Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 13:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52fa205fec11e64cab0e067a165b3c04e5939259c280a793482fbf126687d5be.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
52fa205fec11e64cab0e067a165b3c04e5939259c280a793482fbf126687d5be.exe
-
Size
454KB
-
MD5
5ee4ccfda26e542a30291ca758897c07
-
SHA1
c856c75da2de5c319b7a7a3928947c73fa038d18
-
SHA256
52fa205fec11e64cab0e067a165b3c04e5939259c280a793482fbf126687d5be
-
SHA512
eaf80e4d0bf108bc363f6579477e01a1ccbcb336cd1ebf7ae5bb2f56a09f8969613122545fa18fe2769ba319736c281b55281f606c08bef8a69d2f11e0f50685
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4416-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/796-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-1132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 ffflfff.exe 4016 nbhbtt.exe 624 pjppp.exe 3652 vdddd.exe 2540 dpdpp.exe 4900 pjjdv.exe 4448 vjpvv.exe 3084 nbhhbt.exe 4080 rfxrrrx.exe 1776 1vvpd.exe 2408 xffxrrf.exe 1060 djjjp.exe 3932 nbbbbb.exe 3812 5jjvv.exe 4836 rxrxrfr.exe 4564 vvjjj.exe 2428 dvddv.exe 2996 rrlffrl.exe 4180 lflxrlf.exe 1416 flfrrff.exe 1868 bnhhhh.exe 796 pdpdj.exe 3668 9rrllfl.exe 2900 tnbbbb.exe 1656 hbbbtt.exe 5008 dvddv.exe 2452 rrfflll.exe 1552 rxfxrrf.exe 3696 tnttnt.exe 5116 1flllrr.exe 4984 hhnhbb.exe 2412 xxllxxl.exe 1020 ffrfrfr.exe 1388 htbtth.exe 4776 jjpjd.exe 408 nbbnbt.exe 2004 7xlxffr.exe 3424 7lfrllf.exe 5072 ntnnnn.exe 4760 7ddvj.exe 2356 3lxlxrr.exe 3068 rlrrffr.exe 4864 btnnbt.exe 3564 3vdvp.exe 1032 ffxxrll.exe 4736 nttntb.exe 4856 vvddv.exe 208 rllfrrf.exe 1384 frlxrlx.exe 4404 hnbtnb.exe 4492 vjvpd.exe 4416 rfxrrrr.exe 4064 rxxrllx.exe 1572 tbnhbb.exe 1844 vpvjj.exe 4528 jjpvd.exe 2952 frxllfx.exe 3536 rxfxxxr.exe 2540 nhnhbb.exe 2252 dvppj.exe 1436 1ppjd.exe 4900 ffrrllf.exe 3864 tttnnh.exe 4940 vpdvd.exe -
resource yara_rule behavioral2/memory/2664-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/796-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-636-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4416 wrote to memory of 2664 4416 52fa205fec11e64cab0e067a165b3c04e5939259c280a793482fbf126687d5be.exe 82 PID 4416 wrote to memory of 2664 4416 52fa205fec11e64cab0e067a165b3c04e5939259c280a793482fbf126687d5be.exe 82 PID 4416 wrote to memory of 2664 4416 52fa205fec11e64cab0e067a165b3c04e5939259c280a793482fbf126687d5be.exe 82 PID 2664 wrote to memory of 4016 2664 ffflfff.exe 83 PID 2664 wrote to memory of 4016 2664 ffflfff.exe 83 PID 2664 wrote to memory of 4016 2664 ffflfff.exe 83 PID 4016 wrote to memory of 624 4016 nbhbtt.exe 84 PID 4016 wrote to memory of 624 4016 nbhbtt.exe 84 PID 4016 wrote to memory of 624 4016 nbhbtt.exe 84 PID 624 wrote to memory of 3652 624 pjppp.exe 85 PID 624 wrote to memory of 3652 624 pjppp.exe 85 PID 624 wrote to memory of 3652 624 pjppp.exe 85 PID 3652 wrote to memory of 2540 3652 vdddd.exe 86 PID 3652 wrote to memory of 2540 3652 vdddd.exe 86 PID 3652 wrote to memory of 2540 3652 vdddd.exe 86 PID 2540 wrote to memory of 4900 2540 dpdpp.exe 87 PID 2540 wrote to memory of 4900 2540 dpdpp.exe 87 PID 2540 wrote to memory of 4900 2540 dpdpp.exe 87 PID 4900 wrote to memory of 4448 4900 pjjdv.exe 88 PID 4900 wrote to memory of 4448 4900 pjjdv.exe 88 PID 4900 wrote to memory of 4448 4900 pjjdv.exe 88 PID 4448 wrote to memory of 3084 4448 vjpvv.exe 89 PID 4448 wrote to memory of 3084 4448 vjpvv.exe 89 PID 4448 wrote to memory of 3084 4448 vjpvv.exe 89 PID 3084 wrote to memory of 4080 3084 nbhhbt.exe 90 PID 3084 wrote to memory of 4080 3084 nbhhbt.exe 90 PID 3084 wrote to memory of 4080 3084 nbhhbt.exe 90 PID 4080 wrote to memory of 1776 4080 rfxrrrx.exe 91 PID 4080 wrote to memory of 1776 4080 rfxrrrx.exe 91 PID 4080 wrote to memory of 1776 4080 rfxrrrx.exe 91 PID 1776 wrote to memory of 2408 1776 1vvpd.exe 92 PID 1776 wrote to memory of 2408 1776 1vvpd.exe 92 PID 1776 wrote to memory of 2408 1776 1vvpd.exe 92 PID 2408 wrote to memory of 1060 2408 xffxrrf.exe 93 PID 2408 wrote to memory of 1060 2408 xffxrrf.exe 93 PID 2408 wrote to memory of 1060 2408 xffxrrf.exe 93 PID 1060 wrote to memory of 3932 1060 djjjp.exe 94 PID 1060 wrote to memory of 3932 1060 djjjp.exe 94 PID 1060 wrote to memory of 3932 1060 djjjp.exe 94 PID 3932 wrote to memory of 3812 3932 nbbbbb.exe 95 PID 3932 wrote to memory of 3812 3932 nbbbbb.exe 95 PID 3932 wrote to memory of 3812 3932 nbbbbb.exe 95 PID 3812 wrote to memory of 4836 3812 5jjvv.exe 96 PID 3812 wrote to memory of 4836 3812 5jjvv.exe 96 PID 3812 wrote to memory of 4836 3812 5jjvv.exe 96 PID 4836 wrote to memory of 4564 4836 rxrxrfr.exe 97 PID 4836 wrote to memory of 4564 4836 rxrxrfr.exe 97 PID 4836 wrote to memory of 4564 4836 rxrxrfr.exe 97 PID 4564 wrote to memory of 2428 4564 vvjjj.exe 98 PID 4564 wrote to memory of 2428 4564 vvjjj.exe 98 PID 4564 wrote to memory of 2428 4564 vvjjj.exe 98 PID 2428 wrote to memory of 2996 2428 dvddv.exe 99 PID 2428 wrote to memory of 2996 2428 dvddv.exe 99 PID 2428 wrote to memory of 2996 2428 dvddv.exe 99 PID 2996 wrote to memory of 4180 2996 rrlffrl.exe 100 PID 2996 wrote to memory of 4180 2996 rrlffrl.exe 100 PID 2996 wrote to memory of 4180 2996 rrlffrl.exe 100 PID 4180 wrote to memory of 1416 4180 lflxrlf.exe 101 PID 4180 wrote to memory of 1416 4180 lflxrlf.exe 101 PID 4180 wrote to memory of 1416 4180 lflxrlf.exe 101 PID 1416 wrote to memory of 1868 1416 flfrrff.exe 102 PID 1416 wrote to memory of 1868 1416 flfrrff.exe 102 PID 1416 wrote to memory of 1868 1416 flfrrff.exe 102 PID 1868 wrote to memory of 796 1868 bnhhhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\52fa205fec11e64cab0e067a165b3c04e5939259c280a793482fbf126687d5be.exe"C:\Users\Admin\AppData\Local\Temp\52fa205fec11e64cab0e067a165b3c04e5939259c280a793482fbf126687d5be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\ffflfff.exec:\ffflfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\nbhbtt.exec:\nbhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\pjppp.exec:\pjppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\vdddd.exec:\vdddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\dpdpp.exec:\dpdpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\pjjdv.exec:\pjjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\vjpvv.exec:\vjpvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\nbhhbt.exec:\nbhhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\rfxrrrx.exec:\rfxrrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\1vvpd.exec:\1vvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\xffxrrf.exec:\xffxrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\djjjp.exec:\djjjp.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\nbbbbb.exec:\nbbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\5jjvv.exec:\5jjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\rxrxrfr.exec:\rxrxrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\vvjjj.exec:\vvjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\dvddv.exec:\dvddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\rrlffrl.exec:\rrlffrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\lflxrlf.exec:\lflxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\flfrrff.exec:\flfrrff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\bnhhhh.exec:\bnhhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\pdpdj.exec:\pdpdj.exe23⤵
- Executes dropped EXE
PID:796 -
\??\c:\9rrllfl.exec:\9rrllfl.exe24⤵
- Executes dropped EXE
PID:3668 -
\??\c:\tnbbbb.exec:\tnbbbb.exe25⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbbbtt.exec:\hbbbtt.exe26⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dvddv.exec:\dvddv.exe27⤵
- Executes dropped EXE
PID:5008 -
\??\c:\rrfflll.exec:\rrfflll.exe28⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rxfxrrf.exec:\rxfxrrf.exe29⤵
- Executes dropped EXE
PID:1552 -
\??\c:\tnttnt.exec:\tnttnt.exe30⤵
- Executes dropped EXE
PID:3696 -
\??\c:\1flllrr.exec:\1flllrr.exe31⤵
- Executes dropped EXE
PID:5116 -
\??\c:\hhnhbb.exec:\hhnhbb.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4984 -
\??\c:\xxllxxl.exec:\xxllxxl.exe33⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe34⤵
- Executes dropped EXE
PID:1020 -
\??\c:\htbtth.exec:\htbtth.exe35⤵
- Executes dropped EXE
PID:1388 -
\??\c:\jjpjd.exec:\jjpjd.exe36⤵
- Executes dropped EXE
PID:4776 -
\??\c:\nbbnbt.exec:\nbbnbt.exe37⤵
- Executes dropped EXE
PID:408 -
\??\c:\7xlxffr.exec:\7xlxffr.exe38⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7lfrllf.exec:\7lfrllf.exe39⤵
- Executes dropped EXE
PID:3424 -
\??\c:\ntnnnn.exec:\ntnnnn.exe40⤵
- Executes dropped EXE
PID:5072 -
\??\c:\7ddvj.exec:\7ddvj.exe41⤵
- Executes dropped EXE
PID:4760 -
\??\c:\3lxlxrr.exec:\3lxlxrr.exe42⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rlrrffr.exec:\rlrrffr.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\btnnbt.exec:\btnnbt.exe44⤵
- Executes dropped EXE
PID:4864 -
\??\c:\3vdvp.exec:\3vdvp.exe45⤵
- Executes dropped EXE
PID:3564 -
\??\c:\ffxxrll.exec:\ffxxrll.exe46⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nttntb.exec:\nttntb.exe47⤵
- Executes dropped EXE
PID:4736 -
\??\c:\vvddv.exec:\vvddv.exe48⤵
- Executes dropped EXE
PID:4856 -
\??\c:\rllfrrf.exec:\rllfrrf.exe49⤵
- Executes dropped EXE
PID:208 -
\??\c:\frlxrlx.exec:\frlxrlx.exe50⤵
- Executes dropped EXE
PID:1384 -
\??\c:\hnbtnb.exec:\hnbtnb.exe51⤵
- Executes dropped EXE
PID:4404 -
\??\c:\vjvpd.exec:\vjvpd.exe52⤵
- Executes dropped EXE
PID:4492 -
\??\c:\rfxrrrr.exec:\rfxrrrr.exe53⤵
- Executes dropped EXE
PID:4416 -
\??\c:\rxxrllx.exec:\rxxrllx.exe54⤵
- Executes dropped EXE
PID:4064 -
\??\c:\tbnhbb.exec:\tbnhbb.exe55⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vpvjj.exec:\vpvjj.exe56⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jjpvd.exec:\jjpvd.exe57⤵
- Executes dropped EXE
PID:4528 -
\??\c:\frxllfx.exec:\frxllfx.exe58⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe59⤵
- Executes dropped EXE
PID:3536 -
\??\c:\nhnhbb.exec:\nhnhbb.exe60⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dvppj.exec:\dvppj.exe61⤵
- Executes dropped EXE
PID:2252 -
\??\c:\1ppjd.exec:\1ppjd.exe62⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ffrrllf.exec:\ffrrllf.exe63⤵
- Executes dropped EXE
PID:4900 -
\??\c:\tttnnh.exec:\tttnnh.exe64⤵
- Executes dropped EXE
PID:3864 -
\??\c:\vpdvd.exec:\vpdvd.exe65⤵
- Executes dropped EXE
PID:4940 -
\??\c:\lrrrlrl.exec:\lrrrlrl.exe66⤵PID:5052
-
\??\c:\hnthtt.exec:\hnthtt.exe67⤵PID:3028
-
\??\c:\dvdvv.exec:\dvdvv.exe68⤵PID:3908
-
\??\c:\xrxrllf.exec:\xrxrllf.exe69⤵PID:3844
-
\??\c:\bhntnn.exec:\bhntnn.exe70⤵PID:416
-
\??\c:\djppj.exec:\djppj.exe71⤵PID:3736
-
\??\c:\flxxrrr.exec:\flxxrrr.exe72⤵PID:4820
-
\??\c:\hhbbtt.exec:\hhbbtt.exe73⤵PID:996
-
\??\c:\jpjjd.exec:\jpjjd.exe74⤵PID:3988
-
\??\c:\rflfxrl.exec:\rflfxrl.exe75⤵PID:2828
-
\??\c:\tnhbbh.exec:\tnhbbh.exe76⤵PID:4276
-
\??\c:\hbhhbt.exec:\hbhhbt.exe77⤵PID:3152
-
\??\c:\vjvvd.exec:\vjvvd.exe78⤵PID:4340
-
\??\c:\lffxrrl.exec:\lffxrrl.exe79⤵PID:1828
-
\??\c:\hbbttt.exec:\hbbttt.exe80⤵PID:4048
-
\??\c:\vvppj.exec:\vvppj.exe81⤵PID:3956
-
\??\c:\5llrrrr.exec:\5llrrrr.exe82⤵PID:1416
-
\??\c:\9xfxxrl.exec:\9xfxxrl.exe83⤵PID:4032
-
\??\c:\7nbnhh.exec:\7nbnhh.exe84⤵PID:1084
-
\??\c:\9nbtnb.exec:\9nbtnb.exe85⤵PID:1516
-
\??\c:\9jjpd.exec:\9jjpd.exe86⤵PID:2440
-
\??\c:\7ffxllf.exec:\7ffxllf.exe87⤵PID:528
-
\??\c:\hbtnhh.exec:\hbtnhh.exe88⤵PID:1392
-
\??\c:\pppdv.exec:\pppdv.exe89⤵PID:2552
-
\??\c:\pvdvj.exec:\pvdvj.exe90⤵PID:1824
-
\??\c:\1lfxrlf.exec:\1lfxrlf.exe91⤵PID:4532
-
\??\c:\nhthhb.exec:\nhthhb.exe92⤵PID:4108
-
\??\c:\bhnbtn.exec:\bhnbtn.exe93⤵PID:3696
-
\??\c:\jdvjv.exec:\jdvjv.exe94⤵PID:5116
-
\??\c:\dvvjd.exec:\dvvjd.exe95⤵PID:3328
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe96⤵PID:1832
-
\??\c:\tbnbht.exec:\tbnbht.exe97⤵PID:4220
-
\??\c:\pjppj.exec:\pjppj.exe98⤵PID:64
-
\??\c:\frlllxx.exec:\frlllxx.exe99⤵PID:1388
-
\??\c:\rlrfxxx.exec:\rlrfxxx.exe100⤵PID:1956
-
\??\c:\bthbtt.exec:\bthbtt.exe101⤵PID:5080
-
\??\c:\1dppv.exec:\1dppv.exe102⤵
- System Location Discovery: System Language Discovery
PID:3836 -
\??\c:\9frlllr.exec:\9frlllr.exe103⤵
- System Location Discovery: System Language Discovery
PID:1700 -
\??\c:\1xfxrll.exec:\1xfxrll.exe104⤵PID:832
-
\??\c:\nbhbtn.exec:\nbhbtn.exe105⤵PID:4760
-
\??\c:\9jpjd.exec:\9jpjd.exe106⤵PID:3624
-
\??\c:\jvdvp.exec:\jvdvp.exe107⤵PID:2160
-
\??\c:\llrlfff.exec:\llrlfff.exe108⤵PID:4592
-
\??\c:\thtbtb.exec:\thtbtb.exe109⤵PID:3564
-
\??\c:\jdpjp.exec:\jdpjp.exe110⤵PID:4804
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe111⤵PID:1112
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe112⤵PID:2028
-
\??\c:\ntbtnn.exec:\ntbtnn.exe113⤵PID:1916
-
\??\c:\pdjjd.exec:\pdjjd.exe114⤵PID:4352
-
\??\c:\pjjjj.exec:\pjjjj.exe115⤵PID:4388
-
\??\c:\fffrrrl.exec:\fffrrrl.exe116⤵PID:3572
-
\??\c:\htnnhh.exec:\htnnhh.exe117⤵PID:4740
-
\??\c:\jdjjv.exec:\jdjjv.exe118⤵PID:4620
-
\??\c:\3xllfff.exec:\3xllfff.exe119⤵PID:1572
-
\??\c:\nnhbtn.exec:\nnhbtn.exe120⤵PID:5112
-
\??\c:\ttbtnn.exec:\ttbtnn.exe121⤵PID:4528
-
\??\c:\dvdvp.exec:\dvdvp.exe122⤵PID:1632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-