Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 05:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe
-
Size
454KB
-
MD5
f1426cf9be092473495d8cc67f88a96d
-
SHA1
010a9792407b5d3aedfae8b1b369532746abe0b4
-
SHA256
60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583
-
SHA512
443c001f7a7366a48d8dc0cb77128e56cd5b8dd3b849c872cb5737c319e29e2948dd707818c75d85f21ac7d69703ce69dbf70b47ab6b455d8ee81d4fa0af93bc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/320-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-933-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-1145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-1452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-1709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4924 xlrxfxl.exe 1248 thhtht.exe 968 1jdpd.exe 1676 jjpdv.exe 2256 nbnhhn.exe 4824 lrrlxll.exe 4052 9jdvp.exe 4220 nnnnnh.exe 3528 jvvjv.exe 1852 rfxxxxx.exe 948 thbnbt.exe 3980 jvpdp.exe 1888 5lfrlfx.exe 4776 nbbttn.exe 1148 jdpjd.exe 3972 pddpj.exe 3872 xxxlfrx.exe 4280 tnhbth.exe 2724 3vjvv.exe 3608 ttnbhb.exe 4972 dpvdv.exe 3896 vjjvj.exe 1704 llxxfll.exe 1428 1pdpj.exe 2536 3rfxlfr.exe 748 xflrlfx.exe 4580 1pvpj.exe 2324 xlllfxr.exe 2692 nnthbb.exe 64 thhbtn.exe 1612 vjdvj.exe 4372 fxrffxx.exe 1976 1nnhtn.exe 3460 dppjp.exe 4480 jddjd.exe 1472 7xrlrlr.exe 3524 3htnbt.exe 448 pvvjv.exe 2944 xffflrf.exe 1436 xrlfrlf.exe 1140 httnbt.exe 2516 vpppj.exe 2144 jjdpd.exe 1868 1rfxlxl.exe 4960 hnthbt.exe 2344 httthb.exe 5104 vvpvj.exe 3472 rlffxxx.exe 4752 frfxxrl.exe 3216 bnbnnh.exe 2404 vpvjd.exe 316 jjvpd.exe 436 frlfrlf.exe 5076 bhbtnh.exe 412 htbnbb.exe 4884 vjjvd.exe 4220 lllxrlr.exe 1492 1rlfrlf.exe 2380 btthbt.exe 1308 jvjpd.exe 1852 ddpdj.exe 3644 rlxrlxr.exe 812 ttthtn.exe 2080 nbthtn.exe -
resource yara_rule behavioral2/memory/320-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-602-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 320 wrote to memory of 4924 320 60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe 83 PID 320 wrote to memory of 4924 320 60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe 83 PID 320 wrote to memory of 4924 320 60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe 83 PID 4924 wrote to memory of 1248 4924 xlrxfxl.exe 84 PID 4924 wrote to memory of 1248 4924 xlrxfxl.exe 84 PID 4924 wrote to memory of 1248 4924 xlrxfxl.exe 84 PID 1248 wrote to memory of 968 1248 thhtht.exe 85 PID 1248 wrote to memory of 968 1248 thhtht.exe 85 PID 1248 wrote to memory of 968 1248 thhtht.exe 85 PID 968 wrote to memory of 1676 968 1jdpd.exe 86 PID 968 wrote to memory of 1676 968 1jdpd.exe 86 PID 968 wrote to memory of 1676 968 1jdpd.exe 86 PID 1676 wrote to memory of 2256 1676 jjpdv.exe 87 PID 1676 wrote to memory of 2256 1676 jjpdv.exe 87 PID 1676 wrote to memory of 2256 1676 jjpdv.exe 87 PID 2256 wrote to memory of 4824 2256 nbnhhn.exe 88 PID 2256 wrote to memory of 4824 2256 nbnhhn.exe 88 PID 2256 wrote to memory of 4824 2256 nbnhhn.exe 88 PID 4824 wrote to memory of 4052 4824 lrrlxll.exe 89 PID 4824 wrote to memory of 4052 4824 lrrlxll.exe 89 PID 4824 wrote to memory of 4052 4824 lrrlxll.exe 89 PID 4052 wrote to memory of 4220 4052 9jdvp.exe 90 PID 4052 wrote to memory of 4220 4052 9jdvp.exe 90 PID 4052 wrote to memory of 4220 4052 9jdvp.exe 90 PID 4220 wrote to memory of 3528 4220 nnnnnh.exe 91 PID 4220 wrote to memory of 3528 4220 nnnnnh.exe 91 PID 4220 wrote to memory of 3528 4220 nnnnnh.exe 91 PID 3528 wrote to memory of 1852 3528 jvvjv.exe 92 PID 3528 wrote to memory of 1852 3528 jvvjv.exe 92 PID 3528 wrote to memory of 1852 3528 jvvjv.exe 92 PID 1852 wrote to memory of 948 1852 rfxxxxx.exe 93 PID 1852 wrote to memory of 948 1852 rfxxxxx.exe 93 PID 1852 wrote to memory of 948 1852 rfxxxxx.exe 93 PID 948 wrote to memory of 3980 948 thbnbt.exe 94 PID 948 wrote to memory of 3980 948 thbnbt.exe 94 PID 948 wrote to memory of 3980 948 thbnbt.exe 94 PID 3980 wrote to memory of 1888 3980 jvpdp.exe 95 PID 3980 wrote to memory of 1888 3980 jvpdp.exe 95 PID 3980 wrote to memory of 1888 3980 jvpdp.exe 95 PID 1888 wrote to memory of 4776 1888 5lfrlfx.exe 96 PID 1888 wrote to memory of 4776 1888 5lfrlfx.exe 96 PID 1888 wrote to memory of 4776 1888 5lfrlfx.exe 96 PID 4776 wrote to memory of 1148 4776 nbbttn.exe 97 PID 4776 wrote to memory of 1148 4776 nbbttn.exe 97 PID 4776 wrote to memory of 1148 4776 nbbttn.exe 97 PID 1148 wrote to memory of 3972 1148 jdpjd.exe 98 PID 1148 wrote to memory of 3972 1148 jdpjd.exe 98 PID 1148 wrote to memory of 3972 1148 jdpjd.exe 98 PID 3972 wrote to memory of 3872 3972 pddpj.exe 99 PID 3972 wrote to memory of 3872 3972 pddpj.exe 99 PID 3972 wrote to memory of 3872 3972 pddpj.exe 99 PID 3872 wrote to memory of 4280 3872 xxxlfrx.exe 100 PID 3872 wrote to memory of 4280 3872 xxxlfrx.exe 100 PID 3872 wrote to memory of 4280 3872 xxxlfrx.exe 100 PID 4280 wrote to memory of 2724 4280 tnhbth.exe 101 PID 4280 wrote to memory of 2724 4280 tnhbth.exe 101 PID 4280 wrote to memory of 2724 4280 tnhbth.exe 101 PID 2724 wrote to memory of 3608 2724 3vjvv.exe 102 PID 2724 wrote to memory of 3608 2724 3vjvv.exe 102 PID 2724 wrote to memory of 3608 2724 3vjvv.exe 102 PID 3608 wrote to memory of 4972 3608 ttnbhb.exe 103 PID 3608 wrote to memory of 4972 3608 ttnbhb.exe 103 PID 3608 wrote to memory of 4972 3608 ttnbhb.exe 103 PID 4972 wrote to memory of 3896 4972 dpvdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe"C:\Users\Admin\AppData\Local\Temp\60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\xlrxfxl.exec:\xlrxfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\thhtht.exec:\thhtht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\1jdpd.exec:\1jdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\jjpdv.exec:\jjpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\nbnhhn.exec:\nbnhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\lrrlxll.exec:\lrrlxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\9jdvp.exec:\9jdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\nnnnnh.exec:\nnnnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\jvvjv.exec:\jvvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\thbnbt.exec:\thbnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\jvpdp.exec:\jvpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\5lfrlfx.exec:\5lfrlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\nbbttn.exec:\nbbttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\jdpjd.exec:\jdpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\pddpj.exec:\pddpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\xxxlfrx.exec:\xxxlfrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\tnhbth.exec:\tnhbth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\3vjvv.exec:\3vjvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\ttnbhb.exec:\ttnbhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\dpvdv.exec:\dpvdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\vjjvj.exec:\vjjvj.exe23⤵
- Executes dropped EXE
PID:3896 -
\??\c:\llxxfll.exec:\llxxfll.exe24⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1pdpj.exec:\1pdpj.exe25⤵
- Executes dropped EXE
PID:1428 -
\??\c:\3rfxlfr.exec:\3rfxlfr.exe26⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xflrlfx.exec:\xflrlfx.exe27⤵
- Executes dropped EXE
PID:748 -
\??\c:\1pvpj.exec:\1pvpj.exe28⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xlllfxr.exec:\xlllfxr.exe29⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nnthbb.exec:\nnthbb.exe30⤵
- Executes dropped EXE
PID:2692 -
\??\c:\thhbtn.exec:\thhbtn.exe31⤵
- Executes dropped EXE
PID:64 -
\??\c:\vjdvj.exec:\vjdvj.exe32⤵
- Executes dropped EXE
PID:1612 -
\??\c:\fxrffxx.exec:\fxrffxx.exe33⤵
- Executes dropped EXE
PID:4372 -
\??\c:\1nnhtn.exec:\1nnhtn.exe34⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dppjp.exec:\dppjp.exe35⤵
- Executes dropped EXE
PID:3460 -
\??\c:\jddjd.exec:\jddjd.exe36⤵
- Executes dropped EXE
PID:4480 -
\??\c:\7xrlrlr.exec:\7xrlrlr.exe37⤵
- Executes dropped EXE
PID:1472 -
\??\c:\3htnbt.exec:\3htnbt.exe38⤵
- Executes dropped EXE
PID:3524 -
\??\c:\pvvjv.exec:\pvvjv.exe39⤵
- Executes dropped EXE
PID:448 -
\??\c:\xffflrf.exec:\xffflrf.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe41⤵
- Executes dropped EXE
PID:1436 -
\??\c:\httnbt.exec:\httnbt.exe42⤵
- Executes dropped EXE
PID:1140 -
\??\c:\vpppj.exec:\vpppj.exe43⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jjdpd.exec:\jjdpd.exe44⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1rfxlxl.exec:\1rfxlxl.exe45⤵
- Executes dropped EXE
PID:1868 -
\??\c:\hnthbt.exec:\hnthbt.exe46⤵
- Executes dropped EXE
PID:4960 -
\??\c:\httthb.exec:\httthb.exe47⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vvpvj.exec:\vvpvj.exe48⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rlffxxx.exec:\rlffxxx.exe49⤵
- Executes dropped EXE
PID:3472 -
\??\c:\frfxxrl.exec:\frfxxrl.exe50⤵
- Executes dropped EXE
PID:4752 -
\??\c:\bnbnnh.exec:\bnbnnh.exe51⤵
- Executes dropped EXE
PID:3216 -
\??\c:\vpvjd.exec:\vpvjd.exe52⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jjvpd.exec:\jjvpd.exe53⤵
- Executes dropped EXE
PID:316 -
\??\c:\frlfrlf.exec:\frlfrlf.exe54⤵
- Executes dropped EXE
PID:436 -
\??\c:\bhbtnh.exec:\bhbtnh.exe55⤵
- Executes dropped EXE
PID:5076 -
\??\c:\htbnbb.exec:\htbnbb.exe56⤵
- Executes dropped EXE
PID:412 -
\??\c:\vjjvd.exec:\vjjvd.exe57⤵
- Executes dropped EXE
PID:4884 -
\??\c:\lllxrlr.exec:\lllxrlr.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4220 -
\??\c:\1rlfrlf.exec:\1rlfrlf.exe59⤵
- Executes dropped EXE
PID:1492 -
\??\c:\btthbt.exec:\btthbt.exe60⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jvjpd.exec:\jvjpd.exe61⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ddpdj.exec:\ddpdj.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rlxrlxr.exec:\rlxrlxr.exe63⤵
- Executes dropped EXE
PID:3644 -
\??\c:\ttthtn.exec:\ttthtn.exe64⤵
- Executes dropped EXE
PID:812 -
\??\c:\nbthtn.exec:\nbthtn.exe65⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pvvpd.exec:\pvvpd.exe66⤵PID:4120
-
\??\c:\flrllfx.exec:\flrllfx.exe67⤵PID:4976
-
\??\c:\nhnbth.exec:\nhnbth.exe68⤵PID:3396
-
\??\c:\btnhtn.exec:\btnhtn.exe69⤵PID:516
-
\??\c:\dpdvp.exec:\dpdvp.exe70⤵PID:2648
-
\??\c:\xlfrlxl.exec:\xlfrlxl.exe71⤵PID:228
-
\??\c:\lxxxlll.exec:\lxxxlll.exe72⤵PID:3904
-
\??\c:\nhnhhb.exec:\nhnhhb.exe73⤵PID:2700
-
\??\c:\1dpdj.exec:\1dpdj.exe74⤵PID:1304
-
\??\c:\xrlxxrr.exec:\xrlxxrr.exe75⤵PID:4772
-
\??\c:\hbhbnn.exec:\hbhbnn.exe76⤵PID:3092
-
\??\c:\9thbtn.exec:\9thbtn.exe77⤵PID:3600
-
\??\c:\dpvpv.exec:\dpvpv.exe78⤵PID:4600
-
\??\c:\lrrfrfx.exec:\lrrfrfx.exe79⤵PID:4104
-
\??\c:\nnnhbt.exec:\nnnhbt.exe80⤵PID:5036
-
\??\c:\5jdvj.exec:\5jdvj.exe81⤵PID:1780
-
\??\c:\rflfrfl.exec:\rflfrfl.exe82⤵PID:4460
-
\??\c:\hthhhh.exec:\hthhhh.exe83⤵PID:4524
-
\??\c:\dpvpj.exec:\dpvpj.exe84⤵PID:1668
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe85⤵PID:2252
-
\??\c:\hbtbnt.exec:\hbtbnt.exe86⤵PID:5072
-
\??\c:\thhthb.exec:\thhthb.exe87⤵PID:2980
-
\??\c:\vppdp.exec:\vppdp.exe88⤵PID:2948
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe89⤵PID:1600
-
\??\c:\1tnhtt.exec:\1tnhtt.exe90⤵PID:1484
-
\??\c:\nbbnhb.exec:\nbbnhb.exe91⤵PID:64
-
\??\c:\ddjdp.exec:\ddjdp.exe92⤵PID:2716
-
\??\c:\rrxrfxx.exec:\rrxrfxx.exe93⤵PID:4372
-
\??\c:\lxxlfrx.exec:\lxxlfrx.exe94⤵PID:4336
-
\??\c:\httthb.exec:\httthb.exe95⤵PID:116
-
\??\c:\nbbtbb.exec:\nbbtbb.exe96⤵PID:4916
-
\??\c:\ddvjv.exec:\ddvjv.exe97⤵PID:4712
-
\??\c:\lrrflff.exec:\lrrflff.exe98⤵PID:1784
-
\??\c:\httnbt.exec:\httnbt.exe99⤵PID:4240
-
\??\c:\jjvpp.exec:\jjvpp.exe100⤵PID:396
-
\??\c:\dvpdp.exec:\dvpdp.exe101⤵PID:4736
-
\??\c:\frxrffx.exec:\frxrffx.exe102⤵PID:464
-
\??\c:\nhhtnh.exec:\nhhtnh.exe103⤵PID:320
-
\??\c:\jppdp.exec:\jppdp.exe104⤵PID:2516
-
\??\c:\jdpjp.exec:\jdpjp.exe105⤵PID:2144
-
\??\c:\frxxxrr.exec:\frxxxrr.exe106⤵PID:3140
-
\??\c:\hnnbnh.exec:\hnnbnh.exe107⤵PID:4960
-
\??\c:\jppjd.exec:\jppjd.exe108⤵PID:2352
-
\??\c:\7dvpj.exec:\7dvpj.exe109⤵PID:1412
-
\??\c:\3lxlllr.exec:\3lxlllr.exe110⤵PID:1676
-
\??\c:\nbbtnh.exec:\nbbtnh.exe111⤵PID:2592
-
\??\c:\hnhbtt.exec:\hnhbtt.exe112⤵PID:1548
-
\??\c:\vppjd.exec:\vppjd.exe113⤵PID:3628
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe114⤵PID:3400
-
\??\c:\bnnbnh.exec:\bnnbnh.exe115⤵PID:2044
-
\??\c:\jpvvp.exec:\jpvvp.exe116⤵PID:2264
-
\??\c:\dvjpj.exec:\dvjpj.exe117⤵PID:2272
-
\??\c:\rrxlrlx.exec:\rrxlrlx.exe118⤵PID:4360
-
\??\c:\bttnnb.exec:\bttnnb.exe119⤵PID:1840
-
\??\c:\hbthnt.exec:\hbthnt.exe120⤵PID:1908
-
\??\c:\ppvjd.exec:\ppvjd.exe121⤵PID:5116
-
\??\c:\rffxllf.exec:\rffxllf.exe122⤵PID:1236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-