Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 14:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ed362f5b3acfefa92fff984c94c27e17dd2f3b53ba438fcb2da53881ea0bb0cN.exe
Resource
win7-20240708-en
7 signatures
120 seconds
General
-
Target
7ed362f5b3acfefa92fff984c94c27e17dd2f3b53ba438fcb2da53881ea0bb0cN.exe
-
Size
454KB
-
MD5
90bc83eaabf5f87a9aa6c3c0893559e0
-
SHA1
93ab5b2712277bc5317e4cd6392b0b76f380784d
-
SHA256
7ed362f5b3acfefa92fff984c94c27e17dd2f3b53ba438fcb2da53881ea0bb0c
-
SHA512
f3cbe6e1de2608b2586a246d66ffdf32282e15a9539d21a2ee491a8a959653882fc59f0beb7dc2759f0c8d7a6d3b3eddf556d26304a3814702bf4c463d77eabd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/1340-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-837-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-1576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-1733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4276 rrfxxrx.exe 3292 5bthbt.exe 4580 jjjjd.exe 3860 ffrlffr.exe 4540 vpvpp.exe 4832 7rfxlfx.exe 436 nbnhbt.exe 4300 httnbt.exe 3876 lrxrlfx.exe 2312 tthhnn.exe 32 rxlfxxx.exe 212 hbbthh.exe 2092 vjjdj.exe 5016 7xrrlrr.exe 3560 vdpjd.exe 3040 rxlxrxf.exe 3588 pjvpv.exe 4120 fxfrfxr.exe 3168 xflxrrr.exe 1528 flrlflf.exe 3064 bntbnt.exe 968 jjpjd.exe 1844 dpjdp.exe 3640 vdjvp.exe 2740 nnbnbt.exe 4576 jppdp.exe 2808 flrfrlf.exe 1048 pjdpd.exe 3456 frfxxrr.exe 4948 ppppp.exe 3196 lffflrf.exe 1652 1dpjv.exe 1352 xflxlfx.exe 1192 htthnn.exe 2860 dvdvv.exe 4216 5rflxxl.exe 3132 9rrfxxl.exe 1628 nhhbtn.exe 3336 1vpjj.exe 4152 lllxrrf.exe 2220 nttnbt.exe 2340 hbhbhb.exe 4648 9djdv.exe 1540 lfxrfxr.exe 5080 hnbtnn.exe 3276 jdpdd.exe 1556 5xrlxxr.exe 1832 jvpvv.exe 1940 rxffrrl.exe 3472 rrxrlfr.exe 1692 nbnhbb.exe 384 7pddj.exe 4916 rffxrlf.exe 3676 nbtnhh.exe 464 pppdp.exe 4500 lrrflfx.exe 1332 thhbtn.exe 3484 jjjdv.exe 3656 frrlxrf.exe 3400 3lfrxrf.exe 4360 ddvjv.exe 3528 1ppjd.exe 2684 lfrlrrl.exe 2712 bhhbtt.exe -
resource yara_rule behavioral2/memory/4276-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-1488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-1576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-1733-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 4276 1340 7ed362f5b3acfefa92fff984c94c27e17dd2f3b53ba438fcb2da53881ea0bb0cN.exe 82 PID 1340 wrote to memory of 4276 1340 7ed362f5b3acfefa92fff984c94c27e17dd2f3b53ba438fcb2da53881ea0bb0cN.exe 82 PID 1340 wrote to memory of 4276 1340 7ed362f5b3acfefa92fff984c94c27e17dd2f3b53ba438fcb2da53881ea0bb0cN.exe 82 PID 4276 wrote to memory of 3292 4276 rrfxxrx.exe 83 PID 4276 wrote to memory of 3292 4276 rrfxxrx.exe 83 PID 4276 wrote to memory of 3292 4276 rrfxxrx.exe 83 PID 3292 wrote to memory of 4580 3292 5bthbt.exe 84 PID 3292 wrote to memory of 4580 3292 5bthbt.exe 84 PID 3292 wrote to memory of 4580 3292 5bthbt.exe 84 PID 4580 wrote to memory of 3860 4580 jjjjd.exe 85 PID 4580 wrote to memory of 3860 4580 jjjjd.exe 85 PID 4580 wrote to memory of 3860 4580 jjjjd.exe 85 PID 3860 wrote to memory of 4540 3860 ffrlffr.exe 86 PID 3860 wrote to memory of 4540 3860 ffrlffr.exe 86 PID 3860 wrote to memory of 4540 3860 ffrlffr.exe 86 PID 4540 wrote to memory of 4832 4540 vpvpp.exe 87 PID 4540 wrote to memory of 4832 4540 vpvpp.exe 87 PID 4540 wrote to memory of 4832 4540 vpvpp.exe 87 PID 4832 wrote to memory of 436 4832 7rfxlfx.exe 88 PID 4832 wrote to memory of 436 4832 7rfxlfx.exe 88 PID 4832 wrote to memory of 436 4832 7rfxlfx.exe 88 PID 436 wrote to memory of 4300 436 nbnhbt.exe 89 PID 436 wrote to memory of 4300 436 nbnhbt.exe 89 PID 436 wrote to memory of 4300 436 nbnhbt.exe 89 PID 4300 wrote to memory of 3876 4300 httnbt.exe 90 PID 4300 wrote to memory of 3876 4300 httnbt.exe 90 PID 4300 wrote to memory of 3876 4300 httnbt.exe 90 PID 3876 wrote to memory of 2312 3876 lrxrlfx.exe 91 PID 3876 wrote to memory of 2312 3876 lrxrlfx.exe 91 PID 3876 wrote to memory of 2312 3876 lrxrlfx.exe 91 PID 2312 wrote to memory of 32 2312 tthhnn.exe 92 PID 2312 wrote to memory of 32 2312 tthhnn.exe 92 PID 2312 wrote to memory of 32 2312 tthhnn.exe 92 PID 32 wrote to memory of 212 32 rxlfxxx.exe 93 PID 32 wrote to memory of 212 32 rxlfxxx.exe 93 PID 32 wrote to memory of 212 32 rxlfxxx.exe 93 PID 212 wrote to memory of 2092 212 hbbthh.exe 94 PID 212 wrote to memory of 2092 212 hbbthh.exe 94 PID 212 wrote to memory of 2092 212 hbbthh.exe 94 PID 2092 wrote to memory of 5016 2092 vjjdj.exe 95 PID 2092 wrote to memory of 5016 2092 vjjdj.exe 95 PID 2092 wrote to memory of 5016 2092 vjjdj.exe 95 PID 5016 wrote to memory of 3560 5016 7xrrlrr.exe 96 PID 5016 wrote to memory of 3560 5016 7xrrlrr.exe 96 PID 5016 wrote to memory of 3560 5016 7xrrlrr.exe 96 PID 3560 wrote to memory of 3040 3560 vdpjd.exe 97 PID 3560 wrote to memory of 3040 3560 vdpjd.exe 97 PID 3560 wrote to memory of 3040 3560 vdpjd.exe 97 PID 3040 wrote to memory of 3588 3040 rxlxrxf.exe 98 PID 3040 wrote to memory of 3588 3040 rxlxrxf.exe 98 PID 3040 wrote to memory of 3588 3040 rxlxrxf.exe 98 PID 3588 wrote to memory of 4120 3588 pjvpv.exe 99 PID 3588 wrote to memory of 4120 3588 pjvpv.exe 99 PID 3588 wrote to memory of 4120 3588 pjvpv.exe 99 PID 4120 wrote to memory of 3168 4120 fxfrfxr.exe 100 PID 4120 wrote to memory of 3168 4120 fxfrfxr.exe 100 PID 4120 wrote to memory of 3168 4120 fxfrfxr.exe 100 PID 3168 wrote to memory of 1528 3168 xflxrrr.exe 101 PID 3168 wrote to memory of 1528 3168 xflxrrr.exe 101 PID 3168 wrote to memory of 1528 3168 xflxrrr.exe 101 PID 1528 wrote to memory of 3064 1528 flrlflf.exe 102 PID 1528 wrote to memory of 3064 1528 flrlflf.exe 102 PID 1528 wrote to memory of 3064 1528 flrlflf.exe 102 PID 3064 wrote to memory of 968 3064 bntbnt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ed362f5b3acfefa92fff984c94c27e17dd2f3b53ba438fcb2da53881ea0bb0cN.exe"C:\Users\Admin\AppData\Local\Temp\7ed362f5b3acfefa92fff984c94c27e17dd2f3b53ba438fcb2da53881ea0bb0cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\rrfxxrx.exec:\rrfxxrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\5bthbt.exec:\5bthbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\jjjjd.exec:\jjjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\ffrlffr.exec:\ffrlffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\vpvpp.exec:\vpvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\7rfxlfx.exec:\7rfxlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\nbnhbt.exec:\nbnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\httnbt.exec:\httnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\tthhnn.exec:\tthhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\hbbthh.exec:\hbbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\vjjdj.exec:\vjjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\7xrrlrr.exec:\7xrrlrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\vdpjd.exec:\vdpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\rxlxrxf.exec:\rxlxrxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\pjvpv.exec:\pjvpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\fxfrfxr.exec:\fxfrfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\xflxrrr.exec:\xflxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\flrlflf.exec:\flrlflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\bntbnt.exec:\bntbnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\jjpjd.exec:\jjpjd.exe23⤵
- Executes dropped EXE
PID:968 -
\??\c:\dpjdp.exec:\dpjdp.exe24⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vdjvp.exec:\vdjvp.exe25⤵
- Executes dropped EXE
PID:3640 -
\??\c:\nnbnbt.exec:\nnbnbt.exe26⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jppdp.exec:\jppdp.exe27⤵
- Executes dropped EXE
PID:4576 -
\??\c:\flrfrlf.exec:\flrfrlf.exe28⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pjdpd.exec:\pjdpd.exe29⤵
- Executes dropped EXE
PID:1048 -
\??\c:\frfxxrr.exec:\frfxxrr.exe30⤵
- Executes dropped EXE
PID:3456 -
\??\c:\ppppp.exec:\ppppp.exe31⤵
- Executes dropped EXE
PID:4948 -
\??\c:\lffflrf.exec:\lffflrf.exe32⤵
- Executes dropped EXE
PID:3196 -
\??\c:\1dpjv.exec:\1dpjv.exe33⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xflxlfx.exec:\xflxlfx.exe34⤵
- Executes dropped EXE
PID:1352 -
\??\c:\htthnn.exec:\htthnn.exe35⤵
- Executes dropped EXE
PID:1192 -
\??\c:\dvdvv.exec:\dvdvv.exe36⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5rflxxl.exec:\5rflxxl.exe37⤵
- Executes dropped EXE
PID:4216 -
\??\c:\9rrfxxl.exec:\9rrfxxl.exe38⤵
- Executes dropped EXE
PID:3132 -
\??\c:\nhhbtn.exec:\nhhbtn.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1628 -
\??\c:\1vpjj.exec:\1vpjj.exe40⤵
- Executes dropped EXE
PID:3336 -
\??\c:\lllxrrf.exec:\lllxrrf.exe41⤵
- Executes dropped EXE
PID:4152 -
\??\c:\nttnbt.exec:\nttnbt.exe42⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hbhbhb.exec:\hbhbhb.exe43⤵
- Executes dropped EXE
PID:2340 -
\??\c:\9djdv.exec:\9djdv.exe44⤵
- Executes dropped EXE
PID:4648 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe45⤵
- Executes dropped EXE
PID:1540 -
\??\c:\hnbtnn.exec:\hnbtnn.exe46⤵
- Executes dropped EXE
PID:5080 -
\??\c:\jdpdd.exec:\jdpdd.exe47⤵
- Executes dropped EXE
PID:3276 -
\??\c:\5xrlxxr.exec:\5xrlxxr.exe48⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ttbtnh.exec:\ttbtnh.exe49⤵PID:4536
-
\??\c:\jvpvv.exec:\jvpvv.exe50⤵
- Executes dropped EXE
PID:1832 -
\??\c:\rxffrrl.exec:\rxffrrl.exe51⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rrxrlfr.exec:\rrxrlfr.exe52⤵
- Executes dropped EXE
PID:3472 -
\??\c:\nbnhbb.exec:\nbnhbb.exe53⤵
- Executes dropped EXE
PID:1692 -
\??\c:\7pddj.exec:\7pddj.exe54⤵
- Executes dropped EXE
PID:384 -
\??\c:\rffxrlf.exec:\rffxrlf.exe55⤵
- Executes dropped EXE
PID:4916 -
\??\c:\nbtnhh.exec:\nbtnhh.exe56⤵
- Executes dropped EXE
PID:3676 -
\??\c:\pppdp.exec:\pppdp.exe57⤵
- Executes dropped EXE
PID:464 -
\??\c:\lrrflfx.exec:\lrrflfx.exe58⤵
- Executes dropped EXE
PID:4500 -
\??\c:\thhbtn.exec:\thhbtn.exe59⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jjjdv.exec:\jjjdv.exe60⤵
- Executes dropped EXE
PID:3484 -
\??\c:\frrlxrf.exec:\frrlxrf.exe61⤵
- Executes dropped EXE
PID:3656 -
\??\c:\3lfrxrf.exec:\3lfrxrf.exe62⤵
- Executes dropped EXE
PID:3400 -
\??\c:\ddvjv.exec:\ddvjv.exe63⤵
- Executes dropped EXE
PID:4360 -
\??\c:\1ppjd.exec:\1ppjd.exe64⤵
- Executes dropped EXE
PID:3528 -
\??\c:\lfrlrrl.exec:\lfrlrrl.exe65⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bhhbtt.exec:\bhhbtt.exe66⤵
- Executes dropped EXE
PID:2712 -
\??\c:\7vjvj.exec:\7vjvj.exe67⤵PID:4176
-
\??\c:\pvvjv.exec:\pvvjv.exe68⤵PID:4848
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe69⤵PID:2200
-
\??\c:\ntbnht.exec:\ntbnht.exe70⤵PID:5088
-
\??\c:\nhhbtn.exec:\nhhbtn.exe71⤵PID:2228
-
\??\c:\vjjdp.exec:\vjjdp.exe72⤵PID:2096
-
\??\c:\frfrlxl.exec:\frfrlxl.exe73⤵PID:216
-
\??\c:\hbnhnn.exec:\hbnhnn.exe74⤵PID:1452
-
\??\c:\hnhbtn.exec:\hnhbtn.exe75⤵PID:3740
-
\??\c:\vddvj.exec:\vddvj.exe76⤵PID:2168
-
\??\c:\7lfxlfx.exec:\7lfxlfx.exe77⤵PID:2432
-
\??\c:\5xrfrfr.exec:\5xrfrfr.exe78⤵PID:4208
-
\??\c:\bnthtn.exec:\bnthtn.exe79⤵PID:3504
-
\??\c:\vdjvp.exec:\vdjvp.exe80⤵PID:1616
-
\??\c:\fxrxlff.exec:\fxrxlff.exe81⤵PID:3356
-
\??\c:\htthbt.exec:\htthbt.exe82⤵PID:1664
-
\??\c:\3pdvd.exec:\3pdvd.exe83⤵PID:832
-
\??\c:\lxfxxrf.exec:\lxfxxrf.exe84⤵PID:3892
-
\??\c:\frrlxrf.exec:\frrlxrf.exe85⤵
- System Location Discovery: System Language Discovery
PID:540 -
\??\c:\tntnhb.exec:\tntnhb.exe86⤵PID:2352
-
\??\c:\dppjd.exec:\dppjd.exe87⤵PID:2740
-
\??\c:\lxxlxll.exec:\lxxlxll.exe88⤵PID:4064
-
\??\c:\rllfxrl.exec:\rllfxrl.exe89⤵PID:1960
-
\??\c:\1hhtnh.exec:\1hhtnh.exe90⤵PID:3460
-
\??\c:\vpvvj.exec:\vpvvj.exe91⤵PID:4524
-
\??\c:\frrrlxr.exec:\frrrlxr.exe92⤵PID:1788
-
\??\c:\lllxrfx.exec:\lllxrfx.exe93⤵PID:1776
-
\??\c:\1tnthb.exec:\1tnthb.exe94⤵PID:3644
-
\??\c:\1dpdp.exec:\1dpdp.exe95⤵PID:2668
-
\??\c:\djjvj.exec:\djjvj.exe96⤵PID:2128
-
\??\c:\rxflfrl.exec:\rxflfrl.exe97⤵PID:4628
-
\??\c:\nhnhtt.exec:\nhnhtt.exe98⤵PID:4316
-
\??\c:\dppdv.exec:\dppdv.exe99⤵PID:4760
-
\??\c:\lxxlxxr.exec:\lxxlxxr.exe100⤵PID:4344
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe101⤵PID:4216
-
\??\c:\tnhnbt.exec:\tnhnbt.exe102⤵PID:2868
-
\??\c:\pdpjp.exec:\pdpjp.exe103⤵PID:4864
-
\??\c:\frrfxrl.exec:\frrfxrl.exe104⤵PID:1044
-
\??\c:\1fflflf.exec:\1fflflf.exe105⤵PID:3716
-
\??\c:\tbhnbt.exec:\tbhnbt.exe106⤵PID:1688
-
\??\c:\jpvjv.exec:\jpvjv.exe107⤵PID:2796
-
\??\c:\rxxxrxl.exec:\rxxxrxl.exe108⤵PID:4744
-
\??\c:\xrlfxrf.exec:\xrlfxrf.exe109⤵PID:4956
-
\??\c:\bhhbnh.exec:\bhhbnh.exe110⤵PID:2156
-
\??\c:\nntnhh.exec:\nntnhh.exe111⤵PID:4996
-
\??\c:\vpvjj.exec:\vpvjj.exe112⤵PID:4548
-
\??\c:\xrlxrlx.exec:\xrlxrlx.exe113⤵PID:468
-
\??\c:\1hhbnn.exec:\1hhbnn.exe114⤵PID:320
-
\??\c:\jvdpj.exec:\jvdpj.exe115⤵PID:868
-
\??\c:\1pdpd.exec:\1pdpd.exe116⤵PID:3476
-
\??\c:\lrrrlfr.exec:\lrrrlfr.exe117⤵PID:3968
-
\??\c:\htthtn.exec:\htthtn.exe118⤵PID:2124
-
\??\c:\jvpjv.exec:\jvpjv.exe119⤵
- System Location Discovery: System Language Discovery
PID:3728 -
\??\c:\pjppd.exec:\pjppd.exe120⤵PID:3860
-
\??\c:\lxxfrfx.exec:\lxxfrfx.exe121⤵PID:3676
-
\??\c:\bttnbt.exec:\bttnbt.exe122⤵PID:4540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-