Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 01:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe
Resource
win7-20241023-en
7 signatures
150 seconds
General
-
Target
90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe
-
Size
453KB
-
MD5
545093a51fee83dc08841c4c33813e8c
-
SHA1
4996b0649cb4047506c27b53557d4ff60af7f7cb
-
SHA256
90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc
-
SHA512
ca6a1a78e67df4bbbc7e279496477e6b9ed540ef93568a9d28aaba6f96f6abd0e20afd69caad120775621b9a7dbb73b74f6d30f37fda7313bd0426c0134bb3d7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN4:q7Tc2NYHUrAwfMp3CDN4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1744-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-824-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/236-967-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3756 lllllll.exe 632 thnntt.exe 5032 9dddv.exe 1848 xrxrllf.exe 4332 vdjdd.exe 1604 tntnnn.exe 3152 dvjjp.exe 2732 7ddvp.exe 4320 rllfffx.exe 2008 jjppj.exe 2320 jddpj.exe 1356 lxrfxxf.exe 1948 nttnnn.exe 3500 ddvvv.exe 3544 fxfxrff.exe 1224 dvvpp.exe 2592 rrxllfl.exe 4892 7djjp.exe 3320 tthbhh.exe 2888 tntttb.exe 2292 jjjjd.exe 1472 rxfxxxr.exe 2616 pjvpp.exe 1952 rxfxxxf.exe 832 lrrxrlr.exe 1716 bnnnnh.exe 4660 tthbtt.exe 2324 fflfxxx.exe 4040 nbnnnn.exe 4980 bhnnnh.exe 2132 7lrllfx.exe 2976 xfffxxx.exe 1672 7dddd.exe 3604 3xxllxx.exe 1692 nntnhh.exe 2252 jdjdv.exe 1508 hnbtbt.exe 3940 9hbtnt.exe 1956 djdjd.exe 2944 lffxxxx.exe 2960 ppjdj.exe 1492 fflffll.exe 1684 llrxxfx.exe 2828 jpddd.exe 4312 fxxlfxx.exe 3976 bhnbhb.exe 1744 vvvpj.exe 1960 lfrllll.exe 4064 lxxrlll.exe 2656 3pvpp.exe 3996 vvvdj.exe 5032 tbnntb.exe 3692 vvdvv.exe 4344 xfffffx.exe 2004 ffrlffx.exe 3408 bhhthn.exe 3088 9vddv.exe 2732 frxxxff.exe 2296 nnnnhb.exe 4808 bbbnhh.exe 4840 jvjjj.exe 2556 llrffxx.exe 4084 bhhhbh.exe 112 xxfxrrl.exe -
resource yara_rule behavioral2/memory/1744-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-879-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 3756 1744 90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe 84 PID 1744 wrote to memory of 3756 1744 90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe 84 PID 1744 wrote to memory of 3756 1744 90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe 84 PID 3756 wrote to memory of 632 3756 lllllll.exe 85 PID 3756 wrote to memory of 632 3756 lllllll.exe 85 PID 3756 wrote to memory of 632 3756 lllllll.exe 85 PID 632 wrote to memory of 5032 632 thnntt.exe 86 PID 632 wrote to memory of 5032 632 thnntt.exe 86 PID 632 wrote to memory of 5032 632 thnntt.exe 86 PID 5032 wrote to memory of 1848 5032 9dddv.exe 87 PID 5032 wrote to memory of 1848 5032 9dddv.exe 87 PID 5032 wrote to memory of 1848 5032 9dddv.exe 87 PID 1848 wrote to memory of 4332 1848 xrxrllf.exe 88 PID 1848 wrote to memory of 4332 1848 xrxrllf.exe 88 PID 1848 wrote to memory of 4332 1848 xrxrllf.exe 88 PID 4332 wrote to memory of 1604 4332 vdjdd.exe 89 PID 4332 wrote to memory of 1604 4332 vdjdd.exe 89 PID 4332 wrote to memory of 1604 4332 vdjdd.exe 89 PID 1604 wrote to memory of 3152 1604 tntnnn.exe 90 PID 1604 wrote to memory of 3152 1604 tntnnn.exe 90 PID 1604 wrote to memory of 3152 1604 tntnnn.exe 90 PID 3152 wrote to memory of 2732 3152 dvjjp.exe 91 PID 3152 wrote to memory of 2732 3152 dvjjp.exe 91 PID 3152 wrote to memory of 2732 3152 dvjjp.exe 91 PID 2732 wrote to memory of 4320 2732 7ddvp.exe 92 PID 2732 wrote to memory of 4320 2732 7ddvp.exe 92 PID 2732 wrote to memory of 4320 2732 7ddvp.exe 92 PID 4320 wrote to memory of 2008 4320 rllfffx.exe 93 PID 4320 wrote to memory of 2008 4320 rllfffx.exe 93 PID 4320 wrote to memory of 2008 4320 rllfffx.exe 93 PID 2008 wrote to memory of 2320 2008 jjppj.exe 94 PID 2008 wrote to memory of 2320 2008 jjppj.exe 94 PID 2008 wrote to memory of 2320 2008 jjppj.exe 94 PID 2320 wrote to memory of 1356 2320 jddpj.exe 95 PID 2320 wrote to memory of 1356 2320 jddpj.exe 95 PID 2320 wrote to memory of 1356 2320 jddpj.exe 95 PID 1356 wrote to memory of 1948 1356 lxrfxxf.exe 96 PID 1356 wrote to memory of 1948 1356 lxrfxxf.exe 96 PID 1356 wrote to memory of 1948 1356 lxrfxxf.exe 96 PID 1948 wrote to memory of 3500 1948 nttnnn.exe 97 PID 1948 wrote to memory of 3500 1948 nttnnn.exe 97 PID 1948 wrote to memory of 3500 1948 nttnnn.exe 97 PID 3500 wrote to memory of 3544 3500 ddvvv.exe 98 PID 3500 wrote to memory of 3544 3500 ddvvv.exe 98 PID 3500 wrote to memory of 3544 3500 ddvvv.exe 98 PID 3544 wrote to memory of 1224 3544 fxfxrff.exe 99 PID 3544 wrote to memory of 1224 3544 fxfxrff.exe 99 PID 3544 wrote to memory of 1224 3544 fxfxrff.exe 99 PID 1224 wrote to memory of 2592 1224 dvvpp.exe 100 PID 1224 wrote to memory of 2592 1224 dvvpp.exe 100 PID 1224 wrote to memory of 2592 1224 dvvpp.exe 100 PID 2592 wrote to memory of 4892 2592 rrxllfl.exe 101 PID 2592 wrote to memory of 4892 2592 rrxllfl.exe 101 PID 2592 wrote to memory of 4892 2592 rrxllfl.exe 101 PID 4892 wrote to memory of 3320 4892 7djjp.exe 102 PID 4892 wrote to memory of 3320 4892 7djjp.exe 102 PID 4892 wrote to memory of 3320 4892 7djjp.exe 102 PID 3320 wrote to memory of 2888 3320 tthbhh.exe 103 PID 3320 wrote to memory of 2888 3320 tthbhh.exe 103 PID 3320 wrote to memory of 2888 3320 tthbhh.exe 103 PID 2888 wrote to memory of 2292 2888 tntttb.exe 104 PID 2888 wrote to memory of 2292 2888 tntttb.exe 104 PID 2888 wrote to memory of 2292 2888 tntttb.exe 104 PID 2292 wrote to memory of 1472 2292 jjjjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe"C:\Users\Admin\AppData\Local\Temp\90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\lllllll.exec:\lllllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\thnntt.exec:\thnntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\9dddv.exec:\9dddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\xrxrllf.exec:\xrxrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\vdjdd.exec:\vdjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\tntnnn.exec:\tntnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\dvjjp.exec:\dvjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\7ddvp.exec:\7ddvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\rllfffx.exec:\rllfffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\jjppj.exec:\jjppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\jddpj.exec:\jddpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\lxrfxxf.exec:\lxrfxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\nttnnn.exec:\nttnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\ddvvv.exec:\ddvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\fxfxrff.exec:\fxfxrff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\dvvpp.exec:\dvvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\rrxllfl.exec:\rrxllfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\7djjp.exec:\7djjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\tthbhh.exec:\tthbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\tntttb.exec:\tntttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\jjjjd.exec:\jjjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe23⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pjvpp.exec:\pjvpp.exe24⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rxfxxxf.exec:\rxfxxxf.exe25⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lrrxrlr.exec:\lrrxrlr.exe26⤵
- Executes dropped EXE
PID:832 -
\??\c:\bnnnnh.exec:\bnnnnh.exe27⤵
- Executes dropped EXE
PID:1716 -
\??\c:\tthbtt.exec:\tthbtt.exe28⤵
- Executes dropped EXE
PID:4660 -
\??\c:\fflfxxx.exec:\fflfxxx.exe29⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nbnnnn.exec:\nbnnnn.exe30⤵
- Executes dropped EXE
PID:4040 -
\??\c:\bhnnnh.exec:\bhnnnh.exe31⤵
- Executes dropped EXE
PID:4980 -
\??\c:\7lrllfx.exec:\7lrllfx.exe32⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xfffxxx.exec:\xfffxxx.exe33⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7dddd.exec:\7dddd.exe34⤵
- Executes dropped EXE
PID:1672 -
\??\c:\3xxllxx.exec:\3xxllxx.exe35⤵
- Executes dropped EXE
PID:3604 -
\??\c:\nntnhh.exec:\nntnhh.exe36⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jdjdv.exec:\jdjdv.exe37⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hnbtbt.exec:\hnbtbt.exe38⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9hbtnt.exec:\9hbtnt.exe39⤵
- Executes dropped EXE
PID:3940 -
\??\c:\djdjd.exec:\djdjd.exe40⤵
- Executes dropped EXE
PID:1956 -
\??\c:\lffxxxx.exec:\lffxxxx.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ppjdj.exec:\ppjdj.exe42⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fflffll.exec:\fflffll.exe43⤵
- Executes dropped EXE
PID:1492 -
\??\c:\llrxxfx.exec:\llrxxfx.exe44⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jpddd.exec:\jpddd.exe45⤵
- Executes dropped EXE
PID:2828 -
\??\c:\fxxlfxx.exec:\fxxlfxx.exe46⤵
- Executes dropped EXE
PID:4312 -
\??\c:\bhnbhb.exec:\bhnbhb.exe47⤵
- Executes dropped EXE
PID:3976 -
\??\c:\vvvpj.exec:\vvvpj.exe48⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lfrllll.exec:\lfrllll.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lxxrlll.exec:\lxxrlll.exe50⤵
- Executes dropped EXE
PID:4064 -
\??\c:\3pvpp.exec:\3pvpp.exe51⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vvvdj.exec:\vvvdj.exe52⤵
- Executes dropped EXE
PID:3996 -
\??\c:\tbnntb.exec:\tbnntb.exe53⤵
- Executes dropped EXE
PID:5032 -
\??\c:\vvdvv.exec:\vvdvv.exe54⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xfffffx.exec:\xfffffx.exe55⤵
- Executes dropped EXE
PID:4344 -
\??\c:\ffrlffx.exec:\ffrlffx.exe56⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bhhthn.exec:\bhhthn.exe57⤵
- Executes dropped EXE
PID:3408 -
\??\c:\9vddv.exec:\9vddv.exe58⤵
- Executes dropped EXE
PID:3088 -
\??\c:\frxxxff.exec:\frxxxff.exe59⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nnnnhb.exec:\nnnnhb.exe60⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bbbnhh.exec:\bbbnhh.exe61⤵
- Executes dropped EXE
PID:4808 -
\??\c:\jvjjj.exec:\jvjjj.exe62⤵
- Executes dropped EXE
PID:4840 -
\??\c:\llrffxx.exec:\llrffxx.exe63⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bhhhbh.exec:\bhhhbh.exe64⤵
- Executes dropped EXE
PID:4084 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe65⤵
- Executes dropped EXE
PID:112 -
\??\c:\nbbhhh.exec:\nbbhhh.exe66⤵PID:1356
-
\??\c:\jpvdv.exec:\jpvdv.exe67⤵PID:3024
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe68⤵PID:2280
-
\??\c:\htnhhb.exec:\htnhhb.exe69⤵PID:4780
-
\??\c:\vpvvp.exec:\vpvvp.exe70⤵PID:3292
-
\??\c:\llfrlfl.exec:\llfrlfl.exe71⤵PID:4172
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe72⤵PID:2592
-
\??\c:\tttbtb.exec:\tttbtb.exe73⤵PID:1432
-
\??\c:\jpjjd.exec:\jpjjd.exe74⤵PID:2464
-
\??\c:\tntnnn.exec:\tntnnn.exe75⤵PID:2888
-
\??\c:\jpdjj.exec:\jpdjj.exe76⤵PID:3564
-
\??\c:\rrrllll.exec:\rrrllll.exe77⤵PID:2292
-
\??\c:\nttnnh.exec:\nttnnh.exe78⤵PID:4336
-
\??\c:\5dvpd.exec:\5dvpd.exe79⤵PID:1500
-
\??\c:\7llxrrx.exec:\7llxrrx.exe80⤵PID:4516
-
\??\c:\hbhbtb.exec:\hbhbtb.exe81⤵PID:2840
-
\??\c:\hhtnnt.exec:\hhtnnt.exe82⤵PID:1644
-
\??\c:\vpvjj.exec:\vpvjj.exe83⤵PID:3588
-
\??\c:\5xfxxfx.exec:\5xfxxfx.exe84⤵PID:1016
-
\??\c:\nnhhhn.exec:\nnhhhn.exe85⤵PID:3812
-
\??\c:\tbhbbb.exec:\tbhbbb.exe86⤵PID:220
-
\??\c:\1vvpj.exec:\1vvpj.exe87⤵
- System Location Discovery: System Language Discovery
PID:4628 -
\??\c:\fxlrrfx.exec:\fxlrrfx.exe88⤵PID:4040
-
\??\c:\bhtntt.exec:\bhtntt.exe89⤵
- System Location Discovery: System Language Discovery
PID:1036 -
\??\c:\nhbnhh.exec:\nhbnhh.exe90⤵PID:1724
-
\??\c:\dpjdv.exec:\dpjdv.exe91⤵PID:4916
-
\??\c:\fffffxf.exec:\fffffxf.exe92⤵PID:1924
-
\??\c:\ntnhhh.exec:\ntnhhh.exe93⤵PID:1188
-
\??\c:\vpvvv.exec:\vpvvv.exe94⤵PID:2688
-
\??\c:\3rfxlrl.exec:\3rfxlrl.exe95⤵PID:1692
-
\??\c:\9btnnt.exec:\9btnnt.exe96⤵PID:2252
-
\??\c:\dddvv.exec:\dddvv.exe97⤵PID:1508
-
\??\c:\ffxflrl.exec:\ffxflrl.exe98⤵PID:3288
-
\??\c:\5tthbb.exec:\5tthbb.exe99⤵PID:1988
-
\??\c:\vjdvd.exec:\vjdvd.exe100⤵PID:4952
-
\??\c:\xxxxrrx.exec:\xxxxrrx.exe101⤵PID:1564
-
\??\c:\hnbbhh.exec:\hnbbhh.exe102⤵PID:224
-
\??\c:\7nnnhn.exec:\7nnnhn.exe103⤵PID:2204
-
\??\c:\vjjjj.exec:\vjjjj.exe104⤵PID:2932
-
\??\c:\rlxxrxx.exec:\rlxxrxx.exe105⤵PID:4196
-
\??\c:\bbhbbb.exec:\bbhbbb.exe106⤵PID:1820
-
\??\c:\nntnhh.exec:\nntnhh.exe107⤵PID:3756
-
\??\c:\jjppv.exec:\jjppv.exe108⤵PID:1896
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe109⤵PID:1040
-
\??\c:\hbbtnb.exec:\hbbtnb.exe110⤵PID:4244
-
\??\c:\ddvpp.exec:\ddvpp.exe111⤵PID:1856
-
\??\c:\3rflxff.exec:\3rflxff.exe112⤵PID:1136
-
\??\c:\llxrrrr.exec:\llxrrrr.exe113⤵PID:4884
-
\??\c:\hhbbhn.exec:\hhbbhn.exe114⤵PID:4552
-
\??\c:\9jjjj.exec:\9jjjj.exe115⤵PID:3736
-
\??\c:\lxxxxff.exec:\lxxxxff.exe116⤵PID:3548
-
\??\c:\hbhbbb.exec:\hbhbbb.exe117⤵PID:4508
-
\??\c:\ddvpp.exec:\ddvpp.exe118⤵PID:3408
-
\??\c:\vjvpv.exec:\vjvpv.exe119⤵PID:4332
-
\??\c:\ffllffx.exec:\ffllffx.exe120⤵PID:2364
-
\??\c:\bbhtnb.exec:\bbhtnb.exe121⤵PID:3732
-
\??\c:\vjpjj.exec:\vjpjj.exe122⤵PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-