Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 14:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a601f4f0e79d977b465702819ba5fefcc85472326b0a2e1b180a25d1ab07b1c8.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
a601f4f0e79d977b465702819ba5fefcc85472326b0a2e1b180a25d1ab07b1c8.exe
-
Size
454KB
-
MD5
3e4a6ff5aa3bc6d80d6b0bcd852c22cf
-
SHA1
cd9ab18cf7e2680e15c1632b0be7e9a11e916476
-
SHA256
a601f4f0e79d977b465702819ba5fefcc85472326b0a2e1b180a25d1ab07b1c8
-
SHA512
cef8a338d35b18b72c8121a80d6f58edc01939ccb89e8e5ee80541a9cbc660c64a43aebe9600007d9a3851c523a69d8391a08e66355f8e56824b26a3d48f169d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3620-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-760-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-833-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-924-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3620 hhhbtn.exe 2276 pvpjv.exe 1932 rrfffll.exe 1076 7hbbtb.exe 2716 dvjdd.exe 2280 nnbttt.exe 2896 vpdpp.exe 4232 xlfxxxx.exe 4212 rrlflxl.exe 3628 nbtnhh.exe 4088 lfxrffx.exe 4880 hnhbbb.exe 1520 nnbnbt.exe 2852 3btbtb.exe 1308 fxxlfrf.exe 964 bbhbtn.exe 4816 3pjjd.exe 5108 fffxrrr.exe 2320 5tbbhn.exe 1952 9vddp.exe 3552 rxfxlxr.exe 4732 vdddv.exe 1192 tnntnh.exe 4044 rfrrlll.exe 4800 bhtnhh.exe 2656 1nbbbh.exe 2288 xrfxrll.exe 2272 7vjjj.exe 1376 nbhnnn.exe 3384 xflfxxx.exe 2596 frffxxx.exe 1756 5jppj.exe 1888 5lrxlxx.exe 4152 dvdvv.exe 3876 xxrlrlf.exe 1288 btnhbn.exe 3872 jvjdv.exe 2204 llllllf.exe 1124 btnhhh.exe 4004 pdjdv.exe 5088 xrxfrrx.exe 4712 bthbtb.exe 2912 1dpdj.exe 228 5llfxxx.exe 4164 rrllxxf.exe 2884 hbhhbb.exe 2860 tthnhh.exe 4600 dvdvj.exe 2100 fffxrrr.exe 2888 thhbtt.exe 3644 dpvpv.exe 1532 rflfxrl.exe 3332 5frrllr.exe 1100 nthbbh.exe 1008 jvvjd.exe 2652 rxlrlrl.exe 1780 nnbnhh.exe 2948 vvdvp.exe 1200 pjvvv.exe 3940 7rfrrrr.exe 4556 tnhbbb.exe 2520 dpjdv.exe 3628 1rfrlfl.exe 4320 ttbnhh.exe -
resource yara_rule behavioral2/memory/3620-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-672-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 3620 1320 a601f4f0e79d977b465702819ba5fefcc85472326b0a2e1b180a25d1ab07b1c8.exe 83 PID 1320 wrote to memory of 3620 1320 a601f4f0e79d977b465702819ba5fefcc85472326b0a2e1b180a25d1ab07b1c8.exe 83 PID 1320 wrote to memory of 3620 1320 a601f4f0e79d977b465702819ba5fefcc85472326b0a2e1b180a25d1ab07b1c8.exe 83 PID 3620 wrote to memory of 2276 3620 hhhbtn.exe 84 PID 3620 wrote to memory of 2276 3620 hhhbtn.exe 84 PID 3620 wrote to memory of 2276 3620 hhhbtn.exe 84 PID 2276 wrote to memory of 1932 2276 pvpjv.exe 85 PID 2276 wrote to memory of 1932 2276 pvpjv.exe 85 PID 2276 wrote to memory of 1932 2276 pvpjv.exe 85 PID 1932 wrote to memory of 1076 1932 rrfffll.exe 86 PID 1932 wrote to memory of 1076 1932 rrfffll.exe 86 PID 1932 wrote to memory of 1076 1932 rrfffll.exe 86 PID 1076 wrote to memory of 2716 1076 7hbbtb.exe 87 PID 1076 wrote to memory of 2716 1076 7hbbtb.exe 87 PID 1076 wrote to memory of 2716 1076 7hbbtb.exe 87 PID 2716 wrote to memory of 2280 2716 dvjdd.exe 88 PID 2716 wrote to memory of 2280 2716 dvjdd.exe 88 PID 2716 wrote to memory of 2280 2716 dvjdd.exe 88 PID 2280 wrote to memory of 2896 2280 nnbttt.exe 89 PID 2280 wrote to memory of 2896 2280 nnbttt.exe 89 PID 2280 wrote to memory of 2896 2280 nnbttt.exe 89 PID 2896 wrote to memory of 4232 2896 vpdpp.exe 90 PID 2896 wrote to memory of 4232 2896 vpdpp.exe 90 PID 2896 wrote to memory of 4232 2896 vpdpp.exe 90 PID 4232 wrote to memory of 4212 4232 xlfxxxx.exe 91 PID 4232 wrote to memory of 4212 4232 xlfxxxx.exe 91 PID 4232 wrote to memory of 4212 4232 xlfxxxx.exe 91 PID 4212 wrote to memory of 3628 4212 rrlflxl.exe 92 PID 4212 wrote to memory of 3628 4212 rrlflxl.exe 92 PID 4212 wrote to memory of 3628 4212 rrlflxl.exe 92 PID 3628 wrote to memory of 4088 3628 nbtnhh.exe 93 PID 3628 wrote to memory of 4088 3628 nbtnhh.exe 93 PID 3628 wrote to memory of 4088 3628 nbtnhh.exe 93 PID 4088 wrote to memory of 4880 4088 lfxrffx.exe 94 PID 4088 wrote to memory of 4880 4088 lfxrffx.exe 94 PID 4088 wrote to memory of 4880 4088 lfxrffx.exe 94 PID 4880 wrote to memory of 1520 4880 hnhbbb.exe 95 PID 4880 wrote to memory of 1520 4880 hnhbbb.exe 95 PID 4880 wrote to memory of 1520 4880 hnhbbb.exe 95 PID 1520 wrote to memory of 2852 1520 nnbnbt.exe 96 PID 1520 wrote to memory of 2852 1520 nnbnbt.exe 96 PID 1520 wrote to memory of 2852 1520 nnbnbt.exe 96 PID 2852 wrote to memory of 1308 2852 3btbtb.exe 97 PID 2852 wrote to memory of 1308 2852 3btbtb.exe 97 PID 2852 wrote to memory of 1308 2852 3btbtb.exe 97 PID 1308 wrote to memory of 964 1308 fxxlfrf.exe 98 PID 1308 wrote to memory of 964 1308 fxxlfrf.exe 98 PID 1308 wrote to memory of 964 1308 fxxlfrf.exe 98 PID 964 wrote to memory of 4816 964 bbhbtn.exe 99 PID 964 wrote to memory of 4816 964 bbhbtn.exe 99 PID 964 wrote to memory of 4816 964 bbhbtn.exe 99 PID 4816 wrote to memory of 5108 4816 3pjjd.exe 100 PID 4816 wrote to memory of 5108 4816 3pjjd.exe 100 PID 4816 wrote to memory of 5108 4816 3pjjd.exe 100 PID 5108 wrote to memory of 2320 5108 fffxrrr.exe 101 PID 5108 wrote to memory of 2320 5108 fffxrrr.exe 101 PID 5108 wrote to memory of 2320 5108 fffxrrr.exe 101 PID 2320 wrote to memory of 1952 2320 5tbbhn.exe 102 PID 2320 wrote to memory of 1952 2320 5tbbhn.exe 102 PID 2320 wrote to memory of 1952 2320 5tbbhn.exe 102 PID 1952 wrote to memory of 3552 1952 9vddp.exe 103 PID 1952 wrote to memory of 3552 1952 9vddp.exe 103 PID 1952 wrote to memory of 3552 1952 9vddp.exe 103 PID 3552 wrote to memory of 4732 3552 rxfxlxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a601f4f0e79d977b465702819ba5fefcc85472326b0a2e1b180a25d1ab07b1c8.exe"C:\Users\Admin\AppData\Local\Temp\a601f4f0e79d977b465702819ba5fefcc85472326b0a2e1b180a25d1ab07b1c8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\hhhbtn.exec:\hhhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\pvpjv.exec:\pvpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\rrfffll.exec:\rrfffll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\7hbbtb.exec:\7hbbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\dvjdd.exec:\dvjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nnbttt.exec:\nnbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vpdpp.exec:\vpdpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\xlfxxxx.exec:\xlfxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\rrlflxl.exec:\rrlflxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\nbtnhh.exec:\nbtnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\lfxrffx.exec:\lfxrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\hnhbbb.exec:\hnhbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\nnbnbt.exec:\nnbnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\3btbtb.exec:\3btbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\fxxlfrf.exec:\fxxlfrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\bbhbtn.exec:\bbhbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\3pjjd.exec:\3pjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\fffxrrr.exec:\fffxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\5tbbhn.exec:\5tbbhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\9vddp.exec:\9vddp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\rxfxlxr.exec:\rxfxlxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\vdddv.exec:\vdddv.exe23⤵
- Executes dropped EXE
PID:4732 -
\??\c:\tnntnh.exec:\tnntnh.exe24⤵
- Executes dropped EXE
PID:1192 -
\??\c:\rfrrlll.exec:\rfrrlll.exe25⤵
- Executes dropped EXE
PID:4044 -
\??\c:\bhtnhh.exec:\bhtnhh.exe26⤵
- Executes dropped EXE
PID:4800 -
\??\c:\1nbbbh.exec:\1nbbbh.exe27⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xrfxrll.exec:\xrfxrll.exe28⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7vjjj.exec:\7vjjj.exe29⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nbhnnn.exec:\nbhnnn.exe30⤵
- Executes dropped EXE
PID:1376 -
\??\c:\xflfxxx.exec:\xflfxxx.exe31⤵
- Executes dropped EXE
PID:3384 -
\??\c:\frffxxx.exec:\frffxxx.exe32⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5jppj.exec:\5jppj.exe33⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5lrxlxx.exec:\5lrxlxx.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\dvdvv.exec:\dvdvv.exe35⤵
- Executes dropped EXE
PID:4152 -
\??\c:\xxrlrlf.exec:\xxrlrlf.exe36⤵
- Executes dropped EXE
PID:3876 -
\??\c:\btnhbn.exec:\btnhbn.exe37⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jvjdv.exec:\jvjdv.exe38⤵
- Executes dropped EXE
PID:3872 -
\??\c:\llllllf.exec:\llllllf.exe39⤵
- Executes dropped EXE
PID:2204 -
\??\c:\btnhhh.exec:\btnhhh.exe40⤵
- Executes dropped EXE
PID:1124 -
\??\c:\pdjdv.exec:\pdjdv.exe41⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xrxfrrx.exec:\xrxfrrx.exe42⤵
- Executes dropped EXE
PID:5088 -
\??\c:\bthbtb.exec:\bthbtb.exe43⤵
- Executes dropped EXE
PID:4712 -
\??\c:\1dpdj.exec:\1dpdj.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\5llfxxx.exec:\5llfxxx.exe45⤵
- Executes dropped EXE
PID:228 -
\??\c:\rrllxxf.exec:\rrllxxf.exe46⤵
- Executes dropped EXE
PID:4164 -
\??\c:\hbhhbb.exec:\hbhhbb.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tthnhh.exec:\tthnhh.exe48⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dvdvj.exec:\dvdvj.exe49⤵
- Executes dropped EXE
PID:4600 -
\??\c:\fffxrrr.exec:\fffxrrr.exe50⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rxfxrrf.exec:\rxfxrrf.exe51⤵PID:4340
-
\??\c:\thhbtt.exec:\thhbtt.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dpvpv.exec:\dpvpv.exe53⤵
- Executes dropped EXE
PID:3644 -
\??\c:\rflfxrl.exec:\rflfxrl.exe54⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5frrllr.exec:\5frrllr.exe55⤵
- Executes dropped EXE
PID:3332 -
\??\c:\nthbbh.exec:\nthbbh.exe56⤵
- Executes dropped EXE
PID:1100 -
\??\c:\jvvjd.exec:\jvvjd.exe57⤵
- Executes dropped EXE
PID:1008 -
\??\c:\rxlrlrl.exec:\rxlrlrl.exe58⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nnbnhh.exec:\nnbnhh.exe59⤵
- Executes dropped EXE
PID:1780 -
\??\c:\vvdvp.exec:\vvdvp.exe60⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pjvvv.exec:\pjvvv.exe61⤵
- Executes dropped EXE
PID:1200 -
\??\c:\7rfrrrr.exec:\7rfrrrr.exe62⤵
- Executes dropped EXE
PID:3940 -
\??\c:\tnhbbb.exec:\tnhbbb.exe63⤵
- Executes dropped EXE
PID:4556 -
\??\c:\dpjdv.exec:\dpjdv.exe64⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1rfrlfl.exec:\1rfrlfl.exe65⤵
- Executes dropped EXE
PID:3628 -
\??\c:\ttbnhh.exec:\ttbnhh.exe66⤵
- Executes dropped EXE
PID:4320 -
\??\c:\djjvj.exec:\djjvj.exe67⤵PID:4668
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe68⤵PID:4996
-
\??\c:\7ntnnn.exec:\7ntnnn.exe69⤵PID:1800
-
\??\c:\bbtnnt.exec:\bbtnnt.exe70⤵PID:5064
-
\??\c:\3jjpp.exec:\3jjpp.exe71⤵PID:2124
-
\??\c:\rflxfxr.exec:\rflxfxr.exe72⤵PID:2756
-
\??\c:\hhhnbb.exec:\hhhnbb.exe73⤵PID:2256
-
\??\c:\9jppp.exec:\9jppp.exe74⤵PID:3164
-
\??\c:\xxrlfxx.exec:\xxrlfxx.exe75⤵PID:1292
-
\??\c:\7xxxrll.exec:\7xxxrll.exe76⤵PID:2724
-
\??\c:\tnnhhb.exec:\tnnhhb.exe77⤵PID:3056
-
\??\c:\vpvdp.exec:\vpvdp.exe78⤵PID:4936
-
\??\c:\jjppd.exec:\jjppd.exe79⤵PID:4132
-
\??\c:\rrxrllf.exec:\rrxrllf.exe80⤵PID:4696
-
\??\c:\tbbtnn.exec:\tbbtnn.exe81⤵PID:3864
-
\??\c:\jvjdv.exec:\jvjdv.exe82⤵PID:4588
-
\??\c:\fxrrlll.exec:\fxrrlll.exe83⤵PID:4640
-
\??\c:\nntnnt.exec:\nntnnt.exe84⤵PID:760
-
\??\c:\thtnhh.exec:\thtnhh.exe85⤵PID:1660
-
\??\c:\ddvpv.exec:\ddvpv.exe86⤵PID:3672
-
\??\c:\lxxrlll.exec:\lxxrlll.exe87⤵PID:216
-
\??\c:\hntnnh.exec:\hntnnh.exe88⤵PID:4312
-
\??\c:\1jjjd.exec:\1jjjd.exe89⤵PID:2068
-
\??\c:\5pvpp.exec:\5pvpp.exe90⤵PID:2272
-
\??\c:\1rrrrrf.exec:\1rrrrrf.exe91⤵PID:4076
-
\??\c:\nbhbbt.exec:\nbhbbt.exe92⤵PID:4392
-
\??\c:\dvdvv.exec:\dvdvv.exe93⤵PID:4040
-
\??\c:\djjdd.exec:\djjdd.exe94⤵PID:4440
-
\??\c:\rrxrlll.exec:\rrxrlll.exe95⤵PID:4484
-
\??\c:\tbthht.exec:\tbthht.exe96⤵PID:2508
-
\??\c:\3ddpv.exec:\3ddpv.exe97⤵PID:1068
-
\??\c:\rflfrfx.exec:\rflfrfx.exe98⤵PID:2028
-
\??\c:\1rxlffx.exec:\1rxlffx.exe99⤵PID:4796
-
\??\c:\7nnhbb.exec:\7nnhbb.exe100⤵PID:1288
-
\??\c:\dpdjd.exec:\dpdjd.exe101⤵PID:2372
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe102⤵PID:2140
-
\??\c:\tntnhh.exec:\tntnhh.exe103⤵PID:884
-
\??\c:\pjjdv.exec:\pjjdv.exe104⤵PID:1860
-
\??\c:\frfxrrr.exec:\frfxrrr.exe105⤵PID:5088
-
\??\c:\fflffff.exec:\fflffff.exe106⤵PID:792
-
\??\c:\hhnthh.exec:\hhnthh.exe107⤵PID:2912
-
\??\c:\ddjdd.exec:\ddjdd.exe108⤵PID:3996
-
\??\c:\vjpjv.exec:\vjpjv.exe109⤵PID:1268
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe110⤵
- System Location Discovery: System Language Discovery
PID:4576 -
\??\c:\tttnhb.exec:\tttnhb.exe111⤵PID:3412
-
\??\c:\5dddp.exec:\5dddp.exe112⤵PID:4048
-
\??\c:\xrrlffx.exec:\xrrlffx.exe113⤵PID:5000
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe114⤵PID:3656
-
\??\c:\3nbbtt.exec:\3nbbtt.exe115⤵PID:1504
-
\??\c:\5vpjd.exec:\5vpjd.exe116⤵PID:1696
-
\??\c:\xlxrflf.exec:\xlxrflf.exe117⤵PID:4968
-
\??\c:\ntbtnn.exec:\ntbtnn.exe118⤵PID:3436
-
\??\c:\vppdv.exec:\vppdv.exe119⤵PID:3800
-
\??\c:\rlxrffx.exec:\rlxrffx.exe120⤵PID:4388
-
\??\c:\5xfflll.exec:\5xfflll.exe121⤵PID:1364
-
\??\c:\1ntnhh.exec:\1ntnhh.exe122⤵PID:4848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-