Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe
-
Size
455KB
-
MD5
c928735fd08144078f102f7c0cc8ebdf
-
SHA1
dbc899bf0def03fa9b6a4f0b45601b5e48130ca0
-
SHA256
d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7
-
SHA512
56e63161e29de19aef8ea028c4dc6354cc76202d3d32a1d7b19f719abfbc3e1bbf16d38c9f2c6d46fde584711c151b78555abfdeff65118fc97c10bfc7092c4c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4300-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-786-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-913-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-1040-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-1059-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-1138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 428 thtnnn.exe 3540 fxllflr.exe 1792 djpjd.exe 208 3rfxrlf.exe 3004 ntnnhb.exe 2360 bttnhb.exe 1700 xrxrlll.exe 3552 djvpj.exe 1932 1lffxfx.exe 1088 pjpjj.exe 2328 jjpjj.exe 1380 rllffxr.exe 3784 ttbttt.exe 3248 5rxrrrr.exe 516 9nthhh.exe 4968 pvjdd.exe 3904 nbbtnh.exe 1944 lllfxrl.exe 2324 vppdp.exe 1096 rrxffxr.exe 2592 7hhtnn.exe 548 jjjjd.exe 2340 dddjd.exe 384 9ttnbb.exe 3668 xffxxrf.exe 4324 djpvv.exe 3148 hhnhtb.exe 4484 pjppp.exe 944 rlllffx.exe 4112 nnbbbb.exe 2648 jdddv.exe 3532 rfllflf.exe 2764 vdvjd.exe 2124 jdvpd.exe 3980 9flfxxx.exe 2596 hhtnnn.exe 2520 vddjd.exe 3736 pdjvj.exe 2408 xrffrxr.exe 4628 3thbtn.exe 1624 7vpjd.exe 3972 3xfxfff.exe 4052 dpvvv.exe 1720 tnhhnt.exe 1360 jddvd.exe 3296 lxrlfxx.exe 2456 jvdvd.exe 4908 rlxrxrl.exe 884 hnbthb.exe 2604 dppdp.exe 4808 ppvpj.exe 3292 hnbnth.exe 2308 dpvpj.exe 3888 dpjdv.exe 4736 lllfxrr.exe 1612 bhhhbt.exe 3216 ppvpd.exe 4556 rrxrllf.exe 1924 htnhbt.exe 2280 hnnhbb.exe 3392 dpppj.exe 1404 7xfxrxr.exe 1380 hbtnhb.exe 1304 jdvjd.exe -
resource yara_rule behavioral2/memory/4300-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-1040-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 428 4300 d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe 82 PID 4300 wrote to memory of 428 4300 d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe 82 PID 4300 wrote to memory of 428 4300 d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe 82 PID 428 wrote to memory of 3540 428 thtnnn.exe 83 PID 428 wrote to memory of 3540 428 thtnnn.exe 83 PID 428 wrote to memory of 3540 428 thtnnn.exe 83 PID 3540 wrote to memory of 1792 3540 fxllflr.exe 84 PID 3540 wrote to memory of 1792 3540 fxllflr.exe 84 PID 3540 wrote to memory of 1792 3540 fxllflr.exe 84 PID 1792 wrote to memory of 208 1792 djpjd.exe 85 PID 1792 wrote to memory of 208 1792 djpjd.exe 85 PID 1792 wrote to memory of 208 1792 djpjd.exe 85 PID 208 wrote to memory of 3004 208 3rfxrlf.exe 86 PID 208 wrote to memory of 3004 208 3rfxrlf.exe 86 PID 208 wrote to memory of 3004 208 3rfxrlf.exe 86 PID 3004 wrote to memory of 2360 3004 ntnnhb.exe 87 PID 3004 wrote to memory of 2360 3004 ntnnhb.exe 87 PID 3004 wrote to memory of 2360 3004 ntnnhb.exe 87 PID 2360 wrote to memory of 1700 2360 bttnhb.exe 88 PID 2360 wrote to memory of 1700 2360 bttnhb.exe 88 PID 2360 wrote to memory of 1700 2360 bttnhb.exe 88 PID 1700 wrote to memory of 3552 1700 xrxrlll.exe 89 PID 1700 wrote to memory of 3552 1700 xrxrlll.exe 89 PID 1700 wrote to memory of 3552 1700 xrxrlll.exe 89 PID 3552 wrote to memory of 1932 3552 djvpj.exe 90 PID 3552 wrote to memory of 1932 3552 djvpj.exe 90 PID 3552 wrote to memory of 1932 3552 djvpj.exe 90 PID 1932 wrote to memory of 1088 1932 1lffxfx.exe 91 PID 1932 wrote to memory of 1088 1932 1lffxfx.exe 91 PID 1932 wrote to memory of 1088 1932 1lffxfx.exe 91 PID 1088 wrote to memory of 2328 1088 pjpjj.exe 92 PID 1088 wrote to memory of 2328 1088 pjpjj.exe 92 PID 1088 wrote to memory of 2328 1088 pjpjj.exe 92 PID 2328 wrote to memory of 1380 2328 jjpjj.exe 93 PID 2328 wrote to memory of 1380 2328 jjpjj.exe 93 PID 2328 wrote to memory of 1380 2328 jjpjj.exe 93 PID 1380 wrote to memory of 3784 1380 rllffxr.exe 94 PID 1380 wrote to memory of 3784 1380 rllffxr.exe 94 PID 1380 wrote to memory of 3784 1380 rllffxr.exe 94 PID 3784 wrote to memory of 3248 3784 ttbttt.exe 95 PID 3784 wrote to memory of 3248 3784 ttbttt.exe 95 PID 3784 wrote to memory of 3248 3784 ttbttt.exe 95 PID 3248 wrote to memory of 516 3248 5rxrrrr.exe 96 PID 3248 wrote to memory of 516 3248 5rxrrrr.exe 96 PID 3248 wrote to memory of 516 3248 5rxrrrr.exe 96 PID 516 wrote to memory of 4968 516 9nthhh.exe 97 PID 516 wrote to memory of 4968 516 9nthhh.exe 97 PID 516 wrote to memory of 4968 516 9nthhh.exe 97 PID 4968 wrote to memory of 3904 4968 pvjdd.exe 98 PID 4968 wrote to memory of 3904 4968 pvjdd.exe 98 PID 4968 wrote to memory of 3904 4968 pvjdd.exe 98 PID 3904 wrote to memory of 1944 3904 nbbtnh.exe 99 PID 3904 wrote to memory of 1944 3904 nbbtnh.exe 99 PID 3904 wrote to memory of 1944 3904 nbbtnh.exe 99 PID 1944 wrote to memory of 2324 1944 lllfxrl.exe 100 PID 1944 wrote to memory of 2324 1944 lllfxrl.exe 100 PID 1944 wrote to memory of 2324 1944 lllfxrl.exe 100 PID 2324 wrote to memory of 1096 2324 vppdp.exe 101 PID 2324 wrote to memory of 1096 2324 vppdp.exe 101 PID 2324 wrote to memory of 1096 2324 vppdp.exe 101 PID 1096 wrote to memory of 2592 1096 rrxffxr.exe 102 PID 1096 wrote to memory of 2592 1096 rrxffxr.exe 102 PID 1096 wrote to memory of 2592 1096 rrxffxr.exe 102 PID 2592 wrote to memory of 548 2592 7hhtnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe"C:\Users\Admin\AppData\Local\Temp\d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\thtnnn.exec:\thtnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\fxllflr.exec:\fxllflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\djpjd.exec:\djpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\3rfxrlf.exec:\3rfxrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\ntnnhb.exec:\ntnnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bttnhb.exec:\bttnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\xrxrlll.exec:\xrxrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\djvpj.exec:\djvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\1lffxfx.exec:\1lffxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\pjpjj.exec:\pjpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\jjpjj.exec:\jjpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\rllffxr.exec:\rllffxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\ttbttt.exec:\ttbttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\5rxrrrr.exec:\5rxrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\9nthhh.exec:\9nthhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\pvjdd.exec:\pvjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\nbbtnh.exec:\nbbtnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\lllfxrl.exec:\lllfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\vppdp.exec:\vppdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\rrxffxr.exec:\rrxffxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\7hhtnn.exec:\7hhtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jjjjd.exec:\jjjjd.exe23⤵
- Executes dropped EXE
PID:548 -
\??\c:\dddjd.exec:\dddjd.exe24⤵
- Executes dropped EXE
PID:2340 -
\??\c:\9ttnbb.exec:\9ttnbb.exe25⤵
- Executes dropped EXE
PID:384 -
\??\c:\xffxxrf.exec:\xffxxrf.exe26⤵
- Executes dropped EXE
PID:3668 -
\??\c:\djpvv.exec:\djpvv.exe27⤵
- Executes dropped EXE
PID:4324 -
\??\c:\hhnhtb.exec:\hhnhtb.exe28⤵
- Executes dropped EXE
PID:3148 -
\??\c:\pjppp.exec:\pjppp.exe29⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rlllffx.exec:\rlllffx.exe30⤵
- Executes dropped EXE
PID:944 -
\??\c:\nnbbbb.exec:\nnbbbb.exe31⤵
- Executes dropped EXE
PID:4112 -
\??\c:\jdddv.exec:\jdddv.exe32⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rfllflf.exec:\rfllflf.exe33⤵
- Executes dropped EXE
PID:3532 -
\??\c:\vdvjd.exec:\vdvjd.exe34⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdvpd.exec:\jdvpd.exe35⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9flfxxx.exec:\9flfxxx.exe36⤵
- Executes dropped EXE
PID:3980 -
\??\c:\hhtnnn.exec:\hhtnnn.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vddjd.exec:\vddjd.exe38⤵
- Executes dropped EXE
PID:2520 -
\??\c:\pdjvj.exec:\pdjvj.exe39⤵
- Executes dropped EXE
PID:3736 -
\??\c:\xrffrxr.exec:\xrffrxr.exe40⤵
- Executes dropped EXE
PID:2408 -
\??\c:\3thbtn.exec:\3thbtn.exe41⤵
- Executes dropped EXE
PID:4628 -
\??\c:\7vpjd.exec:\7vpjd.exe42⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3xfxfff.exec:\3xfxfff.exe43⤵
- Executes dropped EXE
PID:3972 -
\??\c:\dpvvv.exec:\dpvvv.exe44⤵
- Executes dropped EXE
PID:4052 -
\??\c:\tnhhnt.exec:\tnhhnt.exe45⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jddvd.exec:\jddvd.exe46⤵
- Executes dropped EXE
PID:1360 -
\??\c:\lxrlfxx.exec:\lxrlfxx.exe47⤵
- Executes dropped EXE
PID:3296 -
\??\c:\jvdvd.exec:\jvdvd.exe48⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rlxrxrl.exec:\rlxrxrl.exe49⤵
- Executes dropped EXE
PID:4908 -
\??\c:\hnbthb.exec:\hnbthb.exe50⤵
- Executes dropped EXE
PID:884 -
\??\c:\dppdp.exec:\dppdp.exe51⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ppvpj.exec:\ppvpj.exe52⤵
- Executes dropped EXE
PID:4808 -
\??\c:\hnbnth.exec:\hnbnth.exe53⤵
- Executes dropped EXE
PID:3292 -
\??\c:\dpvpj.exec:\dpvpj.exe54⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dpjdv.exec:\dpjdv.exe55⤵
- Executes dropped EXE
PID:3888 -
\??\c:\lllfxrr.exec:\lllfxrr.exe56⤵
- Executes dropped EXE
PID:4736 -
\??\c:\bhhhbt.exec:\bhhhbt.exe57⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ppvpd.exec:\ppvpd.exe58⤵
- Executes dropped EXE
PID:3216 -
\??\c:\rrxrllf.exec:\rrxrllf.exe59⤵
- Executes dropped EXE
PID:4556 -
\??\c:\htnhbt.exec:\htnhbt.exe60⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hnnhbb.exec:\hnnhbb.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dpppj.exec:\dpppj.exe62⤵
- Executes dropped EXE
PID:3392 -
\??\c:\7xfxrxr.exec:\7xfxrxr.exe63⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hbtnhb.exec:\hbtnhb.exe64⤵
- Executes dropped EXE
PID:1380 -
\??\c:\jdvjd.exec:\jdvjd.exe65⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jjvjd.exec:\jjvjd.exe66⤵PID:5096
-
\??\c:\3fxrlll.exec:\3fxrlll.exe67⤵PID:3336
-
\??\c:\nntbth.exec:\nntbth.exe68⤵PID:1696
-
\??\c:\pvvjd.exec:\pvvjd.exe69⤵PID:3712
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe70⤵PID:4968
-
\??\c:\nnbhbt.exec:\nnbhbt.exe71⤵PID:4020
-
\??\c:\dvppv.exec:\dvppv.exe72⤵PID:1052
-
\??\c:\7lllffx.exec:\7lllffx.exe73⤵PID:1220
-
\??\c:\ttbtbt.exec:\ttbtbt.exe74⤵PID:1480
-
\??\c:\dvdpv.exec:\dvdpv.exe75⤵PID:4012
-
\??\c:\rlrfrrr.exec:\rlrfrrr.exe76⤵PID:628
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe77⤵
- System Location Discovery: System Language Discovery
PID:1996 -
\??\c:\9bnbtn.exec:\9bnbtn.exe78⤵PID:1328
-
\??\c:\pdjvp.exec:\pdjvp.exe79⤵PID:4232
-
\??\c:\3xxlfxr.exec:\3xxlfxr.exe80⤵PID:4596
-
\??\c:\tbhtbt.exec:\tbhtbt.exe81⤵PID:4448
-
\??\c:\vpvjd.exec:\vpvjd.exe82⤵PID:2964
-
\??\c:\dpvjd.exec:\dpvjd.exe83⤵
- System Location Discovery: System Language Discovery
PID:4324 -
\??\c:\lffxxxx.exec:\lffxxxx.exe84⤵PID:2716
-
\??\c:\hhnhbb.exec:\hhnhbb.exe85⤵PID:2980
-
\??\c:\7hbbtt.exec:\7hbbtt.exe86⤵PID:2544
-
\??\c:\5ppdj.exec:\5ppdj.exe87⤵PID:4672
-
\??\c:\rllxrrf.exec:\rllxrrf.exe88⤵PID:2412
-
\??\c:\5ntnnt.exec:\5ntnnt.exe89⤵PID:2084
-
\??\c:\jpvpj.exec:\jpvpj.exe90⤵PID:5112
-
\??\c:\rrllfxr.exec:\rrllfxr.exe91⤵PID:1548
-
\??\c:\bnhhbt.exec:\bnhhbt.exe92⤵PID:4172
-
\??\c:\jvpjd.exec:\jvpjd.exe93⤵PID:3528
-
\??\c:\vjpdv.exec:\vjpdv.exe94⤵PID:4460
-
\??\c:\xfllxrl.exec:\xfllxrl.exe95⤵PID:4856
-
\??\c:\hnhtnn.exec:\hnhtnn.exe96⤵PID:2416
-
\??\c:\jddjj.exec:\jddjj.exe97⤵PID:4256
-
\??\c:\llllxfx.exec:\llllxfx.exe98⤵PID:2696
-
\??\c:\tbbthh.exec:\tbbthh.exe99⤵PID:1232
-
\??\c:\nbtnnn.exec:\nbtnnn.exe100⤵PID:4348
-
\??\c:\dvjpd.exec:\dvjpd.exe101⤵PID:4240
-
\??\c:\lrxrfll.exec:\lrxrfll.exe102⤵PID:4052
-
\??\c:\ttttbn.exec:\ttttbn.exe103⤵PID:4424
-
\??\c:\pdjjd.exec:\pdjjd.exe104⤵PID:1360
-
\??\c:\jjvdd.exec:\jjvdd.exe105⤵PID:1248
-
\??\c:\3rlfxlf.exec:\3rlfxlf.exe106⤵PID:4972
-
\??\c:\1nbbbb.exec:\1nbbbb.exe107⤵PID:1540
-
\??\c:\bntnhh.exec:\bntnhh.exe108⤵PID:1408
-
\??\c:\5ddvd.exec:\5ddvd.exe109⤵PID:1744
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe110⤵PID:2604
-
\??\c:\7frflfl.exec:\7frflfl.exe111⤵PID:320
-
\??\c:\nbhnhn.exec:\nbhnhn.exe112⤵PID:760
-
\??\c:\1pdvp.exec:\1pdvp.exe113⤵PID:1348
-
\??\c:\3flfxxr.exec:\3flfxxr.exe114⤵PID:2088
-
\??\c:\9xfxrfx.exec:\9xfxrfx.exe115⤵PID:3600
-
\??\c:\bbbhbt.exec:\bbbhbt.exe116⤵PID:3732
-
\??\c:\vvvpp.exec:\vvvpp.exe117⤵PID:2352
-
\??\c:\frxrfff.exec:\frxrfff.exe118⤵PID:4352
-
\??\c:\rrffrrx.exec:\rrffrrx.exe119⤵PID:5024
-
\??\c:\hnbtbb.exec:\hnbtbb.exe120⤵PID:2788
-
\??\c:\djpjj.exec:\djpjj.exe121⤵PID:2276
-
\??\c:\fllllxx.exec:\fllllxx.exe122⤵
- System Location Discovery: System Language Discovery
PID:3836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-