Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 23:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55c8a6e524ec6a4588e8391e668618eaea898aa99b94d6e9779c101208408429.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
55c8a6e524ec6a4588e8391e668618eaea898aa99b94d6e9779c101208408429.exe
-
Size
456KB
-
MD5
cdf47c6edfc7f7e9a84544809c31e828
-
SHA1
6216c0195e91e14faff58d83d3a12270c81026a7
-
SHA256
55c8a6e524ec6a4588e8391e668618eaea898aa99b94d6e9779c101208408429
-
SHA512
0e1dd0b7bdec91368eb589af762a58e5c045b4d0c4348d37a372d3a976eedda0fce82a1224b788644bd495dc0154299ba996d469791f9ae0b3f10f08aa6762fa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRo:q7Tc2NYHUrAwfMp3CDRo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4216-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-647-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-820-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-948-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-1430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-1548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5072 flxlfll.exe 4228 ffxfxlf.exe 3876 hbhttb.exe 4800 pvpvd.exe 912 xlxfrfl.exe 816 pjvvp.exe 5116 jdpjv.exe 2644 tthbhh.exe 3960 1jvpj.exe 4936 tbbtnb.exe 1392 xxrffrx.exe 3024 tntnhb.exe 2636 btbttt.exe 2120 jjjjp.exe 2700 dppjd.exe 2060 lxfxrrr.exe 2084 hntnhh.exe 4644 pdjvp.exe 3756 dvppp.exe 4140 5nbbbt.exe 1724 5ddpj.exe 5104 rlxrrrl.exe 656 7djdv.exe 4992 lrxrxrl.exe 2932 hbnhbb.exe 1720 7ttnnn.exe 3368 7vjdv.exe 1660 rlxrxxf.exe 4492 ffrllff.exe 3644 ntnhnh.exe 684 lllfffx.exe 4160 hbhbtt.exe 4360 nhhtnh.exe 3444 7llllrr.exe 1924 nhnhhn.exe 4400 vvjvp.exe 3136 lxrlrxf.exe 4684 tbtnnt.exe 4032 ddvvd.exe 1112 5nhbtn.exe 2424 jjvvv.exe 2536 xxfrrrf.exe 2020 thbttt.exe 3360 ppddj.exe 4472 ddddd.exe 4748 lfflfff.exe 440 tntnhh.exe 2268 vjjpj.exe 3484 3xfrrrx.exe 4124 1llllrx.exe 2408 hbbtnn.exe 1172 dvvjv.exe 3164 7lrrlrx.exe 3988 hthbbb.exe 4312 tnbtnt.exe 2704 ddjdv.exe 2036 rflfxxx.exe 2936 bbhbnn.exe 3364 nthhhb.exe 3076 pppjd.exe 4916 xrlfxxr.exe 4064 tntthh.exe 2648 5dddv.exe 3024 hbbtnt.exe -
resource yara_rule behavioral2/memory/5072-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-872-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtttb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4216 wrote to memory of 5072 4216 55c8a6e524ec6a4588e8391e668618eaea898aa99b94d6e9779c101208408429.exe 82 PID 4216 wrote to memory of 5072 4216 55c8a6e524ec6a4588e8391e668618eaea898aa99b94d6e9779c101208408429.exe 82 PID 4216 wrote to memory of 5072 4216 55c8a6e524ec6a4588e8391e668618eaea898aa99b94d6e9779c101208408429.exe 82 PID 5072 wrote to memory of 4228 5072 flxlfll.exe 83 PID 5072 wrote to memory of 4228 5072 flxlfll.exe 83 PID 5072 wrote to memory of 4228 5072 flxlfll.exe 83 PID 4228 wrote to memory of 3876 4228 ffxfxlf.exe 84 PID 4228 wrote to memory of 3876 4228 ffxfxlf.exe 84 PID 4228 wrote to memory of 3876 4228 ffxfxlf.exe 84 PID 3876 wrote to memory of 4800 3876 hbhttb.exe 85 PID 3876 wrote to memory of 4800 3876 hbhttb.exe 85 PID 3876 wrote to memory of 4800 3876 hbhttb.exe 85 PID 4800 wrote to memory of 912 4800 pvpvd.exe 86 PID 4800 wrote to memory of 912 4800 pvpvd.exe 86 PID 4800 wrote to memory of 912 4800 pvpvd.exe 86 PID 912 wrote to memory of 816 912 xlxfrfl.exe 87 PID 912 wrote to memory of 816 912 xlxfrfl.exe 87 PID 912 wrote to memory of 816 912 xlxfrfl.exe 87 PID 816 wrote to memory of 5116 816 pjvvp.exe 88 PID 816 wrote to memory of 5116 816 pjvvp.exe 88 PID 816 wrote to memory of 5116 816 pjvvp.exe 88 PID 5116 wrote to memory of 2644 5116 jdpjv.exe 89 PID 5116 wrote to memory of 2644 5116 jdpjv.exe 89 PID 5116 wrote to memory of 2644 5116 jdpjv.exe 89 PID 2644 wrote to memory of 3960 2644 tthbhh.exe 90 PID 2644 wrote to memory of 3960 2644 tthbhh.exe 90 PID 2644 wrote to memory of 3960 2644 tthbhh.exe 90 PID 3960 wrote to memory of 4936 3960 1jvpj.exe 91 PID 3960 wrote to memory of 4936 3960 1jvpj.exe 91 PID 3960 wrote to memory of 4936 3960 1jvpj.exe 91 PID 4936 wrote to memory of 1392 4936 tbbtnb.exe 92 PID 4936 wrote to memory of 1392 4936 tbbtnb.exe 92 PID 4936 wrote to memory of 1392 4936 tbbtnb.exe 92 PID 1392 wrote to memory of 3024 1392 xxrffrx.exe 93 PID 1392 wrote to memory of 3024 1392 xxrffrx.exe 93 PID 1392 wrote to memory of 3024 1392 xxrffrx.exe 93 PID 3024 wrote to memory of 2636 3024 tntnhb.exe 94 PID 3024 wrote to memory of 2636 3024 tntnhb.exe 94 PID 3024 wrote to memory of 2636 3024 tntnhb.exe 94 PID 2636 wrote to memory of 2120 2636 btbttt.exe 95 PID 2636 wrote to memory of 2120 2636 btbttt.exe 95 PID 2636 wrote to memory of 2120 2636 btbttt.exe 95 PID 2120 wrote to memory of 2700 2120 jjjjp.exe 96 PID 2120 wrote to memory of 2700 2120 jjjjp.exe 96 PID 2120 wrote to memory of 2700 2120 jjjjp.exe 96 PID 2700 wrote to memory of 2060 2700 dppjd.exe 97 PID 2700 wrote to memory of 2060 2700 dppjd.exe 97 PID 2700 wrote to memory of 2060 2700 dppjd.exe 97 PID 2060 wrote to memory of 2084 2060 lxfxrrr.exe 98 PID 2060 wrote to memory of 2084 2060 lxfxrrr.exe 98 PID 2060 wrote to memory of 2084 2060 lxfxrrr.exe 98 PID 2084 wrote to memory of 4644 2084 hntnhh.exe 99 PID 2084 wrote to memory of 4644 2084 hntnhh.exe 99 PID 2084 wrote to memory of 4644 2084 hntnhh.exe 99 PID 4644 wrote to memory of 3756 4644 pdjvp.exe 100 PID 4644 wrote to memory of 3756 4644 pdjvp.exe 100 PID 4644 wrote to memory of 3756 4644 pdjvp.exe 100 PID 3756 wrote to memory of 4140 3756 dvppp.exe 101 PID 3756 wrote to memory of 4140 3756 dvppp.exe 101 PID 3756 wrote to memory of 4140 3756 dvppp.exe 101 PID 4140 wrote to memory of 1724 4140 5nbbbt.exe 102 PID 4140 wrote to memory of 1724 4140 5nbbbt.exe 102 PID 4140 wrote to memory of 1724 4140 5nbbbt.exe 102 PID 1724 wrote to memory of 5104 1724 5ddpj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\55c8a6e524ec6a4588e8391e668618eaea898aa99b94d6e9779c101208408429.exe"C:\Users\Admin\AppData\Local\Temp\55c8a6e524ec6a4588e8391e668618eaea898aa99b94d6e9779c101208408429.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\flxlfll.exec:\flxlfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\ffxfxlf.exec:\ffxfxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\hbhttb.exec:\hbhttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\pvpvd.exec:\pvpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\xlxfrfl.exec:\xlxfrfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\pjvvp.exec:\pjvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\jdpjv.exec:\jdpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\tthbhh.exec:\tthbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\1jvpj.exec:\1jvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\tbbtnb.exec:\tbbtnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\xxrffrx.exec:\xxrffrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\tntnhb.exec:\tntnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\btbttt.exec:\btbttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jjjjp.exec:\jjjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\dppjd.exec:\dppjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\hntnhh.exec:\hntnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\pdjvp.exec:\pdjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\dvppp.exec:\dvppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\5nbbbt.exec:\5nbbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\5ddpj.exec:\5ddpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\rlxrrrl.exec:\rlxrrrl.exe23⤵
- Executes dropped EXE
PID:5104 -
\??\c:\7djdv.exec:\7djdv.exe24⤵
- Executes dropped EXE
PID:656 -
\??\c:\lrxrxrl.exec:\lrxrxrl.exe25⤵
- Executes dropped EXE
PID:4992 -
\??\c:\hbnhbb.exec:\hbnhbb.exe26⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7ttnnn.exec:\7ttnnn.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7vjdv.exec:\7vjdv.exe28⤵
- Executes dropped EXE
PID:3368 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe29⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ffrllff.exec:\ffrllff.exe30⤵
- Executes dropped EXE
PID:4492 -
\??\c:\ntnhnh.exec:\ntnhnh.exe31⤵
- Executes dropped EXE
PID:3644 -
\??\c:\lllfffx.exec:\lllfffx.exe32⤵
- Executes dropped EXE
PID:684 -
\??\c:\hbhbtt.exec:\hbhbtt.exe33⤵
- Executes dropped EXE
PID:4160 -
\??\c:\nhhtnh.exec:\nhhtnh.exe34⤵
- Executes dropped EXE
PID:4360 -
\??\c:\7llllrr.exec:\7llllrr.exe35⤵
- Executes dropped EXE
PID:3444 -
\??\c:\nhnhhn.exec:\nhnhhn.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1924 -
\??\c:\vvjvp.exec:\vvjvp.exe37⤵
- Executes dropped EXE
PID:4400 -
\??\c:\lxrlrxf.exec:\lxrlrxf.exe38⤵
- Executes dropped EXE
PID:3136 -
\??\c:\tbtnnt.exec:\tbtnnt.exe39⤵
- Executes dropped EXE
PID:4684 -
\??\c:\ddvvd.exec:\ddvvd.exe40⤵
- Executes dropped EXE
PID:4032 -
\??\c:\5nhbtn.exec:\5nhbtn.exe41⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jjvvv.exec:\jjvvv.exe42⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xxfrrrf.exec:\xxfrrrf.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\thbttt.exec:\thbttt.exe44⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ppddj.exec:\ppddj.exe45⤵
- Executes dropped EXE
PID:3360 -
\??\c:\ddddd.exec:\ddddd.exe46⤵
- Executes dropped EXE
PID:4472 -
\??\c:\lfflfff.exec:\lfflfff.exe47⤵
- Executes dropped EXE
PID:4748 -
\??\c:\tntnhh.exec:\tntnhh.exe48⤵
- Executes dropped EXE
PID:440 -
\??\c:\vjjpj.exec:\vjjpj.exe49⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3xfrrrx.exec:\3xfrrrx.exe50⤵
- Executes dropped EXE
PID:3484 -
\??\c:\1llllrx.exec:\1llllrx.exe51⤵
- Executes dropped EXE
PID:4124 -
\??\c:\hbbtnn.exec:\hbbtnn.exe52⤵
- Executes dropped EXE
PID:2408 -
\??\c:\dvvjv.exec:\dvvjv.exe53⤵
- Executes dropped EXE
PID:1172 -
\??\c:\7lrrlrx.exec:\7lrrlrx.exe54⤵
- Executes dropped EXE
PID:3164 -
\??\c:\hthbbb.exec:\hthbbb.exe55⤵
- Executes dropped EXE
PID:3988 -
\??\c:\tnbtnt.exec:\tnbtnt.exe56⤵
- Executes dropped EXE
PID:4312 -
\??\c:\ddjdv.exec:\ddjdv.exe57⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rflfxxx.exec:\rflfxxx.exe58⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bbhbnn.exec:\bbhbnn.exe59⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nthhhb.exec:\nthhhb.exe60⤵
- Executes dropped EXE
PID:3364 -
\??\c:\pppjd.exec:\pppjd.exe61⤵
- Executes dropped EXE
PID:3076 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe62⤵
- Executes dropped EXE
PID:4916 -
\??\c:\tntthh.exec:\tntthh.exe63⤵
- Executes dropped EXE
PID:4064 -
\??\c:\5dddv.exec:\5dddv.exe64⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hbbtnt.exec:\hbbtnt.exe65⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nthbhb.exec:\nthbhb.exe66⤵PID:1884
-
\??\c:\vvjjv.exec:\vvjjv.exe67⤵PID:4144
-
\??\c:\ffxxlfx.exec:\ffxxlfx.exe68⤵PID:2120
-
\??\c:\nhnnht.exec:\nhnnht.exe69⤵PID:4168
-
\??\c:\7pjpd.exec:\7pjpd.exe70⤵PID:2108
-
\??\c:\vpjjd.exec:\vpjjd.exe71⤵PID:3152
-
\??\c:\llxrflr.exec:\llxrflr.exe72⤵PID:1604
-
\??\c:\fllrlxr.exec:\fllrlxr.exe73⤵PID:2024
-
\??\c:\tnhbnh.exec:\tnhbnh.exe74⤵PID:2944
-
\??\c:\pppjj.exec:\pppjj.exe75⤵PID:1668
-
\??\c:\lxllllr.exec:\lxllllr.exe76⤵PID:4128
-
\??\c:\bhtnhb.exec:\bhtnhb.exe77⤵PID:3676
-
\??\c:\thnhbn.exec:\thnhbn.exe78⤵PID:2688
-
\??\c:\dvvpd.exec:\dvvpd.exe79⤵PID:5104
-
\??\c:\1ffxrrr.exec:\1ffxrrr.exe80⤵PID:656
-
\??\c:\5bbnht.exec:\5bbnht.exe81⤵PID:2552
-
\??\c:\vjjjd.exec:\vjjjd.exe82⤵PID:4020
-
\??\c:\3vdvv.exec:\3vdvv.exe83⤵PID:848
-
\??\c:\7rlxxrr.exec:\7rlxxrr.exe84⤵PID:4868
-
\??\c:\thnhtt.exec:\thnhtt.exe85⤵PID:3616
-
\??\c:\bttnhh.exec:\bttnhh.exe86⤵PID:2728
-
\??\c:\vvvpd.exec:\vvvpd.exe87⤵PID:1660
-
\??\c:\ffrlffx.exec:\ffrlffx.exe88⤵PID:4884
-
\??\c:\ffxxffl.exec:\ffxxffl.exe89⤵PID:4212
-
\??\c:\nbntnh.exec:\nbntnh.exe90⤵PID:2444
-
\??\c:\jjddp.exec:\jjddp.exe91⤵PID:684
-
\??\c:\jppdp.exec:\jppdp.exe92⤵PID:4984
-
\??\c:\flxxrrl.exec:\flxxrrl.exe93⤵PID:632
-
\??\c:\nhnhhh.exec:\nhnhhh.exe94⤵PID:1016
-
\??\c:\5hnhhh.exec:\5hnhhh.exe95⤵PID:3924
-
\??\c:\djvvp.exec:\djvvp.exe96⤵PID:1532
-
\??\c:\llfxlxl.exec:\llfxlxl.exe97⤵PID:1092
-
\??\c:\7xfxlfr.exec:\7xfxlfr.exe98⤵PID:4564
-
\??\c:\hnnbbt.exec:\hnnbbt.exe99⤵PID:2324
-
\??\c:\9pjdd.exec:\9pjdd.exe100⤵PID:628
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe101⤵PID:1148
-
\??\c:\hbnnhn.exec:\hbnnhn.exe102⤵PID:1880
-
\??\c:\bntnbt.exec:\bntnbt.exe103⤵PID:1708
-
\??\c:\dvdpp.exec:\dvdpp.exe104⤵PID:3436
-
\??\c:\rflffff.exec:\rflffff.exe105⤵PID:3572
-
\??\c:\xlrrlfx.exec:\xlrrlfx.exe106⤵PID:2424
-
\??\c:\hnttnn.exec:\hnttnn.exe107⤵PID:1892
-
\??\c:\jvjdv.exec:\jvjdv.exe108⤵PID:4480
-
\??\c:\pdpjj.exec:\pdpjj.exe109⤵PID:1732
-
\??\c:\rrlfllf.exec:\rrlfllf.exe110⤵PID:4472
-
\??\c:\hbhbnn.exec:\hbhbnn.exe111⤵PID:1688
-
\??\c:\djpjv.exec:\djpjv.exe112⤵PID:3380
-
\??\c:\pdjdd.exec:\pdjdd.exe113⤵PID:844
-
\??\c:\flfrllf.exec:\flfrllf.exe114⤵PID:4236
-
\??\c:\bbhhbn.exec:\bbhhbn.exe115⤵PID:1956
-
\??\c:\vpjjd.exec:\vpjjd.exe116⤵PID:3656
-
\??\c:\dvddv.exec:\dvddv.exe117⤵PID:1976
-
\??\c:\xxxfxlf.exec:\xxxfxlf.exe118⤵PID:4800
-
\??\c:\htbbhb.exec:\htbbhb.exe119⤵PID:4824
-
\??\c:\jjddv.exec:\jjddv.exe120⤵PID:3772
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe121⤵PID:3820
-
\??\c:\7nnnhh.exec:\7nnnhh.exe122⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-