Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 21:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe
-
Size
456KB
-
MD5
547daad7af969af1acbeee22159442f0
-
SHA1
d427988b5631732a6b8f44c606fb95f9ced4a6dc
-
SHA256
4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834
-
SHA512
4fbbbee74ea0a08727627a12e1d3babd76cf97ff896359d0842f25ff9c80efdc1d7aa6d92b6c453afeb2aaf5c26fef62acb212b6f0d55795fd57876b597ea9c5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbelm:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/336-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-837-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-1140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-1328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-1692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-1738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3136 rlxrrlx.exe 4880 1bbhbn.exe 5088 llffxrx.exe 4728 hbhbnn.exe 3156 5ffxxxr.exe 3276 ddvpj.exe 1780 7jpjd.exe 1104 vdpjd.exe 4128 xrrlfxx.exe 2812 thhtbb.exe 652 nbbbbb.exe 4600 1pdvj.exe 3028 frxffxr.exe 3184 bttnnn.exe 3840 jvvvp.exe 3344 rlxrxrx.exe 2848 btbbtt.exe 2852 vpvdp.exe 3228 fxlfxfr.exe 4908 dpppj.exe 2204 vpjjj.exe 3204 lfxxrrr.exe 3928 hbbbtb.exe 4048 lrxrrrl.exe 3948 pjpjd.exe 2544 lxllffx.exe 4524 bhbtnn.exe 1528 nhhhbb.exe 4264 vpppp.exe 4672 1xxxrxr.exe 1788 pvjdd.exe 2232 xxfxxll.exe 4528 tthbtn.exe 1668 3jpdd.exe 4708 jvvvp.exe 436 rlrlfrl.exe 3284 jddpd.exe 2292 flxlffr.exe 628 rfrrllf.exe 1864 jpppj.exe 5084 llxrlfx.exe 3224 bnttnn.exe 3616 hbbnhb.exe 4940 pdjdv.exe 764 flrlllf.exe 4624 7ttntt.exe 1732 bbhhnn.exe 940 1djdp.exe 2844 rflfffx.exe 4744 btbthh.exe 4360 nntbth.exe 3660 1dvpp.exe 4868 lrffxxx.exe 5032 rrfxffl.exe 464 bnbbhb.exe 3572 dpvpj.exe 3912 jjpjp.exe 4804 rlllfrr.exe 5012 tnnhtt.exe 4476 9ddvp.exe 1616 1xrlffx.exe 4968 9xxrllx.exe 1436 thnhnn.exe 4156 dpvpp.exe -
resource yara_rule behavioral2/memory/336-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-708-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 336 wrote to memory of 3136 336 4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe 84 PID 336 wrote to memory of 3136 336 4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe 84 PID 336 wrote to memory of 3136 336 4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe 84 PID 3136 wrote to memory of 4880 3136 rlxrrlx.exe 85 PID 3136 wrote to memory of 4880 3136 rlxrrlx.exe 85 PID 3136 wrote to memory of 4880 3136 rlxrrlx.exe 85 PID 4880 wrote to memory of 5088 4880 1bbhbn.exe 86 PID 4880 wrote to memory of 5088 4880 1bbhbn.exe 86 PID 4880 wrote to memory of 5088 4880 1bbhbn.exe 86 PID 5088 wrote to memory of 4728 5088 llffxrx.exe 87 PID 5088 wrote to memory of 4728 5088 llffxrx.exe 87 PID 5088 wrote to memory of 4728 5088 llffxrx.exe 87 PID 4728 wrote to memory of 3156 4728 hbhbnn.exe 88 PID 4728 wrote to memory of 3156 4728 hbhbnn.exe 88 PID 4728 wrote to memory of 3156 4728 hbhbnn.exe 88 PID 3156 wrote to memory of 3276 3156 5ffxxxr.exe 89 PID 3156 wrote to memory of 3276 3156 5ffxxxr.exe 89 PID 3156 wrote to memory of 3276 3156 5ffxxxr.exe 89 PID 3276 wrote to memory of 1780 3276 ddvpj.exe 90 PID 3276 wrote to memory of 1780 3276 ddvpj.exe 90 PID 3276 wrote to memory of 1780 3276 ddvpj.exe 90 PID 1780 wrote to memory of 1104 1780 7jpjd.exe 91 PID 1780 wrote to memory of 1104 1780 7jpjd.exe 91 PID 1780 wrote to memory of 1104 1780 7jpjd.exe 91 PID 1104 wrote to memory of 4128 1104 vdpjd.exe 92 PID 1104 wrote to memory of 4128 1104 vdpjd.exe 92 PID 1104 wrote to memory of 4128 1104 vdpjd.exe 92 PID 4128 wrote to memory of 2812 4128 xrrlfxx.exe 93 PID 4128 wrote to memory of 2812 4128 xrrlfxx.exe 93 PID 4128 wrote to memory of 2812 4128 xrrlfxx.exe 93 PID 2812 wrote to memory of 652 2812 thhtbb.exe 94 PID 2812 wrote to memory of 652 2812 thhtbb.exe 94 PID 2812 wrote to memory of 652 2812 thhtbb.exe 94 PID 652 wrote to memory of 4600 652 nbbbbb.exe 95 PID 652 wrote to memory of 4600 652 nbbbbb.exe 95 PID 652 wrote to memory of 4600 652 nbbbbb.exe 95 PID 4600 wrote to memory of 3028 4600 1pdvj.exe 96 PID 4600 wrote to memory of 3028 4600 1pdvj.exe 96 PID 4600 wrote to memory of 3028 4600 1pdvj.exe 96 PID 3028 wrote to memory of 3184 3028 frxffxr.exe 97 PID 3028 wrote to memory of 3184 3028 frxffxr.exe 97 PID 3028 wrote to memory of 3184 3028 frxffxr.exe 97 PID 3184 wrote to memory of 3840 3184 bttnnn.exe 98 PID 3184 wrote to memory of 3840 3184 bttnnn.exe 98 PID 3184 wrote to memory of 3840 3184 bttnnn.exe 98 PID 3840 wrote to memory of 3344 3840 jvvvp.exe 99 PID 3840 wrote to memory of 3344 3840 jvvvp.exe 99 PID 3840 wrote to memory of 3344 3840 jvvvp.exe 99 PID 3344 wrote to memory of 2848 3344 rlxrxrx.exe 100 PID 3344 wrote to memory of 2848 3344 rlxrxrx.exe 100 PID 3344 wrote to memory of 2848 3344 rlxrxrx.exe 100 PID 2848 wrote to memory of 2852 2848 btbbtt.exe 101 PID 2848 wrote to memory of 2852 2848 btbbtt.exe 101 PID 2848 wrote to memory of 2852 2848 btbbtt.exe 101 PID 2852 wrote to memory of 3228 2852 vpvdp.exe 102 PID 2852 wrote to memory of 3228 2852 vpvdp.exe 102 PID 2852 wrote to memory of 3228 2852 vpvdp.exe 102 PID 3228 wrote to memory of 4908 3228 fxlfxfr.exe 103 PID 3228 wrote to memory of 4908 3228 fxlfxfr.exe 103 PID 3228 wrote to memory of 4908 3228 fxlfxfr.exe 103 PID 4908 wrote to memory of 2204 4908 dpppj.exe 104 PID 4908 wrote to memory of 2204 4908 dpppj.exe 104 PID 4908 wrote to memory of 2204 4908 dpppj.exe 104 PID 2204 wrote to memory of 3204 2204 vpjjj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe"C:\Users\Admin\AppData\Local\Temp\4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\rlxrrlx.exec:\rlxrrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\1bbhbn.exec:\1bbhbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\llffxrx.exec:\llffxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\hbhbnn.exec:\hbhbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\5ffxxxr.exec:\5ffxxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\ddvpj.exec:\ddvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\7jpjd.exec:\7jpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\vdpjd.exec:\vdpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\thhtbb.exec:\thhtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\nbbbbb.exec:\nbbbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\1pdvj.exec:\1pdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\frxffxr.exec:\frxffxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\bttnnn.exec:\bttnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\jvvvp.exec:\jvvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\rlxrxrx.exec:\rlxrxrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\btbbtt.exec:\btbbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vpvdp.exec:\vpvdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\fxlfxfr.exec:\fxlfxfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\dpppj.exec:\dpppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\vpjjj.exec:\vpjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe23⤵
- Executes dropped EXE
PID:3204 -
\??\c:\hbbbtb.exec:\hbbbtb.exe24⤵
- Executes dropped EXE
PID:3928 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe25⤵
- Executes dropped EXE
PID:4048 -
\??\c:\pjpjd.exec:\pjpjd.exe26⤵
- Executes dropped EXE
PID:3948 -
\??\c:\lxllffx.exec:\lxllffx.exe27⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bhbtnn.exec:\bhbtnn.exe28⤵
- Executes dropped EXE
PID:4524 -
\??\c:\nhhhbb.exec:\nhhhbb.exe29⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vpppp.exec:\vpppp.exe30⤵
- Executes dropped EXE
PID:4264 -
\??\c:\1xxxrxr.exec:\1xxxrxr.exe31⤵
- Executes dropped EXE
PID:4672 -
\??\c:\pvjdd.exec:\pvjdd.exe32⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xxfxxll.exec:\xxfxxll.exe33⤵
- Executes dropped EXE
PID:2232 -
\??\c:\tthbtn.exec:\tthbtn.exe34⤵
- Executes dropped EXE
PID:4528 -
\??\c:\3jpdd.exec:\3jpdd.exe35⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jvvvp.exec:\jvvvp.exe36⤵
- Executes dropped EXE
PID:4708 -
\??\c:\rlrlfrl.exec:\rlrlfrl.exe37⤵
- Executes dropped EXE
PID:436 -
\??\c:\jddpd.exec:\jddpd.exe38⤵
- Executes dropped EXE
PID:3284 -
\??\c:\flxlffr.exec:\flxlffr.exe39⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rfrrllf.exec:\rfrrllf.exe40⤵
- Executes dropped EXE
PID:628 -
\??\c:\jpppj.exec:\jpppj.exe41⤵
- Executes dropped EXE
PID:1864 -
\??\c:\llxrlfx.exec:\llxrlfx.exe42⤵
- Executes dropped EXE
PID:5084 -
\??\c:\bnttnn.exec:\bnttnn.exe43⤵
- Executes dropped EXE
PID:3224 -
\??\c:\hbbnhb.exec:\hbbnhb.exe44⤵
- Executes dropped EXE
PID:3616 -
\??\c:\pdjdv.exec:\pdjdv.exe45⤵
- Executes dropped EXE
PID:4940 -
\??\c:\flrlllf.exec:\flrlllf.exe46⤵
- Executes dropped EXE
PID:764 -
\??\c:\7ttntt.exec:\7ttntt.exe47⤵
- Executes dropped EXE
PID:4624 -
\??\c:\bbhhnn.exec:\bbhhnn.exe48⤵
- Executes dropped EXE
PID:1732 -
\??\c:\1djdp.exec:\1djdp.exe49⤵
- Executes dropped EXE
PID:940 -
\??\c:\rflfffx.exec:\rflfffx.exe50⤵
- Executes dropped EXE
PID:2844 -
\??\c:\btbthh.exec:\btbthh.exe51⤵
- Executes dropped EXE
PID:4744 -
\??\c:\nntbth.exec:\nntbth.exe52⤵
- Executes dropped EXE
PID:4360 -
\??\c:\1dvpp.exec:\1dvpp.exe53⤵
- Executes dropped EXE
PID:3660 -
\??\c:\lrffxxx.exec:\lrffxxx.exe54⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rrfxffl.exec:\rrfxffl.exe55⤵
- Executes dropped EXE
PID:5032 -
\??\c:\bnbbhb.exec:\bnbbhb.exe56⤵
- Executes dropped EXE
PID:464 -
\??\c:\dpvpj.exec:\dpvpj.exe57⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jjpjp.exec:\jjpjp.exe58⤵
- Executes dropped EXE
PID:3912 -
\??\c:\rlllfrr.exec:\rlllfrr.exe59⤵
- Executes dropped EXE
PID:4804 -
\??\c:\tnnhtt.exec:\tnnhtt.exe60⤵
- Executes dropped EXE
PID:5012 -
\??\c:\9ddvp.exec:\9ddvp.exe61⤵
- Executes dropped EXE
PID:4476 -
\??\c:\1xrlffx.exec:\1xrlffx.exe62⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9xxrllx.exec:\9xxrllx.exe63⤵
- Executes dropped EXE
PID:4968 -
\??\c:\thnhnn.exec:\thnhnn.exe64⤵
- Executes dropped EXE
PID:1436 -
\??\c:\dpvpp.exec:\dpvpp.exe65⤵
- Executes dropped EXE
PID:4156 -
\??\c:\jvdvp.exec:\jvdvp.exe66⤵PID:4896
-
\??\c:\fxflfxx.exec:\fxflfxx.exe67⤵PID:1268
-
\??\c:\ntbtbb.exec:\ntbtbb.exe68⤵PID:224
-
\??\c:\dvddv.exec:\dvddv.exe69⤵PID:2900
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe70⤵PID:3036
-
\??\c:\htnhnn.exec:\htnhnn.exe71⤵PID:2552
-
\??\c:\5ttbnn.exec:\5ttbnn.exe72⤵PID:3040
-
\??\c:\vjjdd.exec:\vjjdd.exe73⤵PID:2404
-
\??\c:\rxlffxl.exec:\rxlffxl.exe74⤵PID:844
-
\??\c:\7tnhhh.exec:\7tnhhh.exe75⤵PID:3508
-
\??\c:\ppjjd.exec:\ppjjd.exe76⤵PID:3128
-
\??\c:\xrllfxx.exec:\xrllfxx.exe77⤵PID:4504
-
\??\c:\tbbttn.exec:\tbbttn.exe78⤵PID:4432
-
\??\c:\pvvvj.exec:\pvvvj.exe79⤵PID:3216
-
\??\c:\dvdvp.exec:\dvdvp.exe80⤵PID:1256
-
\??\c:\9xrlllf.exec:\9xrlllf.exe81⤵PID:4328
-
\??\c:\9rlfxxf.exec:\9rlfxxf.exe82⤵PID:4460
-
\??\c:\bttbtt.exec:\bttbtt.exe83⤵PID:3472
-
\??\c:\pvjpj.exec:\pvjpj.exe84⤵PID:4548
-
\??\c:\rfxrffx.exec:\rfxrffx.exe85⤵PID:1332
-
\??\c:\7flfrrf.exec:\7flfrrf.exe86⤵
- System Location Discovery: System Language Discovery
PID:540 -
\??\c:\9thtnb.exec:\9thtnb.exe87⤵PID:3928
-
\??\c:\jdvpd.exec:\jdvpd.exe88⤵PID:4048
-
\??\c:\xrrllff.exec:\xrrllff.exe89⤵PID:1388
-
\??\c:\ntbthh.exec:\ntbthh.exe90⤵PID:2544
-
\??\c:\3nnhbh.exec:\3nnhbh.exe91⤵
- System Location Discovery: System Language Discovery
PID:4668 -
\??\c:\9jjdv.exec:\9jjdv.exe92⤵PID:4164
-
\??\c:\xxffrrl.exec:\xxffrrl.exe93⤵
- System Location Discovery: System Language Discovery
PID:2256 -
\??\c:\bttbtn.exec:\bttbtn.exe94⤵PID:4892
-
\??\c:\vvjdj.exec:\vvjdj.exe95⤵PID:1152
-
\??\c:\lrxrffx.exec:\lrxrffx.exe96⤵PID:1788
-
\??\c:\rfrlfrl.exec:\rfrlfrl.exe97⤵PID:2904
-
\??\c:\tnbnnh.exec:\tnbnnh.exe98⤵PID:4756
-
\??\c:\3vpjd.exec:\3vpjd.exe99⤵PID:4828
-
\??\c:\xxffrrf.exec:\xxffrrf.exe100⤵PID:1860
-
\??\c:\bttnhb.exec:\bttnhb.exe101⤵PID:2716
-
\??\c:\hnbtnh.exec:\hnbtnh.exe102⤵PID:3332
-
\??\c:\vppdv.exec:\vppdv.exe103⤵PID:4840
-
\??\c:\7fxxrrr.exec:\7fxxrrr.exe104⤵PID:2292
-
\??\c:\htttnn.exec:\htttnn.exe105⤵PID:628
-
\??\c:\vjppj.exec:\vjppj.exe106⤵PID:4052
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe107⤵PID:3000
-
\??\c:\tnbbhb.exec:\tnbbhb.exe108⤵PID:1216
-
\??\c:\5ddjp.exec:\5ddjp.exe109⤵PID:4712
-
\??\c:\9pjvd.exec:\9pjvd.exe110⤵PID:1312
-
\??\c:\xlxrfrr.exec:\xlxrfrr.exe111⤵PID:2660
-
\??\c:\nhthnh.exec:\nhthnh.exe112⤵PID:3504
-
\??\c:\jpdvp.exec:\jpdvp.exe113⤵PID:852
-
\??\c:\3rfxxxr.exec:\3rfxxxr.exe114⤵PID:2428
-
\??\c:\1bbtnn.exec:\1bbtnn.exe115⤵PID:2876
-
\??\c:\5hnbhh.exec:\5hnbhh.exe116⤵PID:4284
-
\??\c:\jvddv.exec:\jvddv.exe117⤵PID:4236
-
\??\c:\7xlfxrl.exec:\7xlfxrl.exe118⤵PID:1424
-
\??\c:\tthhtt.exec:\tthhtt.exe119⤵PID:2420
-
\??\c:\hbbtnh.exec:\hbbtnh.exe120⤵PID:2300
-
\??\c:\dvvpp.exec:\dvvpp.exe121⤵PID:2956
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe122⤵PID:516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-