Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 14:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe
-
Size
453KB
-
MD5
23e4e611d58dfe5eae01444970e258c0
-
SHA1
a56beb086813dd27225c32863dc4fd56d06376c6
-
SHA256
caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638
-
SHA512
55f92a72f96142df2de84c3229786a0f028b9cfe54d6429e5c45944c22c3232fb92ccb41c406e8b922052a31ae0b23b31e3b8a86886350a8430a8e7dc64d59f2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbee:q7Tc2NYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1052-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-856-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-887-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-997-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-1138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-1211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1644 rrfxxfx.exe 212 hhnhhn.exe 1032 vvvvp.exe 3480 xrxrrll.exe 3372 nnttbh.exe 4864 frlrlxr.exe 2592 nttbtt.exe 1904 xrllllf.exe 4148 dpdvv.exe 4396 jdppd.exe 676 hnbbbt.exe 2868 7tbbbb.exe 3420 rffffff.exe 3096 nnnnnh.exe 2724 pdjjj.exe 3984 1ffxxrr.exe 1712 ddddv.exe 2300 hhntht.exe 4624 nntnbt.exe 4392 nhhbtt.exe 2264 dpvvj.exe 4768 xfrlffx.exe 1180 nnhtnh.exe 2196 lxffxxr.exe 876 pddvj.exe 3704 frxrlrl.exe 4688 dppjd.exe 4968 lrxrrrl.exe 1980 7jpdj.exe 1636 bbhbtt.exe 4340 lrxrfff.exe 4448 9ntnhb.exe 1680 lxrrllr.exe 1832 tnhhbb.exe 2276 vdvvv.exe 3148 xrlfxxr.exe 1860 nnhbtn.exe 3216 ppjdj.exe 4832 pppjd.exe 3404 xlllfff.exe 3912 nhnhth.exe 2392 1hnhbb.exe 5020 vjppj.exe 1884 1vvvp.exe 784 xfllfff.exe 4500 nntbhn.exe 5076 1jpjj.exe 4276 vppjj.exe 4352 xrllfxr.exe 2872 bhttnn.exe 1876 vdjdd.exe 1296 xxxrrll.exe 4256 rlrlllr.exe 3132 bbntnh.exe 2332 1vdvd.exe 2616 frfxrxr.exe 4908 rrxxxxx.exe 1576 ttnnnn.exe 1956 3jjdj.exe 556 xxxxrrr.exe 2312 tntnnn.exe 2636 pjdpj.exe 1440 xrxrrrr.exe 3564 3tbtnn.exe -
resource yara_rule behavioral2/memory/1052-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-887-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-997-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1052 wrote to memory of 1644 1052 caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe 83 PID 1052 wrote to memory of 1644 1052 caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe 83 PID 1052 wrote to memory of 1644 1052 caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe 83 PID 1644 wrote to memory of 212 1644 rrfxxfx.exe 84 PID 1644 wrote to memory of 212 1644 rrfxxfx.exe 84 PID 1644 wrote to memory of 212 1644 rrfxxfx.exe 84 PID 212 wrote to memory of 1032 212 hhnhhn.exe 85 PID 212 wrote to memory of 1032 212 hhnhhn.exe 85 PID 212 wrote to memory of 1032 212 hhnhhn.exe 85 PID 1032 wrote to memory of 3480 1032 vvvvp.exe 86 PID 1032 wrote to memory of 3480 1032 vvvvp.exe 86 PID 1032 wrote to memory of 3480 1032 vvvvp.exe 86 PID 3480 wrote to memory of 3372 3480 xrxrrll.exe 87 PID 3480 wrote to memory of 3372 3480 xrxrrll.exe 87 PID 3480 wrote to memory of 3372 3480 xrxrrll.exe 87 PID 3372 wrote to memory of 4864 3372 nnttbh.exe 88 PID 3372 wrote to memory of 4864 3372 nnttbh.exe 88 PID 3372 wrote to memory of 4864 3372 nnttbh.exe 88 PID 4864 wrote to memory of 2592 4864 frlrlxr.exe 89 PID 4864 wrote to memory of 2592 4864 frlrlxr.exe 89 PID 4864 wrote to memory of 2592 4864 frlrlxr.exe 89 PID 2592 wrote to memory of 1904 2592 nttbtt.exe 90 PID 2592 wrote to memory of 1904 2592 nttbtt.exe 90 PID 2592 wrote to memory of 1904 2592 nttbtt.exe 90 PID 1904 wrote to memory of 4148 1904 xrllllf.exe 91 PID 1904 wrote to memory of 4148 1904 xrllllf.exe 91 PID 1904 wrote to memory of 4148 1904 xrllllf.exe 91 PID 4148 wrote to memory of 4396 4148 dpdvv.exe 92 PID 4148 wrote to memory of 4396 4148 dpdvv.exe 92 PID 4148 wrote to memory of 4396 4148 dpdvv.exe 92 PID 4396 wrote to memory of 676 4396 jdppd.exe 93 PID 4396 wrote to memory of 676 4396 jdppd.exe 93 PID 4396 wrote to memory of 676 4396 jdppd.exe 93 PID 676 wrote to memory of 2868 676 hnbbbt.exe 94 PID 676 wrote to memory of 2868 676 hnbbbt.exe 94 PID 676 wrote to memory of 2868 676 hnbbbt.exe 94 PID 2868 wrote to memory of 3420 2868 7tbbbb.exe 95 PID 2868 wrote to memory of 3420 2868 7tbbbb.exe 95 PID 2868 wrote to memory of 3420 2868 7tbbbb.exe 95 PID 3420 wrote to memory of 3096 3420 rffffff.exe 96 PID 3420 wrote to memory of 3096 3420 rffffff.exe 96 PID 3420 wrote to memory of 3096 3420 rffffff.exe 96 PID 3096 wrote to memory of 2724 3096 nnnnnh.exe 97 PID 3096 wrote to memory of 2724 3096 nnnnnh.exe 97 PID 3096 wrote to memory of 2724 3096 nnnnnh.exe 97 PID 2724 wrote to memory of 3984 2724 pdjjj.exe 98 PID 2724 wrote to memory of 3984 2724 pdjjj.exe 98 PID 2724 wrote to memory of 3984 2724 pdjjj.exe 98 PID 3984 wrote to memory of 1712 3984 1ffxxrr.exe 99 PID 3984 wrote to memory of 1712 3984 1ffxxrr.exe 99 PID 3984 wrote to memory of 1712 3984 1ffxxrr.exe 99 PID 1712 wrote to memory of 2300 1712 ddddv.exe 100 PID 1712 wrote to memory of 2300 1712 ddddv.exe 100 PID 1712 wrote to memory of 2300 1712 ddddv.exe 100 PID 2300 wrote to memory of 4624 2300 hhntht.exe 101 PID 2300 wrote to memory of 4624 2300 hhntht.exe 101 PID 2300 wrote to memory of 4624 2300 hhntht.exe 101 PID 4624 wrote to memory of 4392 4624 nntnbt.exe 102 PID 4624 wrote to memory of 4392 4624 nntnbt.exe 102 PID 4624 wrote to memory of 4392 4624 nntnbt.exe 102 PID 4392 wrote to memory of 2264 4392 nhhbtt.exe 103 PID 4392 wrote to memory of 2264 4392 nhhbtt.exe 103 PID 4392 wrote to memory of 2264 4392 nhhbtt.exe 103 PID 2264 wrote to memory of 4768 2264 dpvvj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe"C:\Users\Admin\AppData\Local\Temp\caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\rrfxxfx.exec:\rrfxxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\hhnhhn.exec:\hhnhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\vvvvp.exec:\vvvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\xrxrrll.exec:\xrxrrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\nnttbh.exec:\nnttbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\frlrlxr.exec:\frlrlxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\nttbtt.exec:\nttbtt.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xrllllf.exec:\xrllllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\dpdvv.exec:\dpdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\jdppd.exec:\jdppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\hnbbbt.exec:\hnbbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\7tbbbb.exec:\7tbbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rffffff.exec:\rffffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\nnnnnh.exec:\nnnnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\pdjjj.exec:\pdjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1ffxxrr.exec:\1ffxxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\ddddv.exec:\ddddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\hhntht.exec:\hhntht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\nntnbt.exec:\nntnbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\nhhbtt.exec:\nhhbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\dpvvj.exec:\dpvvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\xfrlffx.exec:\xfrlffx.exe23⤵
- Executes dropped EXE
PID:4768 -
\??\c:\nnhtnh.exec:\nnhtnh.exe24⤵
- Executes dropped EXE
PID:1180 -
\??\c:\lxffxxr.exec:\lxffxxr.exe25⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pddvj.exec:\pddvj.exe26⤵
- Executes dropped EXE
PID:876 -
\??\c:\frxrlrl.exec:\frxrlrl.exe27⤵
- Executes dropped EXE
PID:3704 -
\??\c:\dppjd.exec:\dppjd.exe28⤵
- Executes dropped EXE
PID:4688 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe29⤵
- Executes dropped EXE
PID:4968 -
\??\c:\7jpdj.exec:\7jpdj.exe30⤵
- Executes dropped EXE
PID:1980 -
\??\c:\bbhbtt.exec:\bbhbtt.exe31⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lrxrfff.exec:\lrxrfff.exe32⤵
- Executes dropped EXE
PID:4340 -
\??\c:\9ntnhb.exec:\9ntnhb.exe33⤵
- Executes dropped EXE
PID:4448 -
\??\c:\lxrrllr.exec:\lxrrllr.exe34⤵
- Executes dropped EXE
PID:1680 -
\??\c:\tnhhbb.exec:\tnhhbb.exe35⤵
- Executes dropped EXE
PID:1832 -
\??\c:\vdvvv.exec:\vdvvv.exe36⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe37⤵
- Executes dropped EXE
PID:3148 -
\??\c:\nnhbtn.exec:\nnhbtn.exe38⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ppjdj.exec:\ppjdj.exe39⤵
- Executes dropped EXE
PID:3216 -
\??\c:\pppjd.exec:\pppjd.exe40⤵
- Executes dropped EXE
PID:4832 -
\??\c:\xlllfff.exec:\xlllfff.exe41⤵
- Executes dropped EXE
PID:3404 -
\??\c:\nhnhth.exec:\nhnhth.exe42⤵
- Executes dropped EXE
PID:3912 -
\??\c:\1hnhbb.exec:\1hnhbb.exe43⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vjppj.exec:\vjppj.exe44⤵
- Executes dropped EXE
PID:5020 -
\??\c:\1vvvp.exec:\1vvvp.exe45⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xfllfff.exec:\xfllfff.exe46⤵
- Executes dropped EXE
PID:784 -
\??\c:\nntbhn.exec:\nntbhn.exe47⤵
- Executes dropped EXE
PID:4500 -
\??\c:\1jpjj.exec:\1jpjj.exe48⤵
- Executes dropped EXE
PID:5076 -
\??\c:\vppjj.exec:\vppjj.exe49⤵
- Executes dropped EXE
PID:4276 -
\??\c:\xrllfxr.exec:\xrllfxr.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4352 -
\??\c:\bhttnn.exec:\bhttnn.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vdjdd.exec:\vdjdd.exe52⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xxxrrll.exec:\xxxrrll.exe53⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rlrlllr.exec:\rlrlllr.exe54⤵
- Executes dropped EXE
PID:4256 -
\??\c:\bbntnh.exec:\bbntnh.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3132 -
\??\c:\1vdvd.exec:\1vdvd.exe56⤵
- Executes dropped EXE
PID:2332 -
\??\c:\frfxrxr.exec:\frfxrxr.exe57⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe58⤵
- Executes dropped EXE
PID:4908 -
\??\c:\ttnnnn.exec:\ttnnnn.exe59⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3jjdj.exec:\3jjdj.exe60⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe61⤵
- Executes dropped EXE
PID:556 -
\??\c:\tntnnn.exec:\tntnnn.exe62⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pjdpj.exec:\pjdpj.exe63⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe64⤵
- Executes dropped EXE
PID:1440 -
\??\c:\3tbtnn.exec:\3tbtnn.exe65⤵
- Executes dropped EXE
PID:3564 -
\??\c:\dvpjd.exec:\dvpjd.exe66⤵PID:3084
-
\??\c:\9lffxxx.exec:\9lffxxx.exe67⤵PID:4396
-
\??\c:\tbhbbh.exec:\tbhbbh.exe68⤵PID:2800
-
\??\c:\ddjjp.exec:\ddjjp.exe69⤵PID:4944
-
\??\c:\rlrllff.exec:\rlrllff.exe70⤵PID:2152
-
\??\c:\xlrrllr.exec:\xlrrllr.exe71⤵PID:3420
-
\??\c:\bbbbtb.exec:\bbbbtb.exe72⤵PID:4488
-
\??\c:\ppjdd.exec:\ppjdd.exe73⤵PID:1420
-
\??\c:\xlllfff.exec:\xlllfff.exe74⤵PID:832
-
\??\c:\nthhbn.exec:\nthhbn.exe75⤵PID:3896
-
\??\c:\5hnbhh.exec:\5hnbhh.exe76⤵PID:4660
-
\??\c:\jdjdv.exec:\jdjdv.exe77⤵PID:2492
-
\??\c:\rflffff.exec:\rflffff.exe78⤵PID:1628
-
\??\c:\tnhbbb.exec:\tnhbbb.exe79⤵PID:4056
-
\??\c:\tnbbbh.exec:\tnbbbh.exe80⤵PID:2820
-
\??\c:\jdpjp.exec:\jdpjp.exe81⤵PID:2684
-
\??\c:\fllfxxr.exec:\fllfxxr.exe82⤵PID:4676
-
\??\c:\ntbtbb.exec:\ntbtbb.exe83⤵PID:1668
-
\??\c:\pjdvj.exec:\pjdvj.exe84⤵PID:3928
-
\??\c:\frlfxxr.exec:\frlfxxr.exe85⤵PID:3500
-
\??\c:\thtntt.exec:\thtntt.exe86⤵PID:3444
-
\??\c:\bthnhn.exec:\bthnhn.exe87⤵PID:4840
-
\??\c:\7vdjd.exec:\7vdjd.exe88⤵PID:4264
-
\??\c:\frfxrlf.exec:\frfxrlf.exe89⤵PID:4524
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe90⤵PID:4384
-
\??\c:\bnnhhb.exec:\bnnhhb.exe91⤵PID:3452
-
\??\c:\vddvp.exec:\vddvp.exe92⤵PID:1148
-
\??\c:\1fffxff.exec:\1fffxff.exe93⤵PID:2676
-
\??\c:\5ttbbt.exec:\5ttbbt.exe94⤵PID:1028
-
\??\c:\djpjv.exec:\djpjv.exe95⤵PID:4536
-
\??\c:\xfrlffx.exec:\xfrlffx.exe96⤵PID:4340
-
\??\c:\bnnhbb.exec:\bnnhbb.exe97⤵PID:3676
-
\??\c:\pvjdp.exec:\pvjdp.exe98⤵PID:1680
-
\??\c:\9xxrllf.exec:\9xxrllf.exe99⤵PID:3124
-
\??\c:\hnbtbb.exec:\hnbtbb.exe100⤵PID:2276
-
\??\c:\vpddv.exec:\vpddv.exe101⤵PID:3148
-
\??\c:\frrlfxr.exec:\frrlfxr.exe102⤵PID:2772
-
\??\c:\fflrlfr.exec:\fflrlfr.exe103⤵PID:2840
-
\??\c:\bttnhh.exec:\bttnhh.exe104⤵PID:2500
-
\??\c:\jvvpj.exec:\jvvpj.exe105⤵PID:3936
-
\??\c:\1rfrfxl.exec:\1rfrfxl.exe106⤵PID:1008
-
\??\c:\3btnhh.exec:\3btnhh.exe107⤵PID:2368
-
\??\c:\pjjdv.exec:\pjjdv.exe108⤵PID:2600
-
\??\c:\xlffxxf.exec:\xlffxxf.exe109⤵PID:1584
-
\??\c:\tbhbtt.exec:\tbhbtt.exe110⤵PID:1768
-
\??\c:\dpjjv.exec:\dpjjv.exe111⤵PID:1580
-
\??\c:\5vdvj.exec:\5vdvj.exe112⤵PID:1964
-
\??\c:\lllfrlr.exec:\lllfrlr.exe113⤵PID:1032
-
\??\c:\bhnhbt.exec:\bhnhbt.exe114⤵PID:4984
-
\??\c:\vvjjp.exec:\vvjjp.exe115⤵PID:4292
-
\??\c:\3jpjj.exec:\3jpjj.exe116⤵PID:1916
-
\??\c:\1xrlffx.exec:\1xrlffx.exe117⤵PID:4864
-
\??\c:\hnttnn.exec:\hnttnn.exe118⤵
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\7jjdv.exec:\7jjdv.exe119⤵PID:3812
-
\??\c:\rxfxfxx.exec:\rxfxfxx.exe120⤵PID:1344
-
\??\c:\htbbtt.exec:\htbbtt.exe121⤵PID:4308
-
\??\c:\vvpjj.exec:\vvpjj.exe122⤵PID:4148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-