Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 13:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
94657ad8d38d86d5a664cd6ad353a0bed68a3b50df4ab75332d5e501429dbee9.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
94657ad8d38d86d5a664cd6ad353a0bed68a3b50df4ab75332d5e501429dbee9.exe
-
Size
455KB
-
MD5
f569e1d1796ba6d3fb637beead40263b
-
SHA1
c5266af2ac7e2a278432d969679d6b07aa7ec3bf
-
SHA256
94657ad8d38d86d5a664cd6ad353a0bed68a3b50df4ab75332d5e501429dbee9
-
SHA512
2b794500676b90613cad560920ce011864389c72aef9e33f310987a95fb256e8ceb6421cf32b51df4c608ef7e89d8acb631bae58f829f6a3db041ed93cfa50fa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3096-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/984-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-825-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-921-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-1551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2128 8062004.exe 4828 3vjvd.exe 632 s4420.exe 2640 rrlxrlx.exe 4988 jvpdp.exe 984 o068608.exe 3584 440860.exe 3532 lrfrflx.exe 1076 bttbnh.exe 1948 tttttb.exe 2240 6842048.exe 3852 2286486.exe 3624 20600.exe 2336 e46026.exe 552 u246266.exe 3316 7jdpd.exe 1408 a0608.exe 4576 lfxfrlx.exe 4664 88224.exe 4592 5pdjv.exe 2588 8664264.exe 2756 xlxlfxx.exe 2164 htnbnh.exe 3612 66608.exe 4524 jvdpj.exe 1224 lfxxrrl.exe 748 rxrflfr.exe 4856 644244.exe 1592 ppvpd.exe 4156 rfxlxlx.exe 4536 6668642.exe 2020 9rxlxrf.exe 3684 844204.exe 1792 frrfrlf.exe 5084 884266.exe 3772 4880806.exe 4292 04082.exe 408 fllxlfr.exe 4008 s0226.exe 5048 djjvj.exe 1876 0444206.exe 1032 pvvjv.exe 1956 bthbbt.exe 4780 662648.exe 2520 424200.exe 1860 nbbhhb.exe 4940 rrlfxrf.exe 4320 68464.exe 4904 82204.exe 2316 222648.exe 3112 dvpvd.exe 2468 rlrflxx.exe 4824 4842200.exe 632 0886486.exe 4976 44464.exe 1724 5btnbt.exe 4284 hnnnnh.exe 2820 c224264.exe 3584 1pjvj.exe 3532 lllxfxr.exe 3312 66620.exe 1780 426024.exe 5100 dvdpv.exe 4312 pdddp.exe -
resource yara_rule behavioral2/memory/3096-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/984-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-608-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 880866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 428644.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c620040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882422.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g0086.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0020044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84420.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 846404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 2128 3096 94657ad8d38d86d5a664cd6ad353a0bed68a3b50df4ab75332d5e501429dbee9.exe 83 PID 3096 wrote to memory of 2128 3096 94657ad8d38d86d5a664cd6ad353a0bed68a3b50df4ab75332d5e501429dbee9.exe 83 PID 3096 wrote to memory of 2128 3096 94657ad8d38d86d5a664cd6ad353a0bed68a3b50df4ab75332d5e501429dbee9.exe 83 PID 2128 wrote to memory of 4828 2128 8062004.exe 84 PID 2128 wrote to memory of 4828 2128 8062004.exe 84 PID 2128 wrote to memory of 4828 2128 8062004.exe 84 PID 4828 wrote to memory of 632 4828 3vjvd.exe 85 PID 4828 wrote to memory of 632 4828 3vjvd.exe 85 PID 4828 wrote to memory of 632 4828 3vjvd.exe 85 PID 632 wrote to memory of 2640 632 s4420.exe 86 PID 632 wrote to memory of 2640 632 s4420.exe 86 PID 632 wrote to memory of 2640 632 s4420.exe 86 PID 2640 wrote to memory of 4988 2640 rrlxrlx.exe 87 PID 2640 wrote to memory of 4988 2640 rrlxrlx.exe 87 PID 2640 wrote to memory of 4988 2640 rrlxrlx.exe 87 PID 4988 wrote to memory of 984 4988 jvpdp.exe 88 PID 4988 wrote to memory of 984 4988 jvpdp.exe 88 PID 4988 wrote to memory of 984 4988 jvpdp.exe 88 PID 984 wrote to memory of 3584 984 o068608.exe 89 PID 984 wrote to memory of 3584 984 o068608.exe 89 PID 984 wrote to memory of 3584 984 o068608.exe 89 PID 3584 wrote to memory of 3532 3584 440860.exe 90 PID 3584 wrote to memory of 3532 3584 440860.exe 90 PID 3584 wrote to memory of 3532 3584 440860.exe 90 PID 3532 wrote to memory of 1076 3532 lrfrflx.exe 91 PID 3532 wrote to memory of 1076 3532 lrfrflx.exe 91 PID 3532 wrote to memory of 1076 3532 lrfrflx.exe 91 PID 1076 wrote to memory of 1948 1076 bttbnh.exe 92 PID 1076 wrote to memory of 1948 1076 bttbnh.exe 92 PID 1076 wrote to memory of 1948 1076 bttbnh.exe 92 PID 1948 wrote to memory of 2240 1948 tttttb.exe 93 PID 1948 wrote to memory of 2240 1948 tttttb.exe 93 PID 1948 wrote to memory of 2240 1948 tttttb.exe 93 PID 2240 wrote to memory of 3852 2240 6842048.exe 94 PID 2240 wrote to memory of 3852 2240 6842048.exe 94 PID 2240 wrote to memory of 3852 2240 6842048.exe 94 PID 3852 wrote to memory of 3624 3852 2286486.exe 95 PID 3852 wrote to memory of 3624 3852 2286486.exe 95 PID 3852 wrote to memory of 3624 3852 2286486.exe 95 PID 3624 wrote to memory of 2336 3624 20600.exe 96 PID 3624 wrote to memory of 2336 3624 20600.exe 96 PID 3624 wrote to memory of 2336 3624 20600.exe 96 PID 2336 wrote to memory of 552 2336 e46026.exe 97 PID 2336 wrote to memory of 552 2336 e46026.exe 97 PID 2336 wrote to memory of 552 2336 e46026.exe 97 PID 552 wrote to memory of 3316 552 u246266.exe 98 PID 552 wrote to memory of 3316 552 u246266.exe 98 PID 552 wrote to memory of 3316 552 u246266.exe 98 PID 3316 wrote to memory of 1408 3316 7jdpd.exe 99 PID 3316 wrote to memory of 1408 3316 7jdpd.exe 99 PID 3316 wrote to memory of 1408 3316 7jdpd.exe 99 PID 1408 wrote to memory of 4576 1408 a0608.exe 100 PID 1408 wrote to memory of 4576 1408 a0608.exe 100 PID 1408 wrote to memory of 4576 1408 a0608.exe 100 PID 4576 wrote to memory of 4664 4576 lfxfrlx.exe 101 PID 4576 wrote to memory of 4664 4576 lfxfrlx.exe 101 PID 4576 wrote to memory of 4664 4576 lfxfrlx.exe 101 PID 4664 wrote to memory of 4592 4664 88224.exe 102 PID 4664 wrote to memory of 4592 4664 88224.exe 102 PID 4664 wrote to memory of 4592 4664 88224.exe 102 PID 4592 wrote to memory of 2588 4592 5pdjv.exe 103 PID 4592 wrote to memory of 2588 4592 5pdjv.exe 103 PID 4592 wrote to memory of 2588 4592 5pdjv.exe 103 PID 2588 wrote to memory of 2756 2588 8664264.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\94657ad8d38d86d5a664cd6ad353a0bed68a3b50df4ab75332d5e501429dbee9.exe"C:\Users\Admin\AppData\Local\Temp\94657ad8d38d86d5a664cd6ad353a0bed68a3b50df4ab75332d5e501429dbee9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\8062004.exec:\8062004.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\3vjvd.exec:\3vjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\s4420.exec:\s4420.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\rrlxrlx.exec:\rrlxrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\jvpdp.exec:\jvpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\o068608.exec:\o068608.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\440860.exec:\440860.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\lrfrflx.exec:\lrfrflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\bttbnh.exec:\bttbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\tttttb.exec:\tttttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\6842048.exec:\6842048.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\2286486.exec:\2286486.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\20600.exec:\20600.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\e46026.exec:\e46026.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\u246266.exec:\u246266.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\7jdpd.exec:\7jdpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\a0608.exec:\a0608.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\lfxfrlx.exec:\lfxfrlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\88224.exec:\88224.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\5pdjv.exec:\5pdjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\8664264.exec:\8664264.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\xlxlfxx.exec:\xlxlfxx.exe23⤵
- Executes dropped EXE
PID:2756 -
\??\c:\htnbnh.exec:\htnbnh.exe24⤵
- Executes dropped EXE
PID:2164 -
\??\c:\66608.exec:\66608.exe25⤵
- Executes dropped EXE
PID:3612 -
\??\c:\jvdpj.exec:\jvdpj.exe26⤵
- Executes dropped EXE
PID:4524 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe27⤵
- Executes dropped EXE
PID:1224 -
\??\c:\rxrflfr.exec:\rxrflfr.exe28⤵
- Executes dropped EXE
PID:748 -
\??\c:\644244.exec:\644244.exe29⤵
- Executes dropped EXE
PID:4856 -
\??\c:\ppvpd.exec:\ppvpd.exe30⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rfxlxlx.exec:\rfxlxlx.exe31⤵
- Executes dropped EXE
PID:4156 -
\??\c:\6668642.exec:\6668642.exe32⤵
- Executes dropped EXE
PID:4536 -
\??\c:\9rxlxrf.exec:\9rxlxrf.exe33⤵
- Executes dropped EXE
PID:2020 -
\??\c:\844204.exec:\844204.exe34⤵
- Executes dropped EXE
PID:3684 -
\??\c:\frrfrlf.exec:\frrfrlf.exe35⤵
- Executes dropped EXE
PID:1792 -
\??\c:\884266.exec:\884266.exe36⤵
- Executes dropped EXE
PID:5084 -
\??\c:\4880806.exec:\4880806.exe37⤵
- Executes dropped EXE
PID:3772 -
\??\c:\04082.exec:\04082.exe38⤵
- Executes dropped EXE
PID:4292 -
\??\c:\fllxlfr.exec:\fllxlfr.exe39⤵
- Executes dropped EXE
PID:408 -
\??\c:\s0226.exec:\s0226.exe40⤵
- Executes dropped EXE
PID:4008 -
\??\c:\djjvj.exec:\djjvj.exe41⤵
- Executes dropped EXE
PID:5048 -
\??\c:\0444206.exec:\0444206.exe42⤵
- Executes dropped EXE
PID:1876 -
\??\c:\pvvjv.exec:\pvvjv.exe43⤵
- Executes dropped EXE
PID:1032 -
\??\c:\bthbbt.exec:\bthbbt.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\662648.exec:\662648.exe45⤵
- Executes dropped EXE
PID:4780 -
\??\c:\424200.exec:\424200.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nbbhhb.exec:\nbbhhb.exe47⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rrlfxrf.exec:\rrlfxrf.exe48⤵
- Executes dropped EXE
PID:4940 -
\??\c:\68464.exec:\68464.exe49⤵
- Executes dropped EXE
PID:4320 -
\??\c:\82204.exec:\82204.exe50⤵
- Executes dropped EXE
PID:4904 -
\??\c:\222648.exec:\222648.exe51⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dvpvd.exec:\dvpvd.exe52⤵
- Executes dropped EXE
PID:3112 -
\??\c:\rlrflxx.exec:\rlrflxx.exe53⤵
- Executes dropped EXE
PID:2468 -
\??\c:\4842200.exec:\4842200.exe54⤵
- Executes dropped EXE
PID:4824 -
\??\c:\0886486.exec:\0886486.exe55⤵
- Executes dropped EXE
PID:632 -
\??\c:\44464.exec:\44464.exe56⤵
- Executes dropped EXE
PID:4976 -
\??\c:\5btnbt.exec:\5btnbt.exe57⤵
- Executes dropped EXE
PID:1724 -
\??\c:\hnnnnh.exec:\hnnnnh.exe58⤵
- Executes dropped EXE
PID:4284 -
\??\c:\c224264.exec:\c224264.exe59⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1pjvj.exec:\1pjvj.exe60⤵
- Executes dropped EXE
PID:3584 -
\??\c:\lllxfxr.exec:\lllxfxr.exe61⤵
- Executes dropped EXE
PID:3532 -
\??\c:\66620.exec:\66620.exe62⤵
- Executes dropped EXE
PID:3312 -
\??\c:\426024.exec:\426024.exe63⤵
- Executes dropped EXE
PID:1780 -
\??\c:\dvdpv.exec:\dvdpv.exe64⤵
- Executes dropped EXE
PID:5100 -
\??\c:\pdddp.exec:\pdddp.exe65⤵
- Executes dropped EXE
PID:4312 -
\??\c:\2224264.exec:\2224264.exe66⤵PID:4456
-
\??\c:\60608.exec:\60608.exe67⤵PID:1852
-
\??\c:\fllxlfr.exec:\fllxlfr.exe68⤵PID:2460
-
\??\c:\jvpjv.exec:\jvpjv.exe69⤵PID:5032
-
\??\c:\nnnthb.exec:\nnnthb.exe70⤵PID:1904
-
\??\c:\20464.exec:\20464.exe71⤵PID:1556
-
\??\c:\hnnthb.exec:\hnnthb.exe72⤵PID:636
-
\??\c:\dppdp.exec:\dppdp.exe73⤵PID:2812
-
\??\c:\200482.exec:\200482.exe74⤵PID:1628
-
\??\c:\082026.exec:\082026.exe75⤵PID:3024
-
\??\c:\628008.exec:\628008.exe76⤵PID:3580
-
\??\c:\lrlxlxl.exec:\lrlxlxl.exe77⤵PID:5064
-
\??\c:\xlrfxrr.exec:\xlrfxrr.exe78⤵PID:2984
-
\??\c:\42466.exec:\42466.exe79⤵PID:844
-
\??\c:\djjvj.exec:\djjvj.exe80⤵PID:2800
-
\??\c:\lffrfxl.exec:\lffrfxl.exe81⤵PID:4396
-
\??\c:\vdjdp.exec:\vdjdp.exe82⤵PID:4588
-
\??\c:\w88086.exec:\w88086.exe83⤵PID:4752
-
\??\c:\88864.exec:\88864.exe84⤵PID:2760
-
\??\c:\6448484.exec:\6448484.exe85⤵PID:2292
-
\??\c:\600424.exec:\600424.exe86⤵PID:4524
-
\??\c:\4620826.exec:\4620826.exe87⤵PID:4584
-
\??\c:\822660.exec:\822660.exe88⤵PID:3664
-
\??\c:\nbbntn.exec:\nbbntn.exe89⤵PID:1036
-
\??\c:\bbbnbn.exec:\bbbnbn.exe90⤵PID:3028
-
\??\c:\vjdpd.exec:\vjdpd.exe91⤵PID:2384
-
\??\c:\rffrfxl.exec:\rffrfxl.exe92⤵PID:1592
-
\??\c:\jvvdj.exec:\jvvdj.exe93⤵PID:2568
-
\??\c:\200804.exec:\200804.exe94⤵PID:1916
-
\??\c:\tbthth.exec:\tbthth.exe95⤵PID:1352
-
\??\c:\hnnbtn.exec:\hnnbtn.exe96⤵PID:2020
-
\??\c:\thhnth.exec:\thhnth.exe97⤵PID:3684
-
\??\c:\q84226.exec:\q84226.exe98⤵PID:1792
-
\??\c:\600804.exec:\600804.exe99⤵PID:5084
-
\??\c:\9bnbnb.exec:\9bnbnb.exe100⤵PID:3064
-
\??\c:\2008048.exec:\2008048.exe101⤵PID:212
-
\??\c:\4268608.exec:\4268608.exe102⤵PID:428
-
\??\c:\u886820.exec:\u886820.exe103⤵PID:3856
-
\??\c:\nbtbnh.exec:\nbtbnh.exe104⤵PID:4764
-
\??\c:\5lllxrx.exec:\5lllxrx.exe105⤵PID:520
-
\??\c:\s6642.exec:\s6642.exe106⤵PID:972
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe107⤵PID:3504
-
\??\c:\i608264.exec:\i608264.exe108⤵PID:1252
-
\??\c:\i008608.exec:\i008608.exe109⤵PID:2976
-
\??\c:\a2642.exec:\a2642.exe110⤵PID:1860
-
\??\c:\bnhtbt.exec:\bnhtbt.exe111⤵PID:4940
-
\??\c:\vddjv.exec:\vddjv.exe112⤵PID:2840
-
\??\c:\xrrlxlf.exec:\xrrlxlf.exe113⤵PID:4440
-
\??\c:\ttbthn.exec:\ttbthn.exe114⤵PID:4208
-
\??\c:\dvpdv.exec:\dvpdv.exe115⤵PID:2128
-
\??\c:\pjjjd.exec:\pjjjd.exe116⤵PID:2304
-
\??\c:\822082.exec:\822082.exe117⤵PID:3428
-
\??\c:\86642.exec:\86642.exe118⤵PID:4132
-
\??\c:\7jjpv.exec:\7jjpv.exe119⤵PID:2452
-
\??\c:\08208.exec:\08208.exe120⤵PID:4964
-
\??\c:\httnbt.exec:\httnbt.exe121⤵PID:1672
-
\??\c:\s6646.exec:\s6646.exe122⤵PID:2464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-