Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 02:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe
-
Size
454KB
-
MD5
b984be71c510dcf66b1bfccfc5908d70
-
SHA1
451b737b815e2a62bcf3afadc4747469003575d7
-
SHA256
53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4
-
SHA512
16496e910079a1028160c0ecd03d4e89b12031b002dd7e1695fda6691998ed644e50a396b04199a513a4185f39d7dc87aa30b0c7348215313d9f93f08700d6d2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3056-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/660-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-1364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2024 frrlxxr.exe 1236 bnnhhh.exe 3928 ntbtnh.exe 704 pdppj.exe 2376 nbtnhb.exe 4900 jdjdd.exe 1112 7hnhhb.exe 3932 xrrfxlf.exe 4420 5vvvv.exe 1244 vjdvd.exe 1152 xlrfrrl.exe 660 llrlrlr.exe 3012 btbtnn.exe 4972 pjpjj.exe 2132 lffxrlf.exe 392 tnbbhh.exe 2928 jpjdp.exe 212 bhnbtn.exe 3720 1pjjj.exe 4664 5llllfx.exe 2268 1nttnt.exe 880 7pppj.exe 2036 9fllxfl.exe 3888 nnbbhn.exe 4448 ppddv.exe 3232 fxrlrrl.exe 5028 rlrrrxr.exe 4872 hntthn.exe 4644 jdppj.exe 208 xxlfxxr.exe 3592 vdjvp.exe 3264 xlrfflf.exe 1748 1xrrrrr.exe 2404 rfxrrrl.exe 316 3nthbb.exe 3696 ppvvp.exe 4480 5lrxrfx.exe 2684 xrxrffx.exe 2360 5hhhbb.exe 3560 jvvdp.exe 5080 fxxrfxl.exe 2396 3nbbtb.exe 5092 btnhnn.exe 1680 dpvvp.exe 3588 rrlfrlf.exe 3968 nnbttt.exe 1228 ppjjp.exe 1544 djvpj.exe 4760 rlrlflf.exe 1428 bnbbbb.exe 1936 vjpjv.exe 4080 xllllll.exe 388 bbhhbb.exe 2224 vdpdp.exe 1880 lfxxlfl.exe 1664 fxrxxfl.exe 3496 bbtnhh.exe 2984 ddjjd.exe 2376 rffxllf.exe 4592 3tbbhb.exe 224 jdpdp.exe 5052 5xxrfxr.exe 4576 nnhbtn.exe 1060 tnthth.exe -
resource yara_rule behavioral2/memory/3056-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/660-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-597-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2024 3056 53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe 82 PID 3056 wrote to memory of 2024 3056 53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe 82 PID 3056 wrote to memory of 2024 3056 53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe 82 PID 2024 wrote to memory of 1236 2024 frrlxxr.exe 83 PID 2024 wrote to memory of 1236 2024 frrlxxr.exe 83 PID 2024 wrote to memory of 1236 2024 frrlxxr.exe 83 PID 1236 wrote to memory of 3928 1236 bnnhhh.exe 84 PID 1236 wrote to memory of 3928 1236 bnnhhh.exe 84 PID 1236 wrote to memory of 3928 1236 bnnhhh.exe 84 PID 3928 wrote to memory of 704 3928 ntbtnh.exe 85 PID 3928 wrote to memory of 704 3928 ntbtnh.exe 85 PID 3928 wrote to memory of 704 3928 ntbtnh.exe 85 PID 704 wrote to memory of 2376 704 pdppj.exe 86 PID 704 wrote to memory of 2376 704 pdppj.exe 86 PID 704 wrote to memory of 2376 704 pdppj.exe 86 PID 2376 wrote to memory of 4900 2376 nbtnhb.exe 87 PID 2376 wrote to memory of 4900 2376 nbtnhb.exe 87 PID 2376 wrote to memory of 4900 2376 nbtnhb.exe 87 PID 4900 wrote to memory of 1112 4900 jdjdd.exe 88 PID 4900 wrote to memory of 1112 4900 jdjdd.exe 88 PID 4900 wrote to memory of 1112 4900 jdjdd.exe 88 PID 1112 wrote to memory of 3932 1112 7hnhhb.exe 89 PID 1112 wrote to memory of 3932 1112 7hnhhb.exe 89 PID 1112 wrote to memory of 3932 1112 7hnhhb.exe 89 PID 3932 wrote to memory of 4420 3932 xrrfxlf.exe 90 PID 3932 wrote to memory of 4420 3932 xrrfxlf.exe 90 PID 3932 wrote to memory of 4420 3932 xrrfxlf.exe 90 PID 4420 wrote to memory of 1244 4420 5vvvv.exe 91 PID 4420 wrote to memory of 1244 4420 5vvvv.exe 91 PID 4420 wrote to memory of 1244 4420 5vvvv.exe 91 PID 1244 wrote to memory of 1152 1244 vjdvd.exe 92 PID 1244 wrote to memory of 1152 1244 vjdvd.exe 92 PID 1244 wrote to memory of 1152 1244 vjdvd.exe 92 PID 1152 wrote to memory of 660 1152 xlrfrrl.exe 93 PID 1152 wrote to memory of 660 1152 xlrfrrl.exe 93 PID 1152 wrote to memory of 660 1152 xlrfrrl.exe 93 PID 660 wrote to memory of 3012 660 llrlrlr.exe 94 PID 660 wrote to memory of 3012 660 llrlrlr.exe 94 PID 660 wrote to memory of 3012 660 llrlrlr.exe 94 PID 3012 wrote to memory of 4972 3012 btbtnn.exe 95 PID 3012 wrote to memory of 4972 3012 btbtnn.exe 95 PID 3012 wrote to memory of 4972 3012 btbtnn.exe 95 PID 4972 wrote to memory of 2132 4972 pjpjj.exe 96 PID 4972 wrote to memory of 2132 4972 pjpjj.exe 96 PID 4972 wrote to memory of 2132 4972 pjpjj.exe 96 PID 2132 wrote to memory of 392 2132 lffxrlf.exe 97 PID 2132 wrote to memory of 392 2132 lffxrlf.exe 97 PID 2132 wrote to memory of 392 2132 lffxrlf.exe 97 PID 392 wrote to memory of 2928 392 tnbbhh.exe 98 PID 392 wrote to memory of 2928 392 tnbbhh.exe 98 PID 392 wrote to memory of 2928 392 tnbbhh.exe 98 PID 2928 wrote to memory of 212 2928 jpjdp.exe 99 PID 2928 wrote to memory of 212 2928 jpjdp.exe 99 PID 2928 wrote to memory of 212 2928 jpjdp.exe 99 PID 212 wrote to memory of 3720 212 bhnbtn.exe 100 PID 212 wrote to memory of 3720 212 bhnbtn.exe 100 PID 212 wrote to memory of 3720 212 bhnbtn.exe 100 PID 3720 wrote to memory of 4664 3720 1pjjj.exe 101 PID 3720 wrote to memory of 4664 3720 1pjjj.exe 101 PID 3720 wrote to memory of 4664 3720 1pjjj.exe 101 PID 4664 wrote to memory of 2268 4664 5llllfx.exe 102 PID 4664 wrote to memory of 2268 4664 5llllfx.exe 102 PID 4664 wrote to memory of 2268 4664 5llllfx.exe 102 PID 2268 wrote to memory of 880 2268 1nttnt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe"C:\Users\Admin\AppData\Local\Temp\53471875bf7873e7f4a201140557a784261ad195f223529be8b7f93f8863cbc4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\frrlxxr.exec:\frrlxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\bnnhhh.exec:\bnnhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\ntbtnh.exec:\ntbtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\pdppj.exec:\pdppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\nbtnhb.exec:\nbtnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\jdjdd.exec:\jdjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\7hnhhb.exec:\7hnhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\xrrfxlf.exec:\xrrfxlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\5vvvv.exec:\5vvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\vjdvd.exec:\vjdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\xlrfrrl.exec:\xlrfrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\llrlrlr.exec:\llrlrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\btbtnn.exec:\btbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\pjpjj.exec:\pjpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\lffxrlf.exec:\lffxrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\tnbbhh.exec:\tnbbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\jpjdp.exec:\jpjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\bhnbtn.exec:\bhnbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\1pjjj.exec:\1pjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\5llllfx.exec:\5llllfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\1nttnt.exec:\1nttnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\7pppj.exec:\7pppj.exe23⤵
- Executes dropped EXE
PID:880 -
\??\c:\9fllxfl.exec:\9fllxfl.exe24⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nnbbhn.exec:\nnbbhn.exe25⤵
- Executes dropped EXE
PID:3888 -
\??\c:\ppddv.exec:\ppddv.exe26⤵
- Executes dropped EXE
PID:4448 -
\??\c:\fxrlrrl.exec:\fxrlrrl.exe27⤵
- Executes dropped EXE
PID:3232 -
\??\c:\rlrrrxr.exec:\rlrrrxr.exe28⤵
- Executes dropped EXE
PID:5028 -
\??\c:\hntthn.exec:\hntthn.exe29⤵
- Executes dropped EXE
PID:4872 -
\??\c:\jdppj.exec:\jdppj.exe30⤵
- Executes dropped EXE
PID:4644 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe31⤵
- Executes dropped EXE
PID:208 -
\??\c:\vdjvp.exec:\vdjvp.exe32⤵
- Executes dropped EXE
PID:3592 -
\??\c:\xlrfflf.exec:\xlrfflf.exe33⤵
- Executes dropped EXE
PID:3264 -
\??\c:\1xrrrrr.exec:\1xrrrrr.exe34⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rfxrrrl.exec:\rfxrrrl.exe35⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3nthbb.exec:\3nthbb.exe36⤵
- Executes dropped EXE
PID:316 -
\??\c:\ppvvp.exec:\ppvvp.exe37⤵
- Executes dropped EXE
PID:3696 -
\??\c:\5lrxrfx.exec:\5lrxrfx.exe38⤵
- Executes dropped EXE
PID:4480 -
\??\c:\xrxrffx.exec:\xrxrffx.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5hhhbb.exec:\5hhhbb.exe40⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jvvdp.exec:\jvvdp.exe41⤵
- Executes dropped EXE
PID:3560 -
\??\c:\fxxrfxl.exec:\fxxrfxl.exe42⤵
- Executes dropped EXE
PID:5080 -
\??\c:\3nbbtb.exec:\3nbbtb.exe43⤵
- Executes dropped EXE
PID:2396 -
\??\c:\btnhnn.exec:\btnhnn.exe44⤵
- Executes dropped EXE
PID:5092 -
\??\c:\dpvvp.exec:\dpvvp.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1680 -
\??\c:\rrlfrlf.exec:\rrlfrlf.exe46⤵
- Executes dropped EXE
PID:3588 -
\??\c:\nnbttt.exec:\nnbttt.exe47⤵
- Executes dropped EXE
PID:3968 -
\??\c:\ppjjp.exec:\ppjjp.exe48⤵
- Executes dropped EXE
PID:1228 -
\??\c:\djvpj.exec:\djvpj.exe49⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rlrlflf.exec:\rlrlflf.exe50⤵
- Executes dropped EXE
PID:4760 -
\??\c:\bnbbbb.exec:\bnbbbb.exe51⤵
- Executes dropped EXE
PID:1428 -
\??\c:\vjpjv.exec:\vjpjv.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rllrlxr.exec:\rllrlxr.exe53⤵PID:2768
-
\??\c:\xllllll.exec:\xllllll.exe54⤵
- Executes dropped EXE
PID:4080 -
\??\c:\bbhhbb.exec:\bbhhbb.exe55⤵
- Executes dropped EXE
PID:388 -
\??\c:\vdpdp.exec:\vdpdp.exe56⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lfxxlfl.exec:\lfxxlfl.exe57⤵
- Executes dropped EXE
PID:1880 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe58⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bbtnhh.exec:\bbtnhh.exe59⤵
- Executes dropped EXE
PID:3496 -
\??\c:\ddjjd.exec:\ddjjd.exe60⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rffxllf.exec:\rffxllf.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\3tbbhb.exec:\3tbbhb.exe62⤵
- Executes dropped EXE
PID:4592 -
\??\c:\jdpdp.exec:\jdpdp.exe63⤵
- Executes dropped EXE
PID:224 -
\??\c:\5xxrfxr.exec:\5xxrfxr.exe64⤵
- Executes dropped EXE
PID:5052 -
\??\c:\nnhbtn.exec:\nnhbtn.exe65⤵
- Executes dropped EXE
PID:4576 -
\??\c:\tnthth.exec:\tnthth.exe66⤵
- Executes dropped EXE
PID:1060 -
\??\c:\3vjjj.exec:\3vjjj.exe67⤵PID:1804
-
\??\c:\hhbttn.exec:\hhbttn.exe68⤵PID:1480
-
\??\c:\ddjpp.exec:\ddjpp.exe69⤵PID:1128
-
\??\c:\7dvpj.exec:\7dvpj.exe70⤵PID:3308
-
\??\c:\rllfrrl.exec:\rllfrrl.exe71⤵PID:2580
-
\??\c:\1hbtnn.exec:\1hbtnn.exe72⤵PID:2380
-
\??\c:\nthhtn.exec:\nthhtn.exe73⤵PID:1564
-
\??\c:\3pdvj.exec:\3pdvj.exe74⤵PID:2384
-
\??\c:\rllfxfl.exec:\rllfxfl.exe75⤵PID:2576
-
\??\c:\thhbtt.exec:\thhbtt.exe76⤵PID:3468
-
\??\c:\vjppj.exec:\vjppj.exe77⤵PID:392
-
\??\c:\pppvj.exec:\pppvj.exe78⤵PID:2820
-
\??\c:\llxfxrx.exec:\llxfxrx.exe79⤵PID:4784
-
\??\c:\1tbtnh.exec:\1tbtnh.exe80⤵PID:4312
-
\??\c:\1ddvj.exec:\1ddvj.exe81⤵PID:2516
-
\??\c:\dpvpj.exec:\dpvpj.exe82⤵PID:4880
-
\??\c:\llfllrr.exec:\llfllrr.exe83⤵PID:1136
-
\??\c:\bbbhbb.exec:\bbbhbb.exe84⤵PID:2732
-
\??\c:\jjpjd.exec:\jjpjd.exe85⤵PID:3276
-
\??\c:\pdddd.exec:\pdddd.exe86⤵PID:3300
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe87⤵PID:1396
-
\??\c:\htnhtn.exec:\htnhtn.exe88⤵PID:4660
-
\??\c:\5vvjd.exec:\5vvjd.exe89⤵PID:4780
-
\??\c:\djjdp.exec:\djjdp.exe90⤵PID:3388
-
\??\c:\9flxllr.exec:\9flxllr.exe91⤵PID:4888
-
\??\c:\nbhbtt.exec:\nbhbtt.exe92⤵PID:912
-
\??\c:\jdvdv.exec:\jdvdv.exe93⤵
- System Location Discovery: System Language Discovery
PID:3820 -
\??\c:\xrrfrrl.exec:\xrrfrrl.exe94⤵PID:2228
-
\??\c:\5ntnhb.exec:\5ntnhb.exe95⤵PID:4644
-
\??\c:\vjvvd.exec:\vjvvd.exe96⤵PID:632
-
\??\c:\dvjdp.exec:\dvjdp.exe97⤵PID:3196
-
\??\c:\lxffrxx.exec:\lxffrxx.exe98⤵PID:4300
-
\??\c:\3bbthh.exec:\3bbthh.exe99⤵PID:1392
-
\??\c:\vjpjp.exec:\vjpjp.exe100⤵PID:1748
-
\??\c:\rlxfxll.exec:\rlxfxll.exe101⤵PID:1976
-
\??\c:\5tbbnh.exec:\5tbbnh.exe102⤵PID:316
-
\??\c:\djddp.exec:\djddp.exe103⤵PID:3696
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe104⤵PID:4168
-
\??\c:\thnhbt.exec:\thnhbt.exe105⤵PID:4352
-
\??\c:\dvdvj.exec:\dvdvj.exe106⤵PID:3336
-
\??\c:\3rxrrrx.exec:\3rxrrrx.exe107⤵PID:3560
-
\??\c:\hbnhbt.exec:\hbnhbt.exe108⤵PID:2284
-
\??\c:\hnntnn.exec:\hnntnn.exe109⤵PID:1552
-
\??\c:\frxxlfl.exec:\frxxlfl.exe110⤵PID:856
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe111⤵PID:672
-
\??\c:\pjppv.exec:\pjppv.exe112⤵PID:1228
-
\??\c:\llrxlxx.exec:\llrxlxx.exe113⤵PID:2080
-
\??\c:\bbhbhb.exec:\bbhbhb.exe114⤵PID:2280
-
\??\c:\nhtnbh.exec:\nhtnbh.exe115⤵PID:1428
-
\??\c:\5ppdd.exec:\5ppdd.exe116⤵PID:4176
-
\??\c:\3ppdv.exec:\3ppdv.exe117⤵PID:2604
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe118⤵PID:916
-
\??\c:\tntnhh.exec:\tntnhh.exe119⤵PID:5060
-
\??\c:\7jjvp.exec:\7jjvp.exe120⤵PID:1672
-
\??\c:\llfxxfx.exec:\llfxxfx.exe121⤵PID:2352
-
\??\c:\nhbbtt.exec:\nhbbtt.exe122⤵PID:3780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-