Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 01:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe
-
Size
456KB
-
MD5
7c5ae6140ef8bdf10df5bff29e5eaa3d
-
SHA1
5e67f88f4c47fd7f230a393a5ede8bbbdc0b5e6a
-
SHA256
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683
-
SHA512
d9c85c3aa5bf2c03b0eda75ef9fb2cf1449304c6023b9e24c1e77b1afcc95c7786136ad92a1ece457c855da0accf1a5a093efc4bccfd52a7396f90154f75e27e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4524-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-786-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-916-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-977-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-1102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-1338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4996 xfxrlfx.exe 2724 bhhhbb.exe 1032 3vddj.exe 3068 frxrlfx.exe 4064 pvpjd.exe 1596 1jddp.exe 3496 xlffrff.exe 1708 jpjpj.exe 1200 vjpdv.exe 4836 lrfrlxr.exe 2792 jddvp.exe 1488 rrxrlfx.exe 1132 bnnhhb.exe 2096 5ddvp.exe 4964 5lrxllf.exe 1876 rlrllrl.exe 4992 ttnhbt.exe 1176 jpvvv.exe 4936 llxxffl.exe 4708 bhnhbt.exe 3976 pdjvp.exe 3940 bhtnhb.exe 1536 dpddv.exe 1172 pddjd.exe 1804 pjjvv.exe 3988 fxfllfx.exe 4216 pvdvp.exe 4900 xlrfrlx.exe 3176 vvvvp.exe 4256 lxlfrrl.exe 5004 pjppj.exe 916 3ddvj.exe 3372 bttnbb.exe 3872 vjpjd.exe 1308 fflfxxx.exe 5092 tnnbbn.exe 372 pjddv.exe 3652 3jppj.exe 2464 frfxllf.exe 3368 tnhbht.exe 2472 5dvpj.exe 3308 xfrrxxr.exe 404 5ttttt.exe 4276 jppjd.exe 4464 fllfxxr.exe 2788 tnthbb.exe 2504 1vppj.exe 2352 9ffxrxr.exe 2012 1ffxrrl.exe 3428 9ttnhh.exe 1188 ddppd.exe 3612 3xrlllf.exe 3464 tthhhh.exe 3504 7hhtnn.exe 4212 dpdvj.exe 4796 lrfxrrr.exe 2892 xrrrllf.exe 1496 bhhhhh.exe 4388 7vppd.exe 4920 fxffffl.exe 1952 nhtbbh.exe 1088 nhhbth.exe 640 dvjdv.exe 512 flrffff.exe -
resource yara_rule behavioral2/memory/4524-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-977-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 4996 4524 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 82 PID 4524 wrote to memory of 4996 4524 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 82 PID 4524 wrote to memory of 4996 4524 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 82 PID 4996 wrote to memory of 2724 4996 xfxrlfx.exe 83 PID 4996 wrote to memory of 2724 4996 xfxrlfx.exe 83 PID 4996 wrote to memory of 2724 4996 xfxrlfx.exe 83 PID 2724 wrote to memory of 1032 2724 bhhhbb.exe 84 PID 2724 wrote to memory of 1032 2724 bhhhbb.exe 84 PID 2724 wrote to memory of 1032 2724 bhhhbb.exe 84 PID 1032 wrote to memory of 3068 1032 3vddj.exe 85 PID 1032 wrote to memory of 3068 1032 3vddj.exe 85 PID 1032 wrote to memory of 3068 1032 3vddj.exe 85 PID 3068 wrote to memory of 4064 3068 frxrlfx.exe 86 PID 3068 wrote to memory of 4064 3068 frxrlfx.exe 86 PID 3068 wrote to memory of 4064 3068 frxrlfx.exe 86 PID 4064 wrote to memory of 1596 4064 pvpjd.exe 87 PID 4064 wrote to memory of 1596 4064 pvpjd.exe 87 PID 4064 wrote to memory of 1596 4064 pvpjd.exe 87 PID 1596 wrote to memory of 3496 1596 1jddp.exe 88 PID 1596 wrote to memory of 3496 1596 1jddp.exe 88 PID 1596 wrote to memory of 3496 1596 1jddp.exe 88 PID 3496 wrote to memory of 1708 3496 xlffrff.exe 89 PID 3496 wrote to memory of 1708 3496 xlffrff.exe 89 PID 3496 wrote to memory of 1708 3496 xlffrff.exe 89 PID 1708 wrote to memory of 1200 1708 jpjpj.exe 90 PID 1708 wrote to memory of 1200 1708 jpjpj.exe 90 PID 1708 wrote to memory of 1200 1708 jpjpj.exe 90 PID 1200 wrote to memory of 4836 1200 vjpdv.exe 91 PID 1200 wrote to memory of 4836 1200 vjpdv.exe 91 PID 1200 wrote to memory of 4836 1200 vjpdv.exe 91 PID 4836 wrote to memory of 2792 4836 lrfrlxr.exe 92 PID 4836 wrote to memory of 2792 4836 lrfrlxr.exe 92 PID 4836 wrote to memory of 2792 4836 lrfrlxr.exe 92 PID 2792 wrote to memory of 1488 2792 jddvp.exe 93 PID 2792 wrote to memory of 1488 2792 jddvp.exe 93 PID 2792 wrote to memory of 1488 2792 jddvp.exe 93 PID 1488 wrote to memory of 1132 1488 rrxrlfx.exe 94 PID 1488 wrote to memory of 1132 1488 rrxrlfx.exe 94 PID 1488 wrote to memory of 1132 1488 rrxrlfx.exe 94 PID 1132 wrote to memory of 2096 1132 bnnhhb.exe 95 PID 1132 wrote to memory of 2096 1132 bnnhhb.exe 95 PID 1132 wrote to memory of 2096 1132 bnnhhb.exe 95 PID 2096 wrote to memory of 4964 2096 5ddvp.exe 96 PID 2096 wrote to memory of 4964 2096 5ddvp.exe 96 PID 2096 wrote to memory of 4964 2096 5ddvp.exe 96 PID 4964 wrote to memory of 1876 4964 5lrxllf.exe 97 PID 4964 wrote to memory of 1876 4964 5lrxllf.exe 97 PID 4964 wrote to memory of 1876 4964 5lrxllf.exe 97 PID 1876 wrote to memory of 4992 1876 rlrllrl.exe 98 PID 1876 wrote to memory of 4992 1876 rlrllrl.exe 98 PID 1876 wrote to memory of 4992 1876 rlrllrl.exe 98 PID 4992 wrote to memory of 1176 4992 ttnhbt.exe 99 PID 4992 wrote to memory of 1176 4992 ttnhbt.exe 99 PID 4992 wrote to memory of 1176 4992 ttnhbt.exe 99 PID 1176 wrote to memory of 4936 1176 jpvvv.exe 100 PID 1176 wrote to memory of 4936 1176 jpvvv.exe 100 PID 1176 wrote to memory of 4936 1176 jpvvv.exe 100 PID 4936 wrote to memory of 4708 4936 llxxffl.exe 101 PID 4936 wrote to memory of 4708 4936 llxxffl.exe 101 PID 4936 wrote to memory of 4708 4936 llxxffl.exe 101 PID 4708 wrote to memory of 3976 4708 bhnhbt.exe 102 PID 4708 wrote to memory of 3976 4708 bhnhbt.exe 102 PID 4708 wrote to memory of 3976 4708 bhnhbt.exe 102 PID 3976 wrote to memory of 3940 3976 pdjvp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe"C:\Users\Admin\AppData\Local\Temp\84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\bhhhbb.exec:\bhhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\3vddj.exec:\3vddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\frxrlfx.exec:\frxrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\pvpjd.exec:\pvpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\1jddp.exec:\1jddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\xlffrff.exec:\xlffrff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\jpjpj.exec:\jpjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\vjpdv.exec:\vjpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\lrfrlxr.exec:\lrfrlxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\jddvp.exec:\jddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\bnnhhb.exec:\bnnhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\5ddvp.exec:\5ddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\5lrxllf.exec:\5lrxllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\rlrllrl.exec:\rlrllrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\ttnhbt.exec:\ttnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\jpvvv.exec:\jpvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\llxxffl.exec:\llxxffl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\bhnhbt.exec:\bhnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\pdjvp.exec:\pdjvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\bhtnhb.exec:\bhtnhb.exe23⤵
- Executes dropped EXE
PID:3940 -
\??\c:\dpddv.exec:\dpddv.exe24⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pddjd.exec:\pddjd.exe25⤵
- Executes dropped EXE
PID:1172 -
\??\c:\pjjvv.exec:\pjjvv.exe26⤵
- Executes dropped EXE
PID:1804 -
\??\c:\fxfllfx.exec:\fxfllfx.exe27⤵
- Executes dropped EXE
PID:3988 -
\??\c:\pvdvp.exec:\pvdvp.exe28⤵
- Executes dropped EXE
PID:4216 -
\??\c:\xlrfrlx.exec:\xlrfrlx.exe29⤵
- Executes dropped EXE
PID:4900 -
\??\c:\vvvvp.exec:\vvvvp.exe30⤵
- Executes dropped EXE
PID:3176 -
\??\c:\lxlfrrl.exec:\lxlfrrl.exe31⤵
- Executes dropped EXE
PID:4256 -
\??\c:\pjppj.exec:\pjppj.exe32⤵
- Executes dropped EXE
PID:5004 -
\??\c:\3ddvj.exec:\3ddvj.exe33⤵
- Executes dropped EXE
PID:916 -
\??\c:\bttnbb.exec:\bttnbb.exe34⤵
- Executes dropped EXE
PID:3372 -
\??\c:\vjpjd.exec:\vjpjd.exe35⤵
- Executes dropped EXE
PID:3872 -
\??\c:\fflfxxx.exec:\fflfxxx.exe36⤵
- Executes dropped EXE
PID:1308 -
\??\c:\tnnbbn.exec:\tnnbbn.exe37⤵
- Executes dropped EXE
PID:5092 -
\??\c:\pjddv.exec:\pjddv.exe38⤵
- Executes dropped EXE
PID:372 -
\??\c:\3jppj.exec:\3jppj.exe39⤵
- Executes dropped EXE
PID:3652 -
\??\c:\frfxllf.exec:\frfxllf.exe40⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tnhbht.exec:\tnhbht.exe41⤵
- Executes dropped EXE
PID:3368 -
\??\c:\5dvpj.exec:\5dvpj.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xfrrxxr.exec:\xfrrxxr.exe43⤵
- Executes dropped EXE
PID:3308 -
\??\c:\5ttttt.exec:\5ttttt.exe44⤵
- Executes dropped EXE
PID:404 -
\??\c:\jppjd.exec:\jppjd.exe45⤵
- Executes dropped EXE
PID:4276 -
\??\c:\fllfxxr.exec:\fllfxxr.exe46⤵
- Executes dropped EXE
PID:4464 -
\??\c:\tnthbb.exec:\tnthbb.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788 -
\??\c:\1vppj.exec:\1vppj.exe48⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9ffxrxr.exec:\9ffxrxr.exe49⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1ffxrrl.exec:\1ffxrrl.exe50⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9ttnhh.exec:\9ttnhh.exe51⤵
- Executes dropped EXE
PID:3428 -
\??\c:\ddppd.exec:\ddppd.exe52⤵
- Executes dropped EXE
PID:1188 -
\??\c:\3xrlllf.exec:\3xrlllf.exe53⤵
- Executes dropped EXE
PID:3612 -
\??\c:\tthhhh.exec:\tthhhh.exe54⤵
- Executes dropped EXE
PID:3464 -
\??\c:\7hhtnn.exec:\7hhtnn.exe55⤵
- Executes dropped EXE
PID:3504 -
\??\c:\dpdvj.exec:\dpdvj.exe56⤵
- Executes dropped EXE
PID:4212 -
\??\c:\lrfxrrr.exec:\lrfxrrr.exe57⤵
- Executes dropped EXE
PID:4796 -
\??\c:\xrrrllf.exec:\xrrrllf.exe58⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bhhhhh.exec:\bhhhhh.exe59⤵
- Executes dropped EXE
PID:1496 -
\??\c:\7vppd.exec:\7vppd.exe60⤵
- Executes dropped EXE
PID:4388 -
\??\c:\fxffffl.exec:\fxffffl.exe61⤵
- Executes dropped EXE
PID:4920 -
\??\c:\nhtbbh.exec:\nhtbbh.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\nhhbth.exec:\nhhbth.exe63⤵
- Executes dropped EXE
PID:1088 -
\??\c:\dvjdv.exec:\dvjdv.exe64⤵
- Executes dropped EXE
PID:640 -
\??\c:\flrffff.exec:\flrffff.exe65⤵
- Executes dropped EXE
PID:512 -
\??\c:\ntbbtt.exec:\ntbbtt.exe66⤵PID:2696
-
\??\c:\9btnhh.exec:\9btnhh.exe67⤵PID:4164
-
\??\c:\vdjjv.exec:\vdjjv.exe68⤵PID:3432
-
\??\c:\frxrfff.exec:\frxrfff.exe69⤵PID:1444
-
\??\c:\htnttt.exec:\htnttt.exe70⤵PID:2288
-
\??\c:\jpvvd.exec:\jpvvd.exe71⤵PID:2036
-
\??\c:\5pjdv.exec:\5pjdv.exe72⤵PID:3164
-
\??\c:\lfrllrr.exec:\lfrllrr.exe73⤵PID:2392
-
\??\c:\ttbntt.exec:\ttbntt.exe74⤵PID:1116
-
\??\c:\vvvpd.exec:\vvvpd.exe75⤵PID:3880
-
\??\c:\fxrlrrf.exec:\fxrlrrf.exe76⤵PID:3080
-
\??\c:\5llfxxr.exec:\5llfxxr.exe77⤵PID:4288
-
\??\c:\1btnhh.exec:\1btnhh.exe78⤵PID:4892
-
\??\c:\9vddv.exec:\9vddv.exe79⤵PID:4672
-
\??\c:\rfrlrrr.exec:\rfrlrrr.exe80⤵PID:2708
-
\??\c:\bhbtnt.exec:\bhbtnt.exe81⤵PID:2020
-
\??\c:\jjvpd.exec:\jjvpd.exe82⤵PID:2112
-
\??\c:\djpdv.exec:\djpdv.exe83⤵PID:4760
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe84⤵PID:1724
-
\??\c:\bhtttn.exec:\bhtttn.exe85⤵PID:1572
-
\??\c:\jjvjd.exec:\jjvjd.exe86⤵PID:4088
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe87⤵PID:2752
-
\??\c:\3fllffr.exec:\3fllffr.exe88⤵PID:3212
-
\??\c:\nthbhb.exec:\nthbhb.exe89⤵PID:3172
-
\??\c:\vjvvj.exec:\vjvvj.exe90⤵PID:4588
-
\??\c:\rrrrlll.exec:\rrrrlll.exe91⤵PID:1912
-
\??\c:\tntnnt.exec:\tntnnt.exe92⤵PID:1532
-
\??\c:\pdpjd.exec:\pdpjd.exe93⤵PID:1304
-
\??\c:\ppvpj.exec:\ppvpj.exe94⤵PID:540
-
\??\c:\rrxrrll.exec:\rrxrrll.exe95⤵PID:1620
-
\??\c:\thnnhn.exec:\thnnhn.exe96⤵PID:4240
-
\??\c:\bbnhnn.exec:\bbnhnn.exe97⤵PID:744
-
\??\c:\1jjdp.exec:\1jjdp.exe98⤵PID:3292
-
\??\c:\3rfxxxf.exec:\3rfxxxf.exe99⤵PID:3368
-
\??\c:\thnhbt.exec:\thnhbt.exe100⤵PID:2460
-
\??\c:\bhtbbn.exec:\bhtbbn.exe101⤵PID:4284
-
\??\c:\7pppd.exec:\7pppd.exe102⤵PID:4348
-
\??\c:\lxlfrxx.exec:\lxlfrxx.exe103⤵PID:4500
-
\??\c:\bbbbtn.exec:\bbbbtn.exe104⤵PID:400
-
\??\c:\ppvpd.exec:\ppvpd.exe105⤵PID:4464
-
\??\c:\7pdjv.exec:\7pdjv.exe106⤵PID:2564
-
\??\c:\lxxrfff.exec:\lxxrfff.exe107⤵PID:3500
-
\??\c:\tntnbb.exec:\tntnbb.exe108⤵PID:2440
-
\??\c:\vvjpv.exec:\vvjpv.exe109⤵PID:4688
-
\??\c:\jjjdv.exec:\jjjdv.exe110⤵PID:4504
-
\??\c:\btbbbb.exec:\btbbbb.exe111⤵PID:4404
-
\??\c:\vddvj.exec:\vddvj.exe112⤵PID:3252
-
\??\c:\3jppp.exec:\3jppp.exe113⤵PID:3608
-
\??\c:\fxxrllf.exec:\fxxrllf.exe114⤵PID:1596
-
\??\c:\5tbbhh.exec:\5tbbhh.exe115⤵PID:2228
-
\??\c:\nbnnhh.exec:\nbnnhh.exe116⤵PID:408
-
\??\c:\jdppp.exec:\jdppp.exe117⤵PID:2976
-
\??\c:\xrfxfll.exec:\xrfxfll.exe118⤵
- System Location Discovery: System Language Discovery
PID:2364 -
\??\c:\7hhhnn.exec:\7hhhnn.exe119⤵PID:1008
-
\??\c:\1ddjj.exec:\1ddjj.exe120⤵PID:1680
-
\??\c:\lxfxrfx.exec:\lxfxrfx.exe121⤵PID:1920
-
\??\c:\rrrrrlf.exec:\rrrrrlf.exe122⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-