Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 19:08
Behavioral task
behavioral1
Sample
01e8227d9762e09acc854a021992b7c46078104d1c8c731b2e2bb21e056aeef2.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
01e8227d9762e09acc854a021992b7c46078104d1c8c731b2e2bb21e056aeef2.exe
-
Size
344KB
-
MD5
fbb54bd97c7502cd444502c318e62427
-
SHA1
8c6bfe49fccc9452ae7ebd3e56edbdda031e3c07
-
SHA256
01e8227d9762e09acc854a021992b7c46078104d1c8c731b2e2bb21e056aeef2
-
SHA512
38390e12088b7ae6f8599fdb5171da909c7e89bcef935c863f66d0a08554c38c5509bb50a9ae93dc563dcf44753acce83211895ff5104f0433846c6c7a8c93ac
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYA6:R4wFHoS3WXZshJX2VGd6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/884-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3816-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/336-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/708-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1668-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/180-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-851-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-941-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-1188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-1191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2644 rllfxxr.exe 2672 frllfxr.exe 2180 pjjvd.exe 1060 bhthbt.exe 2576 vpvpp.exe 408 hbhbbb.exe 4564 jjvpd.exe 3984 rrxfxrr.exe 840 vjddd.exe 1612 bbtnbt.exe 3080 vvdpj.exe 3816 tbnhbn.exe 4900 pjjjd.exe 2288 frrfrfl.exe 1068 dpddv.exe 2876 hhtnnt.exe 4964 jdjpd.exe 5004 pjppj.exe 3240 nthbtn.exe 844 5lxrrrl.exe 2232 tnttnt.exe 4440 3djvp.exe 2756 5hthtt.exe 1880 htbtnh.exe 4848 1pdvp.exe 3636 tnbtbb.exe 4592 frxrlff.exe 2668 5ntnhb.exe 1148 7xfrlfx.exe 392 hhhhbb.exe 1568 xffxxxx.exe 4868 htbttt.exe 4244 ddjdv.exe 336 rlrlffx.exe 3424 bnbbth.exe 708 jddvj.exe 1604 rxfxrrl.exe 880 1rrrlff.exe 3752 bbhnbb.exe 4792 dvdvp.exe 4404 fxrrffx.exe 2976 hbnhbt.exe 2996 jpdvj.exe 4600 ppdvp.exe 3408 xlrlllf.exe 224 ttbtnt.exe 3844 thtnbb.exe 3140 jjjvv.exe 3012 xlrlfff.exe 4636 xlrlfxx.exe 5112 btbbtt.exe 2844 7jddp.exe 324 lrxxrrl.exe 3908 rfrlffx.exe 3236 9bhhnn.exe 3404 nthhhb.exe 4052 1jjvp.exe 1104 dpddv.exe 1668 7xlflrr.exe 2832 thtbnn.exe 2684 tttnnn.exe 1468 dvjdp.exe 2564 rrrllll.exe 2648 btbtth.exe -
resource yara_rule behavioral2/memory/884-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b40-3.dat upx behavioral2/memory/884-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-8.dat upx behavioral2/memory/2644-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9e-11.dat upx behavioral2/memory/2672-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9f-18.dat upx behavioral2/memory/1060-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2180-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba0-24.dat upx behavioral2/memory/1060-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba1-29.dat upx behavioral2/memory/2576-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba2-34.dat upx behavioral2/memory/408-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba3-40.dat upx behavioral2/memory/4564-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba4-44.dat upx behavioral2/memory/3984-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba5-49.dat upx behavioral2/files/0x000a000000023ba6-53.dat upx behavioral2/memory/1612-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba8-58.dat upx behavioral2/files/0x000a000000023ba9-62.dat upx behavioral2/memory/3816-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023baa-67.dat upx behavioral2/files/0x000b000000023b9a-72.dat upx behavioral2/memory/1068-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bab-76.dat upx behavioral2/memory/2876-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bac-81.dat upx behavioral2/memory/4964-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bad-86.dat upx behavioral2/files/0x000a000000023bae-91.dat upx behavioral2/memory/5004-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3240-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023baf-95.dat upx behavioral2/files/0x000a000000023bb0-100.dat upx behavioral2/files/0x000a000000023bb1-104.dat upx behavioral2/memory/2232-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023bb2-109.dat upx behavioral2/memory/4440-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2756-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023bb3-115.dat upx behavioral2/files/0x000b000000023bb4-120.dat upx behavioral2/memory/1880-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bbc-125.dat upx behavioral2/memory/4848-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bc3-129.dat upx behavioral2/memory/3636-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bcc-134.dat upx behavioral2/memory/4592-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2668-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bd1-139.dat upx behavioral2/memory/1148-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bd2-144.dat upx behavioral2/files/0x0009000000023bd3-149.dat upx behavioral2/memory/392-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bd7-154.dat upx behavioral2/memory/336-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3424-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/708-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3752-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lllxff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 884 wrote to memory of 2644 884 01e8227d9762e09acc854a021992b7c46078104d1c8c731b2e2bb21e056aeef2.exe 82 PID 884 wrote to memory of 2644 884 01e8227d9762e09acc854a021992b7c46078104d1c8c731b2e2bb21e056aeef2.exe 82 PID 884 wrote to memory of 2644 884 01e8227d9762e09acc854a021992b7c46078104d1c8c731b2e2bb21e056aeef2.exe 82 PID 2644 wrote to memory of 2672 2644 rllfxxr.exe 83 PID 2644 wrote to memory of 2672 2644 rllfxxr.exe 83 PID 2644 wrote to memory of 2672 2644 rllfxxr.exe 83 PID 2672 wrote to memory of 2180 2672 frllfxr.exe 84 PID 2672 wrote to memory of 2180 2672 frllfxr.exe 84 PID 2672 wrote to memory of 2180 2672 frllfxr.exe 84 PID 2180 wrote to memory of 1060 2180 pjjvd.exe 85 PID 2180 wrote to memory of 1060 2180 pjjvd.exe 85 PID 2180 wrote to memory of 1060 2180 pjjvd.exe 85 PID 1060 wrote to memory of 2576 1060 bhthbt.exe 86 PID 1060 wrote to memory of 2576 1060 bhthbt.exe 86 PID 1060 wrote to memory of 2576 1060 bhthbt.exe 86 PID 2576 wrote to memory of 408 2576 vpvpp.exe 87 PID 2576 wrote to memory of 408 2576 vpvpp.exe 87 PID 2576 wrote to memory of 408 2576 vpvpp.exe 87 PID 408 wrote to memory of 4564 408 hbhbbb.exe 88 PID 408 wrote to memory of 4564 408 hbhbbb.exe 88 PID 408 wrote to memory of 4564 408 hbhbbb.exe 88 PID 4564 wrote to memory of 3984 4564 jjvpd.exe 89 PID 4564 wrote to memory of 3984 4564 jjvpd.exe 89 PID 4564 wrote to memory of 3984 4564 jjvpd.exe 89 PID 3984 wrote to memory of 840 3984 rrxfxrr.exe 90 PID 3984 wrote to memory of 840 3984 rrxfxrr.exe 90 PID 3984 wrote to memory of 840 3984 rrxfxrr.exe 90 PID 840 wrote to memory of 1612 840 vjddd.exe 91 PID 840 wrote to memory of 1612 840 vjddd.exe 91 PID 840 wrote to memory of 1612 840 vjddd.exe 91 PID 1612 wrote to memory of 3080 1612 bbtnbt.exe 92 PID 1612 wrote to memory of 3080 1612 bbtnbt.exe 92 PID 1612 wrote to memory of 3080 1612 bbtnbt.exe 92 PID 3080 wrote to memory of 3816 3080 vvdpj.exe 93 PID 3080 wrote to memory of 3816 3080 vvdpj.exe 93 PID 3080 wrote to memory of 3816 3080 vvdpj.exe 93 PID 3816 wrote to memory of 4900 3816 tbnhbn.exe 94 PID 3816 wrote to memory of 4900 3816 tbnhbn.exe 94 PID 3816 wrote to memory of 4900 3816 tbnhbn.exe 94 PID 4900 wrote to memory of 2288 4900 pjjjd.exe 95 PID 4900 wrote to memory of 2288 4900 pjjjd.exe 95 PID 4900 wrote to memory of 2288 4900 pjjjd.exe 95 PID 2288 wrote to memory of 1068 2288 frrfrfl.exe 96 PID 2288 wrote to memory of 1068 2288 frrfrfl.exe 96 PID 2288 wrote to memory of 1068 2288 frrfrfl.exe 96 PID 1068 wrote to memory of 2876 1068 dpddv.exe 97 PID 1068 wrote to memory of 2876 1068 dpddv.exe 97 PID 1068 wrote to memory of 2876 1068 dpddv.exe 97 PID 2876 wrote to memory of 4964 2876 hhtnnt.exe 98 PID 2876 wrote to memory of 4964 2876 hhtnnt.exe 98 PID 2876 wrote to memory of 4964 2876 hhtnnt.exe 98 PID 4964 wrote to memory of 5004 4964 jdjpd.exe 99 PID 4964 wrote to memory of 5004 4964 jdjpd.exe 99 PID 4964 wrote to memory of 5004 4964 jdjpd.exe 99 PID 5004 wrote to memory of 3240 5004 pjppj.exe 100 PID 5004 wrote to memory of 3240 5004 pjppj.exe 100 PID 5004 wrote to memory of 3240 5004 pjppj.exe 100 PID 3240 wrote to memory of 844 3240 nthbtn.exe 101 PID 3240 wrote to memory of 844 3240 nthbtn.exe 101 PID 3240 wrote to memory of 844 3240 nthbtn.exe 101 PID 844 wrote to memory of 2232 844 5lxrrrl.exe 102 PID 844 wrote to memory of 2232 844 5lxrrrl.exe 102 PID 844 wrote to memory of 2232 844 5lxrrrl.exe 102 PID 2232 wrote to memory of 4440 2232 tnttnt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\01e8227d9762e09acc854a021992b7c46078104d1c8c731b2e2bb21e056aeef2.exe"C:\Users\Admin\AppData\Local\Temp\01e8227d9762e09acc854a021992b7c46078104d1c8c731b2e2bb21e056aeef2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\rllfxxr.exec:\rllfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\frllfxr.exec:\frllfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\pjjvd.exec:\pjjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\bhthbt.exec:\bhthbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\vpvpp.exec:\vpvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\hbhbbb.exec:\hbhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\jjvpd.exec:\jjvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\rrxfxrr.exec:\rrxfxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\vjddd.exec:\vjddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\bbtnbt.exec:\bbtnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\vvdpj.exec:\vvdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\tbnhbn.exec:\tbnhbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\pjjjd.exec:\pjjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\frrfrfl.exec:\frrfrfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\dpddv.exec:\dpddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\hhtnnt.exec:\hhtnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\jdjpd.exec:\jdjpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\pjppj.exec:\pjppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\nthbtn.exec:\nthbtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\5lxrrrl.exec:\5lxrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\tnttnt.exec:\tnttnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\3djvp.exec:\3djvp.exe23⤵
- Executes dropped EXE
PID:4440 -
\??\c:\5hthtt.exec:\5hthtt.exe24⤵
- Executes dropped EXE
PID:2756 -
\??\c:\htbtnh.exec:\htbtnh.exe25⤵
- Executes dropped EXE
PID:1880 -
\??\c:\1pdvp.exec:\1pdvp.exe26⤵
- Executes dropped EXE
PID:4848 -
\??\c:\tnbtbb.exec:\tnbtbb.exe27⤵
- Executes dropped EXE
PID:3636 -
\??\c:\frxrlff.exec:\frxrlff.exe28⤵
- Executes dropped EXE
PID:4592 -
\??\c:\5ntnhb.exec:\5ntnhb.exe29⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7xfrlfx.exec:\7xfrlfx.exe30⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hhhhbb.exec:\hhhhbb.exe31⤵
- Executes dropped EXE
PID:392 -
\??\c:\xffxxxx.exec:\xffxxxx.exe32⤵
- Executes dropped EXE
PID:1568 -
\??\c:\htbttt.exec:\htbttt.exe33⤵
- Executes dropped EXE
PID:4868 -
\??\c:\ddjdv.exec:\ddjdv.exe34⤵
- Executes dropped EXE
PID:4244 -
\??\c:\rlrlffx.exec:\rlrlffx.exe35⤵
- Executes dropped EXE
PID:336 -
\??\c:\bnbbth.exec:\bnbbth.exe36⤵
- Executes dropped EXE
PID:3424 -
\??\c:\jddvj.exec:\jddvj.exe37⤵
- Executes dropped EXE
PID:708 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\1rrrlff.exec:\1rrrlff.exe39⤵
- Executes dropped EXE
PID:880 -
\??\c:\bbhnbb.exec:\bbhnbb.exe40⤵
- Executes dropped EXE
PID:3752 -
\??\c:\dvdvp.exec:\dvdvp.exe41⤵
- Executes dropped EXE
PID:4792 -
\??\c:\fxrrffx.exec:\fxrrffx.exe42⤵
- Executes dropped EXE
PID:4404 -
\??\c:\hbnhbt.exec:\hbnhbt.exe43⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jpdvj.exec:\jpdvj.exe44⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ppdvp.exec:\ppdvp.exe45⤵
- Executes dropped EXE
PID:4600 -
\??\c:\xlrlllf.exec:\xlrlllf.exe46⤵
- Executes dropped EXE
PID:3408 -
\??\c:\ttbtnt.exec:\ttbtnt.exe47⤵
- Executes dropped EXE
PID:224 -
\??\c:\thtnbb.exec:\thtnbb.exe48⤵
- Executes dropped EXE
PID:3844 -
\??\c:\jjjvv.exec:\jjjvv.exe49⤵
- Executes dropped EXE
PID:3140 -
\??\c:\xlrlfff.exec:\xlrlfff.exe50⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe51⤵
- Executes dropped EXE
PID:4636 -
\??\c:\btbbtt.exec:\btbbtt.exe52⤵
- Executes dropped EXE
PID:5112 -
\??\c:\7jddp.exec:\7jddp.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe54⤵
- Executes dropped EXE
PID:324 -
\??\c:\rfrlffx.exec:\rfrlffx.exe55⤵
- Executes dropped EXE
PID:3908 -
\??\c:\9bhhnn.exec:\9bhhnn.exe56⤵
- Executes dropped EXE
PID:3236 -
\??\c:\nthhhb.exec:\nthhhb.exe57⤵
- Executes dropped EXE
PID:3404 -
\??\c:\1jjvp.exec:\1jjvp.exe58⤵
- Executes dropped EXE
PID:4052 -
\??\c:\dpddv.exec:\dpddv.exe59⤵
- Executes dropped EXE
PID:1104 -
\??\c:\7xlflrr.exec:\7xlflrr.exe60⤵
- Executes dropped EXE
PID:1668 -
\??\c:\thtbnn.exec:\thtbnn.exe61⤵
- Executes dropped EXE
PID:2832 -
\??\c:\tttnnn.exec:\tttnnn.exe62⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dvjdp.exec:\dvjdp.exe63⤵
- Executes dropped EXE
PID:1468 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe64⤵PID:4424
-
\??\c:\rrrllll.exec:\rrrllll.exe65⤵
- Executes dropped EXE
PID:2564 -
\??\c:\btbtth.exec:\btbtth.exe66⤵
- Executes dropped EXE
PID:2648 -
\??\c:\djpjj.exec:\djpjj.exe67⤵
- System Location Discovery: System Language Discovery
PID:180 -
\??\c:\vppjd.exec:\vppjd.exe68⤵PID:4960
-
\??\c:\xrxfxxx.exec:\xrxfxxx.exe69⤵PID:4112
-
\??\c:\thtnbb.exec:\thtnbb.exe70⤵PID:2028
-
\??\c:\9hhhbt.exec:\9hhhbt.exe71⤵PID:1780
-
\??\c:\1jjdv.exec:\1jjdv.exe72⤵PID:2728
-
\??\c:\rfllxrr.exec:\rfllxrr.exe73⤵PID:4552
-
\??\c:\hnbbhh.exec:\hnbbhh.exe74⤵PID:1968
-
\??\c:\nhbtnh.exec:\nhbtnh.exe75⤵PID:2300
-
\??\c:\jdpjp.exec:\jdpjp.exe76⤵PID:1176
-
\??\c:\rrxrffx.exec:\rrxrffx.exe77⤵PID:228
-
\??\c:\llrffxx.exec:\llrffxx.exe78⤵PID:556
-
\??\c:\htbhbb.exec:\htbhbb.exe79⤵PID:456
-
\??\c:\vpdvv.exec:\vpdvv.exe80⤵PID:3516
-
\??\c:\7rrlfff.exec:\7rrlfff.exe81⤵PID:2740
-
\??\c:\fxffxfx.exec:\fxffxfx.exe82⤵PID:3996
-
\??\c:\bbhhhh.exec:\bbhhhh.exe83⤵PID:1500
-
\??\c:\vppjd.exec:\vppjd.exe84⤵PID:2836
-
\??\c:\pppjd.exec:\pppjd.exe85⤵PID:4368
-
\??\c:\lrxxrrx.exec:\lrxxrrx.exe86⤵PID:2204
-
\??\c:\tbbbbt.exec:\tbbbbt.exe87⤵PID:2148
-
\??\c:\bthnhb.exec:\bthnhb.exe88⤵PID:3884
-
\??\c:\3vdvv.exec:\3vdvv.exe89⤵PID:3936
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe90⤵PID:2688
-
\??\c:\xrxrlll.exec:\xrxrlll.exe91⤵PID:2808
-
\??\c:\hbbtnn.exec:\hbbtnn.exe92⤵PID:4964
-
\??\c:\jdjdv.exec:\jdjdv.exe93⤵PID:216
-
\??\c:\5vdvp.exec:\5vdvp.exe94⤵PID:1700
-
\??\c:\rllfxxr.exec:\rllfxxr.exe95⤵PID:3240
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe96⤵PID:3528
-
\??\c:\ttbthh.exec:\ttbthh.exe97⤵PID:1028
-
\??\c:\jjppd.exec:\jjppd.exe98⤵PID:2232
-
\??\c:\rxfxrrx.exec:\rxfxrrx.exe99⤵PID:1812
-
\??\c:\rxllffx.exec:\rxllffx.exe100⤵PID:2756
-
\??\c:\htbbtt.exec:\htbbtt.exe101⤵PID:2100
-
\??\c:\9bhhnn.exec:\9bhhnn.exe102⤵PID:1244
-
\??\c:\ddppp.exec:\ddppp.exe103⤵PID:4436
-
\??\c:\3xxxxff.exec:\3xxxxff.exe104⤵PID:1432
-
\??\c:\rfrrrrl.exec:\rfrrrrl.exe105⤵PID:2800
-
\??\c:\nnnhbt.exec:\nnnhbt.exe106⤵PID:1672
-
\??\c:\1vvpj.exec:\1vvpj.exe107⤵PID:4592
-
\??\c:\vdpjv.exec:\vdpjv.exe108⤵PID:916
-
\??\c:\rlxxffx.exec:\rlxxffx.exe109⤵PID:2020
-
\??\c:\flrrlrl.exec:\flrrlrl.exe110⤵PID:2396
-
\??\c:\tthbnn.exec:\tthbnn.exe111⤵PID:4496
-
\??\c:\9djjj.exec:\9djjj.exe112⤵PID:1580
-
\??\c:\vjpjv.exec:\vjpjv.exe113⤵PID:2004
-
\??\c:\xrrlxff.exec:\xrrlxff.exe114⤵PID:1052
-
\??\c:\nbhnbb.exec:\nbhnbb.exe115⤵PID:4244
-
\??\c:\bnnhtt.exec:\bnnhtt.exe116⤵PID:336
-
\??\c:\dvdvj.exec:\dvdvj.exe117⤵PID:3424
-
\??\c:\jdpjp.exec:\jdpjp.exe118⤵PID:2468
-
\??\c:\lrfflrr.exec:\lrfflrr.exe119⤵PID:3940
-
\??\c:\htbttt.exec:\htbttt.exe120⤵PID:2244
-
\??\c:\bbtntt.exec:\bbtntt.exe121⤵PID:4248
-
\??\c:\7vdvv.exec:\7vdvv.exe122⤵PID:1976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-