Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 03:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe
-
Size
454KB
-
MD5
645068246f0bee687d3773642ae64440
-
SHA1
e437431f06e05b494ad52bb2c2c3e4f1583dcd34
-
SHA256
0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3
-
SHA512
c6f53b52caff482a07f9b937351d52a7d90599562b881dbba5fbb173253632508dd91437bf8bb7b7795f97dfd5c23b3411dbc9eb05b0a954b8bbff999be24ef0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTq:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3508-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-647-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-1061-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-1116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-1557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-1869-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-1879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 624 9bnhhn.exe 1688 rrrlffr.exe 4764 bnnhbt.exe 5004 1ddvv.exe 2912 ttnbtn.exe 2036 lfrlxxl.exe 2108 jvdvj.exe 3216 vjdpj.exe 2968 tttnnb.exe 2572 nbtthn.exe 3780 dvvpv.exe 2196 flrfxrl.exe 4880 llfrrlf.exe 3800 tnbthb.exe 3024 ppdpp.exe 2480 tbhbnn.exe 3332 1vppv.exe 4944 rxrffxx.exe 4012 tnhbtb.exe 2696 1pjvp.exe 636 rxlfffx.exe 4984 3tnnhh.exe 4852 3dddv.exe 1428 rfllfrl.exe 436 dvdvj.exe 4500 lrlrxll.exe 2400 ddvvp.exe 3148 rrxrffx.exe 3464 llfxllr.exe 2456 btbbbb.exe 4584 xffrlrl.exe 3168 djddv.exe 1316 1jjjv.exe 1664 bhhnhh.exe 2184 pdvvp.exe 3436 5bnhnn.exe 1748 pppvv.exe 4928 flxlflr.exe 1612 hbhbbn.exe 1800 vvpjv.exe 2504 xfllffx.exe 3008 nnhhbb.exe 216 ddvjd.exe 3188 lrrrfxf.exe 1416 hnhbbt.exe 5108 vppjd.exe 3016 1xffffl.exe 1100 nnnnhn.exe 4372 9ppdv.exe 4980 dvjjd.exe 3508 fxrrllf.exe 3936 tbbbnn.exe 4016 jdvpj.exe 5044 xrrrxxr.exe 4764 bbbttt.exe 4368 pdjjd.exe 3540 jdjdv.exe 3260 7ttttb.exe 3636 7ttbnh.exe 1660 pjdvv.exe 1920 xlrrxxr.exe 844 llrrxxf.exe 3968 hhnnhh.exe 4700 1vvjd.exe -
resource yara_rule behavioral2/memory/3508-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-1061-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-1116-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3508 wrote to memory of 624 3508 0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe 83 PID 3508 wrote to memory of 624 3508 0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe 83 PID 3508 wrote to memory of 624 3508 0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe 83 PID 624 wrote to memory of 1688 624 9bnhhn.exe 84 PID 624 wrote to memory of 1688 624 9bnhhn.exe 84 PID 624 wrote to memory of 1688 624 9bnhhn.exe 84 PID 1688 wrote to memory of 4764 1688 rrrlffr.exe 85 PID 1688 wrote to memory of 4764 1688 rrrlffr.exe 85 PID 1688 wrote to memory of 4764 1688 rrrlffr.exe 85 PID 4764 wrote to memory of 5004 4764 bnnhbt.exe 86 PID 4764 wrote to memory of 5004 4764 bnnhbt.exe 86 PID 4764 wrote to memory of 5004 4764 bnnhbt.exe 86 PID 5004 wrote to memory of 2912 5004 1ddvv.exe 87 PID 5004 wrote to memory of 2912 5004 1ddvv.exe 87 PID 5004 wrote to memory of 2912 5004 1ddvv.exe 87 PID 2912 wrote to memory of 2036 2912 ttnbtn.exe 88 PID 2912 wrote to memory of 2036 2912 ttnbtn.exe 88 PID 2912 wrote to memory of 2036 2912 ttnbtn.exe 88 PID 2036 wrote to memory of 2108 2036 lfrlxxl.exe 89 PID 2036 wrote to memory of 2108 2036 lfrlxxl.exe 89 PID 2036 wrote to memory of 2108 2036 lfrlxxl.exe 89 PID 2108 wrote to memory of 3216 2108 jvdvj.exe 90 PID 2108 wrote to memory of 3216 2108 jvdvj.exe 90 PID 2108 wrote to memory of 3216 2108 jvdvj.exe 90 PID 3216 wrote to memory of 2968 3216 vjdpj.exe 91 PID 3216 wrote to memory of 2968 3216 vjdpj.exe 91 PID 3216 wrote to memory of 2968 3216 vjdpj.exe 91 PID 2968 wrote to memory of 2572 2968 tttnnb.exe 92 PID 2968 wrote to memory of 2572 2968 tttnnb.exe 92 PID 2968 wrote to memory of 2572 2968 tttnnb.exe 92 PID 2572 wrote to memory of 3780 2572 nbtthn.exe 93 PID 2572 wrote to memory of 3780 2572 nbtthn.exe 93 PID 2572 wrote to memory of 3780 2572 nbtthn.exe 93 PID 3780 wrote to memory of 2196 3780 dvvpv.exe 94 PID 3780 wrote to memory of 2196 3780 dvvpv.exe 94 PID 3780 wrote to memory of 2196 3780 dvvpv.exe 94 PID 2196 wrote to memory of 4880 2196 flrfxrl.exe 95 PID 2196 wrote to memory of 4880 2196 flrfxrl.exe 95 PID 2196 wrote to memory of 4880 2196 flrfxrl.exe 95 PID 4880 wrote to memory of 3800 4880 llfrrlf.exe 96 PID 4880 wrote to memory of 3800 4880 llfrrlf.exe 96 PID 4880 wrote to memory of 3800 4880 llfrrlf.exe 96 PID 3800 wrote to memory of 3024 3800 tnbthb.exe 97 PID 3800 wrote to memory of 3024 3800 tnbthb.exe 97 PID 3800 wrote to memory of 3024 3800 tnbthb.exe 97 PID 3024 wrote to memory of 2480 3024 ppdpp.exe 98 PID 3024 wrote to memory of 2480 3024 ppdpp.exe 98 PID 3024 wrote to memory of 2480 3024 ppdpp.exe 98 PID 2480 wrote to memory of 3332 2480 tbhbnn.exe 99 PID 2480 wrote to memory of 3332 2480 tbhbnn.exe 99 PID 2480 wrote to memory of 3332 2480 tbhbnn.exe 99 PID 3332 wrote to memory of 4944 3332 1vppv.exe 100 PID 3332 wrote to memory of 4944 3332 1vppv.exe 100 PID 3332 wrote to memory of 4944 3332 1vppv.exe 100 PID 4944 wrote to memory of 4012 4944 rxrffxx.exe 101 PID 4944 wrote to memory of 4012 4944 rxrffxx.exe 101 PID 4944 wrote to memory of 4012 4944 rxrffxx.exe 101 PID 4012 wrote to memory of 2696 4012 tnhbtb.exe 102 PID 4012 wrote to memory of 2696 4012 tnhbtb.exe 102 PID 4012 wrote to memory of 2696 4012 tnhbtb.exe 102 PID 2696 wrote to memory of 636 2696 1pjvp.exe 103 PID 2696 wrote to memory of 636 2696 1pjvp.exe 103 PID 2696 wrote to memory of 636 2696 1pjvp.exe 103 PID 636 wrote to memory of 4984 636 rxlfffx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe"C:\Users\Admin\AppData\Local\Temp\0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\9bnhhn.exec:\9bnhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\rrrlffr.exec:\rrrlffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\bnnhbt.exec:\bnnhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\1ddvv.exec:\1ddvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\ttnbtn.exec:\ttnbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\jvdvj.exec:\jvdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\vjdpj.exec:\vjdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\tttnnb.exec:\tttnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\nbtthn.exec:\nbtthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\dvvpv.exec:\dvvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\flrfxrl.exec:\flrfxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\llfrrlf.exec:\llfrrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\tnbthb.exec:\tnbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\ppdpp.exec:\ppdpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\tbhbnn.exec:\tbhbnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\1vppv.exec:\1vppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\rxrffxx.exec:\rxrffxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\tnhbtb.exec:\tnhbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\1pjvp.exec:\1pjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\rxlfffx.exec:\rxlfffx.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\3tnnhh.exec:\3tnnhh.exe23⤵
- Executes dropped EXE
PID:4984 -
\??\c:\3dddv.exec:\3dddv.exe24⤵
- Executes dropped EXE
PID:4852 -
\??\c:\rfllfrl.exec:\rfllfrl.exe25⤵
- Executes dropped EXE
PID:1428 -
\??\c:\dvdvj.exec:\dvdvj.exe26⤵
- Executes dropped EXE
PID:436 -
\??\c:\lrlrxll.exec:\lrlrxll.exe27⤵
- Executes dropped EXE
PID:4500 -
\??\c:\ddvvp.exec:\ddvvp.exe28⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rrxrffx.exec:\rrxrffx.exe29⤵
- Executes dropped EXE
PID:3148 -
\??\c:\llfxllr.exec:\llfxllr.exe30⤵
- Executes dropped EXE
PID:3464 -
\??\c:\btbbbb.exec:\btbbbb.exe31⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xffrlrl.exec:\xffrlrl.exe32⤵
- Executes dropped EXE
PID:4584 -
\??\c:\djddv.exec:\djddv.exe33⤵
- Executes dropped EXE
PID:3168 -
\??\c:\1jjjv.exec:\1jjjv.exe34⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bhhnhh.exec:\bhhnhh.exe35⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pdvvp.exec:\pdvvp.exe36⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5bnhnn.exec:\5bnhnn.exe37⤵
- Executes dropped EXE
PID:3436 -
\??\c:\pppvv.exec:\pppvv.exe38⤵
- Executes dropped EXE
PID:1748 -
\??\c:\flxlflr.exec:\flxlflr.exe39⤵
- Executes dropped EXE
PID:4928 -
\??\c:\hbhbbn.exec:\hbhbbn.exe40⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vvpjv.exec:\vvpjv.exe41⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xfllffx.exec:\xfllffx.exe42⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nnhhbb.exec:\nnhhbb.exe43⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ddvjd.exec:\ddvjd.exe44⤵
- Executes dropped EXE
PID:216 -
\??\c:\lrrrfxf.exec:\lrrrfxf.exe45⤵
- Executes dropped EXE
PID:3188 -
\??\c:\hnhbbt.exec:\hnhbbt.exe46⤵
- Executes dropped EXE
PID:1416 -
\??\c:\vppjd.exec:\vppjd.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5108 -
\??\c:\1xffffl.exec:\1xffffl.exe48⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nnnnhn.exec:\nnnnhn.exe49⤵
- Executes dropped EXE
PID:1100 -
\??\c:\9ppdv.exec:\9ppdv.exe50⤵
- Executes dropped EXE
PID:4372 -
\??\c:\dvjjd.exec:\dvjjd.exe51⤵
- Executes dropped EXE
PID:4980 -
\??\c:\fxrrllf.exec:\fxrrllf.exe52⤵
- Executes dropped EXE
PID:3508 -
\??\c:\tbbbnn.exec:\tbbbnn.exe53⤵
- Executes dropped EXE
PID:3936 -
\??\c:\jdvpj.exec:\jdvpj.exe54⤵
- Executes dropped EXE
PID:4016 -
\??\c:\xrrrxxr.exec:\xrrrxxr.exe55⤵
- Executes dropped EXE
PID:5044 -
\??\c:\bbbttt.exec:\bbbttt.exe56⤵
- Executes dropped EXE
PID:4764 -
\??\c:\pdjjd.exec:\pdjjd.exe57⤵
- Executes dropped EXE
PID:4368 -
\??\c:\jdjdv.exec:\jdjdv.exe58⤵
- Executes dropped EXE
PID:3540 -
\??\c:\7ttttb.exec:\7ttttb.exe59⤵
- Executes dropped EXE
PID:3260 -
\??\c:\7ttbnh.exec:\7ttbnh.exe60⤵
- Executes dropped EXE
PID:3636 -
\??\c:\pjdvv.exec:\pjdvv.exe61⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xlrrxxr.exec:\xlrrxxr.exe62⤵
- Executes dropped EXE
PID:1920 -
\??\c:\llrrxxf.exec:\llrrxxf.exe63⤵
- Executes dropped EXE
PID:844 -
\??\c:\hhnnhh.exec:\hhnnhh.exe64⤵
- Executes dropped EXE
PID:3968 -
\??\c:\1vvjd.exec:\1vvjd.exe65⤵
- Executes dropped EXE
PID:4700 -
\??\c:\9vvvd.exec:\9vvvd.exe66⤵PID:2284
-
\??\c:\lxfxrrx.exec:\lxfxrrx.exe67⤵PID:3284
-
\??\c:\ntbbbb.exec:\ntbbbb.exe68⤵PID:2520
-
\??\c:\bhbtnn.exec:\bhbtnn.exe69⤵PID:1208
-
\??\c:\ppddp.exec:\ppddp.exe70⤵PID:540
-
\??\c:\rfxxrfx.exec:\rfxxrfx.exe71⤵PID:1104
-
\??\c:\1ttnnn.exec:\1ttnnn.exe72⤵PID:5052
-
\??\c:\dvdpd.exec:\dvdpd.exe73⤵PID:2576
-
\??\c:\xfxlfxl.exec:\xfxlfxl.exe74⤵PID:5084
-
\??\c:\nhnnbt.exec:\nhnnbt.exe75⤵PID:4040
-
\??\c:\9hhhbn.exec:\9hhhbn.exe76⤵PID:4736
-
\??\c:\9jjvj.exec:\9jjvj.exe77⤵PID:388
-
\??\c:\xfllllr.exec:\xfllllr.exe78⤵PID:2732
-
\??\c:\3rxrffx.exec:\3rxrffx.exe79⤵
- System Location Discovery: System Language Discovery
PID:3304 -
\??\c:\1bbtnn.exec:\1bbtnn.exe80⤵PID:1784
-
\??\c:\7dpdp.exec:\7dpdp.exe81⤵PID:1324
-
\??\c:\rrllffx.exec:\rrllffx.exe82⤵PID:1972
-
\??\c:\nnhbtt.exec:\nnhbtt.exe83⤵PID:372
-
\??\c:\dppjv.exec:\dppjv.exe84⤵PID:376
-
\??\c:\3dvpj.exec:\3dvpj.exe85⤵PID:3316
-
\??\c:\1frfxrf.exec:\1frfxrf.exe86⤵PID:1428
-
\??\c:\hhttbt.exec:\hhttbt.exe87⤵PID:1804
-
\??\c:\hnbhbn.exec:\hnbhbn.exe88⤵PID:4568
-
\??\c:\vdpjj.exec:\vdpjj.exe89⤵PID:3288
-
\??\c:\9xlxfxl.exec:\9xlxfxl.exe90⤵
- System Location Discovery: System Language Discovery
PID:2772 -
\??\c:\7ttnnn.exec:\7ttnnn.exe91⤵PID:2332
-
\??\c:\ddjdv.exec:\ddjdv.exe92⤵PID:2420
-
\??\c:\rfxrxrf.exec:\rfxrxrf.exe93⤵PID:3464
-
\??\c:\7lrlffx.exec:\7lrlffx.exe94⤵PID:1772
-
\??\c:\bhhthh.exec:\bhhthh.exe95⤵PID:1388
-
\??\c:\5pdvj.exec:\5pdvj.exe96⤵PID:3708
-
\??\c:\xrrrlff.exec:\xrrrlff.exe97⤵PID:1420
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe98⤵PID:1536
-
\??\c:\ntbbhh.exec:\ntbbhh.exe99⤵PID:4780
-
\??\c:\3pvpp.exec:\3pvpp.exe100⤵PID:3364
-
\??\c:\jdjdd.exec:\jdjdd.exe101⤵PID:3504
-
\??\c:\rxxxllf.exec:\rxxxllf.exe102⤵PID:1748
-
\??\c:\nhhhbt.exec:\nhhhbt.exe103⤵PID:4928
-
\??\c:\nbnhbb.exec:\nbnhbb.exe104⤵PID:1056
-
\??\c:\jvvjv.exec:\jvvjv.exe105⤵PID:1948
-
\??\c:\rflfrrf.exec:\rflfrrf.exe106⤵PID:4808
-
\??\c:\ntbbtt.exec:\ntbbtt.exe107⤵PID:4280
-
\??\c:\hnhbtt.exec:\hnhbtt.exe108⤵PID:1436
-
\??\c:\jjjdp.exec:\jjjdp.exe109⤵
- System Location Discovery: System Language Discovery
PID:1196 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe110⤵PID:2092
-
\??\c:\7bbttn.exec:\7bbttn.exe111⤵PID:1416
-
\??\c:\bhnhnt.exec:\bhnhnt.exe112⤵PID:2548
-
\??\c:\7pvpv.exec:\7pvpv.exe113⤵PID:4344
-
\??\c:\rlllffx.exec:\rlllffx.exe114⤵PID:1100
-
\??\c:\bbttnb.exec:\bbttnb.exe115⤵PID:4372
-
\??\c:\pdjdv.exec:\pdjdv.exe116⤵PID:4980
-
\??\c:\dddvp.exec:\dddvp.exe117⤵PID:4284
-
\??\c:\9xxrffr.exec:\9xxrffr.exe118⤵PID:4136
-
\??\c:\hhhnbt.exec:\hhhnbt.exe119⤵PID:4752
-
\??\c:\vvddj.exec:\vvddj.exe120⤵PID:872
-
\??\c:\lrrlxfx.exec:\lrrlxfx.exe121⤵PID:2416
-
\??\c:\rfxrllf.exec:\rfxrllf.exe122⤵PID:3652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-