Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 20:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13c369cd307b8d6f182c7a7d35fe840e5482ac591eb79e41947a8c36b23d14bb.exe
Resource
win7-20241023-en
7 signatures
150 seconds
General
-
Target
13c369cd307b8d6f182c7a7d35fe840e5482ac591eb79e41947a8c36b23d14bb.exe
-
Size
453KB
-
MD5
e7e68d83b3987617d77bedb830024f3f
-
SHA1
d13c38a6adce938e116ec6cf94c5a9cbc7e0e001
-
SHA256
13c369cd307b8d6f182c7a7d35fe840e5482ac591eb79e41947a8c36b23d14bb
-
SHA512
68b161240aaabfa2ab38f0f9fdf7bd97a7ab2a2692a94fd01745c397e7bd9555596d21983b00a7b1904c5864810db772e2e18f30b69e97d7fcc12fb94ffaa08e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeP:q7Tc2NYHUrAwfMp3CDP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2216-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/728-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-821-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-960-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-1027-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-1788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 532 rlxxffl.exe 2004 vpvpp.exe 4376 frffxxx.exe 3852 hhttnn.exe 5064 rrrrrfx.exe 3508 dvjdd.exe 2724 hbttnt.exe 3788 frxrrrr.exe 2532 jddvp.exe 3840 ttnhhb.exe 3644 dvdvp.exe 4884 pdvvd.exe 4840 xflflxr.exe 4428 nhhhbh.exe 2900 xflfrrl.exe 4580 1xfxfxf.exe 2240 nbhtnn.exe 3632 vjpjd.exe 1336 xllfxfx.exe 5012 dpdpv.exe 2756 3vjvj.exe 2540 thbtth.exe 3416 rxffxxx.exe 1276 1hhbbh.exe 2168 bbbnbn.exe 3868 5bbtnh.exe 2280 rrxxfll.exe 4700 7bhhbb.exe 3324 pjdvp.exe 4852 vjvpj.exe 440 pjppj.exe 4612 hthbtt.exe 2432 3rrrlxr.exe 4732 dppvd.exe 1848 nbthth.exe 1488 9jpjp.exe 1264 xrlfffx.exe 5024 hthbbb.exe 100 5djdv.exe 1684 5rlfrrl.exe 2120 rllfffx.exe 2704 nttnhb.exe 2444 jdppj.exe 4480 9llxfxl.exe 212 nnnbtb.exe 4588 tttnhh.exe 4456 dpvjv.exe 3244 1rlfllf.exe 3000 btnhtn.exe 2216 pvjpv.exe 3504 xrrlfxr.exe 2004 tnhbnb.exe 1492 bttnnn.exe 1416 pdvjv.exe 4376 xfxlllf.exe 4796 nnnhbb.exe 464 bthbtt.exe 2860 jdjjd.exe 4636 rffxlll.exe 3272 xrlfrrf.exe 2792 hnnhbn.exe 3976 jvvdd.exe 4008 jddpd.exe 3936 xrxrflx.exe -
resource yara_rule behavioral2/memory/2216-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/728-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-774-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 532 2216 13c369cd307b8d6f182c7a7d35fe840e5482ac591eb79e41947a8c36b23d14bb.exe 83 PID 2216 wrote to memory of 532 2216 13c369cd307b8d6f182c7a7d35fe840e5482ac591eb79e41947a8c36b23d14bb.exe 83 PID 2216 wrote to memory of 532 2216 13c369cd307b8d6f182c7a7d35fe840e5482ac591eb79e41947a8c36b23d14bb.exe 83 PID 532 wrote to memory of 2004 532 rlxxffl.exe 84 PID 532 wrote to memory of 2004 532 rlxxffl.exe 84 PID 532 wrote to memory of 2004 532 rlxxffl.exe 84 PID 2004 wrote to memory of 4376 2004 vpvpp.exe 85 PID 2004 wrote to memory of 4376 2004 vpvpp.exe 85 PID 2004 wrote to memory of 4376 2004 vpvpp.exe 85 PID 4376 wrote to memory of 3852 4376 frffxxx.exe 86 PID 4376 wrote to memory of 3852 4376 frffxxx.exe 86 PID 4376 wrote to memory of 3852 4376 frffxxx.exe 86 PID 3852 wrote to memory of 5064 3852 hhttnn.exe 87 PID 3852 wrote to memory of 5064 3852 hhttnn.exe 87 PID 3852 wrote to memory of 5064 3852 hhttnn.exe 87 PID 5064 wrote to memory of 3508 5064 rrrrrfx.exe 88 PID 5064 wrote to memory of 3508 5064 rrrrrfx.exe 88 PID 5064 wrote to memory of 3508 5064 rrrrrfx.exe 88 PID 3508 wrote to memory of 2724 3508 dvjdd.exe 89 PID 3508 wrote to memory of 2724 3508 dvjdd.exe 89 PID 3508 wrote to memory of 2724 3508 dvjdd.exe 89 PID 2724 wrote to memory of 3788 2724 hbttnt.exe 90 PID 2724 wrote to memory of 3788 2724 hbttnt.exe 90 PID 2724 wrote to memory of 3788 2724 hbttnt.exe 90 PID 3788 wrote to memory of 2532 3788 frxrrrr.exe 91 PID 3788 wrote to memory of 2532 3788 frxrrrr.exe 91 PID 3788 wrote to memory of 2532 3788 frxrrrr.exe 91 PID 2532 wrote to memory of 3840 2532 jddvp.exe 92 PID 2532 wrote to memory of 3840 2532 jddvp.exe 92 PID 2532 wrote to memory of 3840 2532 jddvp.exe 92 PID 3840 wrote to memory of 3644 3840 ttnhhb.exe 93 PID 3840 wrote to memory of 3644 3840 ttnhhb.exe 93 PID 3840 wrote to memory of 3644 3840 ttnhhb.exe 93 PID 3644 wrote to memory of 4884 3644 dvdvp.exe 94 PID 3644 wrote to memory of 4884 3644 dvdvp.exe 94 PID 3644 wrote to memory of 4884 3644 dvdvp.exe 94 PID 4884 wrote to memory of 4840 4884 pdvvd.exe 95 PID 4884 wrote to memory of 4840 4884 pdvvd.exe 95 PID 4884 wrote to memory of 4840 4884 pdvvd.exe 95 PID 4840 wrote to memory of 4428 4840 xflflxr.exe 96 PID 4840 wrote to memory of 4428 4840 xflflxr.exe 96 PID 4840 wrote to memory of 4428 4840 xflflxr.exe 96 PID 4428 wrote to memory of 2900 4428 nhhhbh.exe 97 PID 4428 wrote to memory of 2900 4428 nhhhbh.exe 97 PID 4428 wrote to memory of 2900 4428 nhhhbh.exe 97 PID 2900 wrote to memory of 4580 2900 xflfrrl.exe 98 PID 2900 wrote to memory of 4580 2900 xflfrrl.exe 98 PID 2900 wrote to memory of 4580 2900 xflfrrl.exe 98 PID 4580 wrote to memory of 2240 4580 1xfxfxf.exe 99 PID 4580 wrote to memory of 2240 4580 1xfxfxf.exe 99 PID 4580 wrote to memory of 2240 4580 1xfxfxf.exe 99 PID 2240 wrote to memory of 3632 2240 nbhtnn.exe 100 PID 2240 wrote to memory of 3632 2240 nbhtnn.exe 100 PID 2240 wrote to memory of 3632 2240 nbhtnn.exe 100 PID 3632 wrote to memory of 1336 3632 vjpjd.exe 101 PID 3632 wrote to memory of 1336 3632 vjpjd.exe 101 PID 3632 wrote to memory of 1336 3632 vjpjd.exe 101 PID 1336 wrote to memory of 5012 1336 xllfxfx.exe 102 PID 1336 wrote to memory of 5012 1336 xllfxfx.exe 102 PID 1336 wrote to memory of 5012 1336 xllfxfx.exe 102 PID 5012 wrote to memory of 2756 5012 dpdpv.exe 103 PID 5012 wrote to memory of 2756 5012 dpdpv.exe 103 PID 5012 wrote to memory of 2756 5012 dpdpv.exe 103 PID 2756 wrote to memory of 2540 2756 3vjvj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\13c369cd307b8d6f182c7a7d35fe840e5482ac591eb79e41947a8c36b23d14bb.exe"C:\Users\Admin\AppData\Local\Temp\13c369cd307b8d6f182c7a7d35fe840e5482ac591eb79e41947a8c36b23d14bb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\rlxxffl.exec:\rlxxffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\vpvpp.exec:\vpvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\frffxxx.exec:\frffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\hhttnn.exec:\hhttnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\rrrrrfx.exec:\rrrrrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\dvjdd.exec:\dvjdd.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\hbttnt.exec:\hbttnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\frxrrrr.exec:\frxrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\jddvp.exec:\jddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ttnhhb.exec:\ttnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\dvdvp.exec:\dvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\pdvvd.exec:\pdvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\xflflxr.exec:\xflflxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\nhhhbh.exec:\nhhhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\xflfrrl.exec:\xflfrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\1xfxfxf.exec:\1xfxfxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\nbhtnn.exec:\nbhtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\vjpjd.exec:\vjpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\xllfxfx.exec:\xllfxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\dpdpv.exec:\dpdpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\3vjvj.exec:\3vjvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\thbtth.exec:\thbtth.exe23⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rxffxxx.exec:\rxffxxx.exe24⤵
- Executes dropped EXE
PID:3416 -
\??\c:\1hhbbh.exec:\1hhbbh.exe25⤵
- Executes dropped EXE
PID:1276 -
\??\c:\bbbnbn.exec:\bbbnbn.exe26⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5bbtnh.exec:\5bbtnh.exe27⤵
- Executes dropped EXE
PID:3868 -
\??\c:\rrxxfll.exec:\rrxxfll.exe28⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7bhhbb.exec:\7bhhbb.exe29⤵
- Executes dropped EXE
PID:4700 -
\??\c:\pjdvp.exec:\pjdvp.exe30⤵
- Executes dropped EXE
PID:3324 -
\??\c:\vjvpj.exec:\vjvpj.exe31⤵
- Executes dropped EXE
PID:4852 -
\??\c:\pjppj.exec:\pjppj.exe32⤵
- Executes dropped EXE
PID:440 -
\??\c:\hthbtt.exec:\hthbtt.exe33⤵
- Executes dropped EXE
PID:4612 -
\??\c:\3rrrlxr.exec:\3rrrlxr.exe34⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dppvd.exec:\dppvd.exe35⤵
- Executes dropped EXE
PID:4732 -
\??\c:\nbthth.exec:\nbthth.exe36⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9jpjp.exec:\9jpjp.exe37⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xrlfffx.exec:\xrlfffx.exe38⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hthbbb.exec:\hthbbb.exe39⤵
- Executes dropped EXE
PID:5024 -
\??\c:\5djdv.exec:\5djdv.exe40⤵
- Executes dropped EXE
PID:100 -
\??\c:\5rlfrrl.exec:\5rlfrrl.exe41⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rllfffx.exec:\rllfffx.exe42⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nttnhb.exec:\nttnhb.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jdppj.exec:\jdppj.exe44⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9llxfxl.exec:\9llxfxl.exe45⤵
- Executes dropped EXE
PID:4480 -
\??\c:\nnnbtb.exec:\nnnbtb.exe46⤵
- Executes dropped EXE
PID:212 -
\??\c:\tttnhh.exec:\tttnhh.exe47⤵
- Executes dropped EXE
PID:4588 -
\??\c:\dpvjv.exec:\dpvjv.exe48⤵
- Executes dropped EXE
PID:4456 -
\??\c:\1rlfllf.exec:\1rlfllf.exe49⤵
- Executes dropped EXE
PID:3244 -
\??\c:\btnhtn.exec:\btnhtn.exe50⤵
- Executes dropped EXE
PID:3000 -
\??\c:\htthtt.exec:\htthtt.exe51⤵PID:4540
-
\??\c:\pvjpv.exec:\pvjpv.exe52⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe53⤵
- Executes dropped EXE
PID:3504 -
\??\c:\tnhbnb.exec:\tnhbnb.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bttnnn.exec:\bttnnn.exe55⤵
- Executes dropped EXE
PID:1492 -
\??\c:\pdvjv.exec:\pdvjv.exe56⤵
- Executes dropped EXE
PID:1416 -
\??\c:\xfxlllf.exec:\xfxlllf.exe57⤵
- Executes dropped EXE
PID:4376 -
\??\c:\nnnhbb.exec:\nnnhbb.exe58⤵
- Executes dropped EXE
PID:4796 -
\??\c:\bthbtt.exec:\bthbtt.exe59⤵
- Executes dropped EXE
PID:464 -
\??\c:\jdjjd.exec:\jdjjd.exe60⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rffxlll.exec:\rffxlll.exe61⤵
- Executes dropped EXE
PID:4636 -
\??\c:\xrlfrrf.exec:\xrlfrrf.exe62⤵
- Executes dropped EXE
PID:3272 -
\??\c:\hnnhbn.exec:\hnnhbn.exe63⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jvvdd.exec:\jvvdd.exe64⤵
- Executes dropped EXE
PID:3976 -
\??\c:\jddpd.exec:\jddpd.exe65⤵
- Executes dropped EXE
PID:4008 -
\??\c:\xrxrflx.exec:\xrxrflx.exe66⤵
- Executes dropped EXE
PID:3936 -
\??\c:\tbhtnh.exec:\tbhtnh.exe67⤵PID:3644
-
\??\c:\pvvpj.exec:\pvvpj.exe68⤵PID:956
-
\??\c:\xrfrflr.exec:\xrfrflr.exe69⤵PID:3760
-
\??\c:\bntnhh.exec:\bntnhh.exe70⤵PID:3836
-
\??\c:\jvjpd.exec:\jvjpd.exe71⤵PID:220
-
\??\c:\5dvpj.exec:\5dvpj.exe72⤵PID:2456
-
\??\c:\frxxfrf.exec:\frxxfrf.exe73⤵PID:4108
-
\??\c:\bttnbt.exec:\bttnbt.exe74⤵PID:4932
-
\??\c:\vpvpp.exec:\vpvpp.exe75⤵PID:1428
-
\??\c:\ppvvd.exec:\ppvvd.exe76⤵PID:3544
-
\??\c:\lffffxx.exec:\lffffxx.exe77⤵PID:4092
-
\??\c:\1hbtth.exec:\1hbtth.exe78⤵PID:4824
-
\??\c:\1jjdp.exec:\1jjdp.exe79⤵PID:2144
-
\??\c:\ffffxxx.exec:\ffffxxx.exe80⤵PID:1052
-
\??\c:\nhhttn.exec:\nhhttn.exe81⤵PID:3280
-
\??\c:\5djdv.exec:\5djdv.exe82⤵PID:2888
-
\??\c:\jdpdv.exec:\jdpdv.exe83⤵PID:5096
-
\??\c:\fxxrffx.exec:\fxxrffx.exe84⤵PID:3416
-
\??\c:\hthhnn.exec:\hthhnn.exe85⤵PID:1300
-
\??\c:\pdpjj.exec:\pdpjj.exe86⤵PID:1900
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe87⤵PID:1896
-
\??\c:\hbhbtn.exec:\hbhbtn.exe88⤵PID:2168
-
\??\c:\tnnhbt.exec:\tnnhbt.exe89⤵PID:4696
-
\??\c:\dppjj.exec:\dppjj.exe90⤵PID:1716
-
\??\c:\rxlllll.exec:\rxlllll.exe91⤵PID:3684
-
\??\c:\bbnhbt.exec:\bbnhbt.exe92⤵PID:904
-
\??\c:\pjdvp.exec:\pjdvp.exe93⤵PID:4284
-
\??\c:\vdppp.exec:\vdppp.exe94⤵PID:1452
-
\??\c:\xlrfxrl.exec:\xlrfxrl.exe95⤵PID:1088
-
\??\c:\bttbbt.exec:\bttbbt.exe96⤵PID:4172
-
\??\c:\9vvvd.exec:\9vvvd.exe97⤵PID:4612
-
\??\c:\7fxxrll.exec:\7fxxrll.exe98⤵PID:320
-
\??\c:\bnnnnn.exec:\bnnnnn.exe99⤵PID:1800
-
\??\c:\nbhnhb.exec:\nbhnhb.exe100⤵PID:4032
-
\??\c:\vpvdv.exec:\vpvdv.exe101⤵PID:680
-
\??\c:\rffxllf.exec:\rffxllf.exe102⤵PID:2984
-
\??\c:\hhnhbb.exec:\hhnhbb.exe103⤵PID:3448
-
\??\c:\3bbtnn.exec:\3bbtnn.exe104⤵PID:2668
-
\??\c:\vjpjd.exec:\vjpjd.exe105⤵PID:3952
-
\??\c:\vvppd.exec:\vvppd.exe106⤵PID:4020
-
\??\c:\rrrffxf.exec:\rrrffxf.exe107⤵PID:3664
-
\??\c:\9nnhbb.exec:\9nnhbb.exe108⤵PID:4748
-
\??\c:\dvpjd.exec:\dvpjd.exe109⤵PID:2052
-
\??\c:\lrrlrll.exec:\lrrlrll.exe110⤵PID:1816
-
\??\c:\1nnbtn.exec:\1nnbtn.exe111⤵PID:888
-
\??\c:\9pjvj.exec:\9pjvj.exe112⤵PID:5076
-
\??\c:\xlrlfxf.exec:\xlrlfxf.exe113⤵PID:728
-
\??\c:\btnhbt.exec:\btnhbt.exe114⤵PID:4528
-
\??\c:\3bthbt.exec:\3bthbt.exe115⤵PID:1504
-
\??\c:\djjvp.exec:\djjvp.exe116⤵PID:4944
-
\??\c:\3xfrfxf.exec:\3xfrfxf.exe117⤵PID:1412
-
\??\c:\btbhtb.exec:\btbhtb.exe118⤵PID:1248
-
\??\c:\ddppv.exec:\ddppv.exe119⤵PID:5104
-
\??\c:\rxrxrxx.exec:\rxrxrxx.exe120⤵PID:4392
-
\??\c:\3bhbtt.exec:\3bhbtt.exe121⤵PID:4348
-
\??\c:\btnbnh.exec:\btnbnh.exe122⤵PID:3712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-