Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe
-
Size
454KB
-
MD5
da27a22e9d021dc88eb035827cb25c00
-
SHA1
6b5dcf10afd9190bcaacacd7c32943d65dc5e716
-
SHA256
4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850a
-
SHA512
0558ec6eed5817b289b717c119460deade101512d593bee1ceb740ae4fe08d2ed1eaa6183de867b27f55ff82b4466a8deb26ad48ae2556ca39750ee0cdb33623
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2056-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-891-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-1179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1572 rrfffll.exe 4308 xxxxxxx.exe 2896 jdddd.exe 2104 nhtnnn.exe 1632 5pvpj.exe 4364 bhnhtt.exe 3796 rffxfxf.exe 1152 vvddp.exe 1460 5vjdp.exe 3304 pjdvv.exe 4764 pppdd.exe 980 hnbbbh.exe 2904 fxxxfff.exe 2804 llrrrrr.exe 5064 dvjdd.exe 4264 thbbbb.exe 3012 jjvpv.exe 2824 llrxflf.exe 3640 lxlfxxx.exe 5092 5rfflrl.exe 4392 vvvpv.exe 5036 xrfffll.exe 3516 thnbtn.exe 4916 lrxrlfx.exe 4744 nbhhhn.exe 4132 9lrlxxr.exe 4072 3bhnnt.exe 2208 rlfffff.exe 3680 vpvvv.exe 2500 tnttnt.exe 2760 rrxrllf.exe 3480 bbbbbh.exe 4708 jdvvj.exe 1272 bbhbtb.exe 3184 vjjdv.exe 1576 djpvp.exe 1796 xlxxlll.exe 2448 1tnhhh.exe 1984 pvddv.exe 3100 pdvpp.exe 4052 5llxrlf.exe 1612 1nnbbb.exe 1492 dpvpd.exe 1844 llxrllf.exe 2756 nhhhbb.exe 4196 jpdvp.exe 3992 frfffff.exe 3220 xxlrlrl.exe 684 1btttt.exe 4456 djppd.exe 440 llxlffx.exe 3608 bthhhn.exe 2552 djppd.exe 3636 5flxrlf.exe 1304 hnhnnt.exe 4524 vvvvp.exe 4308 rrxfffl.exe 4564 ntntnn.exe 4528 ddppd.exe 2700 xlxrrxx.exe 2104 nntttb.exe 1472 nhhbhb.exe 4464 pvjjp.exe 1700 rrxxxrr.exe -
resource yara_rule behavioral2/memory/2056-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-771-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 1572 2056 4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe 82 PID 2056 wrote to memory of 1572 2056 4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe 82 PID 2056 wrote to memory of 1572 2056 4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe 82 PID 1572 wrote to memory of 4308 1572 rrfffll.exe 83 PID 1572 wrote to memory of 4308 1572 rrfffll.exe 83 PID 1572 wrote to memory of 4308 1572 rrfffll.exe 83 PID 4308 wrote to memory of 2896 4308 xxxxxxx.exe 84 PID 4308 wrote to memory of 2896 4308 xxxxxxx.exe 84 PID 4308 wrote to memory of 2896 4308 xxxxxxx.exe 84 PID 2896 wrote to memory of 2104 2896 jdddd.exe 85 PID 2896 wrote to memory of 2104 2896 jdddd.exe 85 PID 2896 wrote to memory of 2104 2896 jdddd.exe 85 PID 2104 wrote to memory of 1632 2104 nhtnnn.exe 86 PID 2104 wrote to memory of 1632 2104 nhtnnn.exe 86 PID 2104 wrote to memory of 1632 2104 nhtnnn.exe 86 PID 1632 wrote to memory of 4364 1632 5pvpj.exe 87 PID 1632 wrote to memory of 4364 1632 5pvpj.exe 87 PID 1632 wrote to memory of 4364 1632 5pvpj.exe 87 PID 4364 wrote to memory of 3796 4364 bhnhtt.exe 88 PID 4364 wrote to memory of 3796 4364 bhnhtt.exe 88 PID 4364 wrote to memory of 3796 4364 bhnhtt.exe 88 PID 3796 wrote to memory of 1152 3796 rffxfxf.exe 89 PID 3796 wrote to memory of 1152 3796 rffxfxf.exe 89 PID 3796 wrote to memory of 1152 3796 rffxfxf.exe 89 PID 1152 wrote to memory of 1460 1152 vvddp.exe 90 PID 1152 wrote to memory of 1460 1152 vvddp.exe 90 PID 1152 wrote to memory of 1460 1152 vvddp.exe 90 PID 1460 wrote to memory of 3304 1460 5vjdp.exe 91 PID 1460 wrote to memory of 3304 1460 5vjdp.exe 91 PID 1460 wrote to memory of 3304 1460 5vjdp.exe 91 PID 3304 wrote to memory of 4764 3304 pjdvv.exe 92 PID 3304 wrote to memory of 4764 3304 pjdvv.exe 92 PID 3304 wrote to memory of 4764 3304 pjdvv.exe 92 PID 4764 wrote to memory of 980 4764 pppdd.exe 93 PID 4764 wrote to memory of 980 4764 pppdd.exe 93 PID 4764 wrote to memory of 980 4764 pppdd.exe 93 PID 980 wrote to memory of 2904 980 hnbbbh.exe 94 PID 980 wrote to memory of 2904 980 hnbbbh.exe 94 PID 980 wrote to memory of 2904 980 hnbbbh.exe 94 PID 2904 wrote to memory of 2804 2904 fxxxfff.exe 95 PID 2904 wrote to memory of 2804 2904 fxxxfff.exe 95 PID 2904 wrote to memory of 2804 2904 fxxxfff.exe 95 PID 2804 wrote to memory of 5064 2804 llrrrrr.exe 96 PID 2804 wrote to memory of 5064 2804 llrrrrr.exe 96 PID 2804 wrote to memory of 5064 2804 llrrrrr.exe 96 PID 5064 wrote to memory of 4264 5064 dvjdd.exe 97 PID 5064 wrote to memory of 4264 5064 dvjdd.exe 97 PID 5064 wrote to memory of 4264 5064 dvjdd.exe 97 PID 4264 wrote to memory of 3012 4264 thbbbb.exe 98 PID 4264 wrote to memory of 3012 4264 thbbbb.exe 98 PID 4264 wrote to memory of 3012 4264 thbbbb.exe 98 PID 3012 wrote to memory of 2824 3012 jjvpv.exe 99 PID 3012 wrote to memory of 2824 3012 jjvpv.exe 99 PID 3012 wrote to memory of 2824 3012 jjvpv.exe 99 PID 2824 wrote to memory of 3640 2824 llrxflf.exe 100 PID 2824 wrote to memory of 3640 2824 llrxflf.exe 100 PID 2824 wrote to memory of 3640 2824 llrxflf.exe 100 PID 3640 wrote to memory of 5092 3640 lxlfxxx.exe 101 PID 3640 wrote to memory of 5092 3640 lxlfxxx.exe 101 PID 3640 wrote to memory of 5092 3640 lxlfxxx.exe 101 PID 5092 wrote to memory of 4392 5092 5rfflrl.exe 102 PID 5092 wrote to memory of 4392 5092 5rfflrl.exe 102 PID 5092 wrote to memory of 4392 5092 5rfflrl.exe 102 PID 4392 wrote to memory of 5036 4392 vvvpv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe"C:\Users\Admin\AppData\Local\Temp\4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\rrfffll.exec:\rrfffll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\jdddd.exec:\jdddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\nhtnnn.exec:\nhtnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\5pvpj.exec:\5pvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\bhnhtt.exec:\bhnhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\rffxfxf.exec:\rffxfxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\vvddp.exec:\vvddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\5vjdp.exec:\5vjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\pjdvv.exec:\pjdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\pppdd.exec:\pppdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\hnbbbh.exec:\hnbbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\fxxxfff.exec:\fxxxfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\llrrrrr.exec:\llrrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\dvjdd.exec:\dvjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\thbbbb.exec:\thbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\jjvpv.exec:\jjvpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\llrxflf.exec:\llrxflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\5rfflrl.exec:\5rfflrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\vvvpv.exec:\vvvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\xrfffll.exec:\xrfffll.exe23⤵
- Executes dropped EXE
PID:5036 -
\??\c:\thnbtn.exec:\thnbtn.exe24⤵
- Executes dropped EXE
PID:3516 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe25⤵
- Executes dropped EXE
PID:4916 -
\??\c:\nbhhhn.exec:\nbhhhn.exe26⤵
- Executes dropped EXE
PID:4744 -
\??\c:\9lrlxxr.exec:\9lrlxxr.exe27⤵
- Executes dropped EXE
PID:4132 -
\??\c:\3bhnnt.exec:\3bhnnt.exe28⤵
- Executes dropped EXE
PID:4072 -
\??\c:\rlfffff.exec:\rlfffff.exe29⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vpvvv.exec:\vpvvv.exe30⤵
- Executes dropped EXE
PID:3680 -
\??\c:\tnttnt.exec:\tnttnt.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rrxrllf.exec:\rrxrllf.exe32⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bbbbbh.exec:\bbbbbh.exe33⤵
- Executes dropped EXE
PID:3480 -
\??\c:\jdvvj.exec:\jdvvj.exe34⤵
- Executes dropped EXE
PID:4708 -
\??\c:\bbhbtb.exec:\bbhbtb.exe35⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vjjdv.exec:\vjjdv.exe36⤵
- Executes dropped EXE
PID:3184 -
\??\c:\djpvp.exec:\djpvp.exe37⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xlxxlll.exec:\xlxxlll.exe38⤵
- Executes dropped EXE
PID:1796 -
\??\c:\1tnhhh.exec:\1tnhhh.exe39⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pvddv.exec:\pvddv.exe40⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pdvpp.exec:\pdvpp.exe41⤵
- Executes dropped EXE
PID:3100 -
\??\c:\5llxrlf.exec:\5llxrlf.exe42⤵
- Executes dropped EXE
PID:4052 -
\??\c:\1nnbbb.exec:\1nnbbb.exe43⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dpvpd.exec:\dpvpd.exe44⤵
- Executes dropped EXE
PID:1492 -
\??\c:\llxrllf.exec:\llxrllf.exe45⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nhhhbb.exec:\nhhhbb.exe46⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jpdvp.exec:\jpdvp.exe47⤵
- Executes dropped EXE
PID:4196 -
\??\c:\frfffff.exec:\frfffff.exe48⤵
- Executes dropped EXE
PID:3992 -
\??\c:\xxlrlrl.exec:\xxlrlrl.exe49⤵
- Executes dropped EXE
PID:3220 -
\??\c:\1btttt.exec:\1btttt.exe50⤵
- Executes dropped EXE
PID:684 -
\??\c:\djppd.exec:\djppd.exe51⤵
- Executes dropped EXE
PID:4456 -
\??\c:\llxlffx.exec:\llxlffx.exe52⤵
- Executes dropped EXE
PID:440 -
\??\c:\bthhhn.exec:\bthhhn.exe53⤵
- Executes dropped EXE
PID:3608 -
\??\c:\djppd.exec:\djppd.exe54⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5flxrlf.exec:\5flxrlf.exe55⤵
- Executes dropped EXE
PID:3636 -
\??\c:\hnhnnt.exec:\hnhnnt.exe56⤵
- Executes dropped EXE
PID:1304 -
\??\c:\vvvvp.exec:\vvvvp.exe57⤵
- Executes dropped EXE
PID:4524 -
\??\c:\rrxfffl.exec:\rrxfffl.exe58⤵
- Executes dropped EXE
PID:4308 -
\??\c:\ntntnn.exec:\ntntnn.exe59⤵
- Executes dropped EXE
PID:4564 -
\??\c:\ddppd.exec:\ddppd.exe60⤵
- Executes dropped EXE
PID:4528 -
\??\c:\xlxrrxx.exec:\xlxrrxx.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700 -
\??\c:\nntttb.exec:\nntttb.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nhhbhb.exec:\nhhbhb.exe63⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pvjjp.exec:\pvjjp.exe64⤵
- Executes dropped EXE
PID:4464 -
\??\c:\rrxxxrr.exec:\rrxxxrr.exe65⤵
- Executes dropped EXE
PID:1700 -
\??\c:\bbbbtn.exec:\bbbbtn.exe66⤵PID:2712
-
\??\c:\jvjvp.exec:\jvjvp.exe67⤵PID:1396
-
\??\c:\frlffxr.exec:\frlffxr.exe68⤵PID:4952
-
\??\c:\tnbtbb.exec:\tnbtbb.exe69⤵PID:1548
-
\??\c:\3jjdp.exec:\3jjdp.exe70⤵PID:4548
-
\??\c:\dvdpp.exec:\dvdpp.exe71⤵PID:1936
-
\??\c:\9llfxlf.exec:\9llfxlf.exe72⤵PID:1580
-
\??\c:\hhtthn.exec:\hhtthn.exe73⤵PID:2028
-
\??\c:\vvdvp.exec:\vvdvp.exe74⤵PID:3844
-
\??\c:\lfrfxxx.exec:\lfrfxxx.exe75⤵PID:740
-
\??\c:\1bhhhn.exec:\1bhhhn.exe76⤵PID:1212
-
\??\c:\7pppp.exec:\7pppp.exe77⤵PID:3104
-
\??\c:\frxxxxx.exec:\frxxxxx.exe78⤵PID:3940
-
\??\c:\xfrxxxr.exec:\xfrxxxr.exe79⤵PID:3132
-
\??\c:\thnttb.exec:\thnttb.exe80⤵PID:336
-
\??\c:\jjjvv.exec:\jjjvv.exe81⤵PID:3836
-
\??\c:\xxllfxx.exec:\xxllfxx.exe82⤵PID:776
-
\??\c:\nnttnn.exec:\nnttnn.exe83⤵PID:2096
-
\??\c:\tnbbbb.exec:\tnbbbb.exe84⤵PID:3260
-
\??\c:\dppdv.exec:\dppdv.exe85⤵PID:2396
-
\??\c:\frxrlrr.exec:\frxrlrr.exe86⤵PID:2536
-
\??\c:\rrfffff.exec:\rrfffff.exe87⤵PID:5036
-
\??\c:\hthbhh.exec:\hthbhh.exe88⤵
- System Location Discovery: System Language Discovery
PID:3516 -
\??\c:\pvvpj.exec:\pvvpj.exe89⤵PID:3064
-
\??\c:\rlrllff.exec:\rlrllff.exe90⤵PID:452
-
\??\c:\bthhbb.exec:\bthhbb.exe91⤵PID:5028
-
\??\c:\vdpvv.exec:\vdpvv.exe92⤵PID:4468
-
\??\c:\frxrlrx.exec:\frxrlrx.exe93⤵PID:4428
-
\??\c:\hbnhth.exec:\hbnhth.exe94⤵PID:4200
-
\??\c:\thtnnn.exec:\thtnnn.exe95⤵PID:3576
-
\??\c:\jdppp.exec:\jdppp.exe96⤵PID:2512
-
\??\c:\9lrrllf.exec:\9lrrllf.exe97⤵PID:4144
-
\??\c:\tthhhb.exec:\tthhhb.exe98⤵PID:3932
-
\??\c:\bnnbtn.exec:\bnnbtn.exe99⤵PID:4056
-
\??\c:\5jppv.exec:\5jppv.exe100⤵PID:2024
-
\??\c:\llrrfll.exec:\llrrfll.exe101⤵PID:4708
-
\??\c:\hbnhnt.exec:\hbnhnt.exe102⤵PID:3176
-
\??\c:\jdpjj.exec:\jdpjj.exe103⤵PID:1348
-
\??\c:\pvdvv.exec:\pvdvv.exe104⤵PID:1576
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe105⤵PID:1796
-
\??\c:\nhttbh.exec:\nhttbh.exe106⤵PID:2448
-
\??\c:\vjvpj.exec:\vjvpj.exe107⤵PID:1984
-
\??\c:\fxlllll.exec:\fxlllll.exe108⤵PID:3396
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe109⤵PID:4052
-
\??\c:\bntnbb.exec:\bntnbb.exe110⤵PID:5088
-
\??\c:\dvjdd.exec:\dvjdd.exe111⤵PID:1492
-
\??\c:\rlflrrx.exec:\rlflrrx.exe112⤵PID:1844
-
\??\c:\nthnnt.exec:\nthnnt.exe113⤵PID:2756
-
\??\c:\djvpp.exec:\djvpp.exe114⤵PID:4196
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe115⤵PID:2256
-
\??\c:\tnhtbh.exec:\tnhtbh.exe116⤵PID:2580
-
\??\c:\vpddp.exec:\vpddp.exe117⤵PID:1464
-
\??\c:\vvjjp.exec:\vvjjp.exe118⤵PID:2428
-
\??\c:\lxffxff.exec:\lxffxff.exe119⤵PID:3564
-
\??\c:\5tnbhh.exec:\5tnbhh.exe120⤵PID:3908
-
\??\c:\nhttnh.exec:\nhttnh.exe121⤵PID:2016
-
\??\c:\1djjd.exec:\1djjd.exe122⤵PID:3636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-