Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afca385949b9b86ac1e7281fcf17dd06d24969264e81960a8ee39608cb9807bcN.exe
Resource
win7-20240708-en
7 signatures
120 seconds
General
-
Target
afca385949b9b86ac1e7281fcf17dd06d24969264e81960a8ee39608cb9807bcN.exe
-
Size
453KB
-
MD5
6f3660785a4c6962e6f7dfcd83a37ec0
-
SHA1
ef0050719a52e41bc923286c8fef36f64d90f437
-
SHA256
afca385949b9b86ac1e7281fcf17dd06d24969264e81960a8ee39608cb9807bc
-
SHA512
1687b54dddb058b1bd1d7f2af5f14715e4e2d2c844c577d0f3b2b3907e8f1a2e42e236e5bfedd3583b8a765055ed2bf13a1eec42bdc6f421fc20614063f9b104
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3484-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-900-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-1048-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-1167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-1262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-1440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-1486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3832 ffrrflr.exe 916 pdjjj.exe 3476 dddvp.exe 2756 vvjpv.exe 212 tnnnnh.exe 3092 hbhnnt.exe 2052 nnhbht.exe 4020 7vdvp.exe 3756 rlxrlfx.exe 1540 jvjdd.exe 3152 7bnhbb.exe 2556 fxlrxxr.exe 5060 ntbbhh.exe 2004 vpdvv.exe 5040 tnthht.exe 3204 vjjdp.exe 4592 hbbtnn.exe 60 jvjjd.exe 1432 lffxlxf.exe 1704 jvpdv.exe 2232 fxfxxrl.exe 4972 9lrlrxl.exe 3680 bntnnn.exe 3432 jdvpd.exe 2600 hbbbbt.exe 3420 vddvj.exe 1000 tnbthh.exe 4900 7xrlfxr.exe 1984 bhnnnt.exe 4280 ppvpd.exe 4304 7flfrxr.exe 3608 djjdd.exe 1584 rxxrrxx.exe 2616 thnhbt.exe 1012 pjdvp.exe 4832 1llxllx.exe 4672 tbhhbb.exe 4164 dpjdp.exe 540 3rrrllf.exe 5076 bbnhbb.exe 3832 vjdvj.exe 5032 rxlrxfx.exe 4308 llfxrrl.exe 2540 tnhhbb.exe 3520 jpvpv.exe 3112 xrlfrxr.exe 1264 9nnbnh.exe 2324 tbhbnn.exe 3500 vjjvp.exe 4056 rlllrrl.exe 3936 1xxrrff.exe 5096 nntnbb.exe 4864 dpvpp.exe 1988 9xrlffx.exe 4512 1bbtnn.exe 2596 bttnnh.exe 4548 pjdpd.exe 2556 5lfrrrr.exe 4732 tnnthb.exe 640 5pjvj.exe 2004 rflfrrl.exe 3388 nhhhbb.exe 3216 dvvjd.exe 3676 llxlffr.exe -
resource yara_rule behavioral2/memory/3484-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-748-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3484 wrote to memory of 3832 3484 afca385949b9b86ac1e7281fcf17dd06d24969264e81960a8ee39608cb9807bcN.exe 83 PID 3484 wrote to memory of 3832 3484 afca385949b9b86ac1e7281fcf17dd06d24969264e81960a8ee39608cb9807bcN.exe 83 PID 3484 wrote to memory of 3832 3484 afca385949b9b86ac1e7281fcf17dd06d24969264e81960a8ee39608cb9807bcN.exe 83 PID 3832 wrote to memory of 916 3832 ffrrflr.exe 84 PID 3832 wrote to memory of 916 3832 ffrrflr.exe 84 PID 3832 wrote to memory of 916 3832 ffrrflr.exe 84 PID 916 wrote to memory of 3476 916 pdjjj.exe 85 PID 916 wrote to memory of 3476 916 pdjjj.exe 85 PID 916 wrote to memory of 3476 916 pdjjj.exe 85 PID 3476 wrote to memory of 2756 3476 dddvp.exe 86 PID 3476 wrote to memory of 2756 3476 dddvp.exe 86 PID 3476 wrote to memory of 2756 3476 dddvp.exe 86 PID 2756 wrote to memory of 212 2756 vvjpv.exe 87 PID 2756 wrote to memory of 212 2756 vvjpv.exe 87 PID 2756 wrote to memory of 212 2756 vvjpv.exe 87 PID 212 wrote to memory of 3092 212 tnnnnh.exe 88 PID 212 wrote to memory of 3092 212 tnnnnh.exe 88 PID 212 wrote to memory of 3092 212 tnnnnh.exe 88 PID 3092 wrote to memory of 2052 3092 hbhnnt.exe 89 PID 3092 wrote to memory of 2052 3092 hbhnnt.exe 89 PID 3092 wrote to memory of 2052 3092 hbhnnt.exe 89 PID 2052 wrote to memory of 4020 2052 nnhbht.exe 90 PID 2052 wrote to memory of 4020 2052 nnhbht.exe 90 PID 2052 wrote to memory of 4020 2052 nnhbht.exe 90 PID 4020 wrote to memory of 3756 4020 7vdvp.exe 91 PID 4020 wrote to memory of 3756 4020 7vdvp.exe 91 PID 4020 wrote to memory of 3756 4020 7vdvp.exe 91 PID 3756 wrote to memory of 1540 3756 rlxrlfx.exe 92 PID 3756 wrote to memory of 1540 3756 rlxrlfx.exe 92 PID 3756 wrote to memory of 1540 3756 rlxrlfx.exe 92 PID 1540 wrote to memory of 3152 1540 jvjdd.exe 93 PID 1540 wrote to memory of 3152 1540 jvjdd.exe 93 PID 1540 wrote to memory of 3152 1540 jvjdd.exe 93 PID 3152 wrote to memory of 2556 3152 7bnhbb.exe 94 PID 3152 wrote to memory of 2556 3152 7bnhbb.exe 94 PID 3152 wrote to memory of 2556 3152 7bnhbb.exe 94 PID 2556 wrote to memory of 5060 2556 fxlrxxr.exe 95 PID 2556 wrote to memory of 5060 2556 fxlrxxr.exe 95 PID 2556 wrote to memory of 5060 2556 fxlrxxr.exe 95 PID 5060 wrote to memory of 2004 5060 ntbbhh.exe 96 PID 5060 wrote to memory of 2004 5060 ntbbhh.exe 96 PID 5060 wrote to memory of 2004 5060 ntbbhh.exe 96 PID 2004 wrote to memory of 5040 2004 vpdvv.exe 97 PID 2004 wrote to memory of 5040 2004 vpdvv.exe 97 PID 2004 wrote to memory of 5040 2004 vpdvv.exe 97 PID 5040 wrote to memory of 3204 5040 tnthht.exe 98 PID 5040 wrote to memory of 3204 5040 tnthht.exe 98 PID 5040 wrote to memory of 3204 5040 tnthht.exe 98 PID 3204 wrote to memory of 4592 3204 vjjdp.exe 99 PID 3204 wrote to memory of 4592 3204 vjjdp.exe 99 PID 3204 wrote to memory of 4592 3204 vjjdp.exe 99 PID 4592 wrote to memory of 60 4592 hbbtnn.exe 100 PID 4592 wrote to memory of 60 4592 hbbtnn.exe 100 PID 4592 wrote to memory of 60 4592 hbbtnn.exe 100 PID 60 wrote to memory of 1432 60 jvjjd.exe 101 PID 60 wrote to memory of 1432 60 jvjjd.exe 101 PID 60 wrote to memory of 1432 60 jvjjd.exe 101 PID 1432 wrote to memory of 1704 1432 lffxlxf.exe 102 PID 1432 wrote to memory of 1704 1432 lffxlxf.exe 102 PID 1432 wrote to memory of 1704 1432 lffxlxf.exe 102 PID 1704 wrote to memory of 2232 1704 jvpdv.exe 103 PID 1704 wrote to memory of 2232 1704 jvpdv.exe 103 PID 1704 wrote to memory of 2232 1704 jvpdv.exe 103 PID 2232 wrote to memory of 4972 2232 fxfxxrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\afca385949b9b86ac1e7281fcf17dd06d24969264e81960a8ee39608cb9807bcN.exe"C:\Users\Admin\AppData\Local\Temp\afca385949b9b86ac1e7281fcf17dd06d24969264e81960a8ee39608cb9807bcN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\ffrrflr.exec:\ffrrflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\pdjjj.exec:\pdjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\dddvp.exec:\dddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\vvjpv.exec:\vvjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tnnnnh.exec:\tnnnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\hbhnnt.exec:\hbhnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\nnhbht.exec:\nnhbht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\7vdvp.exec:\7vdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\jvjdd.exec:\jvjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\7bnhbb.exec:\7bnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\fxlrxxr.exec:\fxlrxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\ntbbhh.exec:\ntbbhh.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\vpdvv.exec:\vpdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\tnthht.exec:\tnthht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\vjjdp.exec:\vjjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\hbbtnn.exec:\hbbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\jvjjd.exec:\jvjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\lffxlxf.exec:\lffxlxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\jvpdv.exec:\jvpdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\9lrlrxl.exec:\9lrlrxl.exe23⤵
- Executes dropped EXE
PID:4972 -
\??\c:\bntnnn.exec:\bntnnn.exe24⤵
- Executes dropped EXE
PID:3680 -
\??\c:\jdvpd.exec:\jdvpd.exe25⤵
- Executes dropped EXE
PID:3432 -
\??\c:\hbbbbt.exec:\hbbbbt.exe26⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vddvj.exec:\vddvj.exe27⤵
- Executes dropped EXE
PID:3420 -
\??\c:\tnbthh.exec:\tnbthh.exe28⤵
- Executes dropped EXE
PID:1000 -
\??\c:\7xrlfxr.exec:\7xrlfxr.exe29⤵
- Executes dropped EXE
PID:4900 -
\??\c:\bhnnnt.exec:\bhnnnt.exe30⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ppvpd.exec:\ppvpd.exe31⤵
- Executes dropped EXE
PID:4280 -
\??\c:\7flfrxr.exec:\7flfrxr.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4304 -
\??\c:\djjdd.exec:\djjdd.exe33⤵
- Executes dropped EXE
PID:3608 -
\??\c:\rxxrrxx.exec:\rxxrrxx.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\thnhbt.exec:\thnhbt.exe35⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pjdvp.exec:\pjdvp.exe36⤵
- Executes dropped EXE
PID:1012 -
\??\c:\1llxllx.exec:\1llxllx.exe37⤵
- Executes dropped EXE
PID:4832 -
\??\c:\tbhhbb.exec:\tbhhbb.exe38⤵
- Executes dropped EXE
PID:4672 -
\??\c:\dpjdp.exec:\dpjdp.exe39⤵
- Executes dropped EXE
PID:4164 -
\??\c:\3rrrllf.exec:\3rrrllf.exe40⤵
- Executes dropped EXE
PID:540 -
\??\c:\hbnbnh.exec:\hbnbnh.exe41⤵PID:4416
-
\??\c:\bbnhbb.exec:\bbnhbb.exe42⤵
- Executes dropped EXE
PID:5076 -
\??\c:\vjdvj.exec:\vjdvj.exe43⤵
- Executes dropped EXE
PID:3832 -
\??\c:\rxlrxfx.exec:\rxlrxfx.exe44⤵
- Executes dropped EXE
PID:5032 -
\??\c:\llfxrrl.exec:\llfxrrl.exe45⤵
- Executes dropped EXE
PID:4308 -
\??\c:\tnhhbb.exec:\tnhhbb.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jpvpv.exec:\jpvpv.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3520 -
\??\c:\xrlfrxr.exec:\xrlfrxr.exe48⤵
- Executes dropped EXE
PID:3112 -
\??\c:\9nnbnh.exec:\9nnbnh.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1264 -
\??\c:\tbhbnn.exec:\tbhbnn.exe50⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vjjvp.exec:\vjjvp.exe51⤵
- Executes dropped EXE
PID:3500 -
\??\c:\rlllrrl.exec:\rlllrrl.exe52⤵
- Executes dropped EXE
PID:4056 -
\??\c:\1xxrrff.exec:\1xxrrff.exe53⤵
- Executes dropped EXE
PID:3936 -
\??\c:\nntnbb.exec:\nntnbb.exe54⤵
- Executes dropped EXE
PID:5096 -
\??\c:\dpvpp.exec:\dpvpp.exe55⤵
- Executes dropped EXE
PID:4864 -
\??\c:\9xrlffx.exec:\9xrlffx.exe56⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1bbtnn.exec:\1bbtnn.exe57⤵
- Executes dropped EXE
PID:4512 -
\??\c:\bttnnh.exec:\bttnnh.exe58⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pjdpd.exec:\pjdpd.exe59⤵
- Executes dropped EXE
PID:4548 -
\??\c:\5lfrrrr.exec:\5lfrrrr.exe60⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tnnthb.exec:\tnnthb.exe61⤵
- Executes dropped EXE
PID:4732 -
\??\c:\5pjvj.exec:\5pjvj.exe62⤵
- Executes dropped EXE
PID:640 -
\??\c:\rflfrrl.exec:\rflfrrl.exe63⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nhhhbb.exec:\nhhhbb.exe64⤵
- Executes dropped EXE
PID:3388 -
\??\c:\dvvjd.exec:\dvvjd.exe65⤵
- Executes dropped EXE
PID:3216 -
\??\c:\llxlffr.exec:\llxlffr.exe66⤵
- Executes dropped EXE
PID:3676 -
\??\c:\9nbnhb.exec:\9nbnhb.exe67⤵PID:5080
-
\??\c:\7pdpd.exec:\7pdpd.exe68⤵PID:4592
-
\??\c:\dppdd.exec:\dppdd.exe69⤵PID:2372
-
\??\c:\fffxlff.exec:\fffxlff.exe70⤵PID:60
-
\??\c:\9bthbt.exec:\9bthbt.exe71⤵PID:1600
-
\??\c:\thhhbb.exec:\thhhbb.exe72⤵PID:1828
-
\??\c:\pvdpj.exec:\pvdpj.exe73⤵PID:4160
-
\??\c:\lfxxxrx.exec:\lfxxxrx.exe74⤵PID:372
-
\??\c:\lfffxxr.exec:\lfffxxr.exe75⤵PID:3660
-
\??\c:\bnbttn.exec:\bnbttn.exe76⤵PID:2232
-
\??\c:\1vvpp.exec:\1vvpp.exe77⤵PID:4764
-
\??\c:\rrlxxfx.exec:\rrlxxfx.exe78⤵PID:4908
-
\??\c:\bbhbtb.exec:\bbhbtb.exe79⤵PID:1512
-
\??\c:\pvdpd.exec:\pvdpd.exe80⤵PID:2396
-
\??\c:\3rrffxr.exec:\3rrffxr.exe81⤵PID:3220
-
\??\c:\hbnhtn.exec:\hbnhtn.exe82⤵PID:2600
-
\??\c:\jpvpv.exec:\jpvpv.exe83⤵PID:2352
-
\??\c:\9dvpj.exec:\9dvpj.exe84⤵PID:1452
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe85⤵PID:3396
-
\??\c:\1tnnbb.exec:\1tnnbb.exe86⤵PID:1944
-
\??\c:\ddvjj.exec:\ddvjj.exe87⤵PID:4900
-
\??\c:\5lxlfxl.exec:\5lxlfxl.exe88⤵PID:992
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe89⤵PID:1984
-
\??\c:\htbntn.exec:\htbntn.exe90⤵PID:4296
-
\??\c:\jdjjd.exec:\jdjjd.exe91⤵PID:4184
-
\??\c:\dpvvp.exec:\dpvvp.exe92⤵PID:512
-
\??\c:\xlrfxrr.exec:\xlrfxrr.exe93⤵PID:3176
-
\??\c:\bhhbtn.exec:\bhhbtn.exe94⤵PID:1960
-
\??\c:\jvvvp.exec:\jvvvp.exe95⤵PID:4084
-
\??\c:\fxlxxxf.exec:\fxlxxxf.exe96⤵PID:1636
-
\??\c:\frfxxrr.exec:\frfxxrr.exe97⤵PID:4504
-
\??\c:\hbhbnn.exec:\hbhbnn.exe98⤵PID:1340
-
\??\c:\jvvjv.exec:\jvvjv.exe99⤵PID:3460
-
\??\c:\lfffxlf.exec:\lfffxlf.exe100⤵PID:4440
-
\??\c:\xrxrllf.exec:\xrxrllf.exe101⤵PID:4588
-
\??\c:\5btnhb.exec:\5btnhb.exe102⤵PID:3872
-
\??\c:\jvvpv.exec:\jvvpv.exe103⤵PID:4192
-
\??\c:\ffxrffx.exec:\ffxrffx.exe104⤵PID:4300
-
\??\c:\rlllxxr.exec:\rlllxxr.exe105⤵PID:3528
-
\??\c:\9bbttn.exec:\9bbttn.exe106⤵PID:3672
-
\??\c:\vjpjv.exec:\vjpjv.exe107⤵PID:2936
-
\??\c:\frxrrll.exec:\frxrrll.exe108⤵PID:2736
-
\??\c:\7nhbnn.exec:\7nhbnn.exe109⤵PID:3868
-
\??\c:\5pjdp.exec:\5pjdp.exe110⤵
- System Location Discovery: System Language Discovery
PID:2756 -
\??\c:\llrrrlr.exec:\llrrrlr.exe111⤵PID:2040
-
\??\c:\xlxrxrr.exec:\xlxrxrr.exe112⤵PID:3092
-
\??\c:\pddvp.exec:\pddvp.exe113⤵PID:3500
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe114⤵PID:4056
-
\??\c:\rlxxxxr.exec:\rlxxxxr.exe115⤵PID:3168
-
\??\c:\bttbtb.exec:\bttbtb.exe116⤵PID:4500
-
\??\c:\jvpdj.exec:\jvpdj.exe117⤵PID:3408
-
\??\c:\rflfrrl.exec:\rflfrrl.exe118⤵PID:528
-
\??\c:\fffxfxl.exec:\fffxfxl.exe119⤵PID:1988
-
\??\c:\1hbttn.exec:\1hbttn.exe120⤵PID:2608
-
\??\c:\7jjdv.exec:\7jjdv.exe121⤵PID:4716
-
\??\c:\xxxlfxx.exec:\xxxlfxx.exe122⤵PID:4916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-