Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 23:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b902e46cbc36ee7732f868ffab092554298d1f0455ba544144857e33e6b0fb6.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
5b902e46cbc36ee7732f868ffab092554298d1f0455ba544144857e33e6b0fb6.exe
-
Size
454KB
-
MD5
d6aa5031500dea3718fb575cf54fea22
-
SHA1
5a7051940a257c744cc15be8029a0e368c959a1f
-
SHA256
5b902e46cbc36ee7732f868ffab092554298d1f0455ba544144857e33e6b0fb6
-
SHA512
b399c0d09fcc7e58de8903ca749434fcba8fc8bdc9215d757511812aa8af984ea039b78006613210009195e9d1a145b56ae221f3ee9d1397ba5cb61caa0ab8d4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2124-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/180-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-819-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-988-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-998-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-1005-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-1331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-1395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2992 rfrfrlf.exe 4976 64682.exe 3268 s0048.exe 4404 ttnbnh.exe 5092 00664.exe 4372 6424488.exe 4492 602604.exe 4900 020860.exe 1400 pdvjd.exe 1348 04488.exe 2500 2222048.exe 4116 jvddv.exe 3092 7hhbtt.exe 3304 062666.exe 4648 jddvp.exe 3156 4262626.exe 4924 lxxrlxr.exe 1440 7rxrlll.exe 4428 0404448.exe 5080 0866660.exe 1868 48422.exe 3244 084844.exe 536 pdpjd.exe 4768 vvddj.exe 3200 04226.exe 5044 26626.exe 2564 jdpjp.exe 1420 24842.exe 4452 648260.exe 4188 04604.exe 928 62822.exe 5004 a4604.exe 1656 048260.exe 4484 46226.exe 3956 m0008.exe 1084 dpvjv.exe 1680 frrlffx.exe 1728 6888222.exe 2664 2844868.exe 2012 q08288.exe 3448 7hnhhn.exe 808 862666.exe 3224 s6262.exe 3676 xrffxxf.exe 3060 m8482.exe 3332 o886044.exe 2776 60626.exe 4880 rlxxffl.exe 4424 pdjdv.exe 3340 48040.exe 232 xlxrrlr.exe 4896 dvjjv.exe 2908 08408.exe 4224 vjvjp.exe 4404 62444.exe 3276 822266.exe 4832 228882.exe 3656 20204.exe 880 q28226.exe 4492 jdvpd.exe 1132 280088.exe 4900 3rxxfll.exe 3688 s0604.exe 1348 tnbtnn.exe -
resource yara_rule behavioral2/memory/2124-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/180-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-988-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g2680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6408664.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2060882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6622226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2992 2124 5b902e46cbc36ee7732f868ffab092554298d1f0455ba544144857e33e6b0fb6.exe 83 PID 2124 wrote to memory of 2992 2124 5b902e46cbc36ee7732f868ffab092554298d1f0455ba544144857e33e6b0fb6.exe 83 PID 2124 wrote to memory of 2992 2124 5b902e46cbc36ee7732f868ffab092554298d1f0455ba544144857e33e6b0fb6.exe 83 PID 2992 wrote to memory of 4976 2992 rfrfrlf.exe 84 PID 2992 wrote to memory of 4976 2992 rfrfrlf.exe 84 PID 2992 wrote to memory of 4976 2992 rfrfrlf.exe 84 PID 4976 wrote to memory of 3268 4976 64682.exe 85 PID 4976 wrote to memory of 3268 4976 64682.exe 85 PID 4976 wrote to memory of 3268 4976 64682.exe 85 PID 3268 wrote to memory of 4404 3268 s0048.exe 86 PID 3268 wrote to memory of 4404 3268 s0048.exe 86 PID 3268 wrote to memory of 4404 3268 s0048.exe 86 PID 4404 wrote to memory of 5092 4404 ttnbnh.exe 87 PID 4404 wrote to memory of 5092 4404 ttnbnh.exe 87 PID 4404 wrote to memory of 5092 4404 ttnbnh.exe 87 PID 5092 wrote to memory of 4372 5092 00664.exe 88 PID 5092 wrote to memory of 4372 5092 00664.exe 88 PID 5092 wrote to memory of 4372 5092 00664.exe 88 PID 4372 wrote to memory of 4492 4372 6424488.exe 89 PID 4372 wrote to memory of 4492 4372 6424488.exe 89 PID 4372 wrote to memory of 4492 4372 6424488.exe 89 PID 4492 wrote to memory of 4900 4492 602604.exe 90 PID 4492 wrote to memory of 4900 4492 602604.exe 90 PID 4492 wrote to memory of 4900 4492 602604.exe 90 PID 4900 wrote to memory of 1400 4900 020860.exe 91 PID 4900 wrote to memory of 1400 4900 020860.exe 91 PID 4900 wrote to memory of 1400 4900 020860.exe 91 PID 1400 wrote to memory of 1348 1400 pdvjd.exe 92 PID 1400 wrote to memory of 1348 1400 pdvjd.exe 92 PID 1400 wrote to memory of 1348 1400 pdvjd.exe 92 PID 1348 wrote to memory of 2500 1348 04488.exe 93 PID 1348 wrote to memory of 2500 1348 04488.exe 93 PID 1348 wrote to memory of 2500 1348 04488.exe 93 PID 2500 wrote to memory of 4116 2500 2222048.exe 94 PID 2500 wrote to memory of 4116 2500 2222048.exe 94 PID 2500 wrote to memory of 4116 2500 2222048.exe 94 PID 4116 wrote to memory of 3092 4116 jvddv.exe 95 PID 4116 wrote to memory of 3092 4116 jvddv.exe 95 PID 4116 wrote to memory of 3092 4116 jvddv.exe 95 PID 3092 wrote to memory of 3304 3092 7hhbtt.exe 96 PID 3092 wrote to memory of 3304 3092 7hhbtt.exe 96 PID 3092 wrote to memory of 3304 3092 7hhbtt.exe 96 PID 3304 wrote to memory of 4648 3304 062666.exe 97 PID 3304 wrote to memory of 4648 3304 062666.exe 97 PID 3304 wrote to memory of 4648 3304 062666.exe 97 PID 4648 wrote to memory of 3156 4648 jddvp.exe 98 PID 4648 wrote to memory of 3156 4648 jddvp.exe 98 PID 4648 wrote to memory of 3156 4648 jddvp.exe 98 PID 3156 wrote to memory of 4924 3156 4262626.exe 99 PID 3156 wrote to memory of 4924 3156 4262626.exe 99 PID 3156 wrote to memory of 4924 3156 4262626.exe 99 PID 4924 wrote to memory of 1440 4924 lxxrlxr.exe 100 PID 4924 wrote to memory of 1440 4924 lxxrlxr.exe 100 PID 4924 wrote to memory of 1440 4924 lxxrlxr.exe 100 PID 1440 wrote to memory of 4428 1440 7rxrlll.exe 101 PID 1440 wrote to memory of 4428 1440 7rxrlll.exe 101 PID 1440 wrote to memory of 4428 1440 7rxrlll.exe 101 PID 4428 wrote to memory of 5080 4428 0404448.exe 102 PID 4428 wrote to memory of 5080 4428 0404448.exe 102 PID 4428 wrote to memory of 5080 4428 0404448.exe 102 PID 5080 wrote to memory of 1868 5080 0866660.exe 103 PID 5080 wrote to memory of 1868 5080 0866660.exe 103 PID 5080 wrote to memory of 1868 5080 0866660.exe 103 PID 1868 wrote to memory of 3244 1868 48422.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b902e46cbc36ee7732f868ffab092554298d1f0455ba544144857e33e6b0fb6.exe"C:\Users\Admin\AppData\Local\Temp\5b902e46cbc36ee7732f868ffab092554298d1f0455ba544144857e33e6b0fb6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\rfrfrlf.exec:\rfrfrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\64682.exec:\64682.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\s0048.exec:\s0048.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\ttnbnh.exec:\ttnbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\00664.exec:\00664.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\6424488.exec:\6424488.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\602604.exec:\602604.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\020860.exec:\020860.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\pdvjd.exec:\pdvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\04488.exec:\04488.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\2222048.exec:\2222048.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jvddv.exec:\jvddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\7hhbtt.exec:\7hhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\062666.exec:\062666.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\jddvp.exec:\jddvp.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\4262626.exec:\4262626.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\lxxrlxr.exec:\lxxrlxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\7rxrlll.exec:\7rxrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\0404448.exec:\0404448.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\0866660.exec:\0866660.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\48422.exec:\48422.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\084844.exec:\084844.exe23⤵
- Executes dropped EXE
PID:3244 -
\??\c:\pdpjd.exec:\pdpjd.exe24⤵
- Executes dropped EXE
PID:536 -
\??\c:\vvddj.exec:\vvddj.exe25⤵
- Executes dropped EXE
PID:4768 -
\??\c:\04226.exec:\04226.exe26⤵
- Executes dropped EXE
PID:3200 -
\??\c:\26626.exec:\26626.exe27⤵
- Executes dropped EXE
PID:5044 -
\??\c:\jdpjp.exec:\jdpjp.exe28⤵
- Executes dropped EXE
PID:2564 -
\??\c:\24842.exec:\24842.exe29⤵
- Executes dropped EXE
PID:1420 -
\??\c:\648260.exec:\648260.exe30⤵
- Executes dropped EXE
PID:4452 -
\??\c:\04604.exec:\04604.exe31⤵
- Executes dropped EXE
PID:4188 -
\??\c:\62822.exec:\62822.exe32⤵
- Executes dropped EXE
PID:928 -
\??\c:\a4604.exec:\a4604.exe33⤵
- Executes dropped EXE
PID:5004 -
\??\c:\048260.exec:\048260.exe34⤵
- Executes dropped EXE
PID:1656 -
\??\c:\46226.exec:\46226.exe35⤵
- Executes dropped EXE
PID:4484 -
\??\c:\m0008.exec:\m0008.exe36⤵
- Executes dropped EXE
PID:3956 -
\??\c:\dpvjv.exec:\dpvjv.exe37⤵
- Executes dropped EXE
PID:1084 -
\??\c:\frrlffx.exec:\frrlffx.exe38⤵
- Executes dropped EXE
PID:1680 -
\??\c:\6888222.exec:\6888222.exe39⤵
- Executes dropped EXE
PID:1728 -
\??\c:\2844868.exec:\2844868.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\q08288.exec:\q08288.exe41⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7hnhhn.exec:\7hnhhn.exe42⤵
- Executes dropped EXE
PID:3448 -
\??\c:\862666.exec:\862666.exe43⤵
- Executes dropped EXE
PID:808 -
\??\c:\s6262.exec:\s6262.exe44⤵
- Executes dropped EXE
PID:3224 -
\??\c:\xrffxxf.exec:\xrffxxf.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3676 -
\??\c:\m8482.exec:\m8482.exe46⤵
- Executes dropped EXE
PID:3060 -
\??\c:\o886044.exec:\o886044.exe47⤵
- Executes dropped EXE
PID:3332 -
\??\c:\60626.exec:\60626.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rlxxffl.exec:\rlxxffl.exe49⤵
- Executes dropped EXE
PID:4880 -
\??\c:\pdjdv.exec:\pdjdv.exe50⤵
- Executes dropped EXE
PID:4424 -
\??\c:\48040.exec:\48040.exe51⤵
- Executes dropped EXE
PID:3340 -
\??\c:\xlxrrlr.exec:\xlxrrlr.exe52⤵
- Executes dropped EXE
PID:232 -
\??\c:\frxrlff.exec:\frxrlff.exe53⤵PID:4940
-
\??\c:\dvjjv.exec:\dvjjv.exe54⤵
- Executes dropped EXE
PID:4896 -
\??\c:\08408.exec:\08408.exe55⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vjvjp.exec:\vjvjp.exe56⤵
- Executes dropped EXE
PID:4224 -
\??\c:\62444.exec:\62444.exe57⤵
- Executes dropped EXE
PID:4404 -
\??\c:\822266.exec:\822266.exe58⤵
- Executes dropped EXE
PID:3276 -
\??\c:\228882.exec:\228882.exe59⤵
- Executes dropped EXE
PID:4832 -
\??\c:\20204.exec:\20204.exe60⤵
- Executes dropped EXE
PID:3656 -
\??\c:\q28226.exec:\q28226.exe61⤵
- Executes dropped EXE
PID:880 -
\??\c:\jdvpd.exec:\jdvpd.exe62⤵
- Executes dropped EXE
PID:4492 -
\??\c:\280088.exec:\280088.exe63⤵
- Executes dropped EXE
PID:1132 -
\??\c:\3rxxfll.exec:\3rxxfll.exe64⤵
- Executes dropped EXE
PID:4900 -
\??\c:\s0604.exec:\s0604.exe65⤵
- Executes dropped EXE
PID:3688 -
\??\c:\tnbtnn.exec:\tnbtnn.exe66⤵
- Executes dropped EXE
PID:1348 -
\??\c:\028866.exec:\028866.exe67⤵PID:2912
-
\??\c:\dvvpj.exec:\dvvpj.exe68⤵PID:2416
-
\??\c:\26260.exec:\26260.exe69⤵PID:5088
-
\??\c:\406626.exec:\406626.exe70⤵PID:3852
-
\??\c:\xlfrllf.exec:\xlfrllf.exe71⤵PID:3804
-
\??\c:\jddvv.exec:\jddvv.exe72⤵PID:4648
-
\??\c:\7xxrllr.exec:\7xxrllr.exe73⤵PID:2680
-
\??\c:\vdjdp.exec:\vdjdp.exe74⤵PID:4152
-
\??\c:\q62004.exec:\q62004.exe75⤵PID:1224
-
\??\c:\rffrxrf.exec:\rffrxrf.exe76⤵PID:2672
-
\??\c:\jpjdp.exec:\jpjdp.exe77⤵PID:464
-
\??\c:\8400802.exec:\8400802.exe78⤵PID:3648
-
\??\c:\0282660.exec:\0282660.exe79⤵PID:2432
-
\??\c:\0008608.exec:\0008608.exe80⤵PID:5080
-
\??\c:\rxxlfrl.exec:\rxxlfrl.exe81⤵PID:3124
-
\??\c:\jppdd.exec:\jppdd.exe82⤵PID:1648
-
\??\c:\2220448.exec:\2220448.exe83⤵PID:3244
-
\??\c:\080448.exec:\080448.exe84⤵PID:1560
-
\??\c:\pvvjp.exec:\pvvjp.exe85⤵PID:1112
-
\??\c:\9fxlxrf.exec:\9fxlxrf.exe86⤵PID:4948
-
\??\c:\222082.exec:\222082.exe87⤵PID:632
-
\??\c:\k22026.exec:\k22026.exe88⤵PID:4972
-
\??\c:\jvjjj.exec:\jvjjj.exe89⤵PID:2628
-
\??\c:\ttbnnh.exec:\ttbnnh.exe90⤵PID:860
-
\??\c:\dppdj.exec:\dppdj.exe91⤵PID:4992
-
\??\c:\028660.exec:\028660.exe92⤵PID:3344
-
\??\c:\0886266.exec:\0886266.exe93⤵PID:4952
-
\??\c:\80204.exec:\80204.exe94⤵PID:720
-
\??\c:\k82840.exec:\k82840.exe95⤵PID:928
-
\??\c:\84082.exec:\84082.exe96⤵PID:732
-
\??\c:\lllxfxr.exec:\lllxfxr.exe97⤵PID:1888
-
\??\c:\k06448.exec:\k06448.exe98⤵PID:1908
-
\??\c:\btttnn.exec:\btttnn.exe99⤵PID:2932
-
\??\c:\vddpd.exec:\vddpd.exe100⤵PID:5112
-
\??\c:\hnbnhb.exec:\hnbnhb.exe101⤵PID:4772
-
\??\c:\648682.exec:\648682.exe102⤵PID:3408
-
\??\c:\vjdjv.exec:\vjdjv.exe103⤵PID:2488
-
\??\c:\pvpdp.exec:\pvpdp.exe104⤵PID:2324
-
\??\c:\7dvjp.exec:\7dvjp.exe105⤵PID:2940
-
\??\c:\llrlllr.exec:\llrlllr.exe106⤵
- System Location Discovery: System Language Discovery
PID:2332 -
\??\c:\2848882.exec:\2848882.exe107⤵PID:2856
-
\??\c:\ntbttt.exec:\ntbttt.exe108⤵PID:2000
-
\??\c:\o026448.exec:\o026448.exe109⤵PID:1924
-
\??\c:\htttnn.exec:\htttnn.exe110⤵PID:3228
-
\??\c:\268222.exec:\268222.exe111⤵PID:1404
-
\??\c:\xrlxfrf.exec:\xrlxfrf.exe112⤵PID:4572
-
\??\c:\8400004.exec:\8400004.exe113⤵PID:2676
-
\??\c:\482200.exec:\482200.exe114⤵PID:1840
-
\??\c:\88882.exec:\88882.exe115⤵PID:4888
-
\??\c:\lxrflfr.exec:\lxrflfr.exe116⤵PID:1920
-
\??\c:\pdvjv.exec:\pdvjv.exe117⤵PID:4976
-
\??\c:\dpjvj.exec:\dpjvj.exe118⤵PID:2168
-
\??\c:\s6664.exec:\s6664.exe119⤵PID:3404
-
\??\c:\2022262.exec:\2022262.exe120⤵PID:5072
-
\??\c:\w00864.exec:\w00864.exe121⤵PID:396
-
\??\c:\s0086.exec:\s0086.exe122⤵PID:2508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-