Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 20:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe
-
Size
454KB
-
MD5
a542f4bebd6f590532273f252d8dbcd6
-
SHA1
3d2aa1647ee8f3e6fe5073aeb623000dd1628d04
-
SHA256
ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a
-
SHA512
625383b1658179bcad58afe5c6ff4a215c7ba0143e24042b15c31feb39cd9cd3cb418b76824c9996b1a3a4270998f00bf670b8a1153567b2d59f7e2f22535e3a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe4:q7Tc2NYHUrAwfMp3CD4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3120-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/792-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/820-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-797-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-1064-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-1095-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-1117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-1175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-1251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-1580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4496 lfrllff.exe 4924 ppddv.exe 3452 vjvjv.exe 3792 dvjdj.exe 760 ffrflrf.exe 4708 3jjjj.exe 4684 xlrlfff.exe 2276 9hbnhh.exe 1684 jjpdp.exe 2780 nnhhbb.exe 3580 nbbttt.exe 3848 jvjdd.exe 212 3rrrfff.exe 392 nnbtnh.exe 2024 btbtth.exe 516 fllfllf.exe 1536 lflrxlr.exe 1468 jdvvv.exe 4272 dvdvd.exe 3148 xrxrxrx.exe 3844 jvvjd.exe 208 xrrlflr.exe 4904 bhnhbt.exe 4960 bhtbtt.exe 3392 lfxllll.exe 3868 frxrxrx.exe 1244 tthhnb.exe 4084 vdjdj.exe 3816 jpvpv.exe 4288 rlrlfxr.exe 3108 lflfxxr.exe 4624 hbbtnn.exe 2060 7lrrxxl.exe 2504 5bhhbh.exe 4476 ppjdv.exe 468 dppjj.exe 4764 lxfxrlf.exe 1688 hnnhht.exe 5056 1btnhn.exe 1032 vpjdp.exe 4668 rrxrfxr.exe 1476 fffxrrl.exe 1648 nhnhbt.exe 3936 dvdpj.exe 4672 dpjjd.exe 792 lrxlrll.exe 2404 nnbttt.exe 4920 lrlrfrx.exe 5020 nhnhhb.exe 1572 pjpjd.exe 380 tntnhn.exe 1672 hhhtnn.exe 968 vdvjd.exe 3412 lrxrrlx.exe 4956 xfllrlf.exe 4372 vvvvp.exe 4924 flrlfxr.exe 4328 thbbnh.exe 3372 5dvpd.exe 1136 1fxxxxx.exe 1928 fxfxrlf.exe 4336 hbhbbb.exe 4780 pjddj.exe 3536 pjvdp.exe -
resource yara_rule behavioral2/memory/3120-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/792-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/820-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-797-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3120 wrote to memory of 4496 3120 ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe 82 PID 3120 wrote to memory of 4496 3120 ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe 82 PID 3120 wrote to memory of 4496 3120 ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe 82 PID 4496 wrote to memory of 4924 4496 lfrllff.exe 83 PID 4496 wrote to memory of 4924 4496 lfrllff.exe 83 PID 4496 wrote to memory of 4924 4496 lfrllff.exe 83 PID 4924 wrote to memory of 3452 4924 ppddv.exe 84 PID 4924 wrote to memory of 3452 4924 ppddv.exe 84 PID 4924 wrote to memory of 3452 4924 ppddv.exe 84 PID 3452 wrote to memory of 3792 3452 vjvjv.exe 85 PID 3452 wrote to memory of 3792 3452 vjvjv.exe 85 PID 3452 wrote to memory of 3792 3452 vjvjv.exe 85 PID 3792 wrote to memory of 760 3792 dvjdj.exe 86 PID 3792 wrote to memory of 760 3792 dvjdj.exe 86 PID 3792 wrote to memory of 760 3792 dvjdj.exe 86 PID 760 wrote to memory of 4708 760 ffrflrf.exe 87 PID 760 wrote to memory of 4708 760 ffrflrf.exe 87 PID 760 wrote to memory of 4708 760 ffrflrf.exe 87 PID 4708 wrote to memory of 4684 4708 3jjjj.exe 88 PID 4708 wrote to memory of 4684 4708 3jjjj.exe 88 PID 4708 wrote to memory of 4684 4708 3jjjj.exe 88 PID 4684 wrote to memory of 2276 4684 xlrlfff.exe 89 PID 4684 wrote to memory of 2276 4684 xlrlfff.exe 89 PID 4684 wrote to memory of 2276 4684 xlrlfff.exe 89 PID 2276 wrote to memory of 1684 2276 9hbnhh.exe 90 PID 2276 wrote to memory of 1684 2276 9hbnhh.exe 90 PID 2276 wrote to memory of 1684 2276 9hbnhh.exe 90 PID 1684 wrote to memory of 2780 1684 jjpdp.exe 91 PID 1684 wrote to memory of 2780 1684 jjpdp.exe 91 PID 1684 wrote to memory of 2780 1684 jjpdp.exe 91 PID 2780 wrote to memory of 3580 2780 nnhhbb.exe 92 PID 2780 wrote to memory of 3580 2780 nnhhbb.exe 92 PID 2780 wrote to memory of 3580 2780 nnhhbb.exe 92 PID 3580 wrote to memory of 3848 3580 nbbttt.exe 93 PID 3580 wrote to memory of 3848 3580 nbbttt.exe 93 PID 3580 wrote to memory of 3848 3580 nbbttt.exe 93 PID 3848 wrote to memory of 212 3848 jvjdd.exe 94 PID 3848 wrote to memory of 212 3848 jvjdd.exe 94 PID 3848 wrote to memory of 212 3848 jvjdd.exe 94 PID 212 wrote to memory of 392 212 3rrrfff.exe 95 PID 212 wrote to memory of 392 212 3rrrfff.exe 95 PID 212 wrote to memory of 392 212 3rrrfff.exe 95 PID 392 wrote to memory of 2024 392 nnbtnh.exe 96 PID 392 wrote to memory of 2024 392 nnbtnh.exe 96 PID 392 wrote to memory of 2024 392 nnbtnh.exe 96 PID 2024 wrote to memory of 516 2024 btbtth.exe 97 PID 2024 wrote to memory of 516 2024 btbtth.exe 97 PID 2024 wrote to memory of 516 2024 btbtth.exe 97 PID 516 wrote to memory of 1536 516 fllfllf.exe 98 PID 516 wrote to memory of 1536 516 fllfllf.exe 98 PID 516 wrote to memory of 1536 516 fllfllf.exe 98 PID 1536 wrote to memory of 1468 1536 lflrxlr.exe 99 PID 1536 wrote to memory of 1468 1536 lflrxlr.exe 99 PID 1536 wrote to memory of 1468 1536 lflrxlr.exe 99 PID 1468 wrote to memory of 4272 1468 jdvvv.exe 100 PID 1468 wrote to memory of 4272 1468 jdvvv.exe 100 PID 1468 wrote to memory of 4272 1468 jdvvv.exe 100 PID 4272 wrote to memory of 3148 4272 dvdvd.exe 101 PID 4272 wrote to memory of 3148 4272 dvdvd.exe 101 PID 4272 wrote to memory of 3148 4272 dvdvd.exe 101 PID 3148 wrote to memory of 3844 3148 xrxrxrx.exe 102 PID 3148 wrote to memory of 3844 3148 xrxrxrx.exe 102 PID 3148 wrote to memory of 3844 3148 xrxrxrx.exe 102 PID 3844 wrote to memory of 208 3844 jvvjd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe"C:\Users\Admin\AppData\Local\Temp\ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\lfrllff.exec:\lfrllff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\ppddv.exec:\ppddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\vjvjv.exec:\vjvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\dvjdj.exec:\dvjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\ffrflrf.exec:\ffrflrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\3jjjj.exec:\3jjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\xlrlfff.exec:\xlrlfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\9hbnhh.exec:\9hbnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\jjpdp.exec:\jjpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\nnhhbb.exec:\nnhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nbbttt.exec:\nbbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\jvjdd.exec:\jvjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\3rrrfff.exec:\3rrrfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\nnbtnh.exec:\nnbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\btbtth.exec:\btbtth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\fllfllf.exec:\fllfllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\lflrxlr.exec:\lflrxlr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\jdvvv.exec:\jdvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\dvdvd.exec:\dvdvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\jvvjd.exec:\jvvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\xrrlflr.exec:\xrrlflr.exe23⤵
- Executes dropped EXE
PID:208 -
\??\c:\bhnhbt.exec:\bhnhbt.exe24⤵
- Executes dropped EXE
PID:4904 -
\??\c:\bhtbtt.exec:\bhtbtt.exe25⤵
- Executes dropped EXE
PID:4960 -
\??\c:\lfxllll.exec:\lfxllll.exe26⤵
- Executes dropped EXE
PID:3392 -
\??\c:\frxrxrx.exec:\frxrxrx.exe27⤵
- Executes dropped EXE
PID:3868 -
\??\c:\tthhnb.exec:\tthhnb.exe28⤵
- Executes dropped EXE
PID:1244 -
\??\c:\vdjdj.exec:\vdjdj.exe29⤵
- Executes dropped EXE
PID:4084 -
\??\c:\jpvpv.exec:\jpvpv.exe30⤵
- Executes dropped EXE
PID:3816 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe31⤵
- Executes dropped EXE
PID:4288 -
\??\c:\lflfxxr.exec:\lflfxxr.exe32⤵
- Executes dropped EXE
PID:3108 -
\??\c:\hbbtnn.exec:\hbbtnn.exe33⤵
- Executes dropped EXE
PID:4624 -
\??\c:\7lrrxxl.exec:\7lrrxxl.exe34⤵
- Executes dropped EXE
PID:2060 -
\??\c:\5bhhbh.exec:\5bhhbh.exe35⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ppjdv.exec:\ppjdv.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4476 -
\??\c:\dppjj.exec:\dppjj.exe37⤵
- Executes dropped EXE
PID:468 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe38⤵
- Executes dropped EXE
PID:4764 -
\??\c:\hnnhht.exec:\hnnhht.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1688 -
\??\c:\1btnhn.exec:\1btnhn.exe40⤵
- Executes dropped EXE
PID:5056 -
\??\c:\vpjdp.exec:\vpjdp.exe41⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rrxrfxr.exec:\rrxrfxr.exe42⤵
- Executes dropped EXE
PID:4668 -
\??\c:\fffxrrl.exec:\fffxrrl.exe43⤵
- Executes dropped EXE
PID:1476 -
\??\c:\nhnhbt.exec:\nhnhbt.exe44⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dvdpj.exec:\dvdpj.exe45⤵
- Executes dropped EXE
PID:3936 -
\??\c:\dpjjd.exec:\dpjjd.exe46⤵
- Executes dropped EXE
PID:4672 -
\??\c:\lrxlrll.exec:\lrxlrll.exe47⤵
- Executes dropped EXE
PID:792 -
\??\c:\nnbttt.exec:\nnbttt.exe48⤵
- Executes dropped EXE
PID:2404 -
\??\c:\lrlrfrx.exec:\lrlrfrx.exe49⤵
- Executes dropped EXE
PID:4920 -
\??\c:\nhnhhb.exec:\nhnhhb.exe50⤵
- Executes dropped EXE
PID:5020 -
\??\c:\pjpjd.exec:\pjpjd.exe51⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tntnhn.exec:\tntnhn.exe52⤵
- Executes dropped EXE
PID:380 -
\??\c:\hhhtnn.exec:\hhhtnn.exe53⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vdvjd.exec:\vdvjd.exe54⤵
- Executes dropped EXE
PID:968 -
\??\c:\lrxrrlx.exec:\lrxrrlx.exe55⤵
- Executes dropped EXE
PID:3412 -
\??\c:\xfllrlf.exec:\xfllrlf.exe56⤵
- Executes dropped EXE
PID:4956 -
\??\c:\vvvvp.exec:\vvvvp.exe57⤵
- Executes dropped EXE
PID:4372 -
\??\c:\flrlfxr.exec:\flrlfxr.exe58⤵
- Executes dropped EXE
PID:4924 -
\??\c:\thbbnh.exec:\thbbnh.exe59⤵
- Executes dropped EXE
PID:4328 -
\??\c:\5dvpd.exec:\5dvpd.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3372 -
\??\c:\1fxxxxx.exec:\1fxxxxx.exe61⤵
- Executes dropped EXE
PID:1136 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe62⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hbhbbb.exec:\hbhbbb.exe63⤵
- Executes dropped EXE
PID:4336 -
\??\c:\pjddj.exec:\pjddj.exe64⤵
- Executes dropped EXE
PID:4780 -
\??\c:\pjvdp.exec:\pjvdp.exe65⤵
- Executes dropped EXE
PID:3536 -
\??\c:\xxllrrx.exec:\xxllrrx.exe66⤵PID:3068
-
\??\c:\nnhnhb.exec:\nnhnhb.exe67⤵PID:3876
-
\??\c:\jjpdv.exec:\jjpdv.exe68⤵PID:2824
-
\??\c:\vpvpv.exec:\vpvpv.exe69⤵PID:1176
-
\??\c:\frrrlll.exec:\frrrlll.exe70⤵PID:2780
-
\??\c:\tttnnn.exec:\tttnnn.exe71⤵PID:348
-
\??\c:\7nnnhh.exec:\7nnnhh.exe72⤵PID:232
-
\??\c:\vjjjd.exec:\vjjjd.exe73⤵PID:4092
-
\??\c:\lxlxfxf.exec:\lxlxfxf.exe74⤵PID:820
-
\??\c:\btnhbt.exec:\btnhbt.exe75⤵PID:4548
-
\??\c:\jvpjj.exec:\jvpjj.exe76⤵PID:1364
-
\??\c:\9ddvv.exec:\9ddvv.exe77⤵PID:2908
-
\??\c:\xrlfxfx.exec:\xrlfxfx.exe78⤵PID:3588
-
\??\c:\bbtntn.exec:\bbtntn.exe79⤵PID:3516
-
\??\c:\dpvdv.exec:\dpvdv.exe80⤵PID:1468
-
\??\c:\jppjv.exec:\jppjv.exe81⤵PID:4968
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe82⤵PID:4696
-
\??\c:\htnhbt.exec:\htnhbt.exe83⤵PID:2132
-
\??\c:\dpjjj.exec:\dpjjj.exe84⤵PID:3440
-
\??\c:\flllfff.exec:\flllfff.exe85⤵PID:1372
-
\??\c:\tnttnt.exec:\tnttnt.exe86⤵PID:4460
-
\??\c:\ddddd.exec:\ddddd.exe87⤵PID:1488
-
\??\c:\rllrlrr.exec:\rllrlrr.exe88⤵PID:3940
-
\??\c:\nbbtnt.exec:\nbbtnt.exe89⤵PID:2412
-
\??\c:\jdvpp.exec:\jdvpp.exe90⤵PID:4448
-
\??\c:\dvvjd.exec:\dvvjd.exe91⤵PID:4196
-
\??\c:\xffxrlf.exec:\xffxrlf.exe92⤵
- System Location Discovery: System Language Discovery
PID:3044 -
\??\c:\thnbtt.exec:\thnbtt.exe93⤵PID:4352
-
\??\c:\vvjdv.exec:\vvjdv.exe94⤵PID:2876
-
\??\c:\lrllxll.exec:\lrllxll.exe95⤵PID:1880
-
\??\c:\3rrfxxr.exec:\3rrfxxr.exe96⤵PID:4288
-
\??\c:\bnbtnt.exec:\bnbtnt.exe97⤵PID:3108
-
\??\c:\vjppj.exec:\vjppj.exe98⤵PID:764
-
\??\c:\lxrxxff.exec:\lxrxxff.exe99⤵PID:4388
-
\??\c:\lxrfrfr.exec:\lxrfrfr.exe100⤵PID:1720
-
\??\c:\bthtbn.exec:\bthtbn.exe101⤵PID:4864
-
\??\c:\pjjjd.exec:\pjjjd.exe102⤵PID:336
-
\??\c:\1rrlffx.exec:\1rrlffx.exe103⤵PID:2012
-
\??\c:\1bhhnn.exec:\1bhhnn.exe104⤵PID:4796
-
\??\c:\ddddv.exec:\ddddv.exe105⤵PID:5000
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe106⤵PID:1964
-
\??\c:\frrrrll.exec:\frrrrll.exe107⤵PID:4396
-
\??\c:\tnbhnn.exec:\tnbhnn.exe108⤵PID:4232
-
\??\c:\7jdvd.exec:\7jdvd.exe109⤵PID:5036
-
\??\c:\fxxfxrl.exec:\fxxfxrl.exe110⤵PID:1476
-
\??\c:\frrflfx.exec:\frrflfx.exe111⤵PID:3740
-
\??\c:\3bhbbb.exec:\3bhbbb.exe112⤵PID:1160
-
\??\c:\pjjdd.exec:\pjjdd.exe113⤵PID:4672
-
\??\c:\pddvp.exec:\pddvp.exe114⤵PID:1308
-
\??\c:\7xrllrl.exec:\7xrllrl.exe115⤵PID:2812
-
\??\c:\djddv.exec:\djddv.exe116⤵PID:3620
-
\??\c:\vdjdd.exec:\vdjdd.exe117⤵PID:3564
-
\??\c:\lxxfrlx.exec:\lxxfrlx.exe118⤵PID:2708
-
\??\c:\3nnhbb.exec:\3nnhbb.exe119⤵PID:1656
-
\??\c:\vjjjd.exec:\vjjjd.exe120⤵PID:2892
-
\??\c:\lrffllf.exec:\lrffllf.exe121⤵PID:1196
-
\??\c:\thhhnt.exec:\thhhnt.exe122⤵PID:3476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-