Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe
-
Size
454KB
-
MD5
488df8f12423650a8438ea013368e290
-
SHA1
4a7190acb923a512f6ebd836ccdc0a8cea3dc39b
-
SHA256
928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4
-
SHA512
7d732bb692a7a9814fdc4fef1bd0d259da2190ab0d57e3d2a798d7b3375d8b6ca3957c11fa09f5b9ac6f13e5bb22606d315220cdf091a957eed97aa4a8a7a178
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1600-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-1480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-1596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-1699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2788 xrrlffr.exe 3260 bnnnhh.exe 3480 jddvp.exe 3224 llrlfxr.exe 3968 fxrxllx.exe 3624 nbhnhh.exe 1380 vddjd.exe 976 djdvv.exe 4832 lffxrrl.exe 1708 1hbtnh.exe 2476 ntbbtt.exe 116 hhhbtt.exe 5048 rrxxffl.exe 2016 ttbtnn.exe 3472 djdvp.exe 4724 ppjdv.exe 4444 fxllrlr.exe 3040 3hhhbb.exe 1512 nbbnhb.exe 3920 vvjjv.exe 4084 tbtthh.exe 3888 jdvvv.exe 1428 9lxrxfl.exe 2648 xrxrlll.exe 2644 nbnhbb.exe 3528 ppvvp.exe 1828 3dpjd.exe 4600 1rrffrr.exe 5040 1jppd.exe 2212 ffffxxr.exe 2216 vdddv.exe 4464 nttnbt.exe 4888 pvvpp.exe 4408 7dvpj.exe 3584 lxlfxrf.exe 2768 ttttnt.exe 1996 9vpjd.exe 3248 frlrffr.exe 3200 pjpjj.exe 4260 rlrrlll.exe 4864 tnnnhn.exe 2976 xrfxxrr.exe 2656 hbnnnn.exe 1548 dpvpj.exe 5012 xrfflll.exe 2916 bnbbtt.exe 4452 hhhbbn.exe 3112 vpjdd.exe 1220 rlrlxxf.exe 1536 tntnhh.exe 4520 hbhbtn.exe 1420 jddjd.exe 1072 xrfxfxr.exe 3748 thhbtn.exe 3668 vdjdv.exe 1900 vpppd.exe 224 fxrlllx.exe 1796 nnnnnn.exe 4908 pvjjd.exe 1456 jdjdp.exe 3092 1llflfx.exe 3264 9tnhhh.exe 676 jvvpp.exe 3348 dpppj.exe -
resource yara_rule behavioral2/memory/1600-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-1060-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-1412-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2788 1600 928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe 83 PID 1600 wrote to memory of 2788 1600 928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe 83 PID 1600 wrote to memory of 2788 1600 928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe 83 PID 2788 wrote to memory of 3260 2788 xrrlffr.exe 84 PID 2788 wrote to memory of 3260 2788 xrrlffr.exe 84 PID 2788 wrote to memory of 3260 2788 xrrlffr.exe 84 PID 3260 wrote to memory of 3480 3260 bnnnhh.exe 85 PID 3260 wrote to memory of 3480 3260 bnnnhh.exe 85 PID 3260 wrote to memory of 3480 3260 bnnnhh.exe 85 PID 3480 wrote to memory of 3224 3480 jddvp.exe 86 PID 3480 wrote to memory of 3224 3480 jddvp.exe 86 PID 3480 wrote to memory of 3224 3480 jddvp.exe 86 PID 3224 wrote to memory of 3968 3224 llrlfxr.exe 87 PID 3224 wrote to memory of 3968 3224 llrlfxr.exe 87 PID 3224 wrote to memory of 3968 3224 llrlfxr.exe 87 PID 3968 wrote to memory of 3624 3968 fxrxllx.exe 88 PID 3968 wrote to memory of 3624 3968 fxrxllx.exe 88 PID 3968 wrote to memory of 3624 3968 fxrxllx.exe 88 PID 3624 wrote to memory of 1380 3624 nbhnhh.exe 89 PID 3624 wrote to memory of 1380 3624 nbhnhh.exe 89 PID 3624 wrote to memory of 1380 3624 nbhnhh.exe 89 PID 1380 wrote to memory of 976 1380 vddjd.exe 90 PID 1380 wrote to memory of 976 1380 vddjd.exe 90 PID 1380 wrote to memory of 976 1380 vddjd.exe 90 PID 976 wrote to memory of 4832 976 djdvv.exe 91 PID 976 wrote to memory of 4832 976 djdvv.exe 91 PID 976 wrote to memory of 4832 976 djdvv.exe 91 PID 4832 wrote to memory of 1708 4832 lffxrrl.exe 92 PID 4832 wrote to memory of 1708 4832 lffxrrl.exe 92 PID 4832 wrote to memory of 1708 4832 lffxrrl.exe 92 PID 1708 wrote to memory of 2476 1708 1hbtnh.exe 93 PID 1708 wrote to memory of 2476 1708 1hbtnh.exe 93 PID 1708 wrote to memory of 2476 1708 1hbtnh.exe 93 PID 2476 wrote to memory of 116 2476 ntbbtt.exe 94 PID 2476 wrote to memory of 116 2476 ntbbtt.exe 94 PID 2476 wrote to memory of 116 2476 ntbbtt.exe 94 PID 116 wrote to memory of 5048 116 hhhbtt.exe 95 PID 116 wrote to memory of 5048 116 hhhbtt.exe 95 PID 116 wrote to memory of 5048 116 hhhbtt.exe 95 PID 5048 wrote to memory of 2016 5048 rrxxffl.exe 96 PID 5048 wrote to memory of 2016 5048 rrxxffl.exe 96 PID 5048 wrote to memory of 2016 5048 rrxxffl.exe 96 PID 2016 wrote to memory of 3472 2016 ttbtnn.exe 97 PID 2016 wrote to memory of 3472 2016 ttbtnn.exe 97 PID 2016 wrote to memory of 3472 2016 ttbtnn.exe 97 PID 3472 wrote to memory of 4724 3472 djdvp.exe 98 PID 3472 wrote to memory of 4724 3472 djdvp.exe 98 PID 3472 wrote to memory of 4724 3472 djdvp.exe 98 PID 4724 wrote to memory of 4444 4724 ppjdv.exe 99 PID 4724 wrote to memory of 4444 4724 ppjdv.exe 99 PID 4724 wrote to memory of 4444 4724 ppjdv.exe 99 PID 4444 wrote to memory of 3040 4444 fxllrlr.exe 100 PID 4444 wrote to memory of 3040 4444 fxllrlr.exe 100 PID 4444 wrote to memory of 3040 4444 fxllrlr.exe 100 PID 3040 wrote to memory of 1512 3040 3hhhbb.exe 101 PID 3040 wrote to memory of 1512 3040 3hhhbb.exe 101 PID 3040 wrote to memory of 1512 3040 3hhhbb.exe 101 PID 1512 wrote to memory of 3920 1512 nbbnhb.exe 102 PID 1512 wrote to memory of 3920 1512 nbbnhb.exe 102 PID 1512 wrote to memory of 3920 1512 nbbnhb.exe 102 PID 3920 wrote to memory of 4084 3920 vvjjv.exe 103 PID 3920 wrote to memory of 4084 3920 vvjjv.exe 103 PID 3920 wrote to memory of 4084 3920 vvjjv.exe 103 PID 4084 wrote to memory of 3888 4084 tbtthh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe"C:\Users\Admin\AppData\Local\Temp\928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\xrrlffr.exec:\xrrlffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bnnnhh.exec:\bnnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\jddvp.exec:\jddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\llrlfxr.exec:\llrlfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\fxrxllx.exec:\fxrxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\nbhnhh.exec:\nbhnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\vddjd.exec:\vddjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\djdvv.exec:\djdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\lffxrrl.exec:\lffxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\1hbtnh.exec:\1hbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\ntbbtt.exec:\ntbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\hhhbtt.exec:\hhhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rrxxffl.exec:\rrxxffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\ttbtnn.exec:\ttbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\djdvp.exec:\djdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\ppjdv.exec:\ppjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\fxllrlr.exec:\fxllrlr.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\3hhhbb.exec:\3hhhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\nbbnhb.exec:\nbbnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\vvjjv.exec:\vvjjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\tbtthh.exec:\tbtthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\jdvvv.exec:\jdvvv.exe23⤵
- Executes dropped EXE
PID:3888 -
\??\c:\9lxrxfl.exec:\9lxrxfl.exe24⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xrxrlll.exec:\xrxrlll.exe25⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nbnhbb.exec:\nbnhbb.exe26⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ppvvp.exec:\ppvvp.exe27⤵
- Executes dropped EXE
PID:3528 -
\??\c:\3dpjd.exec:\3dpjd.exe28⤵
- Executes dropped EXE
PID:1828 -
\??\c:\1rrffrr.exec:\1rrffrr.exe29⤵
- Executes dropped EXE
PID:4600 -
\??\c:\1jppd.exec:\1jppd.exe30⤵
- Executes dropped EXE
PID:5040 -
\??\c:\ffffxxr.exec:\ffffxxr.exe31⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vdddv.exec:\vdddv.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nttnbt.exec:\nttnbt.exe33⤵
- Executes dropped EXE
PID:4464 -
\??\c:\pvvpp.exec:\pvvpp.exe34⤵
- Executes dropped EXE
PID:4888 -
\??\c:\7dvpj.exec:\7dvpj.exe35⤵
- Executes dropped EXE
PID:4408 -
\??\c:\lxlfxrf.exec:\lxlfxrf.exe36⤵
- Executes dropped EXE
PID:3584 -
\??\c:\ttttnt.exec:\ttttnt.exe37⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9vpjd.exec:\9vpjd.exe38⤵
- Executes dropped EXE
PID:1996 -
\??\c:\frlrffr.exec:\frlrffr.exe39⤵
- Executes dropped EXE
PID:3248 -
\??\c:\pjpjj.exec:\pjpjj.exe40⤵
- Executes dropped EXE
PID:3200 -
\??\c:\rlrrlll.exec:\rlrrlll.exe41⤵
- Executes dropped EXE
PID:4260 -
\??\c:\tnnnhn.exec:\tnnnhn.exe42⤵
- Executes dropped EXE
PID:4864 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe43⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hbnnnn.exec:\hbnnnn.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dpvpj.exec:\dpvpj.exe45⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xrfflll.exec:\xrfflll.exe46⤵
- Executes dropped EXE
PID:5012 -
\??\c:\bnbbtt.exec:\bnbbtt.exe47⤵
- Executes dropped EXE
PID:2916 -
\??\c:\hhhbbn.exec:\hhhbbn.exe48⤵
- Executes dropped EXE
PID:4452 -
\??\c:\vpjdd.exec:\vpjdd.exe49⤵
- Executes dropped EXE
PID:3112 -
\??\c:\rlrlxxf.exec:\rlrlxxf.exe50⤵
- Executes dropped EXE
PID:1220 -
\??\c:\tntnhh.exec:\tntnhh.exe51⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hbhbtn.exec:\hbhbtn.exe52⤵
- Executes dropped EXE
PID:4520 -
\??\c:\jddjd.exec:\jddjd.exe53⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xrfxfxr.exec:\xrfxfxr.exe54⤵
- Executes dropped EXE
PID:1072 -
\??\c:\thhbtn.exec:\thhbtn.exe55⤵
- Executes dropped EXE
PID:3748 -
\??\c:\vdjdv.exec:\vdjdv.exe56⤵
- Executes dropped EXE
PID:3668 -
\??\c:\vpppd.exec:\vpppd.exe57⤵
- Executes dropped EXE
PID:1900 -
\??\c:\fxrlllx.exec:\fxrlllx.exe58⤵
- Executes dropped EXE
PID:224 -
\??\c:\nnnnnn.exec:\nnnnnn.exe59⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pvjjd.exec:\pvjjd.exe60⤵
- Executes dropped EXE
PID:4908 -
\??\c:\jdjdp.exec:\jdjdp.exe61⤵
- Executes dropped EXE
PID:1456 -
\??\c:\1llflfx.exec:\1llflfx.exe62⤵
- Executes dropped EXE
PID:3092 -
\??\c:\9tnhhh.exec:\9tnhhh.exe63⤵
- Executes dropped EXE
PID:3264 -
\??\c:\jvvpp.exec:\jvvpp.exe64⤵
- Executes dropped EXE
PID:676 -
\??\c:\dpppj.exec:\dpppj.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3348 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe66⤵PID:4576
-
\??\c:\bhtnhh.exec:\bhtnhh.exe67⤵PID:1048
-
\??\c:\hbbtnn.exec:\hbbtnn.exe68⤵PID:3588
-
\??\c:\pddvj.exec:\pddvj.exe69⤵PID:1264
-
\??\c:\flxrfrr.exec:\flxrfrr.exe70⤵PID:3656
-
\??\c:\tntnhb.exec:\tntnhb.exe71⤵PID:1120
-
\??\c:\pjpjv.exec:\pjpjv.exe72⤵PID:3596
-
\??\c:\vppjd.exec:\vppjd.exe73⤵PID:3948
-
\??\c:\frrlfff.exec:\frrlfff.exe74⤵PID:4016
-
\??\c:\1hbtnn.exec:\1hbtnn.exe75⤵PID:4592
-
\??\c:\pvjpp.exec:\pvjpp.exe76⤵PID:3040
-
\??\c:\jpjdv.exec:\jpjdv.exe77⤵PID:2288
-
\??\c:\xflfxrl.exec:\xflfxrl.exe78⤵PID:1240
-
\??\c:\nhnhbt.exec:\nhnhbt.exe79⤵PID:4924
-
\??\c:\jpjdv.exec:\jpjdv.exe80⤵PID:4084
-
\??\c:\dppjd.exec:\dppjd.exe81⤵PID:1956
-
\??\c:\xrffxlf.exec:\xrffxlf.exe82⤵PID:1792
-
\??\c:\3hhbbb.exec:\3hhbbb.exe83⤵PID:1428
-
\??\c:\vppjd.exec:\vppjd.exe84⤵PID:4920
-
\??\c:\xxlflfl.exec:\xxlflfl.exe85⤵PID:732
-
\??\c:\xrxfrrl.exec:\xrxfrrl.exe86⤵PID:3612
-
\??\c:\btbnhb.exec:\btbnhb.exe87⤵PID:3100
-
\??\c:\pjppp.exec:\pjppp.exe88⤵PID:3528
-
\??\c:\xrrrlxx.exec:\xrrrlxx.exe89⤵PID:3368
-
\??\c:\nhhbbt.exec:\nhhbbt.exe90⤵PID:4464
-
\??\c:\vjpjj.exec:\vjpjj.exe91⤵
- System Location Discovery: System Language Discovery
PID:1636 -
\??\c:\9rfxxrx.exec:\9rfxxrx.exe92⤵PID:1604
-
\??\c:\xxfxffl.exec:\xxfxffl.exe93⤵PID:2764
-
\??\c:\tnhhhh.exec:\tnhhhh.exe94⤵PID:2652
-
\??\c:\7pvpj.exec:\7pvpj.exe95⤵PID:5104
-
\??\c:\jpppj.exec:\jpppj.exe96⤵PID:4608
-
\??\c:\fflfrrf.exec:\fflfrrf.exe97⤵PID:1388
-
\??\c:\bnbbbb.exec:\bnbbbb.exe98⤵PID:2636
-
\??\c:\pdddv.exec:\pdddv.exe99⤵PID:2452
-
\??\c:\frfxrrl.exec:\frfxrrl.exe100⤵PID:4864
-
\??\c:\3hhnnt.exec:\3hhnnt.exe101⤵PID:2976
-
\??\c:\vpvpj.exec:\vpvpj.exe102⤵PID:1912
-
\??\c:\dpdpj.exec:\dpdpj.exe103⤵PID:5076
-
\??\c:\fxxrrxx.exec:\fxxrrxx.exe104⤵PID:64
-
\??\c:\hthbbh.exec:\hthbbh.exe105⤵PID:2916
-
\??\c:\dvjvd.exec:\dvjvd.exe106⤵PID:4416
-
\??\c:\fxxrffr.exec:\fxxrffr.exe107⤵PID:2260
-
\??\c:\xlrlffx.exec:\xlrlffx.exe108⤵PID:1416
-
\??\c:\nntnnn.exec:\nntnnn.exe109⤵PID:456
-
\??\c:\vpdvv.exec:\vpdvv.exe110⤵PID:2788
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe111⤵PID:3176
-
\??\c:\bthbtt.exec:\bthbtt.exe112⤵PID:4172
-
\??\c:\vvddv.exec:\vvddv.exe113⤵PID:3508
-
\??\c:\jdjpp.exec:\jdjpp.exe114⤵PID:3020
-
\??\c:\lrffxfx.exec:\lrffxfx.exe115⤵PID:1164
-
\??\c:\1ttnhh.exec:\1ttnhh.exe116⤵PID:2912
-
\??\c:\dpdpv.exec:\dpdpv.exe117⤵PID:2312
-
\??\c:\3ffxxxr.exec:\3ffxxxr.exe118⤵PID:1860
-
\??\c:\lflxrlx.exec:\lflxrlx.exe119⤵PID:3328
-
\??\c:\ntbthb.exec:\ntbthb.exe120⤵PID:1756
-
\??\c:\jjpvp.exec:\jjpvp.exe121⤵PID:1812
-
\??\c:\xllffff.exec:\xllffff.exe122⤵PID:1104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-