Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 15:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a12d6642226b35624440eb0562a5fc6aaa2ac69ec92d1ba86dcf05285d51478d.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
a12d6642226b35624440eb0562a5fc6aaa2ac69ec92d1ba86dcf05285d51478d.exe
-
Size
454KB
-
MD5
0607cb4245702542f238db366d4d9b34
-
SHA1
3fff3985940c72703a11b6c2519a98464a1e3b9a
-
SHA256
a12d6642226b35624440eb0562a5fc6aaa2ac69ec92d1ba86dcf05285d51478d
-
SHA512
84747823e34cc1bbe03caf217e185a6ba4752757fa0b5b49cc7c23df7143659f34fdefa5f8180be31caa9c1a5cdd91e6a68dcf36dfe075395d202f822fcb431a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4592-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-810-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-817-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-1271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-1627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3984 rfrffxl.exe 2528 7jpdj.exe 2360 bnhhth.exe 4904 ttbnht.exe 1144 frrlfxr.exe 940 7nnbnh.exe 4152 5btnbb.exe 1476 7djvp.exe 1596 7bbnnb.exe 2040 bbbnbt.exe 2452 djdpd.exe 4816 fxrlfxr.exe 2680 jpdvp.exe 4620 btnbtn.exe 2408 3tbnhb.exe 3752 dppdj.exe 4740 rflfrlx.exe 3352 5nnbnb.exe 4708 pdvjv.exe 2828 7xrlfxr.exe 3776 9nhbnh.exe 1900 tbbnbn.exe 2692 vpjvp.exe 1436 xlfrlfr.exe 4088 nhhthb.exe 4448 7hhbnt.exe 3008 vpdvp.exe 4664 tbthth.exe 3568 bnhthb.exe 4736 pjvjj.exe 1280 xxfxlff.exe 3744 xrfrxrr.exe 4728 bbhbth.exe 764 7vpjd.exe 3044 httnbt.exe 3520 lrlxrrr.exe 1788 tbhhbb.exe 1492 5ntnhh.exe 2464 vjppd.exe 3164 xrxrrxr.exe 796 xxflxfx.exe 3760 bnnhhb.exe 2596 jddjd.exe 2424 flrfxlf.exe 2884 tthhth.exe 4008 htnhbt.exe 3736 pdvpj.exe 1260 rxflrlx.exe 4432 btntbt.exe 5064 jdjdd.exe 1852 xlxxrll.exe 3984 9rxxrrl.exe 2140 nnnbtt.exe 2136 pvdvj.exe 2360 dvpvj.exe 4904 frlffff.exe 3228 tnnhnh.exe 4844 3vpdv.exe 1384 pdjvp.exe 4848 frfxlfx.exe 5028 5nnhbt.exe 4532 vvdvj.exe 4320 lxxlrlx.exe 3064 5nnhht.exe -
resource yara_rule behavioral2/memory/4592-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-817-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4592 wrote to memory of 3984 4592 a12d6642226b35624440eb0562a5fc6aaa2ac69ec92d1ba86dcf05285d51478d.exe 84 PID 4592 wrote to memory of 3984 4592 a12d6642226b35624440eb0562a5fc6aaa2ac69ec92d1ba86dcf05285d51478d.exe 84 PID 4592 wrote to memory of 3984 4592 a12d6642226b35624440eb0562a5fc6aaa2ac69ec92d1ba86dcf05285d51478d.exe 84 PID 3984 wrote to memory of 2528 3984 rfrffxl.exe 85 PID 3984 wrote to memory of 2528 3984 rfrffxl.exe 85 PID 3984 wrote to memory of 2528 3984 rfrffxl.exe 85 PID 2528 wrote to memory of 2360 2528 7jpdj.exe 86 PID 2528 wrote to memory of 2360 2528 7jpdj.exe 86 PID 2528 wrote to memory of 2360 2528 7jpdj.exe 86 PID 2360 wrote to memory of 4904 2360 bnhhth.exe 87 PID 2360 wrote to memory of 4904 2360 bnhhth.exe 87 PID 2360 wrote to memory of 4904 2360 bnhhth.exe 87 PID 4904 wrote to memory of 1144 4904 ttbnht.exe 88 PID 4904 wrote to memory of 1144 4904 ttbnht.exe 88 PID 4904 wrote to memory of 1144 4904 ttbnht.exe 88 PID 1144 wrote to memory of 940 1144 frrlfxr.exe 89 PID 1144 wrote to memory of 940 1144 frrlfxr.exe 89 PID 1144 wrote to memory of 940 1144 frrlfxr.exe 89 PID 940 wrote to memory of 4152 940 7nnbnh.exe 90 PID 940 wrote to memory of 4152 940 7nnbnh.exe 90 PID 940 wrote to memory of 4152 940 7nnbnh.exe 90 PID 4152 wrote to memory of 1476 4152 5btnbb.exe 91 PID 4152 wrote to memory of 1476 4152 5btnbb.exe 91 PID 4152 wrote to memory of 1476 4152 5btnbb.exe 91 PID 1476 wrote to memory of 1596 1476 7djvp.exe 92 PID 1476 wrote to memory of 1596 1476 7djvp.exe 92 PID 1476 wrote to memory of 1596 1476 7djvp.exe 92 PID 1596 wrote to memory of 2040 1596 7bbnnb.exe 93 PID 1596 wrote to memory of 2040 1596 7bbnnb.exe 93 PID 1596 wrote to memory of 2040 1596 7bbnnb.exe 93 PID 2040 wrote to memory of 2452 2040 bbbnbt.exe 94 PID 2040 wrote to memory of 2452 2040 bbbnbt.exe 94 PID 2040 wrote to memory of 2452 2040 bbbnbt.exe 94 PID 2452 wrote to memory of 4816 2452 djdpd.exe 95 PID 2452 wrote to memory of 4816 2452 djdpd.exe 95 PID 2452 wrote to memory of 4816 2452 djdpd.exe 95 PID 4816 wrote to memory of 2680 4816 fxrlfxr.exe 96 PID 4816 wrote to memory of 2680 4816 fxrlfxr.exe 96 PID 4816 wrote to memory of 2680 4816 fxrlfxr.exe 96 PID 2680 wrote to memory of 4620 2680 jpdvp.exe 97 PID 2680 wrote to memory of 4620 2680 jpdvp.exe 97 PID 2680 wrote to memory of 4620 2680 jpdvp.exe 97 PID 4620 wrote to memory of 2408 4620 btnbtn.exe 98 PID 4620 wrote to memory of 2408 4620 btnbtn.exe 98 PID 4620 wrote to memory of 2408 4620 btnbtn.exe 98 PID 2408 wrote to memory of 3752 2408 3tbnhb.exe 99 PID 2408 wrote to memory of 3752 2408 3tbnhb.exe 99 PID 2408 wrote to memory of 3752 2408 3tbnhb.exe 99 PID 3752 wrote to memory of 4740 3752 dppdj.exe 100 PID 3752 wrote to memory of 4740 3752 dppdj.exe 100 PID 3752 wrote to memory of 4740 3752 dppdj.exe 100 PID 4740 wrote to memory of 3352 4740 rflfrlx.exe 101 PID 4740 wrote to memory of 3352 4740 rflfrlx.exe 101 PID 4740 wrote to memory of 3352 4740 rflfrlx.exe 101 PID 3352 wrote to memory of 4708 3352 5nnbnb.exe 102 PID 3352 wrote to memory of 4708 3352 5nnbnb.exe 102 PID 3352 wrote to memory of 4708 3352 5nnbnb.exe 102 PID 4708 wrote to memory of 2828 4708 pdvjv.exe 103 PID 4708 wrote to memory of 2828 4708 pdvjv.exe 103 PID 4708 wrote to memory of 2828 4708 pdvjv.exe 103 PID 2828 wrote to memory of 3776 2828 7xrlfxr.exe 104 PID 2828 wrote to memory of 3776 2828 7xrlfxr.exe 104 PID 2828 wrote to memory of 3776 2828 7xrlfxr.exe 104 PID 3776 wrote to memory of 1900 3776 9nhbnh.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a12d6642226b35624440eb0562a5fc6aaa2ac69ec92d1ba86dcf05285d51478d.exe"C:\Users\Admin\AppData\Local\Temp\a12d6642226b35624440eb0562a5fc6aaa2ac69ec92d1ba86dcf05285d51478d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\rfrffxl.exec:\rfrffxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\7jpdj.exec:\7jpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\bnhhth.exec:\bnhhth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\ttbnht.exec:\ttbnht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\frrlfxr.exec:\frrlfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\7nnbnh.exec:\7nnbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\5btnbb.exec:\5btnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\7djvp.exec:\7djvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\7bbnnb.exec:\7bbnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\bbbnbt.exec:\bbbnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\djdpd.exec:\djdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\jpdvp.exec:\jpdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\btnbtn.exec:\btnbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\3tbnhb.exec:\3tbnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\dppdj.exec:\dppdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\rflfrlx.exec:\rflfrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\5nnbnb.exec:\5nnbnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\pdvjv.exec:\pdvjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\7xrlfxr.exec:\7xrlfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\9nhbnh.exec:\9nhbnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\tbbnbn.exec:\tbbnbn.exe23⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vpjvp.exec:\vpjvp.exe24⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xlfrlfr.exec:\xlfrlfr.exe25⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nhhthb.exec:\nhhthb.exe26⤵
- Executes dropped EXE
PID:4088 -
\??\c:\7hhbnt.exec:\7hhbnt.exe27⤵
- Executes dropped EXE
PID:4448 -
\??\c:\vpdvp.exec:\vpdvp.exe28⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tbthth.exec:\tbthth.exe29⤵
- Executes dropped EXE
PID:4664 -
\??\c:\bnhthb.exec:\bnhthb.exe30⤵
- Executes dropped EXE
PID:3568 -
\??\c:\pjvjj.exec:\pjvjj.exe31⤵
- Executes dropped EXE
PID:4736 -
\??\c:\xxfxlff.exec:\xxfxlff.exe32⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xrfrxrr.exec:\xrfrxrr.exe33⤵
- Executes dropped EXE
PID:3744 -
\??\c:\bbhbth.exec:\bbhbth.exe34⤵
- Executes dropped EXE
PID:4728 -
\??\c:\7vpjd.exec:\7vpjd.exe35⤵
- Executes dropped EXE
PID:764 -
\??\c:\httnbt.exec:\httnbt.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lrlxrrr.exec:\lrlxrrr.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3520 -
\??\c:\tbhhbb.exec:\tbhhbb.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1788 -
\??\c:\5ntnhh.exec:\5ntnhh.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1492 -
\??\c:\vjppd.exec:\vjppd.exe40⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xrxrrxr.exec:\xrxrrxr.exe41⤵
- Executes dropped EXE
PID:3164 -
\??\c:\xxflxfx.exec:\xxflxfx.exe42⤵
- Executes dropped EXE
PID:796 -
\??\c:\bnnhhb.exec:\bnnhhb.exe43⤵
- Executes dropped EXE
PID:3760 -
\??\c:\jddjd.exec:\jddjd.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\flrfxlf.exec:\flrfxlf.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tthhth.exec:\tthhth.exe46⤵
- Executes dropped EXE
PID:2884 -
\??\c:\htnhbt.exec:\htnhbt.exe47⤵
- Executes dropped EXE
PID:4008 -
\??\c:\pdvpj.exec:\pdvpj.exe48⤵
- Executes dropped EXE
PID:3736 -
\??\c:\rxflrlx.exec:\rxflrlx.exe49⤵
- Executes dropped EXE
PID:1260 -
\??\c:\btntbt.exec:\btntbt.exe50⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jdjdd.exec:\jdjdd.exe51⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xlxxrll.exec:\xlxxrll.exe52⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9rxxrrl.exec:\9rxxrrl.exe53⤵
- Executes dropped EXE
PID:3984 -
\??\c:\nnnbtt.exec:\nnnbtt.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pvdvj.exec:\pvdvj.exe55⤵
- Executes dropped EXE
PID:2136 -
\??\c:\dvpvj.exec:\dvpvj.exe56⤵
- Executes dropped EXE
PID:2360 -
\??\c:\frlffff.exec:\frlffff.exe57⤵
- Executes dropped EXE
PID:4904 -
\??\c:\tnnhnh.exec:\tnnhnh.exe58⤵
- Executes dropped EXE
PID:3228 -
\??\c:\3vpdv.exec:\3vpdv.exe59⤵
- Executes dropped EXE
PID:4844 -
\??\c:\pdjvp.exec:\pdjvp.exe60⤵
- Executes dropped EXE
PID:1384 -
\??\c:\frfxlfx.exec:\frfxlfx.exe61⤵
- Executes dropped EXE
PID:4848 -
\??\c:\5nnhbt.exec:\5nnhbt.exe62⤵
- Executes dropped EXE
PID:5028 -
\??\c:\vvdvj.exec:\vvdvj.exe63⤵
- Executes dropped EXE
PID:4532 -
\??\c:\lxxlrlx.exec:\lxxlrlx.exe64⤵
- Executes dropped EXE
PID:4320 -
\??\c:\5nnhht.exec:\5nnhht.exe65⤵
- Executes dropped EXE
PID:3064 -
\??\c:\5jjvp.exec:\5jjvp.exe66⤵PID:2132
-
\??\c:\fxfxlfx.exec:\fxfxlfx.exe67⤵PID:3316
-
\??\c:\thhthh.exec:\thhthh.exe68⤵PID:116
-
\??\c:\pvvjp.exec:\pvvjp.exe69⤵PID:4560
-
\??\c:\3jddv.exec:\3jddv.exe70⤵PID:4620
-
\??\c:\lfrrrlr.exec:\lfrrrlr.exe71⤵PID:2924
-
\??\c:\9flrllr.exec:\9flrllr.exe72⤵PID:3196
-
\??\c:\nbhbtt.exec:\nbhbtt.exe73⤵PID:2908
-
\??\c:\dvdvv.exec:\dvdvv.exe74⤵PID:1068
-
\??\c:\vjpjv.exec:\vjpjv.exe75⤵PID:4980
-
\??\c:\lflfxrl.exec:\lflfxrl.exe76⤵PID:1052
-
\??\c:\hbbtnh.exec:\hbbtnh.exe77⤵PID:3352
-
\??\c:\nnthtn.exec:\nnthtn.exe78⤵PID:2708
-
\??\c:\vdvpv.exec:\vdvpv.exe79⤵PID:2936
-
\??\c:\xffrfrl.exec:\xffrfrl.exe80⤵
- System Location Discovery: System Language Discovery
PID:2036 -
\??\c:\5hnbhb.exec:\5hnbhb.exe81⤵PID:3428
-
\??\c:\9ntntn.exec:\9ntntn.exe82⤵PID:1440
-
\??\c:\3jjpj.exec:\3jjpj.exe83⤵PID:4352
-
\??\c:\xrlffxx.exec:\xrlffxx.exe84⤵PID:4076
-
\??\c:\thnnhh.exec:\thnnhh.exe85⤵PID:2192
-
\??\c:\hnnhbt.exec:\hnnhbt.exe86⤵PID:2620
-
\??\c:\vdjdp.exec:\vdjdp.exe87⤵PID:4448
-
\??\c:\9llfxfx.exec:\9llfxfx.exe88⤵PID:3680
-
\??\c:\htbbbh.exec:\htbbbh.exe89⤵PID:2964
-
\??\c:\7ddpj.exec:\7ddpj.exe90⤵PID:1848
-
\??\c:\rlfrfxr.exec:\rlfrfxr.exe91⤵PID:2824
-
\??\c:\fxxrlfr.exec:\fxxrlfr.exe92⤵PID:4744
-
\??\c:\3nhbtn.exec:\3nhbtn.exe93⤵PID:1028
-
\??\c:\vpvpp.exec:\vpvpp.exe94⤵PID:3792
-
\??\c:\9djdd.exec:\9djdd.exe95⤵PID:1076
-
\??\c:\frlfrxr.exec:\frlfrxr.exe96⤵PID:3480
-
\??\c:\nbbhtt.exec:\nbbhtt.exe97⤵PID:2956
-
\??\c:\vvvvp.exec:\vvvvp.exe98⤵PID:1704
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe99⤵PID:3044
-
\??\c:\7lxxxfr.exec:\7lxxxfr.exe100⤵PID:2116
-
\??\c:\tttnhh.exec:\tttnhh.exe101⤵PID:1656
-
\??\c:\pjdvp.exec:\pjdvp.exe102⤵PID:4916
-
\??\c:\vddvp.exec:\vddvp.exe103⤵PID:2464
-
\??\c:\lflxllf.exec:\lflxllf.exe104⤵PID:5076
-
\??\c:\nthbtn.exec:\nthbtn.exe105⤵PID:1740
-
\??\c:\nhhbtb.exec:\nhhbtb.exe106⤵PID:4192
-
\??\c:\vpjdj.exec:\vpjdj.exe107⤵PID:3052
-
\??\c:\llrfrrl.exec:\llrfrrl.exe108⤵PID:2424
-
\??\c:\5bhbbb.exec:\5bhbbb.exe109⤵PID:3020
-
\??\c:\7dpjv.exec:\7dpjv.exe110⤵PID:4956
-
\??\c:\1ddvp.exec:\1ddvp.exe111⤵PID:2288
-
\??\c:\xflrlfx.exec:\xflrlfx.exe112⤵PID:4388
-
\??\c:\9nhhtt.exec:\9nhhtt.exe113⤵PID:772
-
\??\c:\vjpdv.exec:\vjpdv.exe114⤵PID:2032
-
\??\c:\jjpjv.exec:\jjpjv.exe115⤵PID:2608
-
\??\c:\rxlxfxl.exec:\rxlxfxl.exe116⤵PID:2044
-
\??\c:\tntnhb.exec:\tntnhb.exe117⤵PID:2988
-
\??\c:\9vvjd.exec:\9vvjd.exe118⤵PID:3796
-
\??\c:\frxrffx.exec:\frxrffx.exe119⤵PID:744
-
\??\c:\frxrrll.exec:\frxrrll.exe120⤵PID:4224
-
\??\c:\bttnbt.exec:\bttnbt.exe121⤵PID:3208
-
\??\c:\jvppj.exec:\jvppj.exe122⤵PID:4748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-