Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 05:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e87a0300d81270d2fe65f3faaef9443e8257c4b18e0d0b1d6ac0f9496e6882f8.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
e87a0300d81270d2fe65f3faaef9443e8257c4b18e0d0b1d6ac0f9496e6882f8.exe
-
Size
455KB
-
MD5
34cd3f77d92dda1c642a21151857c357
-
SHA1
848342015cf24385967a98b54292ca7720a0ce00
-
SHA256
e87a0300d81270d2fe65f3faaef9443e8257c4b18e0d0b1d6ac0f9496e6882f8
-
SHA512
a6952c9569e4103d2888baa8cd4bf2562e662df47ed7d38584fbdc453d033e55f7b14e466625a0fd59295ce4e22518230ae8a58c66d9e4ac67a20ce0562e785d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTx:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4676-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/336-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/692-970-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-1019-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-1195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4216 xrrrllf.exe 4884 jjvpj.exe 1772 rlfxffl.exe 2040 xlrrrrr.exe 3480 tnbbhh.exe 4704 jvjdd.exe 4496 xfrlxrl.exe 4792 5nbtbh.exe 716 djjjd.exe 992 llrrrfx.exe 2028 dpdvp.exe 1496 xrllrxf.exe 100 tbnhbb.exe 824 1xxxlrr.exe 5036 1nbbbh.exe 184 dppjj.exe 1288 nntnnt.exe 532 rrffrxl.exe 3000 hbhbbb.exe 1528 fxrlfrl.exe 3700 1tbhbh.exe 3880 htnhbt.exe 2580 fxffxff.exe 1892 9jjjj.exe 336 xfxrrrl.exe 64 rlxrrrr.exe 3064 hhhhbb.exe 4452 xxfxxxx.exe 4388 jvdvv.exe 3544 rxrrrrr.exe 1008 frfxrlf.exe 1396 pjpjj.exe 4928 lxlllll.exe 3324 nbtttt.exe 2660 xlxrrrr.exe 692 hbtnhh.exe 4272 dvjdj.exe 4756 7lrlffx.exe 4620 llxxrrx.exe 1100 jvddv.exe 4288 jdjjd.exe 3548 lrxrlfx.exe 4548 nhnhhh.exe 4824 jdpjd.exe 3352 rlrxxff.exe 3740 xxrfxrf.exe 1500 bhbttn.exe 1060 jdddd.exe 4900 lflfxxr.exe 3948 nnnnhh.exe 4400 bbntbn.exe 1312 vdvjj.exe 3400 llrlllf.exe 3032 bnttnn.exe 2040 pvvpj.exe 2588 3llflll.exe 3480 lrfxxrf.exe 4704 hnnhhh.exe 4192 3pjjj.exe 4800 rrfxrrl.exe 4508 hhbhhb.exe 2700 nbnbnt.exe 3636 vvdvd.exe 4444 rlrfxrr.exe -
resource yara_rule behavioral2/memory/4676-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/336-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/692-970-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4676 wrote to memory of 4216 4676 e87a0300d81270d2fe65f3faaef9443e8257c4b18e0d0b1d6ac0f9496e6882f8.exe 82 PID 4676 wrote to memory of 4216 4676 e87a0300d81270d2fe65f3faaef9443e8257c4b18e0d0b1d6ac0f9496e6882f8.exe 82 PID 4676 wrote to memory of 4216 4676 e87a0300d81270d2fe65f3faaef9443e8257c4b18e0d0b1d6ac0f9496e6882f8.exe 82 PID 4216 wrote to memory of 4884 4216 xrrrllf.exe 83 PID 4216 wrote to memory of 4884 4216 xrrrllf.exe 83 PID 4216 wrote to memory of 4884 4216 xrrrllf.exe 83 PID 4884 wrote to memory of 1772 4884 jjvpj.exe 84 PID 4884 wrote to memory of 1772 4884 jjvpj.exe 84 PID 4884 wrote to memory of 1772 4884 jjvpj.exe 84 PID 1772 wrote to memory of 2040 1772 rlfxffl.exe 85 PID 1772 wrote to memory of 2040 1772 rlfxffl.exe 85 PID 1772 wrote to memory of 2040 1772 rlfxffl.exe 85 PID 2040 wrote to memory of 3480 2040 xlrrrrr.exe 86 PID 2040 wrote to memory of 3480 2040 xlrrrrr.exe 86 PID 2040 wrote to memory of 3480 2040 xlrrrrr.exe 86 PID 3480 wrote to memory of 4704 3480 tnbbhh.exe 87 PID 3480 wrote to memory of 4704 3480 tnbbhh.exe 87 PID 3480 wrote to memory of 4704 3480 tnbbhh.exe 87 PID 4704 wrote to memory of 4496 4704 jvjdd.exe 88 PID 4704 wrote to memory of 4496 4704 jvjdd.exe 88 PID 4704 wrote to memory of 4496 4704 jvjdd.exe 88 PID 4496 wrote to memory of 4792 4496 xfrlxrl.exe 89 PID 4496 wrote to memory of 4792 4496 xfrlxrl.exe 89 PID 4496 wrote to memory of 4792 4496 xfrlxrl.exe 89 PID 4792 wrote to memory of 716 4792 5nbtbh.exe 90 PID 4792 wrote to memory of 716 4792 5nbtbh.exe 90 PID 4792 wrote to memory of 716 4792 5nbtbh.exe 90 PID 716 wrote to memory of 992 716 djjjd.exe 91 PID 716 wrote to memory of 992 716 djjjd.exe 91 PID 716 wrote to memory of 992 716 djjjd.exe 91 PID 992 wrote to memory of 2028 992 llrrrfx.exe 92 PID 992 wrote to memory of 2028 992 llrrrfx.exe 92 PID 992 wrote to memory of 2028 992 llrrrfx.exe 92 PID 2028 wrote to memory of 1496 2028 dpdvp.exe 93 PID 2028 wrote to memory of 1496 2028 dpdvp.exe 93 PID 2028 wrote to memory of 1496 2028 dpdvp.exe 93 PID 1496 wrote to memory of 100 1496 xrllrxf.exe 94 PID 1496 wrote to memory of 100 1496 xrllrxf.exe 94 PID 1496 wrote to memory of 100 1496 xrllrxf.exe 94 PID 100 wrote to memory of 824 100 tbnhbb.exe 95 PID 100 wrote to memory of 824 100 tbnhbb.exe 95 PID 100 wrote to memory of 824 100 tbnhbb.exe 95 PID 824 wrote to memory of 5036 824 1xxxlrr.exe 96 PID 824 wrote to memory of 5036 824 1xxxlrr.exe 96 PID 824 wrote to memory of 5036 824 1xxxlrr.exe 96 PID 5036 wrote to memory of 184 5036 1nbbbh.exe 97 PID 5036 wrote to memory of 184 5036 1nbbbh.exe 97 PID 5036 wrote to memory of 184 5036 1nbbbh.exe 97 PID 184 wrote to memory of 1288 184 dppjj.exe 98 PID 184 wrote to memory of 1288 184 dppjj.exe 98 PID 184 wrote to memory of 1288 184 dppjj.exe 98 PID 1288 wrote to memory of 532 1288 nntnnt.exe 99 PID 1288 wrote to memory of 532 1288 nntnnt.exe 99 PID 1288 wrote to memory of 532 1288 nntnnt.exe 99 PID 532 wrote to memory of 3000 532 rrffrxl.exe 100 PID 532 wrote to memory of 3000 532 rrffrxl.exe 100 PID 532 wrote to memory of 3000 532 rrffrxl.exe 100 PID 3000 wrote to memory of 1528 3000 hbhbbb.exe 101 PID 3000 wrote to memory of 1528 3000 hbhbbb.exe 101 PID 3000 wrote to memory of 1528 3000 hbhbbb.exe 101 PID 1528 wrote to memory of 3700 1528 fxrlfrl.exe 102 PID 1528 wrote to memory of 3700 1528 fxrlfrl.exe 102 PID 1528 wrote to memory of 3700 1528 fxrlfrl.exe 102 PID 3700 wrote to memory of 3880 3700 1tbhbh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e87a0300d81270d2fe65f3faaef9443e8257c4b18e0d0b1d6ac0f9496e6882f8.exe"C:\Users\Admin\AppData\Local\Temp\e87a0300d81270d2fe65f3faaef9443e8257c4b18e0d0b1d6ac0f9496e6882f8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\xrrrllf.exec:\xrrrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\jjvpj.exec:\jjvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\rlfxffl.exec:\rlfxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\tnbbhh.exec:\tnbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\jvjdd.exec:\jvjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\xfrlxrl.exec:\xfrlxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\5nbtbh.exec:\5nbtbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\djjjd.exec:\djjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\llrrrfx.exec:\llrrrfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\dpdvp.exec:\dpdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\xrllrxf.exec:\xrllrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\tbnhbb.exec:\tbnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\1xxxlrr.exec:\1xxxlrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\1nbbbh.exec:\1nbbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\dppjj.exec:\dppjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\nntnnt.exec:\nntnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\rrffrxl.exec:\rrffrxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\hbhbbb.exec:\hbhbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\fxrlfrl.exec:\fxrlfrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\1tbhbh.exec:\1tbhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\htnhbt.exec:\htnhbt.exe23⤵
- Executes dropped EXE
PID:3880 -
\??\c:\fxffxff.exec:\fxffxff.exe24⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9jjjj.exec:\9jjjj.exe25⤵
- Executes dropped EXE
PID:1892 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe26⤵
- Executes dropped EXE
PID:336 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe27⤵
- Executes dropped EXE
PID:64 -
\??\c:\hhhhbb.exec:\hhhhbb.exe28⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe29⤵
- Executes dropped EXE
PID:4452 -
\??\c:\jvdvv.exec:\jvdvv.exe30⤵
- Executes dropped EXE
PID:4388 -
\??\c:\rxrrrrr.exec:\rxrrrrr.exe31⤵
- Executes dropped EXE
PID:3544 -
\??\c:\frfxrlf.exec:\frfxrlf.exe32⤵
- Executes dropped EXE
PID:1008 -
\??\c:\pjpjj.exec:\pjpjj.exe33⤵
- Executes dropped EXE
PID:1396 -
\??\c:\lxlllll.exec:\lxlllll.exe34⤵
- Executes dropped EXE
PID:4928 -
\??\c:\nbtttt.exec:\nbtttt.exe35⤵
- Executes dropped EXE
PID:3324 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe36⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbtnhh.exec:\hbtnhh.exe37⤵
- Executes dropped EXE
PID:692 -
\??\c:\dvjdj.exec:\dvjdj.exe38⤵
- Executes dropped EXE
PID:4272 -
\??\c:\7lrlffx.exec:\7lrlffx.exe39⤵
- Executes dropped EXE
PID:4756 -
\??\c:\llxxrrx.exec:\llxxrrx.exe40⤵
- Executes dropped EXE
PID:4620 -
\??\c:\jvddv.exec:\jvddv.exe41⤵
- Executes dropped EXE
PID:1100 -
\??\c:\jdjjd.exec:\jdjjd.exe42⤵
- Executes dropped EXE
PID:4288 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe43⤵
- Executes dropped EXE
PID:3548 -
\??\c:\nhnhhh.exec:\nhnhhh.exe44⤵
- Executes dropped EXE
PID:4548 -
\??\c:\jdpjd.exec:\jdpjd.exe45⤵
- Executes dropped EXE
PID:4824 -
\??\c:\rlrxxff.exec:\rlrxxff.exe46⤵
- Executes dropped EXE
PID:3352 -
\??\c:\xxrfxrf.exec:\xxrfxrf.exe47⤵
- Executes dropped EXE
PID:3740 -
\??\c:\bhbttn.exec:\bhbttn.exe48⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jdddd.exec:\jdddd.exe49⤵
- Executes dropped EXE
PID:1060 -
\??\c:\lflfxxr.exec:\lflfxxr.exe50⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nnnnhh.exec:\nnnnhh.exe51⤵
- Executes dropped EXE
PID:3948 -
\??\c:\bbntbn.exec:\bbntbn.exe52⤵
- Executes dropped EXE
PID:4400 -
\??\c:\vdvjj.exec:\vdvjj.exe53⤵
- Executes dropped EXE
PID:1312 -
\??\c:\llrlllf.exec:\llrlllf.exe54⤵
- Executes dropped EXE
PID:3400 -
\??\c:\bnttnn.exec:\bnttnn.exe55⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pvvpj.exec:\pvvpj.exe56⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3llflll.exec:\3llflll.exe57⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lrfxxrf.exec:\lrfxxrf.exe58⤵
- Executes dropped EXE
PID:3480 -
\??\c:\hnnhhh.exec:\hnnhhh.exe59⤵
- Executes dropped EXE
PID:4704 -
\??\c:\3pjjj.exec:\3pjjj.exe60⤵
- Executes dropped EXE
PID:4192 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe61⤵
- Executes dropped EXE
PID:4800 -
\??\c:\hhbhhb.exec:\hhbhhb.exe62⤵
- Executes dropped EXE
PID:4508 -
\??\c:\nbnbnt.exec:\nbnbnt.exe63⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vvdvd.exec:\vvdvd.exe64⤵
- Executes dropped EXE
PID:3636 -
\??\c:\rlrfxrr.exec:\rlrfxrr.exe65⤵
- Executes dropped EXE
PID:4444 -
\??\c:\7tnhhh.exec:\7tnhhh.exe66⤵PID:4932
-
\??\c:\tnnhbt.exec:\tnnhbt.exe67⤵PID:4004
-
\??\c:\vpvpj.exec:\vpvpj.exe68⤵PID:3736
-
\??\c:\lfffxxx.exec:\lfffxxx.exe69⤵PID:1780
-
\??\c:\nntttt.exec:\nntttt.exe70⤵PID:100
-
\??\c:\btbhbt.exec:\btbhbt.exe71⤵PID:3516
-
\??\c:\jpvpp.exec:\jpvpp.exe72⤵PID:2584
-
\??\c:\llllrrx.exec:\llllrrx.exe73⤵PID:868
-
\??\c:\lxlllll.exec:\lxlllll.exe74⤵PID:4108
-
\??\c:\hnhnbh.exec:\hnhnbh.exe75⤵PID:184
-
\??\c:\ppvpj.exec:\ppvpj.exe76⤵PID:2620
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe77⤵PID:2388
-
\??\c:\hhnntt.exec:\hhnntt.exe78⤵PID:3872
-
\??\c:\hhnhhh.exec:\hhnhhh.exe79⤵PID:4836
-
\??\c:\5vpdd.exec:\5vpdd.exe80⤵PID:1672
-
\??\c:\7rrrlrl.exec:\7rrrlrl.exe81⤵PID:3936
-
\??\c:\1tbbtt.exec:\1tbbtt.exe82⤵PID:2704
-
\??\c:\jdvpp.exec:\jdvpp.exe83⤵PID:536
-
\??\c:\vdppj.exec:\vdppj.exe84⤵PID:564
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe85⤵PID:2596
-
\??\c:\hbhnhh.exec:\hbhnhh.exe86⤵PID:3260
-
\??\c:\jdjvv.exec:\jdjvv.exe87⤵PID:3832
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe88⤵PID:4044
-
\??\c:\ttbbtb.exec:\ttbbtb.exe89⤵PID:3768
-
\??\c:\bhtnnn.exec:\bhtnnn.exe90⤵PID:4740
-
\??\c:\5ppjv.exec:\5ppjv.exe91⤵PID:3564
-
\??\c:\flllfff.exec:\flllfff.exe92⤵PID:2632
-
\??\c:\bthbhh.exec:\bthbhh.exe93⤵PID:2224
-
\??\c:\pdddv.exec:\pdddv.exe94⤵PID:3544
-
\??\c:\frrrllf.exec:\frrrllf.exe95⤵PID:624
-
\??\c:\xxxxrlx.exec:\xxxxrlx.exe96⤵PID:380
-
\??\c:\hnnthh.exec:\hnnthh.exe97⤵PID:1224
-
\??\c:\3djdd.exec:\3djdd.exe98⤵PID:2844
-
\??\c:\djvvp.exec:\djvvp.exe99⤵PID:400
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe100⤵PID:3036
-
\??\c:\tnbbtt.exec:\tnbbtt.exe101⤵PID:4292
-
\??\c:\bhtnnn.exec:\bhtnnn.exe102⤵PID:3088
-
\??\c:\vvvpp.exec:\vvvpp.exe103⤵PID:2500
-
\??\c:\fxffxll.exec:\fxffxll.exe104⤵PID:1416
-
\??\c:\bbbbtb.exec:\bbbbtb.exe105⤵PID:2196
-
\??\c:\btbtnh.exec:\btbtnh.exe106⤵PID:4288
-
\??\c:\djvvv.exec:\djvvv.exe107⤵PID:3548
-
\??\c:\lflflll.exec:\lflflll.exe108⤵PID:4548
-
\??\c:\1hhbtn.exec:\1hhbtn.exe109⤵PID:4824
-
\??\c:\nnhtnn.exec:\nnhtnn.exe110⤵PID:728
-
\??\c:\pjpjd.exec:\pjpjd.exe111⤵PID:4972
-
\??\c:\xxffxxx.exec:\xxffxxx.exe112⤵PID:4304
-
\??\c:\thnhbb.exec:\thnhbb.exe113⤵PID:3496
-
\??\c:\3tnnhh.exec:\3tnnhh.exe114⤵PID:2408
-
\??\c:\ddpdd.exec:\ddpdd.exe115⤵PID:5056
-
\??\c:\7lrlffx.exec:\7lrlffx.exe116⤵PID:8
-
\??\c:\7rxrlll.exec:\7rxrlll.exe117⤵PID:4940
-
\??\c:\ntnbbb.exec:\ntnbbb.exe118⤵PID:1844
-
\??\c:\nthhbt.exec:\nthhbt.exe119⤵PID:1772
-
\??\c:\vjdjj.exec:\vjdjj.exe120⤵PID:1492
-
\??\c:\llrrrrr.exec:\llrrrrr.exe121⤵PID:2696
-
\??\c:\nbnttn.exec:\nbnttn.exe122⤵PID:1932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-