Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 10:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe
-
Size
454KB
-
MD5
6abd8c063831dcdc79203d5e12de4221
-
SHA1
23b9c356decc9114bec5118f93eca4f8cbb4dee5
-
SHA256
cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f
-
SHA512
7c95bc995ee3b3ef80f6e01bc629b37325e7a6ad610cd0864dc10eb8b53055fd71ff3d601f840e56c041cbc6e1a2aa50d679863bbc2d8e6c195aff489e29d3b1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2872-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/180-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-753-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-838-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-923-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4112 rflfxxx.exe 1948 nbtbbh.exe 3200 dvjjd.exe 2040 1xllrxl.exe 3348 hbhbtt.exe 4300 7jpjd.exe 4168 5ttntt.exe 2020 lfrllrr.exe 1836 lfrrlrr.exe 2396 jjddd.exe 2156 3ffllrl.exe 1880 ppvpj.exe 3372 rlxrrll.exe 448 llxlxff.exe 4240 3nnhhh.exe 3512 vdjdv.exe 1284 ttbtbb.exe 2120 bttntn.exe 4800 rxfxrlf.exe 4212 btbtnn.exe 3924 5xxxrrl.exe 3796 nnbnnt.exe 2356 vpvpp.exe 1848 xxxfrfx.exe 3892 jdjvv.exe 2616 5flfxxx.exe 4644 jdjdv.exe 3812 bhhhbn.exe 848 vpjdp.exe 956 lrlfrxl.exe 4900 djppd.exe 1524 hbtnnn.exe 1708 5pdjj.exe 2016 bbbnbh.exe 1844 pvjjj.exe 2428 rrfrlll.exe 1936 ddvpj.exe 672 lffrfxf.exe 2964 hhhnnt.exe 3488 rrfffll.exe 4792 nbtbhb.exe 1332 jvdvp.exe 4456 lxxrlxf.exe 1300 ppppv.exe 1636 dvjjj.exe 4484 nhhbbb.exe 1264 1dvvp.exe 1932 pvddv.exe 2628 rlllxrl.exe 4388 thhhhh.exe 3860 3djjp.exe 1748 nnnhhh.exe 2368 vdjjd.exe 4168 hnbtnn.exe 1348 jdppj.exe 3276 xxlflrr.exe 1380 bhnhnn.exe 1244 djjdj.exe 2156 lfxxlrf.exe 3068 9tbtnn.exe 4628 lxlfxxr.exe 4140 nhhbnn.exe 180 jdvvd.exe 512 xxlfffx.exe -
resource yara_rule behavioral2/memory/2872-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/180-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-635-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxflr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 4112 2872 cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe 83 PID 2872 wrote to memory of 4112 2872 cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe 83 PID 2872 wrote to memory of 4112 2872 cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe 83 PID 4112 wrote to memory of 1948 4112 rflfxxx.exe 84 PID 4112 wrote to memory of 1948 4112 rflfxxx.exe 84 PID 4112 wrote to memory of 1948 4112 rflfxxx.exe 84 PID 1948 wrote to memory of 3200 1948 nbtbbh.exe 85 PID 1948 wrote to memory of 3200 1948 nbtbbh.exe 85 PID 1948 wrote to memory of 3200 1948 nbtbbh.exe 85 PID 3200 wrote to memory of 2040 3200 dvjjd.exe 86 PID 3200 wrote to memory of 2040 3200 dvjjd.exe 86 PID 3200 wrote to memory of 2040 3200 dvjjd.exe 86 PID 2040 wrote to memory of 3348 2040 1xllrxl.exe 87 PID 2040 wrote to memory of 3348 2040 1xllrxl.exe 87 PID 2040 wrote to memory of 3348 2040 1xllrxl.exe 87 PID 3348 wrote to memory of 4300 3348 hbhbtt.exe 88 PID 3348 wrote to memory of 4300 3348 hbhbtt.exe 88 PID 3348 wrote to memory of 4300 3348 hbhbtt.exe 88 PID 4300 wrote to memory of 4168 4300 7jpjd.exe 89 PID 4300 wrote to memory of 4168 4300 7jpjd.exe 89 PID 4300 wrote to memory of 4168 4300 7jpjd.exe 89 PID 4168 wrote to memory of 2020 4168 5ttntt.exe 90 PID 4168 wrote to memory of 2020 4168 5ttntt.exe 90 PID 4168 wrote to memory of 2020 4168 5ttntt.exe 90 PID 2020 wrote to memory of 1836 2020 lfrllrr.exe 91 PID 2020 wrote to memory of 1836 2020 lfrllrr.exe 91 PID 2020 wrote to memory of 1836 2020 lfrllrr.exe 91 PID 1836 wrote to memory of 2396 1836 lfrrlrr.exe 92 PID 1836 wrote to memory of 2396 1836 lfrrlrr.exe 92 PID 1836 wrote to memory of 2396 1836 lfrrlrr.exe 92 PID 2396 wrote to memory of 2156 2396 jjddd.exe 93 PID 2396 wrote to memory of 2156 2396 jjddd.exe 93 PID 2396 wrote to memory of 2156 2396 jjddd.exe 93 PID 2156 wrote to memory of 1880 2156 3ffllrl.exe 94 PID 2156 wrote to memory of 1880 2156 3ffllrl.exe 94 PID 2156 wrote to memory of 1880 2156 3ffllrl.exe 94 PID 1880 wrote to memory of 3372 1880 ppvpj.exe 95 PID 1880 wrote to memory of 3372 1880 ppvpj.exe 95 PID 1880 wrote to memory of 3372 1880 ppvpj.exe 95 PID 3372 wrote to memory of 448 3372 rlxrrll.exe 96 PID 3372 wrote to memory of 448 3372 rlxrrll.exe 96 PID 3372 wrote to memory of 448 3372 rlxrrll.exe 96 PID 448 wrote to memory of 4240 448 llxlxff.exe 97 PID 448 wrote to memory of 4240 448 llxlxff.exe 97 PID 448 wrote to memory of 4240 448 llxlxff.exe 97 PID 4240 wrote to memory of 3512 4240 3nnhhh.exe 98 PID 4240 wrote to memory of 3512 4240 3nnhhh.exe 98 PID 4240 wrote to memory of 3512 4240 3nnhhh.exe 98 PID 3512 wrote to memory of 1284 3512 vdjdv.exe 99 PID 3512 wrote to memory of 1284 3512 vdjdv.exe 99 PID 3512 wrote to memory of 1284 3512 vdjdv.exe 99 PID 1284 wrote to memory of 2120 1284 ttbtbb.exe 100 PID 1284 wrote to memory of 2120 1284 ttbtbb.exe 100 PID 1284 wrote to memory of 2120 1284 ttbtbb.exe 100 PID 2120 wrote to memory of 4800 2120 bttntn.exe 101 PID 2120 wrote to memory of 4800 2120 bttntn.exe 101 PID 2120 wrote to memory of 4800 2120 bttntn.exe 101 PID 4800 wrote to memory of 4212 4800 rxfxrlf.exe 102 PID 4800 wrote to memory of 4212 4800 rxfxrlf.exe 102 PID 4800 wrote to memory of 4212 4800 rxfxrlf.exe 102 PID 4212 wrote to memory of 3924 4212 btbtnn.exe 103 PID 4212 wrote to memory of 3924 4212 btbtnn.exe 103 PID 4212 wrote to memory of 3924 4212 btbtnn.exe 103 PID 3924 wrote to memory of 3796 3924 5xxxrrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe"C:\Users\Admin\AppData\Local\Temp\cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rflfxxx.exec:\rflfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\nbtbbh.exec:\nbtbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\dvjjd.exec:\dvjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\1xllrxl.exec:\1xllrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\hbhbtt.exec:\hbhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\7jpjd.exec:\7jpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\5ttntt.exec:\5ttntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\lfrllrr.exec:\lfrllrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\lfrrlrr.exec:\lfrrlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\jjddd.exec:\jjddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\3ffllrl.exec:\3ffllrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\ppvpj.exec:\ppvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\rlxrrll.exec:\rlxrrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\llxlxff.exec:\llxlxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\3nnhhh.exec:\3nnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\vdjdv.exec:\vdjdv.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\ttbtbb.exec:\ttbtbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\bttntn.exec:\bttntn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\btbtnn.exec:\btbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\5xxxrrl.exec:\5xxxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\nnbnnt.exec:\nnbnnt.exe23⤵
- Executes dropped EXE
PID:3796 -
\??\c:\vpvpp.exec:\vpvpp.exe24⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xxxfrfx.exec:\xxxfrfx.exe25⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jdjvv.exec:\jdjvv.exe26⤵
- Executes dropped EXE
PID:3892 -
\??\c:\5flfxxx.exec:\5flfxxx.exe27⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jdjdv.exec:\jdjdv.exe28⤵
- Executes dropped EXE
PID:4644 -
\??\c:\bhhhbn.exec:\bhhhbn.exe29⤵
- Executes dropped EXE
PID:3812 -
\??\c:\vpjdp.exec:\vpjdp.exe30⤵
- Executes dropped EXE
PID:848 -
\??\c:\lrlfrxl.exec:\lrlfrxl.exe31⤵
- Executes dropped EXE
PID:956 -
\??\c:\djppd.exec:\djppd.exe32⤵
- Executes dropped EXE
PID:4900 -
\??\c:\hbtnnn.exec:\hbtnnn.exe33⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5pdjj.exec:\5pdjj.exe34⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bbbnbh.exec:\bbbnbh.exe35⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pvjjj.exec:\pvjjj.exe36⤵
- Executes dropped EXE
PID:1844 -
\??\c:\rrfrlll.exec:\rrfrlll.exe37⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ddvpj.exec:\ddvpj.exe38⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lffrfxf.exec:\lffrfxf.exe39⤵
- Executes dropped EXE
PID:672 -
\??\c:\hhhnnt.exec:\hhhnnt.exe40⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rrfffll.exec:\rrfffll.exe41⤵
- Executes dropped EXE
PID:3488 -
\??\c:\nbtbhb.exec:\nbtbhb.exe42⤵
- Executes dropped EXE
PID:4792 -
\??\c:\jvdvp.exec:\jvdvp.exe43⤵
- Executes dropped EXE
PID:1332 -
\??\c:\lxxrlxf.exec:\lxxrlxf.exe44⤵
- Executes dropped EXE
PID:4456 -
\??\c:\ppppv.exec:\ppppv.exe45⤵
- Executes dropped EXE
PID:1300 -
\??\c:\dvjjj.exec:\dvjjj.exe46⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nhhbbb.exec:\nhhbbb.exe47⤵
- Executes dropped EXE
PID:4484 -
\??\c:\1dvvp.exec:\1dvvp.exe48⤵
- Executes dropped EXE
PID:1264 -
\??\c:\pvddv.exec:\pvddv.exe49⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rlllxrl.exec:\rlllxrl.exe50⤵
- Executes dropped EXE
PID:2628 -
\??\c:\thhhhh.exec:\thhhhh.exe51⤵
- Executes dropped EXE
PID:4388 -
\??\c:\3djjp.exec:\3djjp.exe52⤵
- Executes dropped EXE
PID:3860 -
\??\c:\nnnhhh.exec:\nnnhhh.exe53⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vdjjd.exec:\vdjjd.exe54⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hnbtnn.exec:\hnbtnn.exe55⤵
- Executes dropped EXE
PID:4168 -
\??\c:\jdppj.exec:\jdppj.exe56⤵
- Executes dropped EXE
PID:1348 -
\??\c:\xxlflrr.exec:\xxlflrr.exe57⤵
- Executes dropped EXE
PID:3276 -
\??\c:\bhnhnn.exec:\bhnhnn.exe58⤵
- Executes dropped EXE
PID:1380 -
\??\c:\djjdj.exec:\djjdj.exe59⤵
- Executes dropped EXE
PID:1244 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe60⤵
- Executes dropped EXE
PID:2156 -
\??\c:\9tbtnn.exec:\9tbtnn.exe61⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe62⤵
- Executes dropped EXE
PID:4628 -
\??\c:\nhhbnn.exec:\nhhbnn.exe63⤵
- Executes dropped EXE
PID:4140 -
\??\c:\jdvvd.exec:\jdvvd.exe64⤵
- Executes dropped EXE
PID:180 -
\??\c:\xxlfffx.exec:\xxlfffx.exe65⤵
- Executes dropped EXE
PID:512 -
\??\c:\vjddv.exec:\vjddv.exe66⤵PID:1516
-
\??\c:\flfxxfl.exec:\flfxxfl.exe67⤵PID:3088
-
\??\c:\hhhhhh.exec:\hhhhhh.exe68⤵PID:1284
-
\??\c:\nthbtt.exec:\nthbtt.exe69⤵PID:60
-
\??\c:\jjpjv.exec:\jjpjv.exe70⤵PID:4476
-
\??\c:\3flfxxl.exec:\3flfxxl.exe71⤵PID:712
-
\??\c:\ttnhtt.exec:\ttnhtt.exe72⤵PID:2868
-
\??\c:\9jjpp.exec:\9jjpp.exe73⤵PID:1664
-
\??\c:\pvvvp.exec:\pvvvp.exe74⤵PID:3840
-
\??\c:\rrxfxlr.exec:\rrxfxlr.exe75⤵PID:1128
-
\??\c:\djdpj.exec:\djdpj.exe76⤵PID:5116
-
\??\c:\7rxlfff.exec:\7rxlfff.exe77⤵PID:4964
-
\??\c:\5tbbbn.exec:\5tbbbn.exe78⤵PID:2824
-
\??\c:\jpjdd.exec:\jpjdd.exe79⤵PID:4740
-
\??\c:\flllfff.exec:\flllfff.exe80⤵PID:3892
-
\??\c:\bthhnt.exec:\bthhnt.exe81⤵PID:4860
-
\??\c:\ppjjd.exec:\ppjjd.exe82⤵PID:3920
-
\??\c:\rffrlxl.exec:\rffrlxl.exe83⤵PID:4624
-
\??\c:\7tttnt.exec:\7tttnt.exe84⤵PID:2164
-
\??\c:\ppdvj.exec:\ppdvj.exe85⤵PID:4312
-
\??\c:\llflrll.exec:\llflrll.exe86⤵PID:2612
-
\??\c:\dpppv.exec:\dpppv.exe87⤵PID:956
-
\??\c:\ffrrlrr.exec:\ffrrlrr.exe88⤵PID:4900
-
\??\c:\pdvvp.exec:\pdvvp.exe89⤵PID:3404
-
\??\c:\frfxfrr.exec:\frfxfrr.exe90⤵PID:1204
-
\??\c:\nhnnnh.exec:\nhnnnh.exe91⤵PID:2196
-
\??\c:\9djjd.exec:\9djjd.exe92⤵PID:1412
-
\??\c:\lxxrxrl.exec:\lxxrxrl.exe93⤵PID:2352
-
\??\c:\1tbttt.exec:\1tbttt.exe94⤵PID:1960
-
\??\c:\rlflffx.exec:\rlflffx.exe95⤵PID:868
-
\??\c:\thbhhn.exec:\thbhhn.exe96⤵PID:4424
-
\??\c:\vppvj.exec:\vppvj.exe97⤵PID:540
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe98⤵PID:4516
-
\??\c:\nhbttn.exec:\nhbttn.exe99⤵PID:2028
-
\??\c:\7vdvj.exec:\7vdvj.exe100⤵PID:5044
-
\??\c:\nnhntb.exec:\nnhntb.exe101⤵PID:3032
-
\??\c:\1dpvp.exec:\1dpvp.exe102⤵PID:1808
-
\??\c:\rflrlrx.exec:\rflrlrx.exe103⤵PID:628
-
\??\c:\vpvpj.exec:\vpvpj.exe104⤵PID:3384
-
\??\c:\frlrlfl.exec:\frlrlfl.exe105⤵PID:4344
-
\??\c:\3thnnt.exec:\3thnnt.exe106⤵PID:2632
-
\??\c:\dpvpp.exec:\dpvpp.exe107⤵PID:2144
-
\??\c:\tbnbtn.exec:\tbnbtn.exe108⤵PID:1968
-
\??\c:\1pjvp.exec:\1pjvp.exe109⤵PID:2568
-
\??\c:\lrfxlrl.exec:\lrfxlrl.exe110⤵PID:5016
-
\??\c:\hthbtt.exec:\hthbtt.exe111⤵PID:5064
-
\??\c:\pddvv.exec:\pddvv.exe112⤵PID:2040
-
\??\c:\1xrrlrl.exec:\1xrrlrl.exe113⤵PID:2596
-
\??\c:\3bbhtb.exec:\3bbhtb.exe114⤵PID:3940
-
\??\c:\5dvpj.exec:\5dvpj.exe115⤵PID:3860
-
\??\c:\3hnnbb.exec:\3hnnbb.exe116⤵PID:3524
-
\??\c:\pdpjj.exec:\pdpjj.exe117⤵PID:2368
-
\??\c:\frlfrxx.exec:\frlfrxx.exe118⤵PID:4452
-
\??\c:\nhtnhn.exec:\nhtnhn.exe119⤵PID:2152
-
\??\c:\nbtttb.exec:\nbtttb.exe120⤵PID:2396
-
\??\c:\pdvjv.exec:\pdvjv.exe121⤵PID:4736
-
\??\c:\lxrxxxl.exec:\lxrxxxl.exe122⤵PID:3244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-