Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 16:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe
-
Size
453KB
-
MD5
ff12cce6f28003906be1bf1600dcd20b
-
SHA1
c3fc64a3520c166d4d27fdb472cda71fa2fff3cb
-
SHA256
5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99
-
SHA512
1d5bd843186ec038605524e709564555584ff81d94a94cf6f8a55cb3e55831233541d757ac0ccca3fdc25e26d8a6600a25f4fad93234f7bc1457051b76fff325
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3560-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/592-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/692-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-1022-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-1821-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2160 9xllxfr.exe 1492 pdddd.exe 4000 rlxxxrr.exe 2320 nbbttt.exe 592 jdjdp.exe 4216 lrlfxfx.exe 4776 tttnhh.exe 5016 jjjjj.exe 2096 xfffxxr.exe 4844 lxrfrlx.exe 1616 lfffllr.exe 2092 hthhhh.exe 2184 pdvvp.exe 3460 7bhbbh.exe 4500 frxxrrr.exe 2436 hthhbb.exe 956 ddvjd.exe 664 jjjvp.exe 1276 5bbbtn.exe 692 pvvpj.exe 4916 lffxxxr.exe 2584 djvvv.exe 4596 tthbnn.exe 1420 btbbbb.exe 804 htthht.exe 4032 lffrlfl.exe 4408 hnhhnt.exe 4376 1djvv.exe 4188 dvvpp.exe 3960 bbtthh.exe 4908 jpppj.exe 952 pddjp.exe 2936 tthbtt.exe 4932 vpjjj.exe 2132 3xrlffx.exe 3984 ntnhtt.exe 3248 dvdjj.exe 4688 rlllffx.exe 5116 btttnh.exe 4336 vpddd.exe 3492 1llfxxx.exe 4288 nnnhbb.exe 3212 pvdvj.exe 1492 rrxxfff.exe 316 nhnhbh.exe 4888 3jvpd.exe 2448 3bhhht.exe 5064 frffflx.exe 2280 hnttbh.exe 2560 pvvpp.exe 5032 vdjpp.exe 2156 xfrrrrr.exe 5016 hthtnn.exe 2096 ddjvp.exe 3008 9rrrrxr.exe 552 thbbhn.exe 1460 9tbbht.exe 1260 9jjdv.exe 5008 rxrlffl.exe 2272 ntbbbb.exe 2368 tbttth.exe 5060 vdvdp.exe 5112 tthhtt.exe 4472 5jppj.exe -
resource yara_rule behavioral2/memory/3560-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/592-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/592-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/692-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-769-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3560 wrote to memory of 2160 3560 5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe 83 PID 3560 wrote to memory of 2160 3560 5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe 83 PID 3560 wrote to memory of 2160 3560 5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe 83 PID 2160 wrote to memory of 1492 2160 9xllxfr.exe 84 PID 2160 wrote to memory of 1492 2160 9xllxfr.exe 84 PID 2160 wrote to memory of 1492 2160 9xllxfr.exe 84 PID 1492 wrote to memory of 4000 1492 pdddd.exe 85 PID 1492 wrote to memory of 4000 1492 pdddd.exe 85 PID 1492 wrote to memory of 4000 1492 pdddd.exe 85 PID 4000 wrote to memory of 2320 4000 rlxxxrr.exe 86 PID 4000 wrote to memory of 2320 4000 rlxxxrr.exe 86 PID 4000 wrote to memory of 2320 4000 rlxxxrr.exe 86 PID 2320 wrote to memory of 592 2320 nbbttt.exe 87 PID 2320 wrote to memory of 592 2320 nbbttt.exe 87 PID 2320 wrote to memory of 592 2320 nbbttt.exe 87 PID 592 wrote to memory of 4216 592 jdjdp.exe 88 PID 592 wrote to memory of 4216 592 jdjdp.exe 88 PID 592 wrote to memory of 4216 592 jdjdp.exe 88 PID 4216 wrote to memory of 4776 4216 lrlfxfx.exe 89 PID 4216 wrote to memory of 4776 4216 lrlfxfx.exe 89 PID 4216 wrote to memory of 4776 4216 lrlfxfx.exe 89 PID 4776 wrote to memory of 5016 4776 tttnhh.exe 90 PID 4776 wrote to memory of 5016 4776 tttnhh.exe 90 PID 4776 wrote to memory of 5016 4776 tttnhh.exe 90 PID 5016 wrote to memory of 2096 5016 jjjjj.exe 91 PID 5016 wrote to memory of 2096 5016 jjjjj.exe 91 PID 5016 wrote to memory of 2096 5016 jjjjj.exe 91 PID 2096 wrote to memory of 4844 2096 xfffxxr.exe 92 PID 2096 wrote to memory of 4844 2096 xfffxxr.exe 92 PID 2096 wrote to memory of 4844 2096 xfffxxr.exe 92 PID 4844 wrote to memory of 1616 4844 lxrfrlx.exe 93 PID 4844 wrote to memory of 1616 4844 lxrfrlx.exe 93 PID 4844 wrote to memory of 1616 4844 lxrfrlx.exe 93 PID 1616 wrote to memory of 2092 1616 lfffllr.exe 94 PID 1616 wrote to memory of 2092 1616 lfffllr.exe 94 PID 1616 wrote to memory of 2092 1616 lfffllr.exe 94 PID 2092 wrote to memory of 2184 2092 hthhhh.exe 95 PID 2092 wrote to memory of 2184 2092 hthhhh.exe 95 PID 2092 wrote to memory of 2184 2092 hthhhh.exe 95 PID 2184 wrote to memory of 3460 2184 pdvvp.exe 96 PID 2184 wrote to memory of 3460 2184 pdvvp.exe 96 PID 2184 wrote to memory of 3460 2184 pdvvp.exe 96 PID 3460 wrote to memory of 4500 3460 7bhbbh.exe 97 PID 3460 wrote to memory of 4500 3460 7bhbbh.exe 97 PID 3460 wrote to memory of 4500 3460 7bhbbh.exe 97 PID 4500 wrote to memory of 2436 4500 frxxrrr.exe 98 PID 4500 wrote to memory of 2436 4500 frxxrrr.exe 98 PID 4500 wrote to memory of 2436 4500 frxxrrr.exe 98 PID 2436 wrote to memory of 956 2436 hthhbb.exe 99 PID 2436 wrote to memory of 956 2436 hthhbb.exe 99 PID 2436 wrote to memory of 956 2436 hthhbb.exe 99 PID 956 wrote to memory of 664 956 ddvjd.exe 100 PID 956 wrote to memory of 664 956 ddvjd.exe 100 PID 956 wrote to memory of 664 956 ddvjd.exe 100 PID 664 wrote to memory of 1276 664 jjjvp.exe 101 PID 664 wrote to memory of 1276 664 jjjvp.exe 101 PID 664 wrote to memory of 1276 664 jjjvp.exe 101 PID 1276 wrote to memory of 692 1276 5bbbtn.exe 102 PID 1276 wrote to memory of 692 1276 5bbbtn.exe 102 PID 1276 wrote to memory of 692 1276 5bbbtn.exe 102 PID 692 wrote to memory of 4916 692 pvvpj.exe 103 PID 692 wrote to memory of 4916 692 pvvpj.exe 103 PID 692 wrote to memory of 4916 692 pvvpj.exe 103 PID 4916 wrote to memory of 2584 4916 lffxxxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe"C:\Users\Admin\AppData\Local\Temp\5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\9xllxfr.exec:\9xllxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\pdddd.exec:\pdddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\rlxxxrr.exec:\rlxxxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\nbbttt.exec:\nbbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jdjdp.exec:\jdjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\lrlfxfx.exec:\lrlfxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\tttnhh.exec:\tttnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\jjjjj.exec:\jjjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\xfffxxr.exec:\xfffxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lfffllr.exec:\lfffllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\hthhhh.exec:\hthhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\pdvvp.exec:\pdvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\7bhbbh.exec:\7bhbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\frxxrrr.exec:\frxxrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\hthhbb.exec:\hthhbb.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\ddvjd.exec:\ddvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\jjjvp.exec:\jjjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\5bbbtn.exec:\5bbbtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\pvvpj.exec:\pvvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\lffxxxr.exec:\lffxxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\djvvv.exec:\djvvv.exe23⤵
- Executes dropped EXE
PID:2584 -
\??\c:\tthbnn.exec:\tthbnn.exe24⤵
- Executes dropped EXE
PID:4596 -
\??\c:\btbbbb.exec:\btbbbb.exe25⤵
- Executes dropped EXE
PID:1420 -
\??\c:\htthht.exec:\htthht.exe26⤵
- Executes dropped EXE
PID:804 -
\??\c:\lffrlfl.exec:\lffrlfl.exe27⤵
- Executes dropped EXE
PID:4032 -
\??\c:\hnhhnt.exec:\hnhhnt.exe28⤵
- Executes dropped EXE
PID:4408 -
\??\c:\1djvv.exec:\1djvv.exe29⤵
- Executes dropped EXE
PID:4376 -
\??\c:\dvvpp.exec:\dvvpp.exe30⤵
- Executes dropped EXE
PID:4188 -
\??\c:\bbtthh.exec:\bbtthh.exe31⤵
- Executes dropped EXE
PID:3960 -
\??\c:\jpppj.exec:\jpppj.exe32⤵
- Executes dropped EXE
PID:4908 -
\??\c:\pddjp.exec:\pddjp.exe33⤵
- Executes dropped EXE
PID:952 -
\??\c:\tthbtt.exec:\tthbtt.exe34⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vpjjj.exec:\vpjjj.exe35⤵
- Executes dropped EXE
PID:4932 -
\??\c:\3xrlffx.exec:\3xrlffx.exe36⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ntnhtt.exec:\ntnhtt.exe37⤵
- Executes dropped EXE
PID:3984 -
\??\c:\dvdjj.exec:\dvdjj.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3248 -
\??\c:\rlllffx.exec:\rlllffx.exe39⤵
- Executes dropped EXE
PID:4688 -
\??\c:\btttnh.exec:\btttnh.exe40⤵
- Executes dropped EXE
PID:5116 -
\??\c:\vpddd.exec:\vpddd.exe41⤵
- Executes dropped EXE
PID:4336 -
\??\c:\1llfxxx.exec:\1llfxxx.exe42⤵
- Executes dropped EXE
PID:3492 -
\??\c:\nnnhbb.exec:\nnnhbb.exe43⤵
- Executes dropped EXE
PID:4288 -
\??\c:\pvdvj.exec:\pvdvj.exe44⤵
- Executes dropped EXE
PID:3212 -
\??\c:\rrxxfff.exec:\rrxxfff.exe45⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nhnhbh.exec:\nhnhbh.exe46⤵
- Executes dropped EXE
PID:316 -
\??\c:\3jvpd.exec:\3jvpd.exe47⤵
- Executes dropped EXE
PID:4888 -
\??\c:\3bhhht.exec:\3bhhht.exe48⤵
- Executes dropped EXE
PID:2448 -
\??\c:\frffflx.exec:\frffflx.exe49⤵
- Executes dropped EXE
PID:5064 -
\??\c:\hnttbh.exec:\hnttbh.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\pvvpp.exec:\pvvpp.exe51⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vdjpp.exec:\vdjpp.exe52⤵
- Executes dropped EXE
PID:5032 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe53⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hthtnn.exec:\hthtnn.exe54⤵
- Executes dropped EXE
PID:5016 -
\??\c:\ddjvp.exec:\ddjvp.exe55⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9rrrrxr.exec:\9rrrrxr.exe56⤵
- Executes dropped EXE
PID:3008 -
\??\c:\thbbhn.exec:\thbbhn.exe57⤵
- Executes dropped EXE
PID:552 -
\??\c:\9tbbht.exec:\9tbbht.exe58⤵
- Executes dropped EXE
PID:1460 -
\??\c:\9jjdv.exec:\9jjdv.exe59⤵
- Executes dropped EXE
PID:1260 -
\??\c:\rxrlffl.exec:\rxrlffl.exe60⤵
- Executes dropped EXE
PID:5008 -
\??\c:\ntbbbb.exec:\ntbbbb.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\tbttth.exec:\tbttth.exe62⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vdvdp.exec:\vdvdp.exe63⤵
- Executes dropped EXE
PID:5060 -
\??\c:\tthhtt.exec:\tthhtt.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5112 -
\??\c:\5jppj.exec:\5jppj.exe65⤵
- Executes dropped EXE
PID:4472 -
\??\c:\lxffxfx.exec:\lxffxfx.exe66⤵PID:4964
-
\??\c:\ttnnnh.exec:\ttnnnh.exe67⤵PID:3464
-
\??\c:\djdpd.exec:\djdpd.exe68⤵PID:2876
-
\??\c:\9xllrrf.exec:\9xllrrf.exe69⤵PID:1064
-
\??\c:\xrxxxlf.exec:\xrxxxlf.exe70⤵PID:5052
-
\??\c:\bhtthn.exec:\bhtthn.exe71⤵PID:2620
-
\??\c:\vvjjj.exec:\vvjjj.exe72⤵PID:3388
-
\??\c:\xxxxxrr.exec:\xxxxxrr.exe73⤵PID:3712
-
\??\c:\btbbtt.exec:\btbbtt.exe74⤵PID:2524
-
\??\c:\jpdjj.exec:\jpdjj.exe75⤵PID:4508
-
\??\c:\xfllfff.exec:\xfllfff.exe76⤵PID:3144
-
\??\c:\ttnbbt.exec:\ttnbbt.exe77⤵PID:4304
-
\??\c:\7vvvj.exec:\7vvvj.exe78⤵PID:4092
-
\??\c:\dvdvv.exec:\dvdvv.exe79⤵PID:2288
-
\??\c:\rlfffff.exec:\rlfffff.exe80⤵PID:4028
-
\??\c:\nthtnb.exec:\nthtnb.exe81⤵PID:2396
-
\??\c:\3pvvv.exec:\3pvvv.exe82⤵PID:4992
-
\??\c:\llfxxxl.exec:\llfxxxl.exe83⤵PID:1920
-
\??\c:\ntbhtb.exec:\ntbhtb.exe84⤵PID:2460
-
\??\c:\pjvpd.exec:\pjvpd.exe85⤵PID:1428
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe86⤵PID:4376
-
\??\c:\3tnnhh.exec:\3tnnhh.exe87⤵PID:1844
-
\??\c:\dppjv.exec:\dppjv.exe88⤵PID:3960
-
\??\c:\flxflrr.exec:\flxflrr.exe89⤵
- System Location Discovery: System Language Discovery
PID:1108 -
\??\c:\nntthn.exec:\nntthn.exe90⤵PID:2284
-
\??\c:\1vddv.exec:\1vddv.exe91⤵PID:3208
-
\??\c:\rxrxrxr.exec:\rxrxrxr.exe92⤵PID:2052
-
\??\c:\3bnnnt.exec:\3bnnnt.exe93⤵PID:768
-
\??\c:\bbhhhn.exec:\bbhhhn.exe94⤵PID:2240
-
\??\c:\dvvvv.exec:\dvvvv.exe95⤵PID:536
-
\??\c:\rlxxrlr.exec:\rlxxrlr.exe96⤵PID:4620
-
\??\c:\7bbnhb.exec:\7bbnhb.exe97⤵PID:3100
-
\??\c:\3vvpp.exec:\3vvpp.exe98⤵PID:2276
-
\??\c:\vvvvv.exec:\vvvvv.exe99⤵PID:2036
-
\??\c:\xxxxlff.exec:\xxxxlff.exe100⤵PID:4332
-
\??\c:\3bbtnt.exec:\3bbtnt.exe101⤵PID:1696
-
\??\c:\ppppd.exec:\ppppd.exe102⤵PID:1168
-
\??\c:\llrlffx.exec:\llrlffx.exe103⤵PID:1624
-
\??\c:\ntbbtt.exec:\ntbbtt.exe104⤵PID:4976
-
\??\c:\nbnntb.exec:\nbnntb.exe105⤵PID:3824
-
\??\c:\pppjj.exec:\pppjj.exe106⤵
- System Location Discovery: System Language Discovery
PID:4880 -
\??\c:\9fxxxrr.exec:\9fxxxrr.exe107⤵PID:2136
-
\??\c:\bhnhhh.exec:\bhnhhh.exe108⤵PID:4372
-
\??\c:\tbbtnt.exec:\tbbtnt.exe109⤵PID:3760
-
\??\c:\vdpjv.exec:\vdpjv.exe110⤵PID:5064
-
\??\c:\nttttb.exec:\nttttb.exe111⤵PID:2280
-
\??\c:\tbbbth.exec:\tbbbth.exe112⤵PID:2560
-
\??\c:\jjjdv.exec:\jjjdv.exe113⤵PID:5032
-
\??\c:\fflfffx.exec:\fflfffx.exe114⤵PID:1284
-
\??\c:\bnnnnn.exec:\bnnnnn.exe115⤵PID:5108
-
\??\c:\jjjjj.exec:\jjjjj.exe116⤵PID:2600
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe117⤵PID:4844
-
\??\c:\nthnbh.exec:\nthnbh.exe118⤵PID:2740
-
\??\c:\vdppp.exec:\vdppp.exe119⤵PID:3596
-
\??\c:\dpddd.exec:\dpddd.exe120⤵PID:3164
-
\??\c:\llxxxxr.exec:\llxxxxr.exe121⤵PID:4532
-
\??\c:\hnbbhh.exec:\hnbbhh.exe122⤵PID:712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-