Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 14:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe
-
Size
454KB
-
MD5
4e08766b377bed8897d4deecfc658a8d
-
SHA1
7fce2db831fc81f669885f59d942542dca05297a
-
SHA256
d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7
-
SHA512
5fd3c2970d3f29dbc692f8d7910720a39cad52ff14eaa1b1521b1f48e9e42114704592d46bf3ecdfb89be20bc7d9f4d3ea8366ace54b94e98f67408531c737c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3444-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-1058-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-1071-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-1430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-1862-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3444 1fxlxrf.exe 3536 flrrfxx.exe 948 xfxrfxl.exe 4936 hbbttn.exe 4536 xlfrfxl.exe 4928 nbbbtt.exe 3580 bnnnhh.exe 2864 jjddd.exe 2868 vpvvp.exe 4448 7btnhn.exe 548 vdppp.exe 4668 7lxfrlr.exe 3004 rrrlxxr.exe 2560 3tnhbb.exe 4772 ddddv.exe 3396 xlrrxxl.exe 1472 nnbnnb.exe 960 ppvvd.exe 2252 vvdjj.exe 4848 lxxxrrx.exe 2756 xlllfrx.exe 4440 ttnbtn.exe 1856 vjpjd.exe 1092 9jddj.exe 4776 frxrllf.exe 3188 nttnhh.exe 3016 htbhbh.exe 4476 7jvpj.exe 3944 vvvjd.exe 4060 ffrrxxx.exe 4796 nnnnhb.exe 4008 hthbhb.exe 5112 jppjj.exe 832 rrrfxrr.exe 4364 9flfxff.exe 5104 ttnnnt.exe 384 7tnhbb.exe 4356 dpvpv.exe 4728 rlrlffx.exe 2116 5ffxrrl.exe 4028 1tbtnn.exe 1528 9tnnhh.exe 1020 ddjdv.exe 1576 xxrlrrr.exe 4588 3rxxrrr.exe 4416 ntnhbb.exe 4644 djjjj.exe 2320 ppjjd.exe 3836 rflfllx.exe 4736 tttbhh.exe 1608 tnhhbh.exe 2928 pvvvp.exe 2368 jpvpv.exe 3936 llfrffx.exe 3900 1hbtnn.exe 3868 hhnhbb.exe 4872 vpdjd.exe 4292 5xxrrrx.exe 948 1rrlffx.exe 1796 hhnbtb.exe 5092 pppjd.exe 3472 pvvvp.exe 1764 xfxxrrl.exe 3932 bnhbbn.exe -
resource yara_rule behavioral2/memory/3444-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-844-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4436 wrote to memory of 3444 4436 d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe 83 PID 4436 wrote to memory of 3444 4436 d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe 83 PID 4436 wrote to memory of 3444 4436 d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe 83 PID 3444 wrote to memory of 3536 3444 1fxlxrf.exe 84 PID 3444 wrote to memory of 3536 3444 1fxlxrf.exe 84 PID 3444 wrote to memory of 3536 3444 1fxlxrf.exe 84 PID 3536 wrote to memory of 948 3536 flrrfxx.exe 85 PID 3536 wrote to memory of 948 3536 flrrfxx.exe 85 PID 3536 wrote to memory of 948 3536 flrrfxx.exe 85 PID 948 wrote to memory of 4936 948 xfxrfxl.exe 86 PID 948 wrote to memory of 4936 948 xfxrfxl.exe 86 PID 948 wrote to memory of 4936 948 xfxrfxl.exe 86 PID 4936 wrote to memory of 4536 4936 hbbttn.exe 87 PID 4936 wrote to memory of 4536 4936 hbbttn.exe 87 PID 4936 wrote to memory of 4536 4936 hbbttn.exe 87 PID 4536 wrote to memory of 4928 4536 xlfrfxl.exe 88 PID 4536 wrote to memory of 4928 4536 xlfrfxl.exe 88 PID 4536 wrote to memory of 4928 4536 xlfrfxl.exe 88 PID 4928 wrote to memory of 3580 4928 nbbbtt.exe 89 PID 4928 wrote to memory of 3580 4928 nbbbtt.exe 89 PID 4928 wrote to memory of 3580 4928 nbbbtt.exe 89 PID 3580 wrote to memory of 2864 3580 bnnnhh.exe 90 PID 3580 wrote to memory of 2864 3580 bnnnhh.exe 90 PID 3580 wrote to memory of 2864 3580 bnnnhh.exe 90 PID 2864 wrote to memory of 2868 2864 jjddd.exe 91 PID 2864 wrote to memory of 2868 2864 jjddd.exe 91 PID 2864 wrote to memory of 2868 2864 jjddd.exe 91 PID 2868 wrote to memory of 4448 2868 vpvvp.exe 92 PID 2868 wrote to memory of 4448 2868 vpvvp.exe 92 PID 2868 wrote to memory of 4448 2868 vpvvp.exe 92 PID 4448 wrote to memory of 548 4448 7btnhn.exe 93 PID 4448 wrote to memory of 548 4448 7btnhn.exe 93 PID 4448 wrote to memory of 548 4448 7btnhn.exe 93 PID 548 wrote to memory of 4668 548 vdppp.exe 94 PID 548 wrote to memory of 4668 548 vdppp.exe 94 PID 548 wrote to memory of 4668 548 vdppp.exe 94 PID 4668 wrote to memory of 3004 4668 7lxfrlr.exe 95 PID 4668 wrote to memory of 3004 4668 7lxfrlr.exe 95 PID 4668 wrote to memory of 3004 4668 7lxfrlr.exe 95 PID 3004 wrote to memory of 2560 3004 rrrlxxr.exe 96 PID 3004 wrote to memory of 2560 3004 rrrlxxr.exe 96 PID 3004 wrote to memory of 2560 3004 rrrlxxr.exe 96 PID 2560 wrote to memory of 4772 2560 3tnhbb.exe 97 PID 2560 wrote to memory of 4772 2560 3tnhbb.exe 97 PID 2560 wrote to memory of 4772 2560 3tnhbb.exe 97 PID 4772 wrote to memory of 3396 4772 ddddv.exe 98 PID 4772 wrote to memory of 3396 4772 ddddv.exe 98 PID 4772 wrote to memory of 3396 4772 ddddv.exe 98 PID 3396 wrote to memory of 1472 3396 xlrrxxl.exe 99 PID 3396 wrote to memory of 1472 3396 xlrrxxl.exe 99 PID 3396 wrote to memory of 1472 3396 xlrrxxl.exe 99 PID 1472 wrote to memory of 960 1472 nnbnnb.exe 100 PID 1472 wrote to memory of 960 1472 nnbnnb.exe 100 PID 1472 wrote to memory of 960 1472 nnbnnb.exe 100 PID 960 wrote to memory of 2252 960 ppvvd.exe 101 PID 960 wrote to memory of 2252 960 ppvvd.exe 101 PID 960 wrote to memory of 2252 960 ppvvd.exe 101 PID 2252 wrote to memory of 4848 2252 vvdjj.exe 102 PID 2252 wrote to memory of 4848 2252 vvdjj.exe 102 PID 2252 wrote to memory of 4848 2252 vvdjj.exe 102 PID 4848 wrote to memory of 2756 4848 lxxxrrx.exe 103 PID 4848 wrote to memory of 2756 4848 lxxxrrx.exe 103 PID 4848 wrote to memory of 2756 4848 lxxxrrx.exe 103 PID 2756 wrote to memory of 4440 2756 xlllfrx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe"C:\Users\Admin\AppData\Local\Temp\d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\1fxlxrf.exec:\1fxlxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\flrrfxx.exec:\flrrfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\xfxrfxl.exec:\xfxrfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\hbbttn.exec:\hbbttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\nbbbtt.exec:\nbbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\bnnnhh.exec:\bnnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\jjddd.exec:\jjddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vpvvp.exec:\vpvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\7btnhn.exec:\7btnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\vdppp.exec:\vdppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\7lxfrlr.exec:\7lxfrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\rrrlxxr.exec:\rrrlxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\3tnhbb.exec:\3tnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ddddv.exec:\ddddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\xlrrxxl.exec:\xlrrxxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\nnbnnb.exec:\nnbnnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\ppvvd.exec:\ppvvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\vvdjj.exec:\vvdjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\lxxxrrx.exec:\lxxxrrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\xlllfrx.exec:\xlllfrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\ttnbtn.exec:\ttnbtn.exe23⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vjpjd.exec:\vjpjd.exe24⤵
- Executes dropped EXE
PID:1856 -
\??\c:\9jddj.exec:\9jddj.exe25⤵
- Executes dropped EXE
PID:1092 -
\??\c:\frxrllf.exec:\frxrllf.exe26⤵
- Executes dropped EXE
PID:4776 -
\??\c:\nttnhh.exec:\nttnhh.exe27⤵
- Executes dropped EXE
PID:3188 -
\??\c:\htbhbh.exec:\htbhbh.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7jvpj.exec:\7jvpj.exe29⤵
- Executes dropped EXE
PID:4476 -
\??\c:\vvvjd.exec:\vvvjd.exe30⤵
- Executes dropped EXE
PID:3944 -
\??\c:\ffrrxxx.exec:\ffrrxxx.exe31⤵
- Executes dropped EXE
PID:4060 -
\??\c:\nnnnhb.exec:\nnnnhb.exe32⤵
- Executes dropped EXE
PID:4796 -
\??\c:\hthbhb.exec:\hthbhb.exe33⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jppjj.exec:\jppjj.exe34⤵
- Executes dropped EXE
PID:5112 -
\??\c:\rrrfxrr.exec:\rrrfxrr.exe35⤵
- Executes dropped EXE
PID:832 -
\??\c:\9flfxff.exec:\9flfxff.exe36⤵
- Executes dropped EXE
PID:4364 -
\??\c:\ttnnnt.exec:\ttnnnt.exe37⤵
- Executes dropped EXE
PID:5104 -
\??\c:\7tnhbb.exec:\7tnhbb.exe38⤵
- Executes dropped EXE
PID:384 -
\??\c:\dpvpv.exec:\dpvpv.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\rlrlffx.exec:\rlrlffx.exe40⤵
- Executes dropped EXE
PID:4728 -
\??\c:\5ffxrrl.exec:\5ffxrrl.exe41⤵
- Executes dropped EXE
PID:2116 -
\??\c:\1tbtnn.exec:\1tbtnn.exe42⤵
- Executes dropped EXE
PID:4028 -
\??\c:\9tnnhh.exec:\9tnnhh.exe43⤵
- Executes dropped EXE
PID:1528 -
\??\c:\ddjdv.exec:\ddjdv.exe44⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xxrlrrr.exec:\xxrlrrr.exe45⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3rxxrrr.exec:\3rxxrrr.exe46⤵
- Executes dropped EXE
PID:4588 -
\??\c:\ntnhbb.exec:\ntnhbb.exe47⤵
- Executes dropped EXE
PID:4416 -
\??\c:\djjjj.exec:\djjjj.exe48⤵
- Executes dropped EXE
PID:4644 -
\??\c:\ppjjd.exec:\ppjjd.exe49⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rflfllx.exec:\rflfllx.exe50⤵
- Executes dropped EXE
PID:3836 -
\??\c:\tttbhh.exec:\tttbhh.exe51⤵
- Executes dropped EXE
PID:4736 -
\??\c:\tnhhbh.exec:\tnhhbh.exe52⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pvvvp.exec:\pvvvp.exe53⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jpvpv.exec:\jpvpv.exe54⤵
- Executes dropped EXE
PID:2368 -
\??\c:\llfrffx.exec:\llfrffx.exe55⤵
- Executes dropped EXE
PID:3936 -
\??\c:\1hbtnn.exec:\1hbtnn.exe56⤵
- Executes dropped EXE
PID:3900 -
\??\c:\hhnhbb.exec:\hhnhbb.exe57⤵
- Executes dropped EXE
PID:3868 -
\??\c:\vpdjd.exec:\vpdjd.exe58⤵
- Executes dropped EXE
PID:4872 -
\??\c:\5xxrrrx.exec:\5xxrrrx.exe59⤵
- Executes dropped EXE
PID:4292 -
\??\c:\1rrlffx.exec:\1rrlffx.exe60⤵
- Executes dropped EXE
PID:948 -
\??\c:\hhnbtb.exec:\hhnbtb.exe61⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pppjd.exec:\pppjd.exe62⤵
- Executes dropped EXE
PID:5092 -
\??\c:\pvvvp.exec:\pvvvp.exe63⤵
- Executes dropped EXE
PID:3472 -
\??\c:\xfxxrrl.exec:\xfxxrrl.exe64⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bnhbbn.exec:\bnhbbn.exe65⤵
- Executes dropped EXE
PID:3932 -
\??\c:\hbbhhh.exec:\hbbhhh.exe66⤵PID:392
-
\??\c:\pdvvp.exec:\pdvvp.exe67⤵PID:4540
-
\??\c:\bhbnhb.exec:\bhbnhb.exe68⤵PID:3580
-
\??\c:\vdvpj.exec:\vdvpj.exe69⤵PID:2608
-
\??\c:\7fxllxx.exec:\7fxllxx.exe70⤵PID:2036
-
\??\c:\ffffllr.exec:\ffffllr.exe71⤵PID:4748
-
\??\c:\btbtnn.exec:\btbtnn.exe72⤵PID:1160
-
\??\c:\vdjdp.exec:\vdjdp.exe73⤵PID:3476
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe74⤵PID:3428
-
\??\c:\3tbbhb.exec:\3tbbhb.exe75⤵PID:1840
-
\??\c:\vdjjp.exec:\vdjjp.exe76⤵PID:4100
-
\??\c:\lfrlffx.exec:\lfrlffx.exe77⤵PID:3208
-
\??\c:\5rxrxxx.exec:\5rxrxxx.exe78⤵PID:3048
-
\??\c:\djpjd.exec:\djpjd.exe79⤵PID:4264
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe80⤵PID:4208
-
\??\c:\3hhtnn.exec:\3hhtnn.exe81⤵PID:3348
-
\??\c:\vdddv.exec:\vdddv.exe82⤵PID:5056
-
\??\c:\httttt.exec:\httttt.exe83⤵PID:4048
-
\??\c:\pdpdd.exec:\pdpdd.exe84⤵PID:1880
-
\??\c:\5bbtnn.exec:\5bbtnn.exe85⤵PID:1092
-
\??\c:\vdjdv.exec:\vdjdv.exe86⤵PID:1680
-
\??\c:\rxllrrx.exec:\rxllrrx.exe87⤵PID:3188
-
\??\c:\3tnhtt.exec:\3tnhtt.exe88⤵PID:4108
-
\??\c:\5pjdj.exec:\5pjdj.exe89⤵PID:3840
-
\??\c:\pvppj.exec:\pvppj.exe90⤵PID:1260
-
\??\c:\3rllflf.exec:\3rllflf.exe91⤵PID:964
-
\??\c:\1hhhhn.exec:\1hhhhn.exe92⤵PID:4852
-
\??\c:\xffxxxx.exec:\xffxxxx.exe93⤵PID:4640
-
\??\c:\ttbtbb.exec:\ttbtbb.exe94⤵PID:740
-
\??\c:\9vdvv.exec:\9vdvv.exe95⤵PID:2664
-
\??\c:\thnhbb.exec:\thnhbb.exe96⤵PID:3952
-
\??\c:\vjjdj.exec:\vjjdj.exe97⤵PID:2468
-
\??\c:\djdvp.exec:\djdvp.exe98⤵PID:4532
-
\??\c:\xxrrlll.exec:\xxrrlll.exe99⤵PID:3928
-
\??\c:\5ntttt.exec:\5ntttt.exe100⤵PID:4600
-
\??\c:\dppdd.exec:\dppdd.exe101⤵PID:3636
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe102⤵PID:4892
-
\??\c:\rlllfff.exec:\rlllfff.exe103⤵PID:1184
-
\??\c:\5pjdv.exec:\5pjdv.exe104⤵PID:3024
-
\??\c:\fflffff.exec:\fflffff.exe105⤵PID:1920
-
\??\c:\9hhhbb.exec:\9hhhbb.exe106⤵PID:4348
-
\??\c:\jdjdv.exec:\jdjdv.exe107⤵PID:2428
-
\??\c:\fxxlfrr.exec:\fxxlfrr.exe108⤵PID:3860
-
\??\c:\bhnntt.exec:\bhnntt.exe109⤵PID:4148
-
\??\c:\dpvvv.exec:\dpvvv.exe110⤵PID:2928
-
\??\c:\bbttnn.exec:\bbttnn.exe111⤵PID:5068
-
\??\c:\vddvv.exec:\vddvv.exe112⤵PID:1640
-
\??\c:\1frlfrr.exec:\1frlfrr.exe113⤵PID:708
-
\??\c:\ffxrllf.exec:\ffxrllf.exe114⤵PID:3536
-
\??\c:\pdvvv.exec:\pdvvv.exe115⤵
- System Location Discovery: System Language Discovery
PID:3684 -
\??\c:\rflfflf.exec:\rflfflf.exe116⤵PID:4872
-
\??\c:\rfrrllf.exec:\rfrrllf.exe117⤵PID:4436
-
\??\c:\bnhhhh.exec:\bnhhhh.exe118⤵PID:3412
-
\??\c:\vvjjd.exec:\vvjjd.exe119⤵PID:4832
-
\??\c:\fflflrl.exec:\fflflrl.exe120⤵PID:1852
-
\??\c:\1fllfrr.exec:\1fllfrr.exe121⤵PID:3616
-
\??\c:\htttnn.exec:\htttnn.exe122⤵PID:4384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-