Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 19:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe
-
Size
454KB
-
MD5
d4cbdf719a21dc89101c869fd0d3a7c1
-
SHA1
560d041cd3626c46440368467f088999963c4c38
-
SHA256
0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be
-
SHA512
f4cf55fe804c205a8ccd2ce403ee5f75f2e32817a4aae4d7c6c6d9286314d910e3911f17542d14ebfab5819b652d48aebb76ddfc1f05992805c258a34edb7eac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2348-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-954-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-1631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2348 1vppp.exe 3800 lxxlfxr.exe 4916 btbttn.exe 4632 pjddd.exe 2840 thtthn.exe 4884 rrxxxxx.exe 1668 5hhhht.exe 4368 xffxrrl.exe 2032 tbbtnh.exe 3360 hhnhhh.exe 3868 llllllx.exe 3452 pdpdd.exe 3152 jjddd.exe 4124 ffrxxxr.exe 3304 llxxrxf.exe 4912 xrxxxxx.exe 3012 bnnhhh.exe 1896 ffrrxfr.exe 3160 jpvpv.exe 5020 rlrrlrl.exe 1400 nhtttt.exe 388 vdddv.exe 1312 tthnnt.exe 2192 rlxrrxr.exe 2340 1lfffff.exe 5016 bhnhbb.exe 2988 jdppd.exe 880 lrxxxff.exe 3288 bhhhhh.exe 1484 vvvvp.exe 4924 rlrrrrr.exe 652 3jpjj.exe 4548 pddvv.exe 1632 xxfxxrr.exe 4672 bhhtnn.exe 2460 jjpjd.exe 3872 9jdvv.exe 1892 lxxlrrr.exe 2036 rffffff.exe 1696 bhhbbt.exe 4472 jpvpp.exe 2344 frxxrxx.exe 4288 bbbnnn.exe 1904 lrrrrrr.exe 1536 rxxxfff.exe 1888 hhnhhh.exe 4728 jpvvd.exe 3960 lxrrrrr.exe 1496 bnttnn.exe 432 lxxrllf.exe 2580 nnbhht.exe 2980 dvvvv.exe 1360 fffllrx.exe 4656 bnbbbh.exe 4496 7ppdd.exe 4560 bbbnhn.exe 3736 hththb.exe 1748 rrllfxr.exe 1764 btbttt.exe 4000 1vjjj.exe 4940 5fxrlrl.exe 4132 dvjvd.exe 1056 fllflff.exe 2300 xfxlxxl.exe -
resource yara_rule behavioral2/memory/2348-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-738-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2348 2980 0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe 83 PID 2980 wrote to memory of 2348 2980 0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe 83 PID 2980 wrote to memory of 2348 2980 0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe 83 PID 2348 wrote to memory of 3800 2348 1vppp.exe 84 PID 2348 wrote to memory of 3800 2348 1vppp.exe 84 PID 2348 wrote to memory of 3800 2348 1vppp.exe 84 PID 3800 wrote to memory of 4916 3800 lxxlfxr.exe 85 PID 3800 wrote to memory of 4916 3800 lxxlfxr.exe 85 PID 3800 wrote to memory of 4916 3800 lxxlfxr.exe 85 PID 4916 wrote to memory of 4632 4916 btbttn.exe 86 PID 4916 wrote to memory of 4632 4916 btbttn.exe 86 PID 4916 wrote to memory of 4632 4916 btbttn.exe 86 PID 4632 wrote to memory of 2840 4632 pjddd.exe 87 PID 4632 wrote to memory of 2840 4632 pjddd.exe 87 PID 4632 wrote to memory of 2840 4632 pjddd.exe 87 PID 2840 wrote to memory of 4884 2840 thtthn.exe 88 PID 2840 wrote to memory of 4884 2840 thtthn.exe 88 PID 2840 wrote to memory of 4884 2840 thtthn.exe 88 PID 4884 wrote to memory of 1668 4884 rrxxxxx.exe 89 PID 4884 wrote to memory of 1668 4884 rrxxxxx.exe 89 PID 4884 wrote to memory of 1668 4884 rrxxxxx.exe 89 PID 1668 wrote to memory of 4368 1668 5hhhht.exe 90 PID 1668 wrote to memory of 4368 1668 5hhhht.exe 90 PID 1668 wrote to memory of 4368 1668 5hhhht.exe 90 PID 4368 wrote to memory of 2032 4368 xffxrrl.exe 91 PID 4368 wrote to memory of 2032 4368 xffxrrl.exe 91 PID 4368 wrote to memory of 2032 4368 xffxrrl.exe 91 PID 2032 wrote to memory of 3360 2032 tbbtnh.exe 92 PID 2032 wrote to memory of 3360 2032 tbbtnh.exe 92 PID 2032 wrote to memory of 3360 2032 tbbtnh.exe 92 PID 3360 wrote to memory of 3868 3360 hhnhhh.exe 93 PID 3360 wrote to memory of 3868 3360 hhnhhh.exe 93 PID 3360 wrote to memory of 3868 3360 hhnhhh.exe 93 PID 3868 wrote to memory of 3452 3868 llllllx.exe 94 PID 3868 wrote to memory of 3452 3868 llllllx.exe 94 PID 3868 wrote to memory of 3452 3868 llllllx.exe 94 PID 3452 wrote to memory of 3152 3452 pdpdd.exe 95 PID 3452 wrote to memory of 3152 3452 pdpdd.exe 95 PID 3452 wrote to memory of 3152 3452 pdpdd.exe 95 PID 3152 wrote to memory of 4124 3152 jjddd.exe 96 PID 3152 wrote to memory of 4124 3152 jjddd.exe 96 PID 3152 wrote to memory of 4124 3152 jjddd.exe 96 PID 4124 wrote to memory of 3304 4124 ffrxxxr.exe 97 PID 4124 wrote to memory of 3304 4124 ffrxxxr.exe 97 PID 4124 wrote to memory of 3304 4124 ffrxxxr.exe 97 PID 3304 wrote to memory of 4912 3304 llxxrxf.exe 98 PID 3304 wrote to memory of 4912 3304 llxxrxf.exe 98 PID 3304 wrote to memory of 4912 3304 llxxrxf.exe 98 PID 4912 wrote to memory of 3012 4912 xrxxxxx.exe 99 PID 4912 wrote to memory of 3012 4912 xrxxxxx.exe 99 PID 4912 wrote to memory of 3012 4912 xrxxxxx.exe 99 PID 3012 wrote to memory of 1896 3012 bnnhhh.exe 100 PID 3012 wrote to memory of 1896 3012 bnnhhh.exe 100 PID 3012 wrote to memory of 1896 3012 bnnhhh.exe 100 PID 1896 wrote to memory of 3160 1896 ffrrxfr.exe 101 PID 1896 wrote to memory of 3160 1896 ffrrxfr.exe 101 PID 1896 wrote to memory of 3160 1896 ffrrxfr.exe 101 PID 3160 wrote to memory of 5020 3160 jpvpv.exe 102 PID 3160 wrote to memory of 5020 3160 jpvpv.exe 102 PID 3160 wrote to memory of 5020 3160 jpvpv.exe 102 PID 5020 wrote to memory of 1400 5020 rlrrlrl.exe 103 PID 5020 wrote to memory of 1400 5020 rlrrlrl.exe 103 PID 5020 wrote to memory of 1400 5020 rlrrlrl.exe 103 PID 1400 wrote to memory of 388 1400 nhtttt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe"C:\Users\Admin\AppData\Local\Temp\0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\1vppp.exec:\1vppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\btbttn.exec:\btbttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\pjddd.exec:\pjddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\thtthn.exec:\thtthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\5hhhht.exec:\5hhhht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\xffxrrl.exec:\xffxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\tbbtnh.exec:\tbbtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\hhnhhh.exec:\hhnhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\llllllx.exec:\llllllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\pdpdd.exec:\pdpdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\jjddd.exec:\jjddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\ffrxxxr.exec:\ffrxxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\llxxrxf.exec:\llxxrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\bnnhhh.exec:\bnnhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\ffrrxfr.exec:\ffrrxfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\jpvpv.exec:\jpvpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\nhtttt.exec:\nhtttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\vdddv.exec:\vdddv.exe23⤵
- Executes dropped EXE
PID:388 -
\??\c:\tthnnt.exec:\tthnnt.exe24⤵
- Executes dropped EXE
PID:1312 -
\??\c:\rlxrrxr.exec:\rlxrrxr.exe25⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1lfffff.exec:\1lfffff.exe26⤵
- Executes dropped EXE
PID:2340 -
\??\c:\bhnhbb.exec:\bhnhbb.exe27⤵
- Executes dropped EXE
PID:5016 -
\??\c:\jdppd.exec:\jdppd.exe28⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lrxxxff.exec:\lrxxxff.exe29⤵
- Executes dropped EXE
PID:880 -
\??\c:\bhhhhh.exec:\bhhhhh.exe30⤵
- Executes dropped EXE
PID:3288 -
\??\c:\vvvvp.exec:\vvvvp.exe31⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe32⤵
- Executes dropped EXE
PID:4924 -
\??\c:\3jpjj.exec:\3jpjj.exe33⤵
- Executes dropped EXE
PID:652 -
\??\c:\pddvv.exec:\pddvv.exe34⤵
- Executes dropped EXE
PID:4548 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bhhtnn.exec:\bhhtnn.exe36⤵
- Executes dropped EXE
PID:4672 -
\??\c:\jjpjd.exec:\jjpjd.exe37⤵
- Executes dropped EXE
PID:2460 -
\??\c:\9jdvv.exec:\9jdvv.exe38⤵
- Executes dropped EXE
PID:3872 -
\??\c:\lxxlrrr.exec:\lxxlrrr.exe39⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rffffff.exec:\rffffff.exe40⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bhhbbt.exec:\bhhbbt.exe41⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jpvpp.exec:\jpvpp.exe42⤵
- Executes dropped EXE
PID:4472 -
\??\c:\frxxrxx.exec:\frxxrxx.exe43⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bbbnnn.exec:\bbbnnn.exe44⤵
- Executes dropped EXE
PID:4288 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe45⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rxxxfff.exec:\rxxxfff.exe46⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hhnhhh.exec:\hhnhhh.exe47⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jpvvd.exec:\jpvvd.exe48⤵
- Executes dropped EXE
PID:4728 -
\??\c:\lxrrrrr.exec:\lxrrrrr.exe49⤵
- Executes dropped EXE
PID:3960 -
\??\c:\bnttnn.exec:\bnttnn.exe50⤵
- Executes dropped EXE
PID:1496 -
\??\c:\lxxrllf.exec:\lxxrllf.exe51⤵
- Executes dropped EXE
PID:432 -
\??\c:\nnbhht.exec:\nnbhht.exe52⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pppjj.exec:\pppjj.exe53⤵PID:1596
-
\??\c:\dvvvv.exec:\dvvvv.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\fffllrx.exec:\fffllrx.exe55⤵
- Executes dropped EXE
PID:1360 -
\??\c:\bnbbbh.exec:\bnbbbh.exe56⤵
- Executes dropped EXE
PID:4656 -
\??\c:\7ppdd.exec:\7ppdd.exe57⤵
- Executes dropped EXE
PID:4496 -
\??\c:\bbbnhn.exec:\bbbnhn.exe58⤵
- Executes dropped EXE
PID:4560 -
\??\c:\hththb.exec:\hththb.exe59⤵
- Executes dropped EXE
PID:3736 -
\??\c:\rrllfxr.exec:\rrllfxr.exe60⤵
- Executes dropped EXE
PID:1748 -
\??\c:\btbttt.exec:\btbttt.exe61⤵
- Executes dropped EXE
PID:1764 -
\??\c:\1vjjj.exec:\1vjjj.exe62⤵
- Executes dropped EXE
PID:4000 -
\??\c:\5fxrlrl.exec:\5fxrlrl.exe63⤵
- Executes dropped EXE
PID:4940 -
\??\c:\dvjvd.exec:\dvjvd.exe64⤵
- Executes dropped EXE
PID:4132 -
\??\c:\fllflff.exec:\fllflff.exe65⤵
- Executes dropped EXE
PID:1056 -
\??\c:\xfxlxxl.exec:\xfxlxxl.exe66⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ttbtnh.exec:\ttbtnh.exe67⤵PID:3408
-
\??\c:\ppvpp.exec:\ppvpp.exe68⤵PID:3004
-
\??\c:\frfrlfx.exec:\frfrlfx.exe69⤵PID:3360
-
\??\c:\bbthbt.exec:\bbthbt.exe70⤵
- System Location Discovery: System Language Discovery
PID:3444 -
\??\c:\djdvp.exec:\djdvp.exe71⤵PID:3868
-
\??\c:\7frxrlf.exec:\7frxrlf.exe72⤵PID:3452
-
\??\c:\thbtbn.exec:\thbtbn.exe73⤵PID:3892
-
\??\c:\hhtnht.exec:\hhtnht.exe74⤵PID:2676
-
\??\c:\5vjdv.exec:\5vjdv.exe75⤵PID:2832
-
\??\c:\7frlfxr.exec:\7frlfxr.exe76⤵PID:624
-
\??\c:\hntntt.exec:\hntntt.exe77⤵PID:3012
-
\??\c:\ppvjp.exec:\ppvjp.exe78⤵PID:3368
-
\??\c:\1jvjd.exec:\1jvjd.exe79⤵PID:1156
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe80⤵PID:5020
-
\??\c:\nntnhh.exec:\nntnhh.exe81⤵PID:392
-
\??\c:\7jvpd.exec:\7jvpd.exe82⤵PID:1708
-
\??\c:\1lxrffr.exec:\1lxrffr.exe83⤵PID:3468
-
\??\c:\hbbbtn.exec:\hbbbtn.exe84⤵PID:4004
-
\??\c:\9bbthh.exec:\9bbthh.exe85⤵PID:4152
-
\??\c:\pvpvj.exec:\pvpvj.exe86⤵PID:4044
-
\??\c:\rrlfxrf.exec:\rrlfxrf.exe87⤵PID:1060
-
\??\c:\ffxlxrx.exec:\ffxlxrx.exe88⤵PID:2996
-
\??\c:\1nhtnh.exec:\1nhtnh.exe89⤵PID:2364
-
\??\c:\ppvpd.exec:\ppvpd.exe90⤵PID:3712
-
\??\c:\5vpdd.exec:\5vpdd.exe91⤵PID:3604
-
\??\c:\frlfxrf.exec:\frlfxrf.exe92⤵PID:4924
-
\??\c:\bntnhb.exec:\bntnhb.exe93⤵PID:960
-
\??\c:\ddvjd.exec:\ddvjd.exe94⤵
- System Location Discovery: System Language Discovery
PID:4504 -
\??\c:\ppvpp.exec:\ppvpp.exe95⤵PID:4708
-
\??\c:\3frlfxl.exec:\3frlfxl.exe96⤵PID:1996
-
\??\c:\ttnhbt.exec:\ttnhbt.exe97⤵PID:3832
-
\??\c:\3ddvd.exec:\3ddvd.exe98⤵PID:4672
-
\??\c:\xxrlffx.exec:\xxrlffx.exe99⤵PID:4028
-
\??\c:\fllxrlf.exec:\fllxrlf.exe100⤵PID:4032
-
\??\c:\bthtnh.exec:\bthtnh.exe101⤵PID:4960
-
\??\c:\djpdv.exec:\djpdv.exe102⤵PID:2064
-
\??\c:\9xxrlll.exec:\9xxrlll.exe103⤵PID:4744
-
\??\c:\hbbtnh.exec:\hbbtnh.exe104⤵PID:1696
-
\??\c:\5dvpj.exec:\5dvpj.exe105⤵PID:4472
-
\??\c:\jdvjd.exec:\jdvjd.exe106⤵PID:4516
-
\??\c:\5frlflf.exec:\5frlflf.exe107⤵PID:1588
-
\??\c:\1bbnhb.exec:\1bbnhb.exe108⤵PID:3528
-
\??\c:\vdddp.exec:\vdddp.exe109⤵PID:3992
-
\??\c:\5flfrrf.exec:\5flfrrf.exe110⤵PID:4764
-
\??\c:\bnttnn.exec:\bnttnn.exe111⤵PID:1928
-
\??\c:\nnbthn.exec:\nnbthn.exe112⤵PID:4696
-
\??\c:\dddpj.exec:\dddpj.exe113⤵PID:4332
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe114⤵PID:4324
-
\??\c:\1nhbtn.exec:\1nhbtn.exe115⤵PID:1256
-
\??\c:\1bbntn.exec:\1bbntn.exe116⤵PID:440
-
\??\c:\9vpdv.exec:\9vpdv.exe117⤵PID:5096
-
\??\c:\1ffrlrf.exec:\1ffrlrf.exe118⤵PID:3104
-
\??\c:\bntntn.exec:\bntntn.exe119⤵PID:4116
-
\??\c:\vpjdj.exec:\vpjdj.exe120⤵PID:4352
-
\??\c:\1rrlfxr.exec:\1rrlfxr.exe121⤵PID:3668
-
\??\c:\htthbh.exec:\htthbh.exe122⤵PID:4220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-