Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 23:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54519c46bf5fedb48aa1859294b70ae1eb1961c31d1e41e63991dacad8af900a.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
54519c46bf5fedb48aa1859294b70ae1eb1961c31d1e41e63991dacad8af900a.exe
-
Size
457KB
-
MD5
6b6f6ab45056ceec50b44555bea7c3a1
-
SHA1
e0b9803fcc80aa2e6d2b339e13905935cc32b5a3
-
SHA256
54519c46bf5fedb48aa1859294b70ae1eb1961c31d1e41e63991dacad8af900a
-
SHA512
4e18850c7f6bffb8d0d500b3e75dd4df8266ae1d0ec9c8f6868a190ff300025892214827a768926f7196661ca2086a3bc26afae613a7506aa61886749b82a99c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRNa:q7Tc2NYHUrAwfMp3CDRA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4964-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/896-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5024 1xlrrrr.exe 3976 xxrlrrx.exe 216 ntttbh.exe 1708 1nbbhh.exe 2968 xxfxffl.exe 1088 9pjpd.exe 2736 dvjjj.exe 1932 vvjvp.exe 4520 ffxxxlr.exe 1092 ddppv.exe 3908 ffffxlf.exe 2456 btnhtt.exe 2396 ddpvv.exe 3736 vdppp.exe 4820 vpvpp.exe 4228 1thbtb.exe 3012 frxrrrx.exe 4988 bnttbh.exe 3200 pjjjj.exe 4156 3xfxxxf.exe 336 5djjj.exe 3948 3lllfff.exe 3276 fxfxrrl.exe 3124 rlrlfff.exe 4960 rlrlffx.exe 3364 3hnhbh.exe 2080 xxllflf.exe 3384 bnbttt.exe 4660 rfrfrlf.exe 1976 5bhbnn.exe 4544 vvddd.exe 4444 7vjjp.exe 4196 7lfflrf.exe 4484 nbhtnh.exe 2592 vjpjj.exe 1988 rrxxfxf.exe 1896 tnbtbb.exe 1580 vdjdv.exe 4124 rllfrrx.exe 5080 htbttn.exe 3836 pjvpv.exe 1836 pdjvp.exe 4912 fxffrrl.exe 1368 ntbhtb.exe 2172 jddvj.exe 2460 xfrflfl.exe 2072 bhhbtn.exe 4424 bttbbh.exe 1376 pvjdd.exe 3316 fxxrllf.exe 1916 nhbtnh.exe 4388 dpddp.exe 2252 7llfrrl.exe 896 tbnhbt.exe 3520 9nhbtn.exe 4728 ppddv.exe 4524 3ffxllf.exe 4528 xxxxrxr.exe 800 5bttnn.exe 5000 jvdvj.exe 2952 9rrxrlr.exe 3712 thnhhh.exe 1632 1bhtnh.exe 4448 jdjdv.exe -
resource yara_rule behavioral2/memory/4964-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/896-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-833-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4964 wrote to memory of 5024 4964 54519c46bf5fedb48aa1859294b70ae1eb1961c31d1e41e63991dacad8af900a.exe 82 PID 4964 wrote to memory of 5024 4964 54519c46bf5fedb48aa1859294b70ae1eb1961c31d1e41e63991dacad8af900a.exe 82 PID 4964 wrote to memory of 5024 4964 54519c46bf5fedb48aa1859294b70ae1eb1961c31d1e41e63991dacad8af900a.exe 82 PID 5024 wrote to memory of 3976 5024 1xlrrrr.exe 83 PID 5024 wrote to memory of 3976 5024 1xlrrrr.exe 83 PID 5024 wrote to memory of 3976 5024 1xlrrrr.exe 83 PID 3976 wrote to memory of 216 3976 xxrlrrx.exe 84 PID 3976 wrote to memory of 216 3976 xxrlrrx.exe 84 PID 3976 wrote to memory of 216 3976 xxrlrrx.exe 84 PID 216 wrote to memory of 1708 216 ntttbh.exe 85 PID 216 wrote to memory of 1708 216 ntttbh.exe 85 PID 216 wrote to memory of 1708 216 ntttbh.exe 85 PID 1708 wrote to memory of 2968 1708 1nbbhh.exe 86 PID 1708 wrote to memory of 2968 1708 1nbbhh.exe 86 PID 1708 wrote to memory of 2968 1708 1nbbhh.exe 86 PID 2968 wrote to memory of 1088 2968 xxfxffl.exe 87 PID 2968 wrote to memory of 1088 2968 xxfxffl.exe 87 PID 2968 wrote to memory of 1088 2968 xxfxffl.exe 87 PID 1088 wrote to memory of 2736 1088 9pjpd.exe 88 PID 1088 wrote to memory of 2736 1088 9pjpd.exe 88 PID 1088 wrote to memory of 2736 1088 9pjpd.exe 88 PID 2736 wrote to memory of 1932 2736 dvjjj.exe 89 PID 2736 wrote to memory of 1932 2736 dvjjj.exe 89 PID 2736 wrote to memory of 1932 2736 dvjjj.exe 89 PID 1932 wrote to memory of 4520 1932 vvjvp.exe 90 PID 1932 wrote to memory of 4520 1932 vvjvp.exe 90 PID 1932 wrote to memory of 4520 1932 vvjvp.exe 90 PID 4520 wrote to memory of 1092 4520 ffxxxlr.exe 91 PID 4520 wrote to memory of 1092 4520 ffxxxlr.exe 91 PID 4520 wrote to memory of 1092 4520 ffxxxlr.exe 91 PID 1092 wrote to memory of 3908 1092 ddppv.exe 92 PID 1092 wrote to memory of 3908 1092 ddppv.exe 92 PID 1092 wrote to memory of 3908 1092 ddppv.exe 92 PID 3908 wrote to memory of 2456 3908 ffffxlf.exe 93 PID 3908 wrote to memory of 2456 3908 ffffxlf.exe 93 PID 3908 wrote to memory of 2456 3908 ffffxlf.exe 93 PID 2456 wrote to memory of 2396 2456 btnhtt.exe 94 PID 2456 wrote to memory of 2396 2456 btnhtt.exe 94 PID 2456 wrote to memory of 2396 2456 btnhtt.exe 94 PID 2396 wrote to memory of 3736 2396 ddpvv.exe 95 PID 2396 wrote to memory of 3736 2396 ddpvv.exe 95 PID 2396 wrote to memory of 3736 2396 ddpvv.exe 95 PID 3736 wrote to memory of 4820 3736 vdppp.exe 96 PID 3736 wrote to memory of 4820 3736 vdppp.exe 96 PID 3736 wrote to memory of 4820 3736 vdppp.exe 96 PID 4820 wrote to memory of 4228 4820 vpvpp.exe 97 PID 4820 wrote to memory of 4228 4820 vpvpp.exe 97 PID 4820 wrote to memory of 4228 4820 vpvpp.exe 97 PID 4228 wrote to memory of 3012 4228 1thbtb.exe 98 PID 4228 wrote to memory of 3012 4228 1thbtb.exe 98 PID 4228 wrote to memory of 3012 4228 1thbtb.exe 98 PID 3012 wrote to memory of 4988 3012 frxrrrx.exe 99 PID 3012 wrote to memory of 4988 3012 frxrrrx.exe 99 PID 3012 wrote to memory of 4988 3012 frxrrrx.exe 99 PID 4988 wrote to memory of 3200 4988 bnttbh.exe 100 PID 4988 wrote to memory of 3200 4988 bnttbh.exe 100 PID 4988 wrote to memory of 3200 4988 bnttbh.exe 100 PID 3200 wrote to memory of 4156 3200 pjjjj.exe 101 PID 3200 wrote to memory of 4156 3200 pjjjj.exe 101 PID 3200 wrote to memory of 4156 3200 pjjjj.exe 101 PID 4156 wrote to memory of 336 4156 3xfxxxf.exe 102 PID 4156 wrote to memory of 336 4156 3xfxxxf.exe 102 PID 4156 wrote to memory of 336 4156 3xfxxxf.exe 102 PID 336 wrote to memory of 3948 336 5djjj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\54519c46bf5fedb48aa1859294b70ae1eb1961c31d1e41e63991dacad8af900a.exe"C:\Users\Admin\AppData\Local\Temp\54519c46bf5fedb48aa1859294b70ae1eb1961c31d1e41e63991dacad8af900a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\1xlrrrr.exec:\1xlrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\xxrlrrx.exec:\xxrlrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\ntttbh.exec:\ntttbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\1nbbhh.exec:\1nbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\xxfxffl.exec:\xxfxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\9pjpd.exec:\9pjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\dvjjj.exec:\dvjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\vvjvp.exec:\vvjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\ffxxxlr.exec:\ffxxxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\ddppv.exec:\ddppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\ffffxlf.exec:\ffffxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\btnhtt.exec:\btnhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\ddpvv.exec:\ddpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\vdppp.exec:\vdppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\vpvpp.exec:\vpvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\1thbtb.exec:\1thbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\frxrrrx.exec:\frxrrrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\bnttbh.exec:\bnttbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\pjjjj.exec:\pjjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\3xfxxxf.exec:\3xfxxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\5djjj.exec:\5djjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\3lllfff.exec:\3lllfff.exe23⤵
- Executes dropped EXE
PID:3948 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe24⤵
- Executes dropped EXE
PID:3276 -
\??\c:\rlrlfff.exec:\rlrlfff.exe25⤵
- Executes dropped EXE
PID:3124 -
\??\c:\rlrlffx.exec:\rlrlffx.exe26⤵
- Executes dropped EXE
PID:4960 -
\??\c:\3hnhbh.exec:\3hnhbh.exe27⤵
- Executes dropped EXE
PID:3364 -
\??\c:\xxllflf.exec:\xxllflf.exe28⤵
- Executes dropped EXE
PID:2080 -
\??\c:\bnbttt.exec:\bnbttt.exe29⤵
- Executes dropped EXE
PID:3384 -
\??\c:\rfrfrlf.exec:\rfrfrlf.exe30⤵
- Executes dropped EXE
PID:4660 -
\??\c:\5bhbnn.exec:\5bhbnn.exe31⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vvddd.exec:\vvddd.exe32⤵
- Executes dropped EXE
PID:4544 -
\??\c:\7vjjp.exec:\7vjjp.exe33⤵
- Executes dropped EXE
PID:4444 -
\??\c:\7lfflrf.exec:\7lfflrf.exe34⤵
- Executes dropped EXE
PID:4196 -
\??\c:\nbhtnh.exec:\nbhtnh.exe35⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vjpjj.exec:\vjpjj.exe36⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rrxxfxf.exec:\rrxxfxf.exe37⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tnbtbb.exec:\tnbtbb.exe38⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vdjdv.exec:\vdjdv.exe39⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rllfrrx.exec:\rllfrrx.exe40⤵
- Executes dropped EXE
PID:4124 -
\??\c:\htbttn.exec:\htbttn.exe41⤵
- Executes dropped EXE
PID:5080 -
\??\c:\pjvpv.exec:\pjvpv.exe42⤵
- Executes dropped EXE
PID:3836 -
\??\c:\pdjvp.exec:\pdjvp.exe43⤵
- Executes dropped EXE
PID:1836 -
\??\c:\fxffrrl.exec:\fxffrrl.exe44⤵
- Executes dropped EXE
PID:4912 -
\??\c:\ntbhtb.exec:\ntbhtb.exe45⤵
- Executes dropped EXE
PID:1368 -
\??\c:\jddvj.exec:\jddvj.exe46⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xfrflfl.exec:\xfrflfl.exe47⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bhhbtn.exec:\bhhbtn.exe48⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bttbbh.exec:\bttbbh.exe49⤵
- Executes dropped EXE
PID:4424 -
\??\c:\pvjdd.exec:\pvjdd.exe50⤵
- Executes dropped EXE
PID:1376 -
\??\c:\fxxrllf.exec:\fxxrllf.exe51⤵
- Executes dropped EXE
PID:3316 -
\??\c:\nhbtnh.exec:\nhbtnh.exe52⤵
- Executes dropped EXE
PID:1916 -
\??\c:\dpddp.exec:\dpddp.exe53⤵
- Executes dropped EXE
PID:4388 -
\??\c:\7llfrrl.exec:\7llfrrl.exe54⤵
- Executes dropped EXE
PID:2252 -
\??\c:\tbnhbt.exec:\tbnhbt.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:896 -
\??\c:\9nhbtn.exec:\9nhbtn.exe56⤵
- Executes dropped EXE
PID:3520 -
\??\c:\ppddv.exec:\ppddv.exe57⤵
- Executes dropped EXE
PID:4728 -
\??\c:\3ffxllf.exec:\3ffxllf.exe58⤵
- Executes dropped EXE
PID:4524 -
\??\c:\xxxxrxr.exec:\xxxxrxr.exe59⤵
- Executes dropped EXE
PID:4528 -
\??\c:\5bttnn.exec:\5bttnn.exe60⤵
- Executes dropped EXE
PID:800 -
\??\c:\jvdvj.exec:\jvdvj.exe61⤵
- Executes dropped EXE
PID:5000 -
\??\c:\9rrxrlr.exec:\9rrxrlr.exe62⤵
- Executes dropped EXE
PID:2952 -
\??\c:\thnhhh.exec:\thnhhh.exe63⤵
- Executes dropped EXE
PID:3712 -
\??\c:\1bhtnh.exec:\1bhtnh.exe64⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jdjdv.exec:\jdjdv.exe65⤵
- Executes dropped EXE
PID:4448 -
\??\c:\rllfllr.exec:\rllfllr.exe66⤵PID:3084
-
\??\c:\nnntnn.exec:\nnntnn.exe67⤵PID:2964
-
\??\c:\pdjdv.exec:\pdjdv.exe68⤵PID:4080
-
\??\c:\flxrllf.exec:\flxrllf.exe69⤵PID:4336
-
\??\c:\tbnhhh.exec:\tbnhhh.exe70⤵PID:1092
-
\??\c:\5btnhb.exec:\5btnhb.exe71⤵PID:1472
-
\??\c:\jdjdv.exec:\jdjdv.exe72⤵PID:1060
-
\??\c:\7frlfxr.exec:\7frlfxr.exe73⤵PID:2456
-
\??\c:\7ntnhh.exec:\7ntnhh.exe74⤵PID:3812
-
\??\c:\hhthbt.exec:\hhthbt.exe75⤵PID:100
-
\??\c:\5djvj.exec:\5djvj.exe76⤵PID:3972
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe77⤵PID:2828
-
\??\c:\fxrllfl.exec:\fxrllfl.exe78⤵PID:2316
-
\??\c:\tbnnhn.exec:\tbnnhn.exe79⤵PID:2804
-
\??\c:\9vdvj.exec:\9vdvj.exe80⤵PID:3116
-
\??\c:\xxlllrr.exec:\xxlllrr.exe81⤵PID:4876
-
\??\c:\nttttn.exec:\nttttn.exe82⤵PID:4048
-
\??\c:\djjdv.exec:\djjdv.exe83⤵PID:4156
-
\??\c:\5ppjj.exec:\5ppjj.exe84⤵PID:3980
-
\??\c:\lffxrrl.exec:\lffxrrl.exe85⤵PID:2264
-
\??\c:\xllfxff.exec:\xllfxff.exe86⤵PID:3948
-
\??\c:\dvddd.exec:\dvddd.exe87⤵PID:2348
-
\??\c:\1jdvj.exec:\1jdvj.exe88⤵PID:4956
-
\??\c:\xlllfff.exec:\xlllfff.exe89⤵PID:4716
-
\??\c:\tntbtb.exec:\tntbtb.exe90⤵PID:3772
-
\??\c:\3jppd.exec:\3jppd.exe91⤵PID:4052
-
\??\c:\vvdvj.exec:\vvdvj.exe92⤵PID:2452
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe93⤵PID:3984
-
\??\c:\5nhtnt.exec:\5nhtnt.exe94⤵PID:4752
-
\??\c:\7nhnht.exec:\7nhnht.exe95⤵PID:4660
-
\??\c:\vdjpj.exec:\vdjpj.exe96⤵PID:4464
-
\??\c:\1rxrrrx.exec:\1rxrrrx.exe97⤵PID:4544
-
\??\c:\hnbnnn.exec:\hnbnnn.exe98⤵PID:3164
-
\??\c:\jjjdv.exec:\jjjdv.exe99⤵PID:3328
-
\??\c:\jvvjd.exec:\jvvjd.exe100⤵PID:3644
-
\??\c:\lflfxxx.exec:\lflfxxx.exe101⤵PID:524
-
\??\c:\tnnnth.exec:\tnnnth.exe102⤵PID:3228
-
\??\c:\bhbbtt.exec:\bhbbtt.exe103⤵PID:2576
-
\??\c:\5rrlffr.exec:\5rrlffr.exe104⤵PID:1964
-
\??\c:\lflfxxr.exec:\lflfxxr.exe105⤵PID:1956
-
\??\c:\hhnnnt.exec:\hhnnnt.exe106⤵PID:5060
-
\??\c:\jjjdd.exec:\jjjdd.exe107⤵PID:1700
-
\??\c:\fxxrffr.exec:\fxxrffr.exe108⤵PID:1036
-
\??\c:\tbhbbt.exec:\tbhbbt.exe109⤵PID:1836
-
\??\c:\jjpjj.exec:\jjpjj.exe110⤵PID:2184
-
\??\c:\xxxrrll.exec:\xxxrrll.exe111⤵PID:3064
-
\??\c:\htbtnn.exec:\htbtnn.exe112⤵PID:4044
-
\??\c:\3nbbbb.exec:\3nbbbb.exe113⤵PID:4796
-
\??\c:\dvvpd.exec:\dvvpd.exe114⤵PID:2072
-
\??\c:\xffxrrx.exec:\xffxrrx.exe115⤵PID:244
-
\??\c:\nbhbtn.exec:\nbhbtn.exe116⤵PID:4684
-
\??\c:\pjpvd.exec:\pjpvd.exe117⤵PID:3316
-
\??\c:\pjvpj.exec:\pjvpj.exe118⤵PID:4380
-
\??\c:\fflfrll.exec:\fflfrll.exe119⤵PID:5064
-
\??\c:\9thbnn.exec:\9thbnn.exe120⤵PID:2252
-
\??\c:\ntbhtt.exec:\ntbhtt.exe121⤵PID:2760
-
\??\c:\jjjjv.exec:\jjjjv.exe122⤵PID:4740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-