Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 03:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe
-
Size
453KB
-
MD5
4a50aec50881291c33b2e9731d648a20
-
SHA1
e0688793f7a506ebb688210a17e3aad747667a87
-
SHA256
b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f
-
SHA512
2379134392b5000224f477c5fe48f7d0d1fd43d81b9c9f851278aca6947f96737114c46c7b8f93b37409b1eef538931459439cde477d4be0b827b5e6c4cc562a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3508-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/696-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-1070-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-1333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-1817-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3508 1rxxrff.exe 2612 7bbtnn.exe 696 ppjpp.exe 1776 nhnnbn.exe 2044 7lrlflf.exe 3808 1jppj.exe 1308 bbhttb.exe 3796 vvpjp.exe 3564 djvvv.exe 4864 hnbttt.exe 1284 dddvp.exe 776 hntttt.exe 3748 vjddd.exe 4132 lrllfff.exe 4820 nnnhhh.exe 2212 7dddd.exe 448 llllrrx.exe 3952 lxxrrlx.exe 1872 3bbthb.exe 2436 vvvjv.exe 1048 jdpjp.exe 2888 rffxllf.exe 1972 hnbtbt.exe 372 7nbnbb.exe 376 7dvjd.exe 4432 frrlxrl.exe 4604 lrlxrll.exe 1164 ttbttn.exe 2580 hnhbnh.exe 760 pddvj.exe 1608 xllxlxl.exe 2420 rrfxrlx.exe 2256 3bbnnt.exe 3168 ttthtn.exe 3200 vjjdv.exe 1368 rffxfxf.exe 1884 1fxlxrf.exe 1864 9hnbbh.exe 3264 ppjvj.exe 1748 vpvpd.exe 1788 rfffrrl.exe 1620 1frfxlf.exe 2312 ttnhbt.exe 1992 jddvp.exe 2880 vjdjd.exe 1376 llxlxrf.exe 216 nhtnbt.exe 1632 htnbnh.exe 3280 vpdvj.exe 3156 9xxrfxr.exe 4856 flfrxrr.exe 972 vpjdv.exe 1100 lfxlfxl.exe 2992 3frlxrf.exe 3904 bbnhtb.exe 4980 3dddp.exe 2060 lflxrxl.exe 60 xrfxllx.exe 384 btnhbt.exe 2396 pddvj.exe 1776 djpdd.exe 3540 lxfxrrl.exe 3120 bhhhbb.exe 3636 vppjd.exe -
resource yara_rule behavioral2/memory/3508-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-1333-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4624 wrote to memory of 3508 4624 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 83 PID 4624 wrote to memory of 3508 4624 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 83 PID 4624 wrote to memory of 3508 4624 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 83 PID 3508 wrote to memory of 2612 3508 1rxxrff.exe 84 PID 3508 wrote to memory of 2612 3508 1rxxrff.exe 84 PID 3508 wrote to memory of 2612 3508 1rxxrff.exe 84 PID 2612 wrote to memory of 696 2612 7bbtnn.exe 85 PID 2612 wrote to memory of 696 2612 7bbtnn.exe 85 PID 2612 wrote to memory of 696 2612 7bbtnn.exe 85 PID 696 wrote to memory of 1776 696 ppjpp.exe 86 PID 696 wrote to memory of 1776 696 ppjpp.exe 86 PID 696 wrote to memory of 1776 696 ppjpp.exe 86 PID 1776 wrote to memory of 2044 1776 nhnnbn.exe 87 PID 1776 wrote to memory of 2044 1776 nhnnbn.exe 87 PID 1776 wrote to memory of 2044 1776 nhnnbn.exe 87 PID 2044 wrote to memory of 3808 2044 7lrlflf.exe 88 PID 2044 wrote to memory of 3808 2044 7lrlflf.exe 88 PID 2044 wrote to memory of 3808 2044 7lrlflf.exe 88 PID 3808 wrote to memory of 1308 3808 1jppj.exe 89 PID 3808 wrote to memory of 1308 3808 1jppj.exe 89 PID 3808 wrote to memory of 1308 3808 1jppj.exe 89 PID 1308 wrote to memory of 3796 1308 bbhttb.exe 90 PID 1308 wrote to memory of 3796 1308 bbhttb.exe 90 PID 1308 wrote to memory of 3796 1308 bbhttb.exe 90 PID 3796 wrote to memory of 3564 3796 vvpjp.exe 91 PID 3796 wrote to memory of 3564 3796 vvpjp.exe 91 PID 3796 wrote to memory of 3564 3796 vvpjp.exe 91 PID 3564 wrote to memory of 4864 3564 djvvv.exe 92 PID 3564 wrote to memory of 4864 3564 djvvv.exe 92 PID 3564 wrote to memory of 4864 3564 djvvv.exe 92 PID 4864 wrote to memory of 1284 4864 hnbttt.exe 93 PID 4864 wrote to memory of 1284 4864 hnbttt.exe 93 PID 4864 wrote to memory of 1284 4864 hnbttt.exe 93 PID 1284 wrote to memory of 776 1284 dddvp.exe 94 PID 1284 wrote to memory of 776 1284 dddvp.exe 94 PID 1284 wrote to memory of 776 1284 dddvp.exe 94 PID 776 wrote to memory of 3748 776 hntttt.exe 95 PID 776 wrote to memory of 3748 776 hntttt.exe 95 PID 776 wrote to memory of 3748 776 hntttt.exe 95 PID 3748 wrote to memory of 4132 3748 vjddd.exe 96 PID 3748 wrote to memory of 4132 3748 vjddd.exe 96 PID 3748 wrote to memory of 4132 3748 vjddd.exe 96 PID 4132 wrote to memory of 4820 4132 lrllfff.exe 97 PID 4132 wrote to memory of 4820 4132 lrllfff.exe 97 PID 4132 wrote to memory of 4820 4132 lrllfff.exe 97 PID 4820 wrote to memory of 2212 4820 nnnhhh.exe 98 PID 4820 wrote to memory of 2212 4820 nnnhhh.exe 98 PID 4820 wrote to memory of 2212 4820 nnnhhh.exe 98 PID 2212 wrote to memory of 448 2212 7dddd.exe 99 PID 2212 wrote to memory of 448 2212 7dddd.exe 99 PID 2212 wrote to memory of 448 2212 7dddd.exe 99 PID 448 wrote to memory of 3952 448 llllrrx.exe 100 PID 448 wrote to memory of 3952 448 llllrrx.exe 100 PID 448 wrote to memory of 3952 448 llllrrx.exe 100 PID 3952 wrote to memory of 1872 3952 lxxrrlx.exe 101 PID 3952 wrote to memory of 1872 3952 lxxrrlx.exe 101 PID 3952 wrote to memory of 1872 3952 lxxrrlx.exe 101 PID 1872 wrote to memory of 2436 1872 3bbthb.exe 102 PID 1872 wrote to memory of 2436 1872 3bbthb.exe 102 PID 1872 wrote to memory of 2436 1872 3bbthb.exe 102 PID 2436 wrote to memory of 1048 2436 vvvjv.exe 103 PID 2436 wrote to memory of 1048 2436 vvvjv.exe 103 PID 2436 wrote to memory of 1048 2436 vvvjv.exe 103 PID 1048 wrote to memory of 2888 1048 jdpjp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe"C:\Users\Admin\AppData\Local\Temp\b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\1rxxrff.exec:\1rxxrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\7bbtnn.exec:\7bbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\ppjpp.exec:\ppjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\nhnnbn.exec:\nhnnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\7lrlflf.exec:\7lrlflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\1jppj.exec:\1jppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\bbhttb.exec:\bbhttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\vvpjp.exec:\vvpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\djvvv.exec:\djvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\hnbttt.exec:\hnbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\dddvp.exec:\dddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\hntttt.exec:\hntttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\vjddd.exec:\vjddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\lrllfff.exec:\lrllfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\nnnhhh.exec:\nnnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\7dddd.exec:\7dddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\llllrrx.exec:\llllrrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\lxxrrlx.exec:\lxxrrlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\3bbthb.exec:\3bbthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\vvvjv.exec:\vvvjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jdpjp.exec:\jdpjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\rffxllf.exec:\rffxllf.exe23⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hnbtbt.exec:\hnbtbt.exe24⤵
- Executes dropped EXE
PID:1972 -
\??\c:\7nbnbb.exec:\7nbnbb.exe25⤵
- Executes dropped EXE
PID:372 -
\??\c:\7dvjd.exec:\7dvjd.exe26⤵
- Executes dropped EXE
PID:376 -
\??\c:\frrlxrl.exec:\frrlxrl.exe27⤵
- Executes dropped EXE
PID:4432 -
\??\c:\lrlxrll.exec:\lrlxrll.exe28⤵
- Executes dropped EXE
PID:4604 -
\??\c:\ttbttn.exec:\ttbttn.exe29⤵
- Executes dropped EXE
PID:1164 -
\??\c:\hnhbnh.exec:\hnhbnh.exe30⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pddvj.exec:\pddvj.exe31⤵
- Executes dropped EXE
PID:760 -
\??\c:\xllxlxl.exec:\xllxlxl.exe32⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rrfxrlx.exec:\rrfxrlx.exe33⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3bbnnt.exec:\3bbnnt.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ttthtn.exec:\ttthtn.exe35⤵
- Executes dropped EXE
PID:3168 -
\??\c:\vjjdv.exec:\vjjdv.exe36⤵
- Executes dropped EXE
PID:3200 -
\??\c:\rffxfxf.exec:\rffxfxf.exe37⤵
- Executes dropped EXE
PID:1368 -
\??\c:\1fxlxrf.exec:\1fxlxrf.exe38⤵
- Executes dropped EXE
PID:1884 -
\??\c:\9hnbbh.exec:\9hnbbh.exe39⤵
- Executes dropped EXE
PID:1864 -
\??\c:\ppjvj.exec:\ppjvj.exe40⤵
- Executes dropped EXE
PID:3264 -
\??\c:\vpvpd.exec:\vpvpd.exe41⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rfffrrl.exec:\rfffrrl.exe42⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1frfxlf.exec:\1frfxlf.exe43⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ttnhbt.exec:\ttnhbt.exe44⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jddvp.exec:\jddvp.exe45⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vjdjd.exec:\vjdjd.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\llxlxrf.exec:\llxlxrf.exe47⤵
- Executes dropped EXE
PID:1376 -
\??\c:\nhtnbt.exec:\nhtnbt.exe48⤵
- Executes dropped EXE
PID:216 -
\??\c:\htnbnh.exec:\htnbnh.exe49⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vpdvj.exec:\vpdvj.exe50⤵
- Executes dropped EXE
PID:3280 -
\??\c:\9xxrfxr.exec:\9xxrfxr.exe51⤵
- Executes dropped EXE
PID:3156 -
\??\c:\flfrxrr.exec:\flfrxrr.exe52⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vpjdv.exec:\vpjdv.exe53⤵
- Executes dropped EXE
PID:972 -
\??\c:\lfxlfxl.exec:\lfxlfxl.exe54⤵
- Executes dropped EXE
PID:1100 -
\??\c:\3frlxrf.exec:\3frlxrf.exe55⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tnnntn.exec:\tnnntn.exe56⤵PID:4364
-
\??\c:\bbnhtb.exec:\bbnhtb.exe57⤵
- Executes dropped EXE
PID:3904 -
\??\c:\3dddp.exec:\3dddp.exe58⤵
- Executes dropped EXE
PID:4980 -
\??\c:\lflxrxl.exec:\lflxrxl.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xrfxllx.exec:\xrfxllx.exe60⤵
- Executes dropped EXE
PID:60 -
\??\c:\btnhbt.exec:\btnhbt.exe61⤵
- Executes dropped EXE
PID:384 -
\??\c:\pddvj.exec:\pddvj.exe62⤵
- Executes dropped EXE
PID:2396 -
\??\c:\djpdd.exec:\djpdd.exe63⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe64⤵
- Executes dropped EXE
PID:3540 -
\??\c:\bhhhbb.exec:\bhhhbb.exe65⤵
- Executes dropped EXE
PID:3120 -
\??\c:\vppjd.exec:\vppjd.exe66⤵
- Executes dropped EXE
PID:3636 -
\??\c:\bttbbb.exec:\bttbbb.exe67⤵PID:4752
-
\??\c:\dddvv.exec:\dddvv.exe68⤵PID:3216
-
\??\c:\nnttbb.exec:\nnttbb.exe69⤵PID:3796
-
\??\c:\hhtntt.exec:\hhtntt.exe70⤵PID:1936
-
\??\c:\9ddvp.exec:\9ddvp.exe71⤵PID:4256
-
\??\c:\bbhhhb.exec:\bbhhhb.exe72⤵PID:3780
-
\??\c:\lllffrf.exec:\lllffrf.exe73⤵PID:1284
-
\??\c:\jvvpp.exec:\jvvpp.exe74⤵PID:5052
-
\??\c:\1rxxxxx.exec:\1rxxxxx.exe75⤵PID:540
-
\??\c:\hnttbh.exec:\hnttbh.exe76⤵PID:5068
-
\??\c:\ddvjd.exec:\ddvjd.exe77⤵PID:4488
-
\??\c:\httnnh.exec:\httnnh.exe78⤵PID:764
-
\??\c:\nnhhhh.exec:\nnhhhh.exe79⤵PID:1600
-
\??\c:\vdppd.exec:\vdppd.exe80⤵
- System Location Discovery: System Language Discovery
PID:1848 -
\??\c:\bbtnnn.exec:\bbtnnn.exe81⤵
- System Location Discovery: System Language Discovery
PID:1872 -
\??\c:\jjpjd.exec:\jjpjd.exe82⤵PID:2696
-
\??\c:\jpvvd.exec:\jpvvd.exe83⤵PID:4172
-
\??\c:\7rrxrlf.exec:\7rrxrlf.exe84⤵PID:2888
-
\??\c:\hbtnnt.exec:\hbtnnt.exe85⤵PID:1540
-
\??\c:\pjjjd.exec:\pjjjd.exe86⤵PID:3604
-
\??\c:\xxxfxlf.exec:\xxxfxlf.exe87⤵PID:2480
-
\??\c:\bbhbbb.exec:\bbhbbb.exe88⤵PID:1500
-
\??\c:\pddvp.exec:\pddvp.exe89⤵PID:2384
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe90⤵PID:2540
-
\??\c:\bhtnnn.exec:\bhtnnn.exe91⤵PID:760
-
\??\c:\nbtttt.exec:\nbtttt.exe92⤵PID:4588
-
\??\c:\9jjjd.exec:\9jjjd.exe93⤵PID:1388
-
\??\c:\rxfllll.exec:\rxfllll.exe94⤵PID:4840
-
\??\c:\xrxrlll.exec:\xrxrlll.exe95⤵PID:2928
-
\??\c:\3nttnn.exec:\3nttnn.exe96⤵PID:3200
-
\??\c:\lflffrr.exec:\lflffrr.exe97⤵PID:1368
-
\??\c:\tttnhn.exec:\tttnhn.exe98⤵PID:892
-
\??\c:\1jpjd.exec:\1jpjd.exe99⤵PID:4312
-
\??\c:\xxrrlll.exec:\xxrrlll.exe100⤵PID:4000
-
\??\c:\bbhhbb.exec:\bbhhbb.exe101⤵PID:2596
-
\??\c:\nnbthh.exec:\nnbthh.exe102⤵PID:4780
-
\??\c:\ppvpp.exec:\ppvpp.exe103⤵PID:4384
-
\??\c:\lllrlrl.exec:\lllrlrl.exe104⤵PID:1424
-
\??\c:\hnhbnn.exec:\hnhbnn.exe105⤵PID:2880
-
\??\c:\ttbtbb.exec:\ttbtbb.exe106⤵PID:1376
-
\??\c:\vpvdp.exec:\vpvdp.exe107⤵PID:2964
-
\??\c:\flfxlfx.exec:\flfxlfx.exe108⤵PID:3008
-
\??\c:\lxflfrl.exec:\lxflfrl.exe109⤵PID:4688
-
\??\c:\nnnhbb.exec:\nnnhbb.exe110⤵PID:2784
-
\??\c:\ppjdp.exec:\ppjdp.exe111⤵PID:4948
-
\??\c:\llrrfxf.exec:\llrrfxf.exe112⤵PID:3412
-
\??\c:\thhnhh.exec:\thhnhh.exe113⤵PID:3512
-
\??\c:\bbhbtt.exec:\bbhbtt.exe114⤵PID:2992
-
\??\c:\jjjjd.exec:\jjjjd.exe115⤵PID:2348
-
\??\c:\rfxrfxl.exec:\rfxrfxl.exe116⤵PID:4344
-
\??\c:\5flfxxr.exec:\5flfxxr.exe117⤵PID:3488
-
\??\c:\hbnnhh.exec:\hbnnhh.exe118⤵PID:2316
-
\??\c:\dpvpv.exec:\dpvpv.exe119⤵PID:1068
-
\??\c:\flxxxxx.exec:\flxxxxx.exe120⤵PID:3256
-
\??\c:\nhbnnn.exec:\nhbnnn.exe121⤵PID:4560
-
\??\c:\vvvpj.exec:\vvvpj.exe122⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-