Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe
-
Size
453KB
-
MD5
649647b838a61ab9a9034cdb57197057
-
SHA1
c77715af652c043623851a8c8a069df21512fed3
-
SHA256
2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0
-
SHA512
9432263c6b99a10a38c3c176380f6ed29c3f528da6e9b5324e64add9b2e3cacd17455b2f19c512dd6ac9626e24503cb35ecd9ea377516074c487e0f1155f5c57
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1932-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3672 xlrrllf.exe 2000 nhntnt.exe 1072 frrlxrf.exe 3700 fflfxxr.exe 5024 xlxrrlr.exe 3372 frlffxf.exe 800 vvvpj.exe 2524 lxxrllf.exe 4744 jvvpj.exe 1876 7vvjd.exe 1588 xxxxrll.exe 1096 5nnttt.exe 3532 frrlfff.exe 4864 nhhbth.exe 1540 jdjdd.exe 4080 flrlfxl.exe 1804 bnntbn.exe 4932 fflxlfx.exe 1184 thnhbt.exe 2512 ntbtbt.exe 4968 lxxlfxr.exe 1668 bthtnh.exe 3680 3hbtnn.exe 948 ntbthn.exe 3032 rrrfxrf.exe 4012 7tbthh.exe 1624 1flfrrl.exe 3812 pjdvd.exe 4960 rlrxxrx.exe 4172 dpvpj.exe 2580 lxlfffx.exe 1324 9lrfllf.exe 1200 bbhbhh.exe 2644 bbhbnn.exe 4196 nthtbt.exe 3744 xlxrllf.exe 4664 xxxrlfx.exe 4836 hbbtnh.exe 2708 5jjdp.exe 4672 fxxrfxx.exe 3684 hnbnhb.exe 1504 5jjdp.exe 2704 jjpvj.exe 4844 rrllffx.exe 408 hnhtnn.exe 3396 vppjd.exe 4136 rrlfllr.exe 3708 xflxrrl.exe 4632 btnbhb.exe 4928 9vvpj.exe 4472 rxrlxxf.exe 4392 lrrlffx.exe 1928 bhttnn.exe 768 3ppdv.exe 4400 frxxlrf.exe 2792 hnhbhn.exe 5048 hthbtt.exe 4560 3jvpp.exe 5096 pjjdp.exe 5024 rrrfflf.exe 1708 hntnhb.exe 4052 9ppjv.exe 800 fxlfxfx.exe 2384 1lfxrll.exe -
resource yara_rule behavioral2/memory/1932-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-646-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1932 wrote to memory of 3672 1932 2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe 82 PID 1932 wrote to memory of 3672 1932 2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe 82 PID 1932 wrote to memory of 3672 1932 2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe 82 PID 3672 wrote to memory of 2000 3672 xlrrllf.exe 83 PID 3672 wrote to memory of 2000 3672 xlrrllf.exe 83 PID 3672 wrote to memory of 2000 3672 xlrrllf.exe 83 PID 2000 wrote to memory of 1072 2000 nhntnt.exe 84 PID 2000 wrote to memory of 1072 2000 nhntnt.exe 84 PID 2000 wrote to memory of 1072 2000 nhntnt.exe 84 PID 1072 wrote to memory of 3700 1072 frrlxrf.exe 85 PID 1072 wrote to memory of 3700 1072 frrlxrf.exe 85 PID 1072 wrote to memory of 3700 1072 frrlxrf.exe 85 PID 3700 wrote to memory of 5024 3700 fflfxxr.exe 86 PID 3700 wrote to memory of 5024 3700 fflfxxr.exe 86 PID 3700 wrote to memory of 5024 3700 fflfxxr.exe 86 PID 5024 wrote to memory of 3372 5024 xlxrrlr.exe 87 PID 5024 wrote to memory of 3372 5024 xlxrrlr.exe 87 PID 5024 wrote to memory of 3372 5024 xlxrrlr.exe 87 PID 3372 wrote to memory of 800 3372 frlffxf.exe 88 PID 3372 wrote to memory of 800 3372 frlffxf.exe 88 PID 3372 wrote to memory of 800 3372 frlffxf.exe 88 PID 800 wrote to memory of 2524 800 vvvpj.exe 89 PID 800 wrote to memory of 2524 800 vvvpj.exe 89 PID 800 wrote to memory of 2524 800 vvvpj.exe 89 PID 2524 wrote to memory of 4744 2524 lxxrllf.exe 90 PID 2524 wrote to memory of 4744 2524 lxxrllf.exe 90 PID 2524 wrote to memory of 4744 2524 lxxrllf.exe 90 PID 4744 wrote to memory of 1876 4744 jvvpj.exe 91 PID 4744 wrote to memory of 1876 4744 jvvpj.exe 91 PID 4744 wrote to memory of 1876 4744 jvvpj.exe 91 PID 1876 wrote to memory of 1588 1876 7vvjd.exe 92 PID 1876 wrote to memory of 1588 1876 7vvjd.exe 92 PID 1876 wrote to memory of 1588 1876 7vvjd.exe 92 PID 1588 wrote to memory of 1096 1588 xxxxrll.exe 93 PID 1588 wrote to memory of 1096 1588 xxxxrll.exe 93 PID 1588 wrote to memory of 1096 1588 xxxxrll.exe 93 PID 1096 wrote to memory of 3532 1096 5nnttt.exe 94 PID 1096 wrote to memory of 3532 1096 5nnttt.exe 94 PID 1096 wrote to memory of 3532 1096 5nnttt.exe 94 PID 3532 wrote to memory of 4864 3532 frrlfff.exe 95 PID 3532 wrote to memory of 4864 3532 frrlfff.exe 95 PID 3532 wrote to memory of 4864 3532 frrlfff.exe 95 PID 4864 wrote to memory of 1540 4864 nhhbth.exe 96 PID 4864 wrote to memory of 1540 4864 nhhbth.exe 96 PID 4864 wrote to memory of 1540 4864 nhhbth.exe 96 PID 1540 wrote to memory of 4080 1540 jdjdd.exe 97 PID 1540 wrote to memory of 4080 1540 jdjdd.exe 97 PID 1540 wrote to memory of 4080 1540 jdjdd.exe 97 PID 4080 wrote to memory of 1804 4080 flrlfxl.exe 98 PID 4080 wrote to memory of 1804 4080 flrlfxl.exe 98 PID 4080 wrote to memory of 1804 4080 flrlfxl.exe 98 PID 1804 wrote to memory of 4932 1804 bnntbn.exe 99 PID 1804 wrote to memory of 4932 1804 bnntbn.exe 99 PID 1804 wrote to memory of 4932 1804 bnntbn.exe 99 PID 4932 wrote to memory of 1184 4932 fflxlfx.exe 100 PID 4932 wrote to memory of 1184 4932 fflxlfx.exe 100 PID 4932 wrote to memory of 1184 4932 fflxlfx.exe 100 PID 1184 wrote to memory of 2512 1184 thnhbt.exe 101 PID 1184 wrote to memory of 2512 1184 thnhbt.exe 101 PID 1184 wrote to memory of 2512 1184 thnhbt.exe 101 PID 2512 wrote to memory of 4968 2512 ntbtbt.exe 102 PID 2512 wrote to memory of 4968 2512 ntbtbt.exe 102 PID 2512 wrote to memory of 4968 2512 ntbtbt.exe 102 PID 4968 wrote to memory of 1668 4968 lxxlfxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe"C:\Users\Admin\AppData\Local\Temp\2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\xlrrllf.exec:\xlrrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\nhntnt.exec:\nhntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\frrlxrf.exec:\frrlxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\fflfxxr.exec:\fflfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\xlxrrlr.exec:\xlxrrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\frlffxf.exec:\frlffxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\vvvpj.exec:\vvvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\lxxrllf.exec:\lxxrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jvvpj.exec:\jvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\7vvjd.exec:\7vvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\xxxxrll.exec:\xxxxrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\5nnttt.exec:\5nnttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\frrlfff.exec:\frrlfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\nhhbth.exec:\nhhbth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\jdjdd.exec:\jdjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\flrlfxl.exec:\flrlfxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\bnntbn.exec:\bnntbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\fflxlfx.exec:\fflxlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\thnhbt.exec:\thnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\ntbtbt.exec:\ntbtbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\bthtnh.exec:\bthtnh.exe23⤵
- Executes dropped EXE
PID:1668 -
\??\c:\3hbtnn.exec:\3hbtnn.exe24⤵
- Executes dropped EXE
PID:3680 -
\??\c:\ntbthn.exec:\ntbthn.exe25⤵
- Executes dropped EXE
PID:948 -
\??\c:\rrrfxrf.exec:\rrrfxrf.exe26⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7tbthh.exec:\7tbthh.exe27⤵
- Executes dropped EXE
PID:4012 -
\??\c:\1flfrrl.exec:\1flfrrl.exe28⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pjdvd.exec:\pjdvd.exe29⤵
- Executes dropped EXE
PID:3812 -
\??\c:\rlrxxrx.exec:\rlrxxrx.exe30⤵
- Executes dropped EXE
PID:4960 -
\??\c:\dpvpj.exec:\dpvpj.exe31⤵
- Executes dropped EXE
PID:4172 -
\??\c:\lxlfffx.exec:\lxlfffx.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2580 -
\??\c:\9lrfllf.exec:\9lrfllf.exe33⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bbhbhh.exec:\bbhbhh.exe34⤵
- Executes dropped EXE
PID:1200 -
\??\c:\bbhbnn.exec:\bbhbnn.exe35⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nthtbt.exec:\nthtbt.exe36⤵
- Executes dropped EXE
PID:4196 -
\??\c:\xlxrllf.exec:\xlxrllf.exe37⤵
- Executes dropped EXE
PID:3744 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe38⤵
- Executes dropped EXE
PID:4664 -
\??\c:\hbbtnh.exec:\hbbtnh.exe39⤵
- Executes dropped EXE
PID:4836 -
\??\c:\5jjdp.exec:\5jjdp.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\fxxrfxx.exec:\fxxrfxx.exe41⤵
- Executes dropped EXE
PID:4672 -
\??\c:\hnbnhb.exec:\hnbnhb.exe42⤵
- Executes dropped EXE
PID:3684 -
\??\c:\5jjdp.exec:\5jjdp.exe43⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jjpvj.exec:\jjpvj.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rrllffx.exec:\rrllffx.exe45⤵
- Executes dropped EXE
PID:4844 -
\??\c:\hnhtnn.exec:\hnhtnn.exe46⤵
- Executes dropped EXE
PID:408 -
\??\c:\vppjd.exec:\vppjd.exe47⤵
- Executes dropped EXE
PID:3396 -
\??\c:\rrlfllr.exec:\rrlfllr.exe48⤵
- Executes dropped EXE
PID:4136 -
\??\c:\xflxrrl.exec:\xflxrrl.exe49⤵
- Executes dropped EXE
PID:3708 -
\??\c:\btnbhb.exec:\btnbhb.exe50⤵
- Executes dropped EXE
PID:4632 -
\??\c:\9vvpj.exec:\9vvpj.exe51⤵
- Executes dropped EXE
PID:4928 -
\??\c:\rxrlxxf.exec:\rxrlxxf.exe52⤵
- Executes dropped EXE
PID:4472 -
\??\c:\lrrlffx.exec:\lrrlffx.exe53⤵
- Executes dropped EXE
PID:4392 -
\??\c:\bhttnn.exec:\bhttnn.exe54⤵
- Executes dropped EXE
PID:1928 -
\??\c:\3ppdv.exec:\3ppdv.exe55⤵
- Executes dropped EXE
PID:768 -
\??\c:\frxxlrf.exec:\frxxlrf.exe56⤵
- Executes dropped EXE
PID:4400 -
\??\c:\hnhbhn.exec:\hnhbhn.exe57⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hthbtt.exec:\hthbtt.exe58⤵
- Executes dropped EXE
PID:5048 -
\??\c:\3jvpp.exec:\3jvpp.exe59⤵
- Executes dropped EXE
PID:4560 -
\??\c:\pjjdp.exec:\pjjdp.exe60⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rrrfflf.exec:\rrrfflf.exe61⤵
- Executes dropped EXE
PID:5024 -
\??\c:\hntnhb.exec:\hntnhb.exe62⤵
- Executes dropped EXE
PID:1708 -
\??\c:\9ppjv.exec:\9ppjv.exe63⤵
- Executes dropped EXE
PID:4052 -
\??\c:\fxlfxfx.exec:\fxlfxfx.exe64⤵
- Executes dropped EXE
PID:800 -
\??\c:\1lfxrll.exec:\1lfxrll.exe65⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nbhhbb.exec:\nbhhbb.exe66⤵PID:3612
-
\??\c:\1btnth.exec:\1btnth.exe67⤵PID:2144
-
\??\c:\pvdvp.exec:\pvdvp.exe68⤵PID:4604
-
\??\c:\lxfflfl.exec:\lxfflfl.exe69⤵PID:4712
-
\??\c:\xrxlfrf.exec:\xrxlfrf.exe70⤵PID:264
-
\??\c:\nthbtt.exec:\nthbtt.exe71⤵PID:3144
-
\??\c:\jvdvp.exec:\jvdvp.exe72⤵
- System Location Discovery: System Language Discovery
PID:1096 -
\??\c:\dvdpj.exec:\dvdpj.exe73⤵PID:1988
-
\??\c:\hbnbnn.exec:\hbnbnn.exe74⤵PID:1960
-
\??\c:\vpdvd.exec:\vpdvd.exe75⤵PID:4864
-
\??\c:\7rxrfxl.exec:\7rxrfxl.exe76⤵PID:4120
-
\??\c:\bnbbbh.exec:\bnbbbh.exe77⤵PID:4772
-
\??\c:\dpdvv.exec:\dpdvv.exe78⤵PID:3988
-
\??\c:\pdpjd.exec:\pdpjd.exe79⤵PID:4932
-
\??\c:\lfrllff.exec:\lfrllff.exe80⤵PID:4444
-
\??\c:\9htnbt.exec:\9htnbt.exe81⤵PID:2800
-
\??\c:\1djdp.exec:\1djdp.exe82⤵PID:1376
-
\??\c:\jdddv.exec:\jdddv.exe83⤵PID:1696
-
\??\c:\lxxrflf.exec:\lxxrflf.exe84⤵PID:3780
-
\??\c:\bntntt.exec:\bntntt.exe85⤵PID:4008
-
\??\c:\dvpdp.exec:\dvpdp.exe86⤵PID:4652
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe87⤵PID:3680
-
\??\c:\nbbtnh.exec:\nbbtnh.exe88⤵PID:4104
-
\??\c:\jjpdp.exec:\jjpdp.exe89⤵PID:3012
-
\??\c:\dddpj.exec:\dddpj.exe90⤵PID:3032
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe91⤵PID:5056
-
\??\c:\httnbt.exec:\httnbt.exe92⤵PID:4056
-
\??\c:\ntbhtn.exec:\ntbhtn.exe93⤵PID:4112
-
\??\c:\pjpjd.exec:\pjpjd.exe94⤵PID:4996
-
\??\c:\xfrlxxr.exec:\xfrlxxr.exe95⤵PID:3628
-
\??\c:\nnttnh.exec:\nnttnh.exe96⤵PID:2056
-
\??\c:\vpdvp.exec:\vpdvp.exe97⤵
- System Location Discovery: System Language Discovery
PID:716 -
\??\c:\vjvpp.exec:\vjvpp.exe98⤵PID:1816
-
\??\c:\9rlxrrr.exec:\9rlxrrr.exe99⤵PID:3300
-
\??\c:\nbhnhh.exec:\nbhnhh.exe100⤵PID:516
-
\??\c:\pdppp.exec:\pdppp.exe101⤵PID:1764
-
\??\c:\rlxrffx.exec:\rlxrffx.exe102⤵PID:3560
-
\??\c:\llrlllr.exec:\llrlllr.exe103⤵PID:4360
-
\??\c:\5bbttt.exec:\5bbttt.exe104⤵PID:3604
-
\??\c:\pppvp.exec:\pppvp.exe105⤵PID:4504
-
\??\c:\dddjp.exec:\dddjp.exe106⤵PID:4480
-
\??\c:\7frlxxr.exec:\7frlxxr.exe107⤵PID:2140
-
\??\c:\bttnhb.exec:\bttnhb.exe108⤵PID:4252
-
\??\c:\pjddd.exec:\pjddd.exe109⤵PID:4044
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe110⤵PID:3308
-
\??\c:\nnhthb.exec:\nnhthb.exe111⤵PID:3964
-
\??\c:\nhnhtn.exec:\nhnhtn.exe112⤵PID:2812
-
\??\c:\pdjjd.exec:\pdjjd.exe113⤵PID:3396
-
\??\c:\dvvvp.exec:\dvvvp.exe114⤵PID:1720
-
\??\c:\rrxxllf.exec:\rrxxllf.exe115⤵PID:2852
-
\??\c:\hnthth.exec:\hnthth.exe116⤵PID:4028
-
\??\c:\ddjvd.exec:\ddjvd.exe117⤵PID:4484
-
\??\c:\pvddp.exec:\pvddp.exe118⤵PID:4620
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe119⤵PID:2668
-
\??\c:\3tbbhh.exec:\3tbbhh.exe120⤵PID:1680
-
\??\c:\htbtbt.exec:\htbtbt.exe121⤵PID:2672
-
\??\c:\vvdpd.exec:\vvdpd.exe122⤵PID:768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-