Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 14:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507.exe
-
Size
456KB
-
MD5
049dca0ed3a4b4949db1e85fa7adec28
-
SHA1
cbb55b09bb6eb46cb0adb72b0df290b33a0b4d4a
-
SHA256
548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507
-
SHA512
689f0bbc6b9700fe12b6a517a3ffbe5f9aef628db7c6b07bba976287b4e74ecf54cd0a29b4b0af66e6a2393995c6702547e97d28c9000e62ecd0be6ceb085489
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR8:q7Tc2NYHUrAwfMp3CDR8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/3620-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/424-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-951-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-1084-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2576 hbhbnn.exe 1504 pjjvp.exe 3348 lxrxlxr.exe 2716 vdppj.exe 684 bthbnb.exe 1116 9lxrxxx.exe 1948 ntnnbt.exe 1200 9ddpd.exe 3988 vvjdd.exe 396 ttthbt.exe 2536 7dpjv.exe 4880 jdvvp.exe 3504 rfxrlfx.exe 2168 vppdp.exe 2516 flrfxrf.exe 804 llrlxlx.exe 2488 3bttnn.exe 4328 pvjdv.exe 3308 thnhbt.exe 4104 dpdpp.exe 4936 xfxrllf.exe 2316 7bhtnn.exe 2640 llrlxrr.exe 732 xrllllr.exe 4632 nbnhbb.exe 184 vpvpj.exe 4036 5tttnh.exe 4992 xlxrfxl.exe 4540 jjjvp.exe 1328 9dddv.exe 1444 ppjjv.exe 4324 9nhbtt.exe 1756 jjpdp.exe 3536 5rxrffx.exe 2508 lfllxxr.exe 5092 ttbbtb.exe 4572 dpdpj.exe 2780 fxfxlfx.exe 3212 btnnnn.exe 1124 pjjvp.exe 4004 jvdpd.exe 884 rffrffx.exe 2180 tbbnhb.exe 2912 tntnhh.exe 2004 ppvjd.exe 3792 3fxlfrl.exe 3120 7thnnn.exe 2100 3ddvp.exe 5000 htnhhb.exe 3148 dpdpj.exe 4912 llxrffr.exe 3656 hhtnbt.exe 1076 pjpjv.exe 1016 1jdvd.exe 4188 lxxrxxr.exe 3408 bhhhbb.exe 2280 vpjjd.exe 1780 xxllxxr.exe 2616 nnntnn.exe 2364 jdpdd.exe 1560 xflxfxr.exe 3632 5lfxlfx.exe 4556 3tttnh.exe 4728 pvvvd.exe -
resource yara_rule behavioral2/memory/3620-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/424-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-951-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-1084-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-1731-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3620 wrote to memory of 2576 3620 548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507.exe 83 PID 3620 wrote to memory of 2576 3620 548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507.exe 83 PID 3620 wrote to memory of 2576 3620 548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507.exe 83 PID 2576 wrote to memory of 1504 2576 hbhbnn.exe 84 PID 2576 wrote to memory of 1504 2576 hbhbnn.exe 84 PID 2576 wrote to memory of 1504 2576 hbhbnn.exe 84 PID 1504 wrote to memory of 3348 1504 pjjvp.exe 85 PID 1504 wrote to memory of 3348 1504 pjjvp.exe 85 PID 1504 wrote to memory of 3348 1504 pjjvp.exe 85 PID 3348 wrote to memory of 2716 3348 lxrxlxr.exe 86 PID 3348 wrote to memory of 2716 3348 lxrxlxr.exe 86 PID 3348 wrote to memory of 2716 3348 lxrxlxr.exe 86 PID 2716 wrote to memory of 684 2716 vdppj.exe 87 PID 2716 wrote to memory of 684 2716 vdppj.exe 87 PID 2716 wrote to memory of 684 2716 vdppj.exe 87 PID 684 wrote to memory of 1116 684 bthbnb.exe 88 PID 684 wrote to memory of 1116 684 bthbnb.exe 88 PID 684 wrote to memory of 1116 684 bthbnb.exe 88 PID 1116 wrote to memory of 1948 1116 9lxrxxx.exe 89 PID 1116 wrote to memory of 1948 1116 9lxrxxx.exe 89 PID 1116 wrote to memory of 1948 1116 9lxrxxx.exe 89 PID 1948 wrote to memory of 1200 1948 ntnnbt.exe 90 PID 1948 wrote to memory of 1200 1948 ntnnbt.exe 90 PID 1948 wrote to memory of 1200 1948 ntnnbt.exe 90 PID 1200 wrote to memory of 3988 1200 9ddpd.exe 91 PID 1200 wrote to memory of 3988 1200 9ddpd.exe 91 PID 1200 wrote to memory of 3988 1200 9ddpd.exe 91 PID 3988 wrote to memory of 396 3988 vvjdd.exe 92 PID 3988 wrote to memory of 396 3988 vvjdd.exe 92 PID 3988 wrote to memory of 396 3988 vvjdd.exe 92 PID 396 wrote to memory of 2536 396 ttthbt.exe 93 PID 396 wrote to memory of 2536 396 ttthbt.exe 93 PID 396 wrote to memory of 2536 396 ttthbt.exe 93 PID 2536 wrote to memory of 4880 2536 7dpjv.exe 94 PID 2536 wrote to memory of 4880 2536 7dpjv.exe 94 PID 2536 wrote to memory of 4880 2536 7dpjv.exe 94 PID 4880 wrote to memory of 3504 4880 jdvvp.exe 95 PID 4880 wrote to memory of 3504 4880 jdvvp.exe 95 PID 4880 wrote to memory of 3504 4880 jdvvp.exe 95 PID 3504 wrote to memory of 2168 3504 rfxrlfx.exe 96 PID 3504 wrote to memory of 2168 3504 rfxrlfx.exe 96 PID 3504 wrote to memory of 2168 3504 rfxrlfx.exe 96 PID 2168 wrote to memory of 2516 2168 vppdp.exe 97 PID 2168 wrote to memory of 2516 2168 vppdp.exe 97 PID 2168 wrote to memory of 2516 2168 vppdp.exe 97 PID 2516 wrote to memory of 804 2516 flrfxrf.exe 98 PID 2516 wrote to memory of 804 2516 flrfxrf.exe 98 PID 2516 wrote to memory of 804 2516 flrfxrf.exe 98 PID 804 wrote to memory of 2488 804 llrlxlx.exe 99 PID 804 wrote to memory of 2488 804 llrlxlx.exe 99 PID 804 wrote to memory of 2488 804 llrlxlx.exe 99 PID 2488 wrote to memory of 4328 2488 3bttnn.exe 100 PID 2488 wrote to memory of 4328 2488 3bttnn.exe 100 PID 2488 wrote to memory of 4328 2488 3bttnn.exe 100 PID 4328 wrote to memory of 3308 4328 pvjdv.exe 101 PID 4328 wrote to memory of 3308 4328 pvjdv.exe 101 PID 4328 wrote to memory of 3308 4328 pvjdv.exe 101 PID 3308 wrote to memory of 4104 3308 thnhbt.exe 102 PID 3308 wrote to memory of 4104 3308 thnhbt.exe 102 PID 3308 wrote to memory of 4104 3308 thnhbt.exe 102 PID 4104 wrote to memory of 4936 4104 dpdpp.exe 103 PID 4104 wrote to memory of 4936 4104 dpdpp.exe 103 PID 4104 wrote to memory of 4936 4104 dpdpp.exe 103 PID 4936 wrote to memory of 2316 4936 xfxrllf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507.exe"C:\Users\Admin\AppData\Local\Temp\548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\hbhbnn.exec:\hbhbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\pjjvp.exec:\pjjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\lxrxlxr.exec:\lxrxlxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\vdppj.exec:\vdppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bthbnb.exec:\bthbnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\9lxrxxx.exec:\9lxrxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\ntnnbt.exec:\ntnnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\9ddpd.exec:\9ddpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\vvjdd.exec:\vvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\ttthbt.exec:\ttthbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\7dpjv.exec:\7dpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jdvvp.exec:\jdvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\vppdp.exec:\vppdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\flrfxrf.exec:\flrfxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\llrlxlx.exec:\llrlxlx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\3bttnn.exec:\3bttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\pvjdv.exec:\pvjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\thnhbt.exec:\thnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\dpdpp.exec:\dpdpp.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\xfxrllf.exec:\xfxrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\7bhtnn.exec:\7bhtnn.exe23⤵
- Executes dropped EXE
PID:2316 -
\??\c:\llrlxrr.exec:\llrlxrr.exe24⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xrllllr.exec:\xrllllr.exe25⤵
- Executes dropped EXE
PID:732 -
\??\c:\nbnhbb.exec:\nbnhbb.exe26⤵
- Executes dropped EXE
PID:4632 -
\??\c:\vpvpj.exec:\vpvpj.exe27⤵
- Executes dropped EXE
PID:184 -
\??\c:\5tttnh.exec:\5tttnh.exe28⤵
- Executes dropped EXE
PID:4036 -
\??\c:\xlxrfxl.exec:\xlxrfxl.exe29⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jjjvp.exec:\jjjvp.exe30⤵
- Executes dropped EXE
PID:4540 -
\??\c:\9dddv.exec:\9dddv.exe31⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ppjjv.exec:\ppjjv.exe32⤵
- Executes dropped EXE
PID:1444 -
\??\c:\9nhbtt.exec:\9nhbtt.exe33⤵
- Executes dropped EXE
PID:4324 -
\??\c:\jjpdp.exec:\jjpdp.exe34⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5rxrffx.exec:\5rxrffx.exe35⤵
- Executes dropped EXE
PID:3536 -
\??\c:\lfllxxr.exec:\lfllxxr.exe36⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ttbbtb.exec:\ttbbtb.exe37⤵
- Executes dropped EXE
PID:5092 -
\??\c:\dpdpj.exec:\dpdpj.exe38⤵
- Executes dropped EXE
PID:4572 -
\??\c:\fxfxlfx.exec:\fxfxlfx.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\btnnnn.exec:\btnnnn.exe40⤵
- Executes dropped EXE
PID:3212 -
\??\c:\pjjvp.exec:\pjjvp.exe41⤵
- Executes dropped EXE
PID:1124 -
\??\c:\jvdpd.exec:\jvdpd.exe42⤵
- Executes dropped EXE
PID:4004 -
\??\c:\rffrffx.exec:\rffrffx.exe43⤵
- Executes dropped EXE
PID:884 -
\??\c:\tbbnhb.exec:\tbbnhb.exe44⤵
- Executes dropped EXE
PID:2180 -
\??\c:\tntnhh.exec:\tntnhh.exe45⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ppvjd.exec:\ppvjd.exe46⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3fxlfrl.exec:\3fxlfrl.exe47⤵
- Executes dropped EXE
PID:3792 -
\??\c:\7thnnn.exec:\7thnnn.exe48⤵
- Executes dropped EXE
PID:3120 -
\??\c:\3ddvp.exec:\3ddvp.exe49⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xxfxllf.exec:\xxfxllf.exe50⤵PID:3328
-
\??\c:\htnhhb.exec:\htnhhb.exe51⤵
- Executes dropped EXE
PID:5000 -
\??\c:\dpdpj.exec:\dpdpj.exe52⤵
- Executes dropped EXE
PID:3148 -
\??\c:\llxrffr.exec:\llxrffr.exe53⤵
- Executes dropped EXE
PID:4912 -
\??\c:\hhtnbt.exec:\hhtnbt.exe54⤵
- Executes dropped EXE
PID:3656 -
\??\c:\pjpjv.exec:\pjpjv.exe55⤵
- Executes dropped EXE
PID:1076 -
\??\c:\1jdvd.exec:\1jdvd.exe56⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lxxrxxr.exec:\lxxrxxr.exe57⤵
- Executes dropped EXE
PID:4188 -
\??\c:\bhhhbb.exec:\bhhhbb.exe58⤵
- Executes dropped EXE
PID:3408 -
\??\c:\vpjjd.exec:\vpjjd.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xxllxxr.exec:\xxllxxr.exe60⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nnntnn.exec:\nnntnn.exe61⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jdpdd.exec:\jdpdd.exe62⤵
- Executes dropped EXE
PID:2364 -
\??\c:\xflxfxr.exec:\xflxfxr.exe63⤵
- Executes dropped EXE
PID:1560 -
\??\c:\5lfxlfx.exec:\5lfxlfx.exe64⤵
- Executes dropped EXE
PID:3632 -
\??\c:\3tttnh.exec:\3tttnh.exe65⤵
- Executes dropped EXE
PID:4556 -
\??\c:\pvvvd.exec:\pvvvd.exe66⤵
- Executes dropped EXE
PID:4728 -
\??\c:\lffxrlr.exec:\lffxrlr.exe67⤵PID:4976
-
\??\c:\7bbbtb.exec:\7bbbtb.exe68⤵PID:2572
-
\??\c:\vjdvv.exec:\vjdvv.exe69⤵PID:1520
-
\??\c:\frxlllx.exec:\frxlllx.exe70⤵PID:3504
-
\??\c:\bttbtb.exec:\bttbtb.exe71⤵PID:4868
-
\??\c:\vjpjv.exec:\vjpjv.exe72⤵PID:3692
-
\??\c:\5dvpj.exec:\5dvpj.exe73⤵PID:964
-
\??\c:\1flxxxl.exec:\1flxxxl.exe74⤵PID:3092
-
\??\c:\btbtnn.exec:\btbtnn.exe75⤵PID:3052
-
\??\c:\tnthhb.exec:\tnthhb.exe76⤵PID:3056
-
\??\c:\dvjdd.exec:\dvjdd.exe77⤵PID:2020
-
\??\c:\lxlrfff.exec:\lxlrfff.exe78⤵PID:2524
-
\??\c:\ntnbth.exec:\ntnbth.exe79⤵PID:3552
-
\??\c:\htbthh.exec:\htbthh.exe80⤵PID:3256
-
\??\c:\pvvpd.exec:\pvvpd.exe81⤵PID:3064
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe82⤵PID:3636
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe83⤵PID:512
-
\??\c:\1ttnbt.exec:\1ttnbt.exe84⤵PID:2640
-
\??\c:\1vpjv.exec:\1vpjv.exe85⤵PID:1684
-
\??\c:\xxxlxlf.exec:\xxxlxlf.exe86⤵PID:1852
-
\??\c:\llrlxrl.exec:\llrlxrl.exe87⤵PID:1796
-
\??\c:\bttttb.exec:\bttttb.exe88⤵PID:184
-
\??\c:\dvpjv.exec:\dvpjv.exe89⤵PID:3172
-
\??\c:\5xfrfxr.exec:\5xfrfxr.exe90⤵PID:3704
-
\??\c:\bbtnhh.exec:\bbtnhh.exe91⤵PID:1312
-
\??\c:\jjjdv.exec:\jjjdv.exe92⤵PID:3384
-
\??\c:\llrffxr.exec:\llrffxr.exe93⤵PID:1516
-
\??\c:\bhnhbt.exec:\bhnhbt.exe94⤵PID:1444
-
\??\c:\hhhbth.exec:\hhhbth.exe95⤵PID:3952
-
\??\c:\lfxrrlr.exec:\lfxrrlr.exe96⤵PID:4488
-
\??\c:\lflfrlf.exec:\lflfrlf.exe97⤵PID:1888
-
\??\c:\tttnhb.exec:\tttnhb.exe98⤵PID:4152
-
\??\c:\dppjd.exec:\dppjd.exe99⤵
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\1lrlxrl.exec:\1lrlxrl.exe100⤵PID:1288
-
\??\c:\9ntnbb.exec:\9ntnbb.exe101⤵PID:3144
-
\??\c:\hbhbnn.exec:\hbhbnn.exe102⤵PID:2372
-
\??\c:\5jdpj.exec:\5jdpj.exe103⤵PID:3212
-
\??\c:\xxrfxlx.exec:\xxrfxlx.exe104⤵PID:5048
-
\??\c:\5tthhb.exec:\5tthhb.exe105⤵PID:4004
-
\??\c:\pjvjd.exec:\pjvjd.exe106⤵PID:4524
-
\??\c:\3pjdp.exec:\3pjdp.exe107⤵PID:4980
-
\??\c:\llrfxlr.exec:\llrfxlr.exe108⤵PID:1468
-
\??\c:\9flxllx.exec:\9flxllx.exe109⤵PID:3996
-
\??\c:\5tthnh.exec:\5tthnh.exe110⤵PID:3508
-
\??\c:\jvpvp.exec:\jvpvp.exe111⤵PID:4480
-
\??\c:\xxfrfxl.exec:\xxfrfxl.exe112⤵PID:2100
-
\??\c:\hhnnbh.exec:\hhnnbh.exe113⤵PID:2276
-
\??\c:\9pddv.exec:\9pddv.exe114⤵PID:3328
-
\??\c:\pdjvj.exec:\pdjvj.exe115⤵PID:1500
-
\??\c:\lflfxrf.exec:\lflfxrf.exe116⤵PID:2576
-
\??\c:\nbtnhh.exec:\nbtnhh.exe117⤵PID:3740
-
\??\c:\pdjjj.exec:\pdjjj.exe118⤵PID:4912
-
\??\c:\llfffff.exec:\llfffff.exe119⤵PID:4968
-
\??\c:\hntbth.exec:\hntbth.exe120⤵PID:1076
-
\??\c:\jvdvv.exec:\jvdvv.exe121⤵PID:2652
-
\??\c:\5vddv.exec:\5vddv.exe122⤵PID:3848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-