Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 19:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb4ab67100d58b964a654ecba12f0e940c6f3dc8b8a194f6957c07d643aadaa7N.exe
Resource
win7-20241023-en
7 signatures
120 seconds
General
-
Target
fb4ab67100d58b964a654ecba12f0e940c6f3dc8b8a194f6957c07d643aadaa7N.exe
-
Size
456KB
-
MD5
c09b8c6cd879f2c43f3d5247e16dcc50
-
SHA1
a449144f1dc7002d6fe2ee895226c95ed96b4a54
-
SHA256
fb4ab67100d58b964a654ecba12f0e940c6f3dc8b8a194f6957c07d643aadaa7
-
SHA512
33f1069dfbb1dbd57ef7a584a5d50942cb46e4ab7b177212b8e30a058ab39690cfc98ad8918a56f556639126223b5a694cf48ff4b74fe1d6c1942cc498f2091b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRM:q7Tc2NYHUrAwfMp3CDRM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1596-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2668-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-1017-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-1069-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-1484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-1536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3960 xxxrllf.exe 5032 ddjjd.exe 4192 7xxrrxr.exe 4772 nthhhn.exe 3020 pppjj.exe 5056 bbbbtn.exe 4572 jvvvp.exe 2456 fxffffx.exe 4460 vvjvp.exe 3608 fxxxxxr.exe 1984 vvvpp.exe 3616 thhhhh.exe 2864 jjvvp.exe 4684 xlrrxxr.exe 3116 ddvvp.exe 232 rxfrlrr.exe 1440 frlfxxr.exe 2648 bhnnhb.exe 4552 ddjjd.exe 3744 rrxffll.exe 2668 djddv.exe 452 lxrlfrl.exe 2376 jjvpv.exe 1892 ffxxlrx.exe 3880 bnnnhh.exe 1996 dpjvp.exe 60 rxfxffl.exe 4308 3bttnn.exe 4608 9vpvv.exe 5004 tbbttn.exe 2176 7djpj.exe 1020 7tbttt.exe 2332 llrrlll.exe 1504 7bnntt.exe 2004 jvdvd.exe 1556 7lrrffr.exe 4696 tbbbtt.exe 2204 jvdvd.exe 3552 jpjdj.exe 1404 xrrlffx.exe 4472 hnhbtt.exe 4952 jpjpj.exe 4640 rlxrllf.exe 5032 ddjdv.exe 2708 xxrrllf.exe 2720 lfllffl.exe 4680 nbbhhh.exe 1616 ddjjj.exe 1068 ffxrrrl.exe 5056 hhnnhh.exe 4476 jdpjd.exe 4824 rlxrrrl.exe 2456 tbhtbn.exe 2392 hbtttt.exe 2704 pjddd.exe 3608 7fxxrrl.exe 1896 3tnnhh.exe 3328 djjvp.exe 1552 jpppj.exe 1568 lfxflll.exe 4516 xfxxrrr.exe 4684 ttbtnh.exe 3928 pdjdv.exe 3152 xrffxrr.exe -
resource yara_rule behavioral2/memory/1596-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-1017-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-1069-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-1259-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1596 wrote to memory of 3960 1596 fb4ab67100d58b964a654ecba12f0e940c6f3dc8b8a194f6957c07d643aadaa7N.exe 83 PID 1596 wrote to memory of 3960 1596 fb4ab67100d58b964a654ecba12f0e940c6f3dc8b8a194f6957c07d643aadaa7N.exe 83 PID 1596 wrote to memory of 3960 1596 fb4ab67100d58b964a654ecba12f0e940c6f3dc8b8a194f6957c07d643aadaa7N.exe 83 PID 3960 wrote to memory of 5032 3960 xxxrllf.exe 84 PID 3960 wrote to memory of 5032 3960 xxxrllf.exe 84 PID 3960 wrote to memory of 5032 3960 xxxrllf.exe 84 PID 5032 wrote to memory of 4192 5032 ddjjd.exe 85 PID 5032 wrote to memory of 4192 5032 ddjjd.exe 85 PID 5032 wrote to memory of 4192 5032 ddjjd.exe 85 PID 4192 wrote to memory of 4772 4192 7xxrrxr.exe 86 PID 4192 wrote to memory of 4772 4192 7xxrrxr.exe 86 PID 4192 wrote to memory of 4772 4192 7xxrrxr.exe 86 PID 4772 wrote to memory of 3020 4772 nthhhn.exe 87 PID 4772 wrote to memory of 3020 4772 nthhhn.exe 87 PID 4772 wrote to memory of 3020 4772 nthhhn.exe 87 PID 3020 wrote to memory of 5056 3020 pppjj.exe 88 PID 3020 wrote to memory of 5056 3020 pppjj.exe 88 PID 3020 wrote to memory of 5056 3020 pppjj.exe 88 PID 5056 wrote to memory of 4572 5056 bbbbtn.exe 89 PID 5056 wrote to memory of 4572 5056 bbbbtn.exe 89 PID 5056 wrote to memory of 4572 5056 bbbbtn.exe 89 PID 4572 wrote to memory of 2456 4572 jvvvp.exe 90 PID 4572 wrote to memory of 2456 4572 jvvvp.exe 90 PID 4572 wrote to memory of 2456 4572 jvvvp.exe 90 PID 2456 wrote to memory of 4460 2456 fxffffx.exe 91 PID 2456 wrote to memory of 4460 2456 fxffffx.exe 91 PID 2456 wrote to memory of 4460 2456 fxffffx.exe 91 PID 4460 wrote to memory of 3608 4460 vvjvp.exe 92 PID 4460 wrote to memory of 3608 4460 vvjvp.exe 92 PID 4460 wrote to memory of 3608 4460 vvjvp.exe 92 PID 3608 wrote to memory of 1984 3608 fxxxxxr.exe 93 PID 3608 wrote to memory of 1984 3608 fxxxxxr.exe 93 PID 3608 wrote to memory of 1984 3608 fxxxxxr.exe 93 PID 1984 wrote to memory of 3616 1984 vvvpp.exe 94 PID 1984 wrote to memory of 3616 1984 vvvpp.exe 94 PID 1984 wrote to memory of 3616 1984 vvvpp.exe 94 PID 3616 wrote to memory of 2864 3616 thhhhh.exe 95 PID 3616 wrote to memory of 2864 3616 thhhhh.exe 95 PID 3616 wrote to memory of 2864 3616 thhhhh.exe 95 PID 2864 wrote to memory of 4684 2864 jjvvp.exe 96 PID 2864 wrote to memory of 4684 2864 jjvvp.exe 96 PID 2864 wrote to memory of 4684 2864 jjvvp.exe 96 PID 4684 wrote to memory of 3116 4684 xlrrxxr.exe 97 PID 4684 wrote to memory of 3116 4684 xlrrxxr.exe 97 PID 4684 wrote to memory of 3116 4684 xlrrxxr.exe 97 PID 3116 wrote to memory of 232 3116 ddvvp.exe 98 PID 3116 wrote to memory of 232 3116 ddvvp.exe 98 PID 3116 wrote to memory of 232 3116 ddvvp.exe 98 PID 232 wrote to memory of 1440 232 rxfrlrr.exe 99 PID 232 wrote to memory of 1440 232 rxfrlrr.exe 99 PID 232 wrote to memory of 1440 232 rxfrlrr.exe 99 PID 1440 wrote to memory of 2648 1440 frlfxxr.exe 100 PID 1440 wrote to memory of 2648 1440 frlfxxr.exe 100 PID 1440 wrote to memory of 2648 1440 frlfxxr.exe 100 PID 2648 wrote to memory of 4552 2648 bhnnhb.exe 101 PID 2648 wrote to memory of 4552 2648 bhnnhb.exe 101 PID 2648 wrote to memory of 4552 2648 bhnnhb.exe 101 PID 4552 wrote to memory of 3744 4552 ddjjd.exe 102 PID 4552 wrote to memory of 3744 4552 ddjjd.exe 102 PID 4552 wrote to memory of 3744 4552 ddjjd.exe 102 PID 3744 wrote to memory of 2668 3744 rrxffll.exe 103 PID 3744 wrote to memory of 2668 3744 rrxffll.exe 103 PID 3744 wrote to memory of 2668 3744 rrxffll.exe 103 PID 2668 wrote to memory of 452 2668 djddv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb4ab67100d58b964a654ecba12f0e940c6f3dc8b8a194f6957c07d643aadaa7N.exe"C:\Users\Admin\AppData\Local\Temp\fb4ab67100d58b964a654ecba12f0e940c6f3dc8b8a194f6957c07d643aadaa7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\xxxrllf.exec:\xxxrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\ddjjd.exec:\ddjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\7xxrrxr.exec:\7xxrrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\nthhhn.exec:\nthhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\pppjj.exec:\pppjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\bbbbtn.exec:\bbbbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\jvvvp.exec:\jvvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\fxffffx.exec:\fxffffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\vvjvp.exec:\vvjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\vvvpp.exec:\vvvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\thhhhh.exec:\thhhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\jjvvp.exec:\jjvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\xlrrxxr.exec:\xlrrxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\ddvvp.exec:\ddvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\rxfrlrr.exec:\rxfrlrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\frlfxxr.exec:\frlfxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\bhnnhb.exec:\bhnnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\ddjjd.exec:\ddjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\rrxffll.exec:\rrxffll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\djddv.exec:\djddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\lxrlfrl.exec:\lxrlfrl.exe23⤵
- Executes dropped EXE
PID:452 -
\??\c:\jjvpv.exec:\jjvpv.exe24⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ffxxlrx.exec:\ffxxlrx.exe25⤵
- Executes dropped EXE
PID:1892 -
\??\c:\bnnnhh.exec:\bnnnhh.exe26⤵
- Executes dropped EXE
PID:3880 -
\??\c:\dpjvp.exec:\dpjvp.exe27⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rxfxffl.exec:\rxfxffl.exe28⤵
- Executes dropped EXE
PID:60 -
\??\c:\3bttnn.exec:\3bttnn.exe29⤵
- Executes dropped EXE
PID:4308 -
\??\c:\9vpvv.exec:\9vpvv.exe30⤵
- Executes dropped EXE
PID:4608 -
\??\c:\tbbttn.exec:\tbbttn.exe31⤵
- Executes dropped EXE
PID:5004 -
\??\c:\7djpj.exec:\7djpj.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\7tbttt.exec:\7tbttt.exe33⤵
- Executes dropped EXE
PID:1020 -
\??\c:\llrrlll.exec:\llrrlll.exe34⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7bnntt.exec:\7bnntt.exe35⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jvdvd.exec:\jvdvd.exe36⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7lrrffr.exec:\7lrrffr.exe37⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tbbbtt.exec:\tbbbtt.exe38⤵
- Executes dropped EXE
PID:4696 -
\??\c:\jvdvd.exec:\jvdvd.exe39⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jpjdj.exec:\jpjdj.exe40⤵
- Executes dropped EXE
PID:3552 -
\??\c:\xrrlffx.exec:\xrrlffx.exe41⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hnhbtt.exec:\hnhbtt.exe42⤵
- Executes dropped EXE
PID:4472 -
\??\c:\jpjpj.exec:\jpjpj.exe43⤵
- Executes dropped EXE
PID:4952 -
\??\c:\rlxrllf.exec:\rlxrllf.exe44⤵
- Executes dropped EXE
PID:4640 -
\??\c:\ddjdv.exec:\ddjdv.exe45⤵
- Executes dropped EXE
PID:5032 -
\??\c:\xxrrllf.exec:\xxrrllf.exe46⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfllffl.exec:\lfllffl.exe47⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nbbhhh.exec:\nbbhhh.exe48⤵
- Executes dropped EXE
PID:4680 -
\??\c:\ddjjj.exec:\ddjjj.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ffxrrrl.exec:\ffxrrrl.exe50⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hhnnhh.exec:\hhnnhh.exe51⤵
- Executes dropped EXE
PID:5056 -
\??\c:\jdpjd.exec:\jdpjd.exe52⤵
- Executes dropped EXE
PID:4476 -
\??\c:\rlxrrrl.exec:\rlxrrrl.exe53⤵
- Executes dropped EXE
PID:4824 -
\??\c:\tbhtbn.exec:\tbhtbn.exe54⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hbtttt.exec:\hbtttt.exe55⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pjddd.exec:\pjddd.exe56⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7fxxrrl.exec:\7fxxrrl.exe57⤵
- Executes dropped EXE
PID:3608 -
\??\c:\3tnnhh.exec:\3tnnhh.exe58⤵
- Executes dropped EXE
PID:1896 -
\??\c:\djjvp.exec:\djjvp.exe59⤵
- Executes dropped EXE
PID:3328 -
\??\c:\jpppj.exec:\jpppj.exe60⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lfxflll.exec:\lfxflll.exe61⤵
- Executes dropped EXE
PID:1568 -
\??\c:\xfxxrrr.exec:\xfxxrrr.exe62⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ttbtnh.exec:\ttbtnh.exe63⤵
- Executes dropped EXE
PID:4684 -
\??\c:\pdjdv.exec:\pdjdv.exe64⤵
- Executes dropped EXE
PID:3928 -
\??\c:\xrffxrr.exec:\xrffxrr.exe65⤵
- Executes dropped EXE
PID:3152 -
\??\c:\btntbb.exec:\btntbb.exe66⤵PID:1692
-
\??\c:\htbbth.exec:\htbbth.exe67⤵PID:3388
-
\??\c:\7pvdv.exec:\7pvdv.exe68⤵PID:4376
-
\??\c:\ffllffx.exec:\ffllffx.exe69⤵PID:1632
-
\??\c:\htttnh.exec:\htttnh.exe70⤵PID:3120
-
\??\c:\vjpjj.exec:\vjpjj.exe71⤵PID:3016
-
\??\c:\flffrff.exec:\flffrff.exe72⤵PID:4068
-
\??\c:\xfxxffr.exec:\xfxxffr.exe73⤵PID:2128
-
\??\c:\9nbtnn.exec:\9nbtnn.exe74⤵PID:3008
-
\??\c:\dvddd.exec:\dvddd.exe75⤵PID:1488
-
\??\c:\xlllflx.exec:\xlllflx.exe76⤵PID:3824
-
\??\c:\5thbtn.exec:\5thbtn.exe77⤵PID:4040
-
\??\c:\jdjdv.exec:\jdjdv.exe78⤵PID:3636
-
\??\c:\fflfrlf.exec:\fflfrlf.exe79⤵PID:3500
-
\??\c:\rfxrlfr.exec:\rfxrlfr.exe80⤵PID:3980
-
\??\c:\hhtbbb.exec:\hhtbbb.exe81⤵PID:640
-
\??\c:\9dvvp.exec:\9dvvp.exe82⤵PID:3916
-
\??\c:\lrxxrll.exec:\lrxxrll.exe83⤵PID:536
-
\??\c:\frxxrrr.exec:\frxxrrr.exe84⤵PID:1800
-
\??\c:\nhnhbh.exec:\nhnhbh.exe85⤵PID:4308
-
\??\c:\7vpjd.exec:\7vpjd.exe86⤵PID:3224
-
\??\c:\xllfrlf.exec:\xllfrlf.exe87⤵PID:4276
-
\??\c:\rrxfflf.exec:\rrxfflf.exe88⤵PID:2984
-
\??\c:\tbhhnt.exec:\tbhhnt.exe89⤵PID:3672
-
\??\c:\pvvpj.exec:\pvvpj.exe90⤵PID:4856
-
\??\c:\ddjjd.exec:\ddjjd.exe91⤵PID:2356
-
\??\c:\xfxxrxr.exec:\xfxxrxr.exe92⤵PID:4024
-
\??\c:\tnthhb.exec:\tnthhb.exe93⤵PID:388
-
\??\c:\ppjdv.exec:\ppjdv.exe94⤵PID:4652
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe95⤵PID:3600
-
\??\c:\xrllfff.exec:\xrllfff.exe96⤵PID:3736
-
\??\c:\nbttnn.exec:\nbttnn.exe97⤵PID:3688
-
\??\c:\btnnhh.exec:\btnnhh.exe98⤵PID:2052
-
\??\c:\vdvpd.exec:\vdvpd.exe99⤵PID:540
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe100⤵PID:4372
-
\??\c:\5thhbn.exec:\5thhbn.exe101⤵PID:1516
-
\??\c:\vjppj.exec:\vjppj.exe102⤵PID:4380
-
\??\c:\fxrlfff.exec:\fxrlfff.exe103⤵PID:3960
-
\??\c:\nbnbbb.exec:\nbnbbb.exe104⤵PID:4640
-
\??\c:\bbnhhh.exec:\bbnhhh.exe105⤵PID:5032
-
\??\c:\jjvvp.exec:\jjvvp.exe106⤵PID:624
-
\??\c:\lxfrlxr.exec:\lxfrlxr.exe107⤵PID:2820
-
\??\c:\tbhtht.exec:\tbhtht.exe108⤵PID:3700
-
\??\c:\jpvpj.exec:\jpvpj.exe109⤵PID:1968
-
\??\c:\vjvdp.exec:\vjvdp.exe110⤵PID:3244
-
\??\c:\lxlxrfr.exec:\lxlxrfr.exe111⤵PID:5060
-
\??\c:\1bhtbt.exec:\1bhtbt.exe112⤵PID:4512
-
\??\c:\pdvpj.exec:\pdvpj.exe113⤵PID:936
-
\??\c:\lflfxxr.exec:\lflfxxr.exe114⤵PID:1112
-
\??\c:\7llxlrl.exec:\7llxlrl.exe115⤵PID:4808
-
\??\c:\hhnhnh.exec:\hhnhnh.exe116⤵PID:4460
-
\??\c:\3jjvp.exec:\3jjvp.exe117⤵PID:1028
-
\??\c:\xrxrfxl.exec:\xrxrfxl.exe118⤵PID:2008
-
\??\c:\fxxxfxf.exec:\fxxxfxf.exe119⤵PID:5076
-
\??\c:\bthtnh.exec:\bthtnh.exe120⤵PID:4392
-
\??\c:\vjpdv.exec:\vjpdv.exe121⤵PID:3328
-
\??\c:\5jpdd.exec:\5jpdd.exe122⤵PID:4596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-