Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54d7363ec8556b4406c87bb95f44e1772c643884a65e761e54d423579651bef2N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
54d7363ec8556b4406c87bb95f44e1772c643884a65e761e54d423579651bef2N.exe
-
Size
454KB
-
MD5
1784a484f37c946ec7c82c7e4dd809d0
-
SHA1
4bacd79211427c1fea95fadb75e1133f937e6c40
-
SHA256
54d7363ec8556b4406c87bb95f44e1772c643884a65e761e54d423579651bef2
-
SHA512
83653061c8f75e196b49314a8b6ccd928da1bb65827162adebbcbbf94b9d705f25a0f252ad3f9c9d5294aa3a9fdbb9fd945407e35f4c272f65cd60715f2c314e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/3044-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-858-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-946-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-968-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-1416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-1531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-1646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1440 lrlfrlx.exe 3768 9bhhnb.exe 4368 tttnnn.exe 3460 djpjv.exe 4016 3rxrlll.exe 2596 7xfxllx.exe 2236 thnbtn.exe 3496 5vpjv.exe 1040 5vdvp.exe 1772 9xfxrlf.exe 3340 bthbtt.exe 3172 thnbtn.exe 2172 pvddd.exe 1048 3xrfxrr.exe 1376 rlrffff.exe 1044 nnnhbt.exe 2424 1pjjj.exe 3092 5dpdp.exe 3484 lflfrll.exe 3472 nhtntt.exe 1724 nhhhbb.exe 1732 vvjdd.exe 2648 flrrfff.exe 864 xfrlffx.exe 2056 ntthbt.exe 1528 djpjv.exe 4776 jjpdv.exe 4452 lffrfrr.exe 1964 hhntnh.exe 4744 htbntt.exe 3580 3vpdv.exe 2956 rllxrxr.exe 4660 nhhhbn.exe 3972 jpvjv.exe 4268 pjddp.exe 4232 9lfxrrl.exe 4172 tnthbn.exe 1644 9ntnnb.exe 4620 jvjjj.exe 1856 vvjdp.exe 4576 1ffxllr.exe 2008 3hnhbb.exe 2316 hbbtnb.exe 1572 jdvvv.exe 3232 1xxrrrl.exe 3908 lffffxx.exe 4520 3tthnn.exe 1520 bnttnh.exe 1932 djvpd.exe 456 lxffrrl.exe 4320 frxrlrl.exe 4332 9ttnhh.exe 3044 pjdjd.exe 4944 vdpjd.exe 3292 rlfxxxf.exe 3552 hbhhbn.exe 2932 bthbhb.exe 2500 pjvdv.exe 2596 ffrrxxf.exe 1800 3flxrlf.exe 3788 nbhbtb.exe 2052 thtnhh.exe 2904 ppvpd.exe 2680 7fxxrrr.exe -
resource yara_rule behavioral2/memory/3044-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-858-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-968-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-1416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-1531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-1646-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1440 3044 54d7363ec8556b4406c87bb95f44e1772c643884a65e761e54d423579651bef2N.exe 82 PID 3044 wrote to memory of 1440 3044 54d7363ec8556b4406c87bb95f44e1772c643884a65e761e54d423579651bef2N.exe 82 PID 3044 wrote to memory of 1440 3044 54d7363ec8556b4406c87bb95f44e1772c643884a65e761e54d423579651bef2N.exe 82 PID 1440 wrote to memory of 3768 1440 lrlfrlx.exe 83 PID 1440 wrote to memory of 3768 1440 lrlfrlx.exe 83 PID 1440 wrote to memory of 3768 1440 lrlfrlx.exe 83 PID 3768 wrote to memory of 4368 3768 9bhhnb.exe 84 PID 3768 wrote to memory of 4368 3768 9bhhnb.exe 84 PID 3768 wrote to memory of 4368 3768 9bhhnb.exe 84 PID 4368 wrote to memory of 3460 4368 tttnnn.exe 85 PID 4368 wrote to memory of 3460 4368 tttnnn.exe 85 PID 4368 wrote to memory of 3460 4368 tttnnn.exe 85 PID 3460 wrote to memory of 4016 3460 djpjv.exe 86 PID 3460 wrote to memory of 4016 3460 djpjv.exe 86 PID 3460 wrote to memory of 4016 3460 djpjv.exe 86 PID 4016 wrote to memory of 2596 4016 3rxrlll.exe 87 PID 4016 wrote to memory of 2596 4016 3rxrlll.exe 87 PID 4016 wrote to memory of 2596 4016 3rxrlll.exe 87 PID 2596 wrote to memory of 2236 2596 7xfxllx.exe 88 PID 2596 wrote to memory of 2236 2596 7xfxllx.exe 88 PID 2596 wrote to memory of 2236 2596 7xfxllx.exe 88 PID 2236 wrote to memory of 3496 2236 thnbtn.exe 89 PID 2236 wrote to memory of 3496 2236 thnbtn.exe 89 PID 2236 wrote to memory of 3496 2236 thnbtn.exe 89 PID 3496 wrote to memory of 1040 3496 5vpjv.exe 90 PID 3496 wrote to memory of 1040 3496 5vpjv.exe 90 PID 3496 wrote to memory of 1040 3496 5vpjv.exe 90 PID 1040 wrote to memory of 1772 1040 5vdvp.exe 91 PID 1040 wrote to memory of 1772 1040 5vdvp.exe 91 PID 1040 wrote to memory of 1772 1040 5vdvp.exe 91 PID 1772 wrote to memory of 3340 1772 9xfxrlf.exe 92 PID 1772 wrote to memory of 3340 1772 9xfxrlf.exe 92 PID 1772 wrote to memory of 3340 1772 9xfxrlf.exe 92 PID 3340 wrote to memory of 3172 3340 bthbtt.exe 93 PID 3340 wrote to memory of 3172 3340 bthbtt.exe 93 PID 3340 wrote to memory of 3172 3340 bthbtt.exe 93 PID 3172 wrote to memory of 2172 3172 thnbtn.exe 94 PID 3172 wrote to memory of 2172 3172 thnbtn.exe 94 PID 3172 wrote to memory of 2172 3172 thnbtn.exe 94 PID 2172 wrote to memory of 1048 2172 pvddd.exe 95 PID 2172 wrote to memory of 1048 2172 pvddd.exe 95 PID 2172 wrote to memory of 1048 2172 pvddd.exe 95 PID 1048 wrote to memory of 1376 1048 3xrfxrr.exe 96 PID 1048 wrote to memory of 1376 1048 3xrfxrr.exe 96 PID 1048 wrote to memory of 1376 1048 3xrfxrr.exe 96 PID 1376 wrote to memory of 1044 1376 rlrffff.exe 97 PID 1376 wrote to memory of 1044 1376 rlrffff.exe 97 PID 1376 wrote to memory of 1044 1376 rlrffff.exe 97 PID 1044 wrote to memory of 2424 1044 nnnhbt.exe 98 PID 1044 wrote to memory of 2424 1044 nnnhbt.exe 98 PID 1044 wrote to memory of 2424 1044 nnnhbt.exe 98 PID 2424 wrote to memory of 3092 2424 1pjjj.exe 99 PID 2424 wrote to memory of 3092 2424 1pjjj.exe 99 PID 2424 wrote to memory of 3092 2424 1pjjj.exe 99 PID 3092 wrote to memory of 3484 3092 5dpdp.exe 100 PID 3092 wrote to memory of 3484 3092 5dpdp.exe 100 PID 3092 wrote to memory of 3484 3092 5dpdp.exe 100 PID 3484 wrote to memory of 3472 3484 lflfrll.exe 101 PID 3484 wrote to memory of 3472 3484 lflfrll.exe 101 PID 3484 wrote to memory of 3472 3484 lflfrll.exe 101 PID 3472 wrote to memory of 1724 3472 nhtntt.exe 102 PID 3472 wrote to memory of 1724 3472 nhtntt.exe 102 PID 3472 wrote to memory of 1724 3472 nhtntt.exe 102 PID 1724 wrote to memory of 1732 1724 nhhhbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\54d7363ec8556b4406c87bb95f44e1772c643884a65e761e54d423579651bef2N.exe"C:\Users\Admin\AppData\Local\Temp\54d7363ec8556b4406c87bb95f44e1772c643884a65e761e54d423579651bef2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\lrlfrlx.exec:\lrlfrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\9bhhnb.exec:\9bhhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\tttnnn.exec:\tttnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\djpjv.exec:\djpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\3rxrlll.exec:\3rxrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\7xfxllx.exec:\7xfxllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\thnbtn.exec:\thnbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\5vpjv.exec:\5vpjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\5vdvp.exec:\5vdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\9xfxrlf.exec:\9xfxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\bthbtt.exec:\bthbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\thnbtn.exec:\thnbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\pvddd.exec:\pvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\3xrfxrr.exec:\3xrfxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\rlrffff.exec:\rlrffff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\nnnhbt.exec:\nnnhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\1pjjj.exec:\1pjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\5dpdp.exec:\5dpdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\lflfrll.exec:\lflfrll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\nhtntt.exec:\nhtntt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\nhhhbb.exec:\nhhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\vvjdd.exec:\vvjdd.exe23⤵
- Executes dropped EXE
PID:1732 -
\??\c:\flrrfff.exec:\flrrfff.exe24⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xfrlffx.exec:\xfrlffx.exe25⤵
- Executes dropped EXE
PID:864 -
\??\c:\ntthbt.exec:\ntthbt.exe26⤵
- Executes dropped EXE
PID:2056 -
\??\c:\djpjv.exec:\djpjv.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jjpdv.exec:\jjpdv.exe28⤵
- Executes dropped EXE
PID:4776 -
\??\c:\lffrfrr.exec:\lffrfrr.exe29⤵
- Executes dropped EXE
PID:4452 -
\??\c:\hhntnh.exec:\hhntnh.exe30⤵
- Executes dropped EXE
PID:1964 -
\??\c:\htbntt.exec:\htbntt.exe31⤵
- Executes dropped EXE
PID:4744 -
\??\c:\3vpdv.exec:\3vpdv.exe32⤵
- Executes dropped EXE
PID:3580 -
\??\c:\rllxrxr.exec:\rllxrxr.exe33⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nhhhbn.exec:\nhhhbn.exe34⤵
- Executes dropped EXE
PID:4660 -
\??\c:\jpvjv.exec:\jpvjv.exe35⤵
- Executes dropped EXE
PID:3972 -
\??\c:\pjddp.exec:\pjddp.exe36⤵
- Executes dropped EXE
PID:4268 -
\??\c:\9lfxrrl.exec:\9lfxrrl.exe37⤵
- Executes dropped EXE
PID:4232 -
\??\c:\tnthbn.exec:\tnthbn.exe38⤵
- Executes dropped EXE
PID:4172 -
\??\c:\9ntnnb.exec:\9ntnnb.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644 -
\??\c:\jvjjj.exec:\jvjjj.exe40⤵
- Executes dropped EXE
PID:4620 -
\??\c:\vvjdp.exec:\vvjdp.exe41⤵
- Executes dropped EXE
PID:1856 -
\??\c:\1ffxllr.exec:\1ffxllr.exe42⤵
- Executes dropped EXE
PID:4576 -
\??\c:\3hnhbb.exec:\3hnhbb.exe43⤵
- Executes dropped EXE
PID:2008 -
\??\c:\hbbtnb.exec:\hbbtnb.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2316 -
\??\c:\jdvvv.exec:\jdvvv.exe45⤵
- Executes dropped EXE
PID:1572 -
\??\c:\1xxrrrl.exec:\1xxrrrl.exe46⤵
- Executes dropped EXE
PID:3232 -
\??\c:\lffffxx.exec:\lffffxx.exe47⤵
- Executes dropped EXE
PID:3908 -
\??\c:\3tthnn.exec:\3tthnn.exe48⤵
- Executes dropped EXE
PID:4520 -
\??\c:\bnttnh.exec:\bnttnh.exe49⤵
- Executes dropped EXE
PID:1520 -
\??\c:\djvpd.exec:\djvpd.exe50⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lxffrrl.exec:\lxffrrl.exe51⤵
- Executes dropped EXE
PID:456 -
\??\c:\frxrlrl.exec:\frxrlrl.exe52⤵
- Executes dropped EXE
PID:4320 -
\??\c:\9ttnhh.exec:\9ttnhh.exe53⤵
- Executes dropped EXE
PID:4332 -
\??\c:\pjdjd.exec:\pjdjd.exe54⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vdpjd.exec:\vdpjd.exe55⤵
- Executes dropped EXE
PID:4944 -
\??\c:\rlfxxxf.exec:\rlfxxxf.exe56⤵
- Executes dropped EXE
PID:3292 -
\??\c:\hbhhbn.exec:\hbhhbn.exe57⤵
- Executes dropped EXE
PID:3552 -
\??\c:\bthbhb.exec:\bthbhb.exe58⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjvdv.exec:\pjvdv.exe59⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe60⤵
- Executes dropped EXE
PID:2596 -
\??\c:\3flxrlf.exec:\3flxrlf.exe61⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nbhbtb.exec:\nbhbtb.exe62⤵
- Executes dropped EXE
PID:3788 -
\??\c:\thtnhh.exec:\thtnhh.exe63⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ppvpd.exec:\ppvpd.exe64⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7fxxrrr.exec:\7fxxrrr.exe65⤵
- Executes dropped EXE
PID:2680 -
\??\c:\1rxrrrl.exec:\1rxrrrl.exe66⤵PID:3036
-
\??\c:\nbbtnn.exec:\nbbtnn.exe67⤵PID:2672
-
\??\c:\9vvjd.exec:\9vvjd.exe68⤵PID:4020
-
\??\c:\lfrlffx.exec:\lfrlffx.exe69⤵PID:4964
-
\??\c:\fxlfffl.exec:\fxlfffl.exe70⤵PID:1048
-
\??\c:\btbbtn.exec:\btbbtn.exe71⤵PID:884
-
\??\c:\btbhbb.exec:\btbhbb.exe72⤵PID:1044
-
\??\c:\3pvvd.exec:\3pvvd.exe73⤵PID:3476
-
\??\c:\fxfrlff.exec:\fxfrlff.exe74⤵PID:4856
-
\??\c:\5fllxxf.exec:\5fllxxf.exe75⤵PID:2372
-
\??\c:\tbnhtn.exec:\tbnhtn.exe76⤵PID:2544
-
\??\c:\djjjp.exec:\djjjp.exe77⤵PID:4796
-
\??\c:\pjvvd.exec:\pjvvd.exe78⤵PID:4752
-
\??\c:\lfffrrf.exec:\lfffrrf.exe79⤵PID:2648
-
\??\c:\bntnhb.exec:\bntnhb.exe80⤵PID:3596
-
\??\c:\pvvpp.exec:\pvvpp.exe81⤵PID:4360
-
\??\c:\llrlffx.exec:\llrlffx.exe82⤵PID:1608
-
\??\c:\btbnnh.exec:\btbnnh.exe83⤵PID:1032
-
\??\c:\3jdvj.exec:\3jdvj.exe84⤵PID:3224
-
\??\c:\fffxrrl.exec:\fffxrrl.exe85⤵PID:4936
-
\??\c:\flrffff.exec:\flrffff.exe86⤵PID:1652
-
\??\c:\bhbnbb.exec:\bhbnbb.exe87⤵PID:1424
-
\??\c:\vpjdv.exec:\vpjdv.exe88⤵PID:2636
-
\??\c:\3xrlllf.exec:\3xrlllf.exe89⤵PID:1208
-
\??\c:\bhhbtn.exec:\bhhbtn.exe90⤵PID:1644
-
\??\c:\5bbnnh.exec:\5bbnnh.exe91⤵PID:5084
-
\??\c:\jdddd.exec:\jdddd.exe92⤵PID:1356
-
\??\c:\nhttnn.exec:\nhttnn.exe93⤵PID:4336
-
\??\c:\jdjdv.exec:\jdjdv.exe94⤵PID:3816
-
\??\c:\rfxlxff.exec:\rfxlxff.exe95⤵PID:3720
-
\??\c:\hhhnnn.exec:\hhhnnn.exe96⤵PID:3852
-
\??\c:\3htntt.exec:\3htntt.exe97⤵PID:4340
-
\??\c:\xxrrfll.exec:\xxrrfll.exe98⤵PID:2492
-
\??\c:\vppjv.exec:\vppjv.exe99⤵PID:2984
-
\??\c:\jdvvp.exec:\jdvvp.exe100⤵PID:456
-
\??\c:\7xffrlf.exec:\7xffrlf.exe101⤵PID:3016
-
\??\c:\1nbbbh.exec:\1nbbbh.exe102⤵PID:1136
-
\??\c:\3pvvv.exec:\3pvvv.exe103⤵PID:3776
-
\??\c:\5lrllrl.exec:\5lrllrl.exe104⤵PID:2900
-
\??\c:\jjdvp.exec:\jjdvp.exe105⤵PID:2120
-
\??\c:\jddpp.exec:\jddpp.exe106⤵PID:752
-
\??\c:\xrxlfll.exec:\xrxlfll.exe107⤵PID:4324
-
\??\c:\thbhnh.exec:\thbhnh.exe108⤵PID:3856
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe109⤵
- System Location Discovery: System Language Discovery
PID:2380 -
\??\c:\ttbbbb.exec:\ttbbbb.exe110⤵PID:1772
-
\??\c:\bbhbnn.exec:\bbhbnn.exe111⤵PID:3748
-
\??\c:\xfrrlrl.exec:\xfrrlrl.exe112⤵PID:2680
-
\??\c:\tbnhbb.exec:\tbnhbb.exe113⤵PID:2904
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe114⤵PID:4836
-
\??\c:\bthhhn.exec:\bthhhn.exe115⤵PID:3172
-
\??\c:\dvpjj.exec:\dvpjj.exe116⤵PID:3516
-
\??\c:\9fllflx.exec:\9fllflx.exe117⤵PID:1908
-
\??\c:\xrffxrx.exec:\xrffxrx.exe118⤵PID:1864
-
\??\c:\lxffrrl.exec:\lxffrrl.exe119⤵PID:1040
-
\??\c:\xlrrrll.exec:\xlrrrll.exe120⤵PID:1376
-
\??\c:\tnbbbb.exec:\tnbbbb.exe121⤵PID:1472
-
\??\c:\fffffxx.exec:\fffffxx.exe122⤵PID:2124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-