Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 20:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe
-
Size
456KB
-
MD5
81936129e6ecf3314932aae32c0ab213
-
SHA1
09c5a861b63ea28a421a478040eb5f01805d066d
-
SHA256
e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7
-
SHA512
f8d9814f1e5ca8bbf61cc6f5973497af3045caedbeb3fbf831b85a5087f1da9bc353ce2f9e6c07708586144bdc9c9a5b0526126365c265d11151ff87eb0ab890
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1200-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/680-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 732 lllllrr.exe 3476 lfxxxxf.exe 4264 lrrxxff.exe 1996 djppv.exe 4332 lflrrfl.exe 2020 bbbbtt.exe 456 tnbhbt.exe 1188 bhtnhh.exe 2080 bbthbt.exe 1768 vddvd.exe 2156 rrrrrrx.exe 1068 jddvp.exe 3960 ffxrllf.exe 5012 lxrffrr.exe 3740 hhbttt.exe 2144 vvvvj.exe 3916 bhhhhh.exe 4088 vdvpv.exe 432 tbhhht.exe 4536 vddvv.exe 2192 vpjjd.exe 468 ttntnn.exe 4628 pvjdj.exe 5048 hhhhhh.exe 1964 hnhnht.exe 5016 lxflllf.exe 3040 7ppvj.exe 3500 xxrlffx.exe 3392 jjjjp.exe 1128 9thhhn.exe 2100 btnnhh.exe 3300 xrxxxlf.exe 4268 vdjvp.exe 1492 rfxxffl.exe 1476 nhnhhh.exe 3784 1jpvv.exe 3768 ntbhhh.exe 4240 7ddvp.exe 1472 1bnnhn.exe 4868 vjddd.exe 4480 rrrlffx.exe 220 tbbttt.exe 2068 9jvvd.exe 2900 7flllxx.exe 4460 tttnnt.exe 3080 jjpjv.exe 4348 flxflxx.exe 1968 thbhhh.exe 2920 jpjjj.exe 3292 rffllll.exe 2868 5hhhhn.exe 244 nhbbtt.exe 1504 vpjdd.exe 512 frlfxlr.exe 112 bhbhth.exe 4700 flfffll.exe 2864 tnnnnn.exe 964 hntnnb.exe 3480 ppppp.exe 3028 xxxxxff.exe 2680 5ttttn.exe 2908 vdvvv.exe 2800 rffxxxx.exe 4784 9jddd.exe -
resource yara_rule behavioral2/memory/1200-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/680-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-672-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1200 wrote to memory of 732 1200 e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe 83 PID 1200 wrote to memory of 732 1200 e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe 83 PID 1200 wrote to memory of 732 1200 e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe 83 PID 732 wrote to memory of 3476 732 lllllrr.exe 84 PID 732 wrote to memory of 3476 732 lllllrr.exe 84 PID 732 wrote to memory of 3476 732 lllllrr.exe 84 PID 3476 wrote to memory of 4264 3476 lfxxxxf.exe 85 PID 3476 wrote to memory of 4264 3476 lfxxxxf.exe 85 PID 3476 wrote to memory of 4264 3476 lfxxxxf.exe 85 PID 4264 wrote to memory of 1996 4264 lrrxxff.exe 86 PID 4264 wrote to memory of 1996 4264 lrrxxff.exe 86 PID 4264 wrote to memory of 1996 4264 lrrxxff.exe 86 PID 1996 wrote to memory of 4332 1996 djppv.exe 87 PID 1996 wrote to memory of 4332 1996 djppv.exe 87 PID 1996 wrote to memory of 4332 1996 djppv.exe 87 PID 4332 wrote to memory of 2020 4332 lflrrfl.exe 88 PID 4332 wrote to memory of 2020 4332 lflrrfl.exe 88 PID 4332 wrote to memory of 2020 4332 lflrrfl.exe 88 PID 2020 wrote to memory of 456 2020 bbbbtt.exe 89 PID 2020 wrote to memory of 456 2020 bbbbtt.exe 89 PID 2020 wrote to memory of 456 2020 bbbbtt.exe 89 PID 456 wrote to memory of 1188 456 tnbhbt.exe 90 PID 456 wrote to memory of 1188 456 tnbhbt.exe 90 PID 456 wrote to memory of 1188 456 tnbhbt.exe 90 PID 1188 wrote to memory of 2080 1188 bhtnhh.exe 91 PID 1188 wrote to memory of 2080 1188 bhtnhh.exe 91 PID 1188 wrote to memory of 2080 1188 bhtnhh.exe 91 PID 2080 wrote to memory of 1768 2080 bbthbt.exe 92 PID 2080 wrote to memory of 1768 2080 bbthbt.exe 92 PID 2080 wrote to memory of 1768 2080 bbthbt.exe 92 PID 1768 wrote to memory of 2156 1768 vddvd.exe 93 PID 1768 wrote to memory of 2156 1768 vddvd.exe 93 PID 1768 wrote to memory of 2156 1768 vddvd.exe 93 PID 2156 wrote to memory of 1068 2156 rrrrrrx.exe 94 PID 2156 wrote to memory of 1068 2156 rrrrrrx.exe 94 PID 2156 wrote to memory of 1068 2156 rrrrrrx.exe 94 PID 1068 wrote to memory of 3960 1068 jddvp.exe 95 PID 1068 wrote to memory of 3960 1068 jddvp.exe 95 PID 1068 wrote to memory of 3960 1068 jddvp.exe 95 PID 3960 wrote to memory of 5012 3960 ffxrllf.exe 96 PID 3960 wrote to memory of 5012 3960 ffxrllf.exe 96 PID 3960 wrote to memory of 5012 3960 ffxrllf.exe 96 PID 5012 wrote to memory of 3740 5012 lxrffrr.exe 97 PID 5012 wrote to memory of 3740 5012 lxrffrr.exe 97 PID 5012 wrote to memory of 3740 5012 lxrffrr.exe 97 PID 3740 wrote to memory of 2144 3740 hhbttt.exe 98 PID 3740 wrote to memory of 2144 3740 hhbttt.exe 98 PID 3740 wrote to memory of 2144 3740 hhbttt.exe 98 PID 2144 wrote to memory of 3916 2144 vvvvj.exe 99 PID 2144 wrote to memory of 3916 2144 vvvvj.exe 99 PID 2144 wrote to memory of 3916 2144 vvvvj.exe 99 PID 3916 wrote to memory of 4088 3916 bhhhhh.exe 100 PID 3916 wrote to memory of 4088 3916 bhhhhh.exe 100 PID 3916 wrote to memory of 4088 3916 bhhhhh.exe 100 PID 4088 wrote to memory of 432 4088 vdvpv.exe 101 PID 4088 wrote to memory of 432 4088 vdvpv.exe 101 PID 4088 wrote to memory of 432 4088 vdvpv.exe 101 PID 432 wrote to memory of 4536 432 tbhhht.exe 102 PID 432 wrote to memory of 4536 432 tbhhht.exe 102 PID 432 wrote to memory of 4536 432 tbhhht.exe 102 PID 4536 wrote to memory of 2192 4536 vddvv.exe 103 PID 4536 wrote to memory of 2192 4536 vddvv.exe 103 PID 4536 wrote to memory of 2192 4536 vddvv.exe 103 PID 2192 wrote to memory of 468 2192 vpjjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe"C:\Users\Admin\AppData\Local\Temp\e2303d41aa9d2959a7941c7a0221b5fdbdf9091efdcfab72f3f4bb618776b7b7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\lllllrr.exec:\lllllrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\lrrxxff.exec:\lrrxxff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\djppv.exec:\djppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\lflrrfl.exec:\lflrrfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\bbbbtt.exec:\bbbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\tnbhbt.exec:\tnbhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\bhtnhh.exec:\bhtnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\bbthbt.exec:\bbthbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\vddvd.exec:\vddvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\rrrrrrx.exec:\rrrrrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\jddvp.exec:\jddvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\ffxrllf.exec:\ffxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\lxrffrr.exec:\lxrffrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\hhbttt.exec:\hhbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\vvvvj.exec:\vvvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\bhhhhh.exec:\bhhhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\vdvpv.exec:\vdvpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\tbhhht.exec:\tbhhht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\vddvv.exec:\vddvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\vpjjd.exec:\vpjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\ttntnn.exec:\ttntnn.exe23⤵
- Executes dropped EXE
PID:468 -
\??\c:\pvjdj.exec:\pvjdj.exe24⤵
- Executes dropped EXE
PID:4628 -
\??\c:\hhhhhh.exec:\hhhhhh.exe25⤵
- Executes dropped EXE
PID:5048 -
\??\c:\hnhnht.exec:\hnhnht.exe26⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lxflllf.exec:\lxflllf.exe27⤵
- Executes dropped EXE
PID:5016 -
\??\c:\7ppvj.exec:\7ppvj.exe28⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xxrlffx.exec:\xxrlffx.exe29⤵
- Executes dropped EXE
PID:3500 -
\??\c:\jjjjp.exec:\jjjjp.exe30⤵
- Executes dropped EXE
PID:3392 -
\??\c:\9thhhn.exec:\9thhhn.exe31⤵
- Executes dropped EXE
PID:1128 -
\??\c:\btnnhh.exec:\btnnhh.exe32⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xrxxxlf.exec:\xrxxxlf.exe33⤵
- Executes dropped EXE
PID:3300 -
\??\c:\vdjvp.exec:\vdjvp.exe34⤵
- Executes dropped EXE
PID:4268 -
\??\c:\rfxxffl.exec:\rfxxffl.exe35⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nhnhhh.exec:\nhnhhh.exe36⤵
- Executes dropped EXE
PID:1476 -
\??\c:\1jpvv.exec:\1jpvv.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3784 -
\??\c:\ntbhhh.exec:\ntbhhh.exe38⤵
- Executes dropped EXE
PID:3768 -
\??\c:\7ddvp.exec:\7ddvp.exe39⤵
- Executes dropped EXE
PID:4240 -
\??\c:\1bnnhn.exec:\1bnnhn.exe40⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vjddd.exec:\vjddd.exe41⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rrrlffx.exec:\rrrlffx.exe42⤵
- Executes dropped EXE
PID:4480 -
\??\c:\tbbttt.exec:\tbbttt.exe43⤵
- Executes dropped EXE
PID:220 -
\??\c:\9jvvd.exec:\9jvvd.exe44⤵
- Executes dropped EXE
PID:2068 -
\??\c:\7flllxx.exec:\7flllxx.exe45⤵
- Executes dropped EXE
PID:2900 -
\??\c:\tttnnt.exec:\tttnnt.exe46⤵
- Executes dropped EXE
PID:4460 -
\??\c:\jjpjv.exec:\jjpjv.exe47⤵
- Executes dropped EXE
PID:3080 -
\??\c:\flxflxx.exec:\flxflxx.exe48⤵
- Executes dropped EXE
PID:4348 -
\??\c:\thbhhh.exec:\thbhhh.exe49⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jpjjj.exec:\jpjjj.exe50⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rffllll.exec:\rffllll.exe51⤵
- Executes dropped EXE
PID:3292 -
\??\c:\5hhhhn.exec:\5hhhhn.exe52⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhbbtt.exec:\nhbbtt.exe53⤵
- Executes dropped EXE
PID:244 -
\??\c:\vpjdd.exec:\vpjdd.exe54⤵
- Executes dropped EXE
PID:1504 -
\??\c:\frlfxlr.exec:\frlfxlr.exe55⤵
- Executes dropped EXE
PID:512 -
\??\c:\bhbhth.exec:\bhbhth.exe56⤵
- Executes dropped EXE
PID:112 -
\??\c:\flfffll.exec:\flfffll.exe57⤵
- Executes dropped EXE
PID:4700 -
\??\c:\tnnnnn.exec:\tnnnnn.exe58⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hntnnb.exec:\hntnnb.exe59⤵
- Executes dropped EXE
PID:964 -
\??\c:\ppppp.exec:\ppppp.exe60⤵
- Executes dropped EXE
PID:3480 -
\??\c:\xxxxxff.exec:\xxxxxff.exe61⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5ttttn.exec:\5ttttn.exe62⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vdvvv.exec:\vdvvv.exe63⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rffxxxx.exec:\rffxxxx.exe64⤵
- Executes dropped EXE
PID:2800 -
\??\c:\9jddd.exec:\9jddd.exe65⤵
- Executes dropped EXE
PID:4784 -
\??\c:\djpdj.exec:\djpdj.exe66⤵PID:1088
-
\??\c:\9rffrrf.exec:\9rffrrf.exe67⤵PID:4088
-
\??\c:\btbtnn.exec:\btbtnn.exe68⤵PID:4484
-
\??\c:\jjjjj.exec:\jjjjj.exe69⤵PID:4976
-
\??\c:\lrxxlfl.exec:\lrxxlfl.exe70⤵PID:3876
-
\??\c:\bntbhn.exec:\bntbhn.exe71⤵PID:4536
-
\??\c:\pdjpp.exec:\pdjpp.exe72⤵PID:2192
-
\??\c:\vvddj.exec:\vvddj.exe73⤵PID:3376
-
\??\c:\xrxxffr.exec:\xrxxffr.exe74⤵PID:3864
-
\??\c:\nhthhn.exec:\nhthhn.exe75⤵PID:3132
-
\??\c:\djvvd.exec:\djvvd.exe76⤵PID:5048
-
\??\c:\9xlllrx.exec:\9xlllrx.exe77⤵PID:3736
-
\??\c:\nhnhnt.exec:\nhnhnt.exe78⤵PID:1964
-
\??\c:\jpdpd.exec:\jpdpd.exe79⤵PID:1676
-
\??\c:\jvvjd.exec:\jvvjd.exe80⤵PID:3464
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe81⤵PID:4284
-
\??\c:\tttttb.exec:\tttttb.exe82⤵PID:5064
-
\??\c:\jjjdd.exec:\jjjdd.exe83⤵PID:4844
-
\??\c:\rxffxxx.exec:\rxffxxx.exe84⤵PID:4584
-
\??\c:\bhnnnt.exec:\bhnnnt.exe85⤵PID:3828
-
\??\c:\jdjjd.exec:\jdjjd.exe86⤵PID:3708
-
\??\c:\vpppj.exec:\vpppj.exe87⤵PID:2988
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe88⤵PID:4128
-
\??\c:\hbhbhh.exec:\hbhbhh.exe89⤵PID:4692
-
\??\c:\llfrlfr.exec:\llfrlfr.exe90⤵PID:4860
-
\??\c:\hbnhbb.exec:\hbnhbb.exe91⤵PID:4820
-
\??\c:\hhhbtt.exec:\hhhbtt.exe92⤵PID:3056
-
\??\c:\pvvvp.exec:\pvvvp.exe93⤵PID:1192
-
\??\c:\xlfffff.exec:\xlfffff.exe94⤵PID:4520
-
\??\c:\7xxrrrl.exec:\7xxrrrl.exe95⤵PID:4956
-
\??\c:\bttttt.exec:\bttttt.exe96⤵PID:3264
-
\??\c:\ddpvp.exec:\ddpvp.exe97⤵PID:1364
-
\??\c:\rrlllxx.exec:\rrlllxx.exe98⤵PID:4756
-
\??\c:\bhbbtt.exec:\bhbbtt.exe99⤵PID:4240
-
\??\c:\9dvjd.exec:\9dvjd.exe100⤵PID:4376
-
\??\c:\lflfxxx.exec:\lflfxxx.exe101⤵PID:4428
-
\??\c:\nntnbb.exec:\nntnbb.exe102⤵PID:4324
-
\??\c:\5vppp.exec:\5vppp.exe103⤵PID:4848
-
\??\c:\xrfllrx.exec:\xrfllrx.exe104⤵
- System Location Discovery: System Language Discovery
PID:220 -
\??\c:\htbhth.exec:\htbhth.exe105⤵PID:3692
-
\??\c:\bbnnbn.exec:\bbnnbn.exe106⤵PID:3388
-
\??\c:\jvvvv.exec:\jvvvv.exe107⤵PID:1788
-
\??\c:\lrffrrl.exec:\lrffrrl.exe108⤵PID:3316
-
\??\c:\thbttt.exec:\thbttt.exe109⤵PID:1800
-
\??\c:\pjddd.exec:\pjddd.exe110⤵PID:4752
-
\??\c:\vdvvv.exec:\vdvvv.exe111⤵PID:3760
-
\??\c:\5xxrlrl.exec:\5xxrlrl.exe112⤵PID:5100
-
\??\c:\1nhnhn.exec:\1nhnhn.exe113⤵PID:3292
-
\??\c:\jpjjj.exec:\jpjjj.exe114⤵PID:2740
-
\??\c:\jppdv.exec:\jppdv.exe115⤵PID:3252
-
\??\c:\bhthbh.exec:\bhthbh.exe116⤵PID:5056
-
\??\c:\djpjv.exec:\djpjv.exe117⤵PID:2080
-
\??\c:\jjvpj.exec:\jjvpj.exe118⤵
- System Location Discovery: System Language Discovery
PID:184 -
\??\c:\3rrxlrr.exec:\3rrxlrr.exe119⤵PID:4900
-
\??\c:\bbtnhb.exec:\bbtnhb.exe120⤵PID:4700
-
\??\c:\vjpjj.exec:\vjpjj.exe121⤵PID:2864
-
\??\c:\djjdd.exec:\djjdd.exe122⤵PID:964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-