Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe
-
Size
454KB
-
MD5
b087cf0ec6733def35c4b347025dc11a
-
SHA1
f6f37a337fab92ea307f045d9f8775338db69c77
-
SHA256
de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259
-
SHA512
2ba78708aac82a4be078524666df115ed5710943a2e6a6b0dbfe8423d3b3888ef5e29b5420f564d9103a2efc6e3740c5a607072b10c2078a22af896539189902
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex:q7Tc2NYHUrAwfMp3CDx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4456-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/820-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-1365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-1814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3644 fxxxflr.exe 820 thbttb.exe 4020 pjvvv.exe 2932 lfrxxff.exe 3036 dpjpv.exe 2236 xxfllll.exe 3496 jpvdd.exe 1760 tnbhnt.exe 3984 pvvdj.exe 4952 hnnhnn.exe 4968 nbbhbt.exe 4312 ppjvd.exe 2296 ppvdj.exe 3624 xrlxfxx.exe 2624 tnhhnt.exe 4176 pvjpv.exe 3328 llxxflr.exe 2688 htbnbh.exe 4212 5xfllxf.exe 4636 xxfflrx.exe 4464 llrrlxx.exe 3024 dvddd.exe 4600 nnnnnn.exe 4940 lxlfrrl.exe 1964 5xxllrl.exe 540 nhttbh.exe 4516 vjppv.exe 1512 xrfflrl.exe 2040 5jvpd.exe 1424 rlfrrxf.exe 4232 ppvvp.exe 1352 jdjjj.exe 2592 tntttb.exe 3992 jjvdd.exe 1108 llrflrx.exe 1912 nntttb.exe 4184 5jvvv.exe 3232 1xlllxx.exe 4808 bhnnbt.exe 4544 dpvvp.exe 3908 xlrrrxx.exe 456 vjddj.exe 4320 ffllxxl.exe 4304 bthbhn.exe 3748 jpjdp.exe 3988 xxxrrrr.exe 1896 bhnhht.exe 1548 djvdj.exe 1864 xlrlffr.exe 2500 nhhbnn.exe 2932 vdppd.exe 3508 hnthhh.exe 3132 ppvpj.exe 2388 flxxxff.exe 3496 bnnnnt.exe 1832 jvjdv.exe 3004 xfrxxxf.exe 3172 thnbnh.exe 2112 1rlxxfx.exe 1824 tnnnbb.exe 632 vjvvp.exe 4312 3lrrxfx.exe 2372 hthhnt.exe 3300 jdpjj.exe -
resource yara_rule behavioral2/memory/4456-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/820-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-706-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 3644 4456 de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe 82 PID 4456 wrote to memory of 3644 4456 de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe 82 PID 4456 wrote to memory of 3644 4456 de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe 82 PID 3644 wrote to memory of 820 3644 fxxxflr.exe 83 PID 3644 wrote to memory of 820 3644 fxxxflr.exe 83 PID 3644 wrote to memory of 820 3644 fxxxflr.exe 83 PID 820 wrote to memory of 4020 820 thbttb.exe 84 PID 820 wrote to memory of 4020 820 thbttb.exe 84 PID 820 wrote to memory of 4020 820 thbttb.exe 84 PID 4020 wrote to memory of 2932 4020 pjvvv.exe 85 PID 4020 wrote to memory of 2932 4020 pjvvv.exe 85 PID 4020 wrote to memory of 2932 4020 pjvvv.exe 85 PID 2932 wrote to memory of 3036 2932 lfrxxff.exe 86 PID 2932 wrote to memory of 3036 2932 lfrxxff.exe 86 PID 2932 wrote to memory of 3036 2932 lfrxxff.exe 86 PID 3036 wrote to memory of 2236 3036 dpjpv.exe 87 PID 3036 wrote to memory of 2236 3036 dpjpv.exe 87 PID 3036 wrote to memory of 2236 3036 dpjpv.exe 87 PID 2236 wrote to memory of 3496 2236 xxfllll.exe 88 PID 2236 wrote to memory of 3496 2236 xxfllll.exe 88 PID 2236 wrote to memory of 3496 2236 xxfllll.exe 88 PID 3496 wrote to memory of 1760 3496 jpvdd.exe 89 PID 3496 wrote to memory of 1760 3496 jpvdd.exe 89 PID 3496 wrote to memory of 1760 3496 jpvdd.exe 89 PID 1760 wrote to memory of 3984 1760 tnbhnt.exe 90 PID 1760 wrote to memory of 3984 1760 tnbhnt.exe 90 PID 1760 wrote to memory of 3984 1760 tnbhnt.exe 90 PID 3984 wrote to memory of 4952 3984 pvvdj.exe 91 PID 3984 wrote to memory of 4952 3984 pvvdj.exe 91 PID 3984 wrote to memory of 4952 3984 pvvdj.exe 91 PID 4952 wrote to memory of 4968 4952 hnnhnn.exe 92 PID 4952 wrote to memory of 4968 4952 hnnhnn.exe 92 PID 4952 wrote to memory of 4968 4952 hnnhnn.exe 92 PID 4968 wrote to memory of 4312 4968 nbbhbt.exe 93 PID 4968 wrote to memory of 4312 4968 nbbhbt.exe 93 PID 4968 wrote to memory of 4312 4968 nbbhbt.exe 93 PID 4312 wrote to memory of 2296 4312 ppjvd.exe 94 PID 4312 wrote to memory of 2296 4312 ppjvd.exe 94 PID 4312 wrote to memory of 2296 4312 ppjvd.exe 94 PID 2296 wrote to memory of 3624 2296 ppvdj.exe 95 PID 2296 wrote to memory of 3624 2296 ppvdj.exe 95 PID 2296 wrote to memory of 3624 2296 ppvdj.exe 95 PID 3624 wrote to memory of 2624 3624 xrlxfxx.exe 96 PID 3624 wrote to memory of 2624 3624 xrlxfxx.exe 96 PID 3624 wrote to memory of 2624 3624 xrlxfxx.exe 96 PID 2624 wrote to memory of 4176 2624 tnhhnt.exe 97 PID 2624 wrote to memory of 4176 2624 tnhhnt.exe 97 PID 2624 wrote to memory of 4176 2624 tnhhnt.exe 97 PID 4176 wrote to memory of 3328 4176 pvjpv.exe 98 PID 4176 wrote to memory of 3328 4176 pvjpv.exe 98 PID 4176 wrote to memory of 3328 4176 pvjpv.exe 98 PID 3328 wrote to memory of 2688 3328 llxxflr.exe 99 PID 3328 wrote to memory of 2688 3328 llxxflr.exe 99 PID 3328 wrote to memory of 2688 3328 llxxflr.exe 99 PID 2688 wrote to memory of 4212 2688 htbnbh.exe 100 PID 2688 wrote to memory of 4212 2688 htbnbh.exe 100 PID 2688 wrote to memory of 4212 2688 htbnbh.exe 100 PID 4212 wrote to memory of 4636 4212 5xfllxf.exe 101 PID 4212 wrote to memory of 4636 4212 5xfllxf.exe 101 PID 4212 wrote to memory of 4636 4212 5xfllxf.exe 101 PID 4636 wrote to memory of 4464 4636 xxfflrx.exe 102 PID 4636 wrote to memory of 4464 4636 xxfflrx.exe 102 PID 4636 wrote to memory of 4464 4636 xxfflrx.exe 102 PID 4464 wrote to memory of 3024 4464 llrrlxx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe"C:\Users\Admin\AppData\Local\Temp\de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\fxxxflr.exec:\fxxxflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\thbttb.exec:\thbttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\pjvvv.exec:\pjvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\lfrxxff.exec:\lfrxxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dpjpv.exec:\dpjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\xxfllll.exec:\xxfllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\jpvdd.exec:\jpvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\tnbhnt.exec:\tnbhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\pvvdj.exec:\pvvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\hnnhnn.exec:\hnnhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\nbbhbt.exec:\nbbhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\ppjvd.exec:\ppjvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\ppvdj.exec:\ppvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\xrlxfxx.exec:\xrlxfxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\tnhhnt.exec:\tnhhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pvjpv.exec:\pvjpv.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\llxxflr.exec:\llxxflr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\htbnbh.exec:\htbnbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\5xfllxf.exec:\5xfllxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\xxfflrx.exec:\xxfflrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\llrrlxx.exec:\llrrlxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\dvddd.exec:\dvddd.exe23⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nnnnnn.exec:\nnnnnn.exe24⤵
- Executes dropped EXE
PID:4600 -
\??\c:\lxlfrrl.exec:\lxlfrrl.exe25⤵
- Executes dropped EXE
PID:4940 -
\??\c:\5xxllrl.exec:\5xxllrl.exe26⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhttbh.exec:\nhttbh.exe27⤵
- Executes dropped EXE
PID:540 -
\??\c:\vjppv.exec:\vjppv.exe28⤵
- Executes dropped EXE
PID:4516 -
\??\c:\xrfflrl.exec:\xrfflrl.exe29⤵
- Executes dropped EXE
PID:1512 -
\??\c:\5jvpd.exec:\5jvpd.exe30⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rlfrrxf.exec:\rlfrrxf.exe31⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ppvvp.exec:\ppvvp.exe32⤵
- Executes dropped EXE
PID:4232 -
\??\c:\jdjjj.exec:\jdjjj.exe33⤵
- Executes dropped EXE
PID:1352 -
\??\c:\tntttb.exec:\tntttb.exe34⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jjvdd.exec:\jjvdd.exe35⤵
- Executes dropped EXE
PID:3992 -
\??\c:\llrflrx.exec:\llrflrx.exe36⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nntttb.exec:\nntttb.exe37⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5jvvv.exec:\5jvvv.exe38⤵
- Executes dropped EXE
PID:4184 -
\??\c:\1xlllxx.exec:\1xlllxx.exe39⤵
- Executes dropped EXE
PID:3232 -
\??\c:\bhnnbt.exec:\bhnnbt.exe40⤵
- Executes dropped EXE
PID:4808 -
\??\c:\dpvvp.exec:\dpvvp.exe41⤵
- Executes dropped EXE
PID:4544 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe42⤵
- Executes dropped EXE
PID:3908 -
\??\c:\vjddj.exec:\vjddj.exe43⤵
- Executes dropped EXE
PID:456 -
\??\c:\ffllxxl.exec:\ffllxxl.exe44⤵
- Executes dropped EXE
PID:4320 -
\??\c:\bthbhn.exec:\bthbhn.exe45⤵
- Executes dropped EXE
PID:4304 -
\??\c:\jpjdp.exec:\jpjdp.exe46⤵
- Executes dropped EXE
PID:3748 -
\??\c:\xxxrrrr.exec:\xxxrrrr.exe47⤵
- Executes dropped EXE
PID:3988 -
\??\c:\bhnhht.exec:\bhnhht.exe48⤵
- Executes dropped EXE
PID:1896 -
\??\c:\djvdj.exec:\djvdj.exe49⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xlrlffr.exec:\xlrlffr.exe50⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nhhbnn.exec:\nhhbnn.exe51⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vdppd.exec:\vdppd.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hnthhh.exec:\hnthhh.exe53⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ppvpj.exec:\ppvpj.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3132 -
\??\c:\flxxxff.exec:\flxxxff.exe55⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bnnnnt.exec:\bnnnnt.exe56⤵
- Executes dropped EXE
PID:3496 -
\??\c:\jvjdv.exec:\jvjdv.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xfrxxxf.exec:\xfrxxxf.exe58⤵
- Executes dropped EXE
PID:3004 -
\??\c:\thnbnh.exec:\thnbnh.exe59⤵
- Executes dropped EXE
PID:3172 -
\??\c:\1rlxxfx.exec:\1rlxxfx.exe60⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tnnnbb.exec:\tnnnbb.exe61⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vjvvp.exec:\vjvvp.exe62⤵
- Executes dropped EXE
PID:632 -
\??\c:\3lrrxfx.exec:\3lrrxfx.exe63⤵
- Executes dropped EXE
PID:4312 -
\??\c:\hthhnt.exec:\hthhnt.exe64⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jdpjj.exec:\jdpjj.exe65⤵
- Executes dropped EXE
PID:3300 -
\??\c:\frxllxx.exec:\frxllxx.exe66⤵PID:5072
-
\??\c:\5bhhnt.exec:\5bhhnt.exe67⤵PID:4176
-
\??\c:\jpppp.exec:\jpppp.exe68⤵PID:3484
-
\??\c:\1lxxxxx.exec:\1lxxxxx.exe69⤵PID:4156
-
\??\c:\tbnntb.exec:\tbnntb.exe70⤵PID:1364
-
\??\c:\jpjdd.exec:\jpjdd.exe71⤵PID:1436
-
\??\c:\bhbnbn.exec:\bhbnbn.exe72⤵
- System Location Discovery: System Language Discovery
PID:1984 -
\??\c:\vpvjv.exec:\vpvjv.exe73⤵PID:2648
-
\??\c:\xxxrllf.exec:\xxxrllf.exe74⤵
- System Location Discovery: System Language Discovery
PID:4580 -
\??\c:\nthhht.exec:\nthhht.exe75⤵PID:1032
-
\??\c:\jjdvd.exec:\jjdvd.exe76⤵PID:3224
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe77⤵PID:3228
-
\??\c:\tnttnt.exec:\tnttnt.exe78⤵PID:3920
-
\??\c:\pvjvp.exec:\pvjvp.exe79⤵PID:3648
-
\??\c:\rrlxfll.exec:\rrlxfll.exe80⤵PID:1608
-
\??\c:\tthnbb.exec:\tthnbb.exe81⤵PID:4744
-
\??\c:\5dddv.exec:\5dddv.exe82⤵PID:3444
-
\??\c:\llxfxll.exec:\llxfxll.exe83⤵PID:2736
-
\??\c:\thntbh.exec:\thntbh.exe84⤵PID:700
-
\??\c:\lfxxlxf.exec:\lfxxlxf.exe85⤵PID:3720
-
\??\c:\hnhnbn.exec:\hnhnbn.exe86⤵PID:3140
-
\??\c:\jdppv.exec:\jdppv.exe87⤵PID:1208
-
\??\c:\xrlfrrx.exec:\xrlfrrx.exe88⤵
- System Location Discovery: System Language Discovery
PID:2332 -
\??\c:\bnnttb.exec:\bnnttb.exe89⤵PID:3256
-
\??\c:\jpjjp.exec:\jpjjp.exe90⤵PID:3736
-
\??\c:\rrllrrf.exec:\rrllrrf.exe91⤵PID:1560
-
\??\c:\nhnnnt.exec:\nhnnnt.exe92⤵PID:1356
-
\??\c:\vdjvv.exec:\vdjvv.exe93⤵PID:1108
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe94⤵PID:3124
-
\??\c:\3bnnhn.exec:\3bnnhn.exe95⤵PID:2860
-
\??\c:\jpvdd.exec:\jpvdd.exe96⤵PID:2488
-
\??\c:\xxxflrr.exec:\xxxflrr.exe97⤵PID:1292
-
\??\c:\ntthhn.exec:\ntthhn.exe98⤵PID:4756
-
\??\c:\jjjjj.exec:\jjjjj.exe99⤵PID:4104
-
\??\c:\7rxxrxx.exec:\7rxxrxx.exe100⤵PID:3548
-
\??\c:\ttbhnb.exec:\ttbhnb.exe101⤵PID:3556
-
\??\c:\vjddd.exec:\vjddd.exe102⤵PID:2696
-
\??\c:\llxxllx.exec:\llxxllx.exe103⤵PID:4944
-
\??\c:\hbhttb.exec:\hbhttb.exe104⤵PID:4248
-
\??\c:\djpdv.exec:\djpdv.exe105⤵PID:1784
-
\??\c:\tnhhtb.exec:\tnhhtb.exe106⤵PID:2356
-
\??\c:\3jjvv.exec:\3jjvv.exe107⤵PID:2924
-
\??\c:\xfrrrlr.exec:\xfrrrlr.exe108⤵PID:2756
-
\??\c:\7bhbbb.exec:\7bhbbb.exe109⤵PID:1228
-
\??\c:\pjvdd.exec:\pjvdd.exe110⤵PID:5000
-
\??\c:\xfrlffl.exec:\xfrlffl.exe111⤵PID:116
-
\??\c:\bhnttb.exec:\bhnttb.exe112⤵PID:3616
-
\??\c:\jjjjj.exec:\jjjjj.exe113⤵PID:3036
-
\??\c:\3frxfrr.exec:\3frxfrr.exe114⤵PID:2236
-
\??\c:\hbhhtt.exec:\hbhhtt.exe115⤵PID:1564
-
\??\c:\vpvpj.exec:\vpvpj.exe116⤵PID:2388
-
\??\c:\xrrrlxr.exec:\xrrrlxr.exe117⤵PID:4196
-
\??\c:\hntthn.exec:\hntthn.exe118⤵PID:3660
-
\??\c:\vvppj.exec:\vvppj.exe119⤵PID:3984
-
\??\c:\rfrrffx.exec:\rfrrffx.exe120⤵PID:4024
-
\??\c:\bbbnnt.exec:\bbbnnt.exe121⤵PID:2172
-
\??\c:\pjvvp.exec:\pjvvp.exe122⤵PID:4964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-