91 PID 1580 wrote to memory of 3936 1580 llfrlfx.exe 92 PID 1580 wrote to memory of 3936 1580 llfrlfx.exe 92 PID 1580 wrote to memory of 3936 1580 llfrlfx.exe 92 PID 3936 wrote to memory of 4636 3936 btthhb.exe 93 PID 3936 wrote to memory of 4636 3936 btthhb.exe 93 PID 3936 wrote to memory of 4636 3936 btthhb.exe 93 PID 4636 wrote to memory of 5064 4636 pddvp.exe 94 PID 4636 wrote to memory of 5064 4636 pddvp.exe 94 PID 4636 wrote to memory of 5064 4636 pddvp.exe 94 PID 5064 wrote to memory of 4524 5064 lxxrllf.exe 95 PID 5064 wrote to memory of 4524 5064 lxxrllf.exe 95 PID 5064 wrote to memory of 4524 5064 lxxrllf.exe 95 PID 4524 wrote to memory of 3932 4524 9nbtnh.exe 96 PID 4524 wrote to memory of 3932 4524 9nbtnh.exe 96 PID 4524 wrote to memory of 3932 4524 9nbtnh.exe 96 PID 3932 wrote to memory of 2452 3932 tnbtbt.exe 97 PID 3932 wrote to memory of 2452 3932 tnbtbt.exe 97 PID 3932 wrote to memory of 2452 3932 tnbtbt.exe 97 PID 2452 wrote to memory of 2716 2452 xfxxxlx.exe 98 PID 2452 wrote to memory of 2716 2452 xfxxxlx.exe 98 PID 2452 wrote to memory of 2716 2452 xfxxxlx.exe 98 PID 2716 wrote to memory of 4492 2716 3flfxrl.exe 99 PID 2716 wrote to memory of 4492 2716 3flfxrl.exe 99 PID 2716 wrote to memory of 4492 2716 3flfxrl.exe 99 PID 4492 wrote to memory of 2944 4492 pdpjd.exe 100 PID 4492 wrote to memory of 2944 4492 pdpjd.exe 100 PID 4492 wrote to memory of 2944 4492 pdpjd.exe 100 PID 2944 wrote to memory of 2660 2944 hbbtht.exe 101 PID 2944 wrote to memory of 2660 2944 hbbtht.exe 101 PID 2944 wrote to memory of 2660 2944 hbbtht.exe 101 PID 2660 wrote to memory of 4128 2660 vdvdd.exe 102 PID 2660 wrote to memory of 4128 2660 vdvdd.exe 102 PID 2660 wrote to memory of 4128 2660 vdvdd.exe 102 PID 4128 wrote to memory of 4536 4128 xfxrrrf.exe 103 PID 4128 wrote to memory of 4536 4128 xfxrrrf.exe 103 PID 4128 wrote to memory of 4536 4128 xfxrrrf.exe 103 PID 4536 wrote to memory of 3664 4536 lffxxrf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe"C:\Users\Admin\AppData\Local\Temp\a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\rrfrxxf.exec:\rrfrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\1pvpd.exec:\1pvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\1ppjj.exec:\1ppjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\fffxrrl.exec:\fffxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\jpjjv.exec:\jpjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\hbbbhh.exec:\hbbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\fffxrrl.exec:\fffxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\llxffxl.exec:\llxffxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\llfrlfx.exec:\llfrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\btthhb.exec:\btthhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\pddvp.exec:\pddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\lxxrllf.exec:\lxxrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\9nbtnh.exec:\9nbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\tnbtbt.exec:\tnbtbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\xfxxxlx.exec:\xfxxxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\3flfxrl.exec:\3flfxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\pdpjd.exec:\pdpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\hbbtht.exec:\hbbtht.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\vdvdd.exec:\vdvdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\xfxrrrf.exec:\xfxrrrf.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\lffxxrf.exec:\lffxxrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\nnbbtn.exec:\nnbbtn.exe23⤵
- Executes dropped EXE
PID:3664 -
\??\c:\jdpdv.exec:\jdpdv.exe24⤵
- Executes dropped EXE
PID:3824 -
\??\c:\thbthb.exec:\thbthb.exe25⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jpdpd.exec:\jpdpd.exe26⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rfrfrlx.exec:\rfrfrlx.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1748 -
\??\c:\rllxfxl.exec:\rllxfxl.exe28⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nntthh.exec:\nntthh.exe29⤵
- Executes dropped EXE
PID:60 -
\??\c:\vdvpd.exec:\vdvpd.exe30⤵
- Executes dropped EXE
PID:3452 -
\??\c:\xxrfxrf.exec:\xxrfxrf.exe31⤵
- Executes dropped EXE
PID:4424 -
\??\c:\nhbbbt.exec:\nhbbbt.exe32⤵
- Executes dropped EXE
PID:4868 -
\??\c:\7vpdv.exec:\7vpdv.exe33⤵
- Executes dropped EXE
PID:432 -
\??\c:\nhbnhb.exec:\nhbnhb.exe34⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rffxlfr.exec:\rffxlfr.exe35⤵
- Executes dropped EXE
PID:3100 -
\??\c:\1hhbtt.exec:\1hhbtt.exe36⤵
- Executes dropped EXE
PID:4580 -
\??\c:\pvjdp.exec:\pvjdp.exe37⤵
- Executes dropped EXE
PID:3604 -
\??\c:\lxrlfxl.exec:\lxrlfxl.exe38⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jddpv.exec:\jddpv.exe39⤵
- Executes dropped EXE
PID:5100 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe40⤵
- Executes dropped EXE
PID:3424 -
\??\c:\llfrlfx.exec:\llfrlfx.exe41⤵
- Executes dropped EXE
PID:4300 -
\??\c:\hbnbtn.exec:\hbnbtn.exe42⤵
- Executes dropped EXE
PID:4344 -
\??\c:\vddpd.exec:\vddpd.exe43⤵
- Executes dropped EXE
PID:3968 -
\??\c:\jddvj.exec:\jddvj.exe44⤵
- Executes dropped EXE
PID:1900 -
\??\c:\hnhthb.exec:\hnhthb.exe45⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bhbnhb.exec:\bhbnhb.exe46⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vjjdp.exec:\vjjdp.exe47⤵
- Executes dropped EXE
PID:2360 -
\??\c:\5fxxrxr.exec:\5fxxrxr.exe48⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rllxrlr.exec:\rllxrlr.exe49⤵
- Executes dropped EXE
PID:4276 -
\??\c:\hththb.exec:\hththb.exe50⤵
- Executes dropped EXE
PID:4916 -
\??\c:\ppjdp.exec:\ppjdp.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vjvpv.exec:\vjvpv.exe52⤵
- Executes dropped EXE
PID:3924 -
\??\c:\llrlxxr.exec:\llrlxxr.exe53⤵
- Executes dropped EXE
PID:3948 -
\??\c:\bbhnhb.exec:\bbhnhb.exe54⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jjjjd.exec:\jjjjd.exe55⤵
- Executes dropped EXE
PID:4396 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe56⤵
- Executes dropped EXE
PID:5044 -
\??\c:\3rlfrrf.exec:\3rlfrrf.exe57⤵
- Executes dropped EXE
PID:872 -
\??\c:\bnhbtn.exec:\bnhbtn.exe58⤵
- Executes dropped EXE
PID:212 -
\??\c:\pdvpj.exec:\pdvpj.exe59⤵
- Executes dropped EXE
PID:4252 -
\??\c:\5pvpj.exec:\5pvpj.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\llxlrxl.exec:\llxlrxl.exe61⤵
- Executes dropped EXE
PID:1520 -
\??\c:\tnbtnh.exec:\tnbtnh.exe62⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7nbtnn.exec:\7nbtnn.exe63⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jjpjp.exec:\jjpjp.exe64⤵
- Executes dropped EXE
PID:4312 -
\??\c:\frrlffx.exec:\frrlffx.exe65⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bntbbb.exec:\bntbbb.exe66⤵PID:3468
-
\??\c:\vvjjd.exec:\vvjjd.exe67⤵PID:3020
-
\??\c:\pvpjd.exec:\pvpjd.exe68⤵
- System Location Discovery: System Language Discovery
PID:4184 -
\??\c:\xxfrfrf.exec:\xxfrfrf.exe69⤵
- System Location Discovery: System Language Discovery
PID:3124 -
\??\c:\bnbnhh.exec:\bnbnhh.exe70⤵PID:1752
-
\??\c:\ddppj.exec:\ddppj.exe71⤵PID:604
-
\??\c:\xrxxlxr.exec:\xrxxlxr.exe72⤵PID:3932
-
\??\c:\hbttnn.exec:\hbttnn.exe73⤵PID:4320
-
\??\c:\dpdvj.exec:\dpdvj.exe74⤵PID:4436
-
\??\c:\ppjjd.exec:\ppjjd.exe75⤵PID:344
-
\??\c:\ffxrflx.exec:\ffxrflx.exe76⤵PID:2428
-
\??\c:\5nbnhb.exec:\5nbnhb.exe77⤵PID:3044
-
\??\c:\vpdvp.exec:\vpdvp.exe78⤵PID:4004
-
\??\c:\1pvjv.exec:\1pvjv.exe79⤵PID:5084
-
\??\c:\rllfxrl.exec:\rllfxrl.exe80⤵PID:2532
-
\??\c:\nhhhhb.exec:\nhhhhb.exe81⤵PID:3480
-
\??\c:\jjjdd.exec:\jjjdd.exe82⤵PID:2132
-
\??\c:\rrrllff.exec:\rrrllff.exe83⤵PID:2264
-
\??\c:\1rlfrlf.exec:\1rlfrlf.exe84⤵PID:1676
-
\??\c:\nnhhbb.exec:\nnhhbb.exe85⤵PID:4336
-
\??\c:\dppdv.exec:\dppdv.exe86⤵PID:3608
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe87⤵PID:1896
-
\??\c:\bnnbtn.exec:\bnnbtn.exe88⤵
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\ttthbt.exec:\ttthbt.exe89⤵PID:920
-
\??\c:\ddpjv.exec:\ddpjv.exe90⤵PID:1772
-
\??\c:\lxxrllf.exec:\lxxrllf.exe91⤵PID:1340
-
\??\c:\5ttnhh.exec:\5ttnhh.exe92⤵PID:2968
-
\??\c:\ppdvd.exec:\ppdvd.exe93⤵PID:2868
-
\??\c:\lllffxx.exec:\lllffxx.exe94⤵PID:3596
-
\??\c:\lxrlffx.exec:\lxrlffx.exe95⤵
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\nhnhbn.exec:\nhnhbn.exe96⤵PID:3716
-
\??\c:\5dddp.exec:\5dddp.exe97⤵PID:4716
-
\??\c:\lrxrlfl.exec:\lrxrlfl.exe98⤵PID:64
-
\??\c:\9xrlffx.exec:\9xrlffx.exe99⤵PID:3100
-
\??\c:\nhnntt.exec:\nhnntt.exe100⤵PID:3732
-
\??\c:\jdjvv.exec:\jdjvv.exe101⤵PID:1568
-
\??\c:\fxxlfxl.exec:\fxxlfxl.exe102⤵PID:3204
-
\??\c:\btnhtt.exec:\btnhtt.exe103⤵PID:5056
-
\??\c:\hbtnbt.exec:\hbtnbt.exe104⤵PID:1836
-
\??\c:\djjdj.exec:\djjdj.exe105⤵PID:696
-
\??\c:\xxrlfxl.exec:\xxrlfxl.exe106⤵PID:3172
-
\??\c:\xfxfxfx.exec:\xfxfxfx.exe107⤵PID:3624
-
\??\c:\htnnbt.exec:\htnnbt.exe108⤵PID:3120
-
\??\c:\vvvvp.exec:\vvvvp.exe109⤵PID:4156
-
\??\c:\rlfffrx.exec:\rlfffrx.exe110⤵PID:1588
-
\??\c:\5rfrlrf.exec:\5rfrlrf.exe111⤵PID:2324
-
\??\c:\bbthhh.exec:\bbthhh.exe112⤵PID:3400
-
\??\c:\pjjvp.exec:\pjjvp.exe113⤵PID:4304
-
\??\c:\dvdpp.exec:\dvdpp.exe114⤵PID:4276
-
\??\c:\xrrrlll.exec:\xrrrlll.exe115⤵PID:4916
-
\??\c:\bbntnh.exec:\bbntnh.exe116⤵PID:2732
-
\??\c:\vpvpj.exec:\vpvpj.exe117⤵PID:3388
-
\??\c:\9dvpj.exec:\9dvpj.exe118⤵PID:3868
-
\??\c:\xffrffr.exec:\xffrffr.exe119⤵PID:2952
-
\??\c:\tttnnn.exec:\tttnnn.exe120⤵PID:208
-
\??\c:\9nbnhn.exec:\9nbnhn.exe121⤵PID:3508
-
\??\c:\ddvpd.exec:\ddvpd.exe122⤵PID:2020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-