Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 20:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe
-
Size
456KB
-
MD5
c5f1481397bf6c741a6891e32882b090
-
SHA1
7007cc132cc2b5deee031e1d64fb54a0179a16b1
-
SHA256
f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263d
-
SHA512
bcfbae83b56bfd2694f7c8a91bff709c24e920359ffeb540671e309aeeb64f3e392e53b9b06a93076dc6076a8fb12c1c57cfdd56439f63de6dc3efd3d7a87eb7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeLV:q7Tc2NYHUrAwfMp3CDLV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/2844-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/324-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3660 dvvpj.exe 1300 fxrlffx.exe 3572 xflxrlf.exe 4084 bbbtnh.exe 2260 nhhbtn.exe 1240 5vvpj.exe 1472 llxrflr.exe 2980 5rrxrrr.exe 1892 5hhtnn.exe 740 bnnhbb.exe 4128 vjdpj.exe 2812 xffxxrr.exe 5040 bthbhb.exe 1740 nhbttt.exe 2392 dpdvv.exe 5052 lllfffr.exe 4432 7llxrlf.exe 2064 bnnhbt.exe 4984 pddjv.exe 324 xlfxlfx.exe 184 7xrlfxx.exe 348 bttnhn.exe 3532 pjjdv.exe 3960 vppjd.exe 640 7rrxffl.exe 4548 thnhbt.exe 4404 jpvpj.exe 1400 pdjvj.exe 4004 xlrxlrl.exe 784 htthbt.exe 1912 nhthbh.exe 4524 dvpjd.exe 1528 lxxlffr.exe 4164 hhbthb.exe 3404 ntbnbt.exe 3488 ppjdv.exe 4892 frrlfxr.exe 768 xrrfrxl.exe 4488 3nnhbb.exe 404 jdjjd.exe 4116 1dpjv.exe 4992 xflxrlr.exe 4756 hhhbtn.exe 4308 htnbnn.exe 4976 1vjvd.exe 3332 xrllfxr.exe 1736 tnnhtt.exe 628 bbhbtn.exe 228 jddvp.exe 3832 ppvvp.exe 4820 9frlllr.exe 1544 bttnhb.exe 4780 tnthbt.exe 1644 vdjdv.exe 2600 xlrfxrr.exe 1608 fxrlffx.exe 3252 hbhbtt.exe 4500 jddvv.exe 2424 rllfrll.exe 4744 xrrfxrl.exe 4276 bnnbtn.exe 1076 5ppdv.exe 5116 1fllrrr.exe 2096 bntbtt.exe -
resource yara_rule behavioral2/memory/2844-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/324-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-741-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fllxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 3660 2844 f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe 84 PID 2844 wrote to memory of 3660 2844 f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe 84 PID 2844 wrote to memory of 3660 2844 f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe 84 PID 3660 wrote to memory of 1300 3660 dvvpj.exe 85 PID 3660 wrote to memory of 1300 3660 dvvpj.exe 85 PID 3660 wrote to memory of 1300 3660 dvvpj.exe 85 PID 1300 wrote to memory of 3572 1300 fxrlffx.exe 86 PID 1300 wrote to memory of 3572 1300 fxrlffx.exe 86 PID 1300 wrote to memory of 3572 1300 fxrlffx.exe 86 PID 3572 wrote to memory of 4084 3572 xflxrlf.exe 87 PID 3572 wrote to memory of 4084 3572 xflxrlf.exe 87 PID 3572 wrote to memory of 4084 3572 xflxrlf.exe 87 PID 4084 wrote to memory of 2260 4084 bbbtnh.exe 88 PID 4084 wrote to memory of 2260 4084 bbbtnh.exe 88 PID 4084 wrote to memory of 2260 4084 bbbtnh.exe 88 PID 2260 wrote to memory of 1240 2260 nhhbtn.exe 89 PID 2260 wrote to memory of 1240 2260 nhhbtn.exe 89 PID 2260 wrote to memory of 1240 2260 nhhbtn.exe 89 PID 1240 wrote to memory of 1472 1240 5vvpj.exe 90 PID 1240 wrote to memory of 1472 1240 5vvpj.exe 90 PID 1240 wrote to memory of 1472 1240 5vvpj.exe 90 PID 1472 wrote to memory of 2980 1472 llxrflr.exe 91 PID 1472 wrote to memory of 2980 1472 llxrflr.exe 91 PID 1472 wrote to memory of 2980 1472 llxrflr.exe 91 PID 2980 wrote to memory of 1892 2980 5rrxrrr.exe 92 PID 2980 wrote to memory of 1892 2980 5rrxrrr.exe 92 PID 2980 wrote to memory of 1892 2980 5rrxrrr.exe 92 PID 1892 wrote to memory of 740 1892 5hhtnn.exe 93 PID 1892 wrote to memory of 740 1892 5hhtnn.exe 93 PID 1892 wrote to memory of 740 1892 5hhtnn.exe 93 PID 740 wrote to memory of 4128 740 bnnhbb.exe 94 PID 740 wrote to memory of 4128 740 bnnhbb.exe 94 PID 740 wrote to memory of 4128 740 bnnhbb.exe 94 PID 4128 wrote to memory of 2812 4128 vjdpj.exe 95 PID 4128 wrote to memory of 2812 4128 vjdpj.exe 95 PID 4128 wrote to memory of 2812 4128 vjdpj.exe 95 PID 2812 wrote to memory of 5040 2812 xffxxrr.exe 96 PID 2812 wrote to memory of 5040 2812 xffxxrr.exe 96 PID 2812 wrote to memory of 5040 2812 xffxxrr.exe 96 PID 5040 wrote to memory of 1740 5040 bthbhb.exe 97 PID 5040 wrote to memory of 1740 5040 bthbhb.exe 97 PID 5040 wrote to memory of 1740 5040 bthbhb.exe 97 PID 1740 wrote to memory of 2392 1740 nhbttt.exe 98 PID 1740 wrote to memory of 2392 1740 nhbttt.exe 98 PID 1740 wrote to memory of 2392 1740 nhbttt.exe 98 PID 2392 wrote to memory of 5052 2392 dpdvv.exe 161 PID 2392 wrote to memory of 5052 2392 dpdvv.exe 161 PID 2392 wrote to memory of 5052 2392 dpdvv.exe 161 PID 5052 wrote to memory of 4432 5052 lllfffr.exe 100 PID 5052 wrote to memory of 4432 5052 lllfffr.exe 100 PID 5052 wrote to memory of 4432 5052 lllfffr.exe 100 PID 4432 wrote to memory of 2064 4432 7llxrlf.exe 163 PID 4432 wrote to memory of 2064 4432 7llxrlf.exe 163 PID 4432 wrote to memory of 2064 4432 7llxrlf.exe 163 PID 2064 wrote to memory of 4984 2064 bnnhbt.exe 102 PID 2064 wrote to memory of 4984 2064 bnnhbt.exe 102 PID 2064 wrote to memory of 4984 2064 bnnhbt.exe 102 PID 4984 wrote to memory of 324 4984 pddjv.exe 165 PID 4984 wrote to memory of 324 4984 pddjv.exe 165 PID 4984 wrote to memory of 324 4984 pddjv.exe 165 PID 324 wrote to memory of 184 324 xlfxlfx.exe 104 PID 324 wrote to memory of 184 324 xlfxlfx.exe 104 PID 324 wrote to memory of 184 324 xlfxlfx.exe 104 PID 184 wrote to memory of 348 184 7xrlfxx.exe 167
Processes
-
C:\Users\Admin\AppData\Local\Temp\f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe"C:\Users\Admin\AppData\Local\Temp\f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\dvvpj.exec:\dvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\fxrlffx.exec:\fxrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\xflxrlf.exec:\xflxrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\bbbtnh.exec:\bbbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\nhhbtn.exec:\nhhbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\5vvpj.exec:\5vvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\llxrflr.exec:\llxrflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\5rrxrrr.exec:\5rrxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\5hhtnn.exec:\5hhtnn.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\bnnhbb.exec:\bnnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\vjdpj.exec:\vjdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\xffxxrr.exec:\xffxxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\bthbhb.exec:\bthbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\nhbttt.exec:\nhbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\dpdvv.exec:\dpdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\lllfffr.exec:\lllfffr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\7llxrlf.exec:\7llxrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\bnnhbt.exec:\bnnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\pddjv.exec:\pddjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\7xrlfxx.exec:\7xrlfxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\bttnhn.exec:\bttnhn.exe23⤵
- Executes dropped EXE
PID:348 -
\??\c:\pjjdv.exec:\pjjdv.exe24⤵
- Executes dropped EXE
PID:3532 -
\??\c:\vppjd.exec:\vppjd.exe25⤵
- Executes dropped EXE
PID:3960 -
\??\c:\7rrxffl.exec:\7rrxffl.exe26⤵
- Executes dropped EXE
PID:640 -
\??\c:\thnhbt.exec:\thnhbt.exe27⤵
- Executes dropped EXE
PID:4548 -
\??\c:\jpvpj.exec:\jpvpj.exe28⤵
- Executes dropped EXE
PID:4404 -
\??\c:\pdjvj.exec:\pdjvj.exe29⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xlrxlrl.exec:\xlrxlrl.exe30⤵
- Executes dropped EXE
PID:4004 -
\??\c:\htthbt.exec:\htthbt.exe31⤵
- Executes dropped EXE
PID:784 -
\??\c:\nhthbh.exec:\nhthbh.exe32⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dvpjd.exec:\dvpjd.exe33⤵
- Executes dropped EXE
PID:4524 -
\??\c:\lxxlffr.exec:\lxxlffr.exe34⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hhbthb.exec:\hhbthb.exe35⤵
- Executes dropped EXE
PID:4164 -
\??\c:\ntbnbt.exec:\ntbnbt.exe36⤵
- Executes dropped EXE
PID:3404 -
\??\c:\ppjdv.exec:\ppjdv.exe37⤵
- Executes dropped EXE
PID:3488 -
\??\c:\frrlfxr.exec:\frrlfxr.exe38⤵
- Executes dropped EXE
PID:4892 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe39⤵
- Executes dropped EXE
PID:768 -
\??\c:\3nnhbb.exec:\3nnhbb.exe40⤵
- Executes dropped EXE
PID:4488 -
\??\c:\jdjjd.exec:\jdjjd.exe41⤵
- Executes dropped EXE
PID:404 -
\??\c:\1dpjv.exec:\1dpjv.exe42⤵
- Executes dropped EXE
PID:4116 -
\??\c:\xflxrlr.exec:\xflxrlr.exe43⤵
- Executes dropped EXE
PID:4992 -
\??\c:\hhhbtn.exec:\hhhbtn.exe44⤵
- Executes dropped EXE
PID:4756 -
\??\c:\htnbnn.exec:\htnbnn.exe45⤵
- Executes dropped EXE
PID:4308 -
\??\c:\1vjvd.exec:\1vjvd.exe46⤵
- Executes dropped EXE
PID:4976 -
\??\c:\xrllfxr.exec:\xrllfxr.exe47⤵
- Executes dropped EXE
PID:3332 -
\??\c:\tnnhtt.exec:\tnnhtt.exe48⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bbhbtn.exec:\bbhbtn.exe49⤵
- Executes dropped EXE
PID:628 -
\??\c:\jddvp.exec:\jddvp.exe50⤵
- Executes dropped EXE
PID:228 -
\??\c:\ppvvp.exec:\ppvvp.exe51⤵
- Executes dropped EXE
PID:3832 -
\??\c:\9frlllr.exec:\9frlllr.exe52⤵
- Executes dropped EXE
PID:4820 -
\??\c:\bttnhb.exec:\bttnhb.exe53⤵
- Executes dropped EXE
PID:1544 -
\??\c:\tnthbt.exec:\tnthbt.exe54⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vdjdv.exec:\vdjdv.exe55⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xlrfxrr.exec:\xlrfxrr.exe56⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fxrlffx.exec:\fxrlffx.exe57⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hbhbtt.exec:\hbhbtt.exe58⤵
- Executes dropped EXE
PID:3252 -
\??\c:\jddvv.exec:\jddvv.exe59⤵
- Executes dropped EXE
PID:4500 -
\??\c:\rllfrll.exec:\rllfrll.exe60⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe61⤵
- Executes dropped EXE
PID:4744 -
\??\c:\bnnbtn.exec:\bnnbtn.exe62⤵
- Executes dropped EXE
PID:4276 -
\??\c:\5ppdv.exec:\5ppdv.exe63⤵
- Executes dropped EXE
PID:1076 -
\??\c:\1ddvv.exec:\1ddvv.exe64⤵PID:2844
-
\??\c:\1fllrrr.exec:\1fllrrr.exe65⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bntbtt.exec:\bntbtt.exe66⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nbnhtt.exec:\nbnhtt.exe67⤵PID:4208
-
\??\c:\5ppjj.exec:\5ppjj.exe68⤵PID:4140
-
\??\c:\lrffxxr.exec:\lrffxxr.exe69⤵PID:3912
-
\??\c:\xxfxllx.exec:\xxfxllx.exe70⤵PID:3192
-
\??\c:\bbnhbb.exec:\bbnhbb.exe71⤵PID:1240
-
\??\c:\jpdvv.exec:\jpdvv.exe72⤵PID:1472
-
\??\c:\jddpj.exec:\jddpj.exe73⤵PID:2644
-
\??\c:\frxfxxr.exec:\frxfxxr.exe74⤵PID:2144
-
\??\c:\nhthhb.exec:\nhthhb.exe75⤵PID:1964
-
\??\c:\jddvp.exec:\jddvp.exe76⤵PID:1080
-
\??\c:\3lxrrxf.exec:\3lxrrxf.exe77⤵PID:924
-
\??\c:\ffllffx.exec:\ffllffx.exe78⤵PID:664
-
\??\c:\frrlrlf.exec:\frrlrlf.exe79⤵PID:5052
-
\??\c:\hbtnbb.exec:\hbtnbb.exe80⤵PID:1928
-
\??\c:\jvdjd.exec:\jvdjd.exe81⤵PID:2064
-
\??\c:\rllxrll.exec:\rllxrll.exe82⤵PID:2444
-
\??\c:\bhntnn.exec:\bhntnn.exe83⤵PID:324
-
\??\c:\pvdpj.exec:\pvdpj.exe84⤵PID:1560
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe85⤵PID:348
-
\??\c:\lfrlrlr.exec:\lfrlrlr.exe86⤵PID:4688
-
\??\c:\tnhhbb.exec:\tnhhbb.exe87⤵PID:3032
-
\??\c:\ppjdd.exec:\ppjdd.exe88⤵PID:1820
-
\??\c:\1hnhnn.exec:\1hnhnn.exe89⤵PID:4912
-
\??\c:\dvvjd.exec:\dvvjd.exe90⤵PID:4004
-
\??\c:\ttbttt.exec:\ttbttt.exe91⤵PID:3652
-
\??\c:\dpdpj.exec:\dpdpj.exe92⤵PID:1816
-
\??\c:\vdvvp.exec:\vdvvp.exe93⤵PID:3984
-
\??\c:\fxlflfl.exec:\fxlflfl.exe94⤵PID:4600
-
\??\c:\3nntnh.exec:\3nntnh.exe95⤵PID:2288
-
\??\c:\djpjj.exec:\djpjj.exe96⤵PID:2544
-
\??\c:\rxffxxr.exec:\rxffxxr.exe97⤵PID:3668
-
\??\c:\1flfxxr.exec:\1flfxxr.exe98⤵PID:2232
-
\??\c:\nhhbtn.exec:\nhhbtn.exe99⤵PID:4408
-
\??\c:\5nnhbb.exec:\5nnhbb.exe100⤵PID:3112
-
\??\c:\7vvpp.exec:\7vvpp.exe101⤵PID:4992
-
\??\c:\llxrfxf.exec:\llxrfxf.exe102⤵PID:2664
-
\??\c:\nnhtht.exec:\nnhtht.exe103⤵PID:1152
-
\??\c:\5jpjp.exec:\5jpjp.exe104⤵PID:4136
-
\??\c:\7jvpd.exec:\7jvpd.exe105⤵PID:3208
-
\??\c:\fxrlxfx.exec:\fxrlxfx.exe106⤵PID:2700
-
\??\c:\1hnhbb.exec:\1hnhbb.exe107⤵PID:2476
-
\??\c:\9jjdd.exec:\9jjdd.exe108⤵PID:4888
-
\??\c:\frfxrrx.exec:\frfxrrx.exe109⤵PID:2716
-
\??\c:\pjpjd.exec:\pjpjd.exe110⤵PID:3656
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe111⤵PID:4840
-
\??\c:\xflfllr.exec:\xflfllr.exe112⤵PID:4844
-
\??\c:\ttbnhn.exec:\ttbnhn.exe113⤵PID:3240
-
\??\c:\rfrfrfl.exec:\rfrfrfl.exe114⤵PID:3188
-
\??\c:\5xfxrrr.exec:\5xfxrrr.exe115⤵PID:4916
-
\??\c:\vpjdj.exec:\vpjdj.exe116⤵PID:1304
-
\??\c:\fflfxxf.exec:\fflfxxf.exe117⤵PID:3640
-
\??\c:\5ntnhh.exec:\5ntnhh.exe118⤵PID:1140
-
\??\c:\3lxrlff.exec:\3lxrlff.exe119⤵PID:4268
-
\??\c:\nthbnn.exec:\nthbnn.exe120⤵PID:4276
-
\??\c:\pppjj.exec:\pppjj.exe121⤵PID:728
-
\??\c:\vpdvd.exec:\vpdvd.exe122⤵PID:3136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-