Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2025 06:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce94f91f14606ad5d92ecfa1bf328b2277502cf48785e8d9ea25b260e23c059d.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
ce94f91f14606ad5d92ecfa1bf328b2277502cf48785e8d9ea25b260e23c059d.exe
-
Size
455KB
-
MD5
32a7bb8ba4ec350b9ccc077653a7da74
-
SHA1
828356e42db2c0e1eeacee4a4cb0e596ffd33b0c
-
SHA256
ce94f91f14606ad5d92ecfa1bf328b2277502cf48785e8d9ea25b260e23c059d
-
SHA512
42becce2b510fa0d87cdcd78f16743efc3ca6d098774c479c83c7218845cb0c0fd48af435d9c77fd86c0d29cf342980cb1a49231aed13f406f9026375b01a83f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/548-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/264-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-931-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-1109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-1249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-1611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-1968-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3168 tnnbtt.exe 968 frlffxr.exe 2280 xllfxrl.exe 5060 ttnhbb.exe 1068 ddpjd.exe 4640 djjdj.exe 4952 tnttbb.exe 4220 pdjdd.exe 4796 dpvjd.exe 4936 1nnhhh.exe 920 nnhhbb.exe 1272 dpvvj.exe 3672 rfxxfxr.exe 5056 nhthnn.exe 32 vpvdv.exe 3620 bhnhbt.exe 2872 lxllrlr.exe 2904 hbhbhb.exe 2244 pjdjj.exe 1088 jdpjv.exe 4652 xrrlfxx.exe 3940 5bnnbh.exe 4628 jdvpj.exe 2996 lxrrlfl.exe 4100 5llfxfx.exe 3696 nhhhbb.exe 2204 9vdvp.exe 3500 xxrfxrl.exe 4212 5ppjd.exe 4400 hnnhbb.exe 2556 bhnhhh.exe 4916 lxrlrrl.exe 3244 3bhbtb.exe 2368 rrllfff.exe 3108 lflrllf.exe 3664 9ppjd.exe 1012 nhhtbn.exe 3276 nntnnb.exe 4168 5jpjj.exe 2908 xrllffl.exe 3200 nbbttt.exe 264 dvddd.exe 3516 llrrrxx.exe 3576 1bbttt.exe 384 vpddv.exe 632 dvvpj.exe 4236 xrfxlrr.exe 3240 thnhhn.exe 2324 vpppj.exe 2224 ffrlffx.exe 1172 bbbbtt.exe 4788 jdjjp.exe 4312 ppvvd.exe 3568 lfffrrr.exe 4420 nhhtnn.exe 3512 7vvpj.exe 3604 pvjdj.exe 4304 xffxxff.exe 4780 tnnbbt.exe 4204 ddjvp.exe 3408 lllfxfx.exe 1400 btttnn.exe 5068 jjddd.exe 3676 fxfffff.exe -
resource yara_rule behavioral2/memory/548-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/264-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-931-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-1109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-1146-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 548 wrote to memory of 3168 548 ce94f91f14606ad5d92ecfa1bf328b2277502cf48785e8d9ea25b260e23c059d.exe 82 PID 548 wrote to memory of 3168 548 ce94f91f14606ad5d92ecfa1bf328b2277502cf48785e8d9ea25b260e23c059d.exe 82 PID 548 wrote to memory of 3168 548 ce94f91f14606ad5d92ecfa1bf328b2277502cf48785e8d9ea25b260e23c059d.exe 82 PID 3168 wrote to memory of 968 3168 tnnbtt.exe 83 PID 3168 wrote to memory of 968 3168 tnnbtt.exe 83 PID 3168 wrote to memory of 968 3168 tnnbtt.exe 83 PID 968 wrote to memory of 2280 968 frlffxr.exe 84 PID 968 wrote to memory of 2280 968 frlffxr.exe 84 PID 968 wrote to memory of 2280 968 frlffxr.exe 84 PID 2280 wrote to memory of 5060 2280 xllfxrl.exe 85 PID 2280 wrote to memory of 5060 2280 xllfxrl.exe 85 PID 2280 wrote to memory of 5060 2280 xllfxrl.exe 85 PID 5060 wrote to memory of 1068 5060 ttnhbb.exe 86 PID 5060 wrote to memory of 1068 5060 ttnhbb.exe 86 PID 5060 wrote to memory of 1068 5060 ttnhbb.exe 86 PID 1068 wrote to memory of 4640 1068 ddpjd.exe 87 PID 1068 wrote to memory of 4640 1068 ddpjd.exe 87 PID 1068 wrote to memory of 4640 1068 ddpjd.exe 87 PID 4640 wrote to memory of 4952 4640 djjdj.exe 88 PID 4640 wrote to memory of 4952 4640 djjdj.exe 88 PID 4640 wrote to memory of 4952 4640 djjdj.exe 88 PID 4952 wrote to memory of 4220 4952 tnttbb.exe 89 PID 4952 wrote to memory of 4220 4952 tnttbb.exe 89 PID 4952 wrote to memory of 4220 4952 tnttbb.exe 89 PID 4220 wrote to memory of 4796 4220 pdjdd.exe 90 PID 4220 wrote to memory of 4796 4220 pdjdd.exe 90 PID 4220 wrote to memory of 4796 4220 pdjdd.exe 90 PID 4796 wrote to memory of 4936 4796 dpvjd.exe 91 PID 4796 wrote to memory of 4936 4796 dpvjd.exe 91 PID 4796 wrote to memory of 4936 4796 dpvjd.exe 91 PID 4936 wrote to memory of 920 4936 1nnhhh.exe 92 PID 4936 wrote to memory of 920 4936 1nnhhh.exe 92 PID 4936 wrote to memory of 920 4936 1nnhhh.exe 92 PID 920 wrote to memory of 1272 920 nnhhbb.exe 93 PID 920 wrote to memory of 1272 920 nnhhbb.exe 93 PID 920 wrote to memory of 1272 920 nnhhbb.exe 93 PID 1272 wrote to memory of 3672 1272 dpvvj.exe 94 PID 1272 wrote to memory of 3672 1272 dpvvj.exe 94 PID 1272 wrote to memory of 3672 1272 dpvvj.exe 94 PID 3672 wrote to memory of 5056 3672 rfxxfxr.exe 95 PID 3672 wrote to memory of 5056 3672 rfxxfxr.exe 95 PID 3672 wrote to memory of 5056 3672 rfxxfxr.exe 95 PID 5056 wrote to memory of 32 5056 nhthnn.exe 96 PID 5056 wrote to memory of 32 5056 nhthnn.exe 96 PID 5056 wrote to memory of 32 5056 nhthnn.exe 96 PID 32 wrote to memory of 3620 32 vpvdv.exe 97 PID 32 wrote to memory of 3620 32 vpvdv.exe 97 PID 32 wrote to memory of 3620 32 vpvdv.exe 97 PID 3620 wrote to memory of 2872 3620 bhnhbt.exe 98 PID 3620 wrote to memory of 2872 3620 bhnhbt.exe 98 PID 3620 wrote to memory of 2872 3620 bhnhbt.exe 98 PID 2872 wrote to memory of 2904 2872 lxllrlr.exe 99 PID 2872 wrote to memory of 2904 2872 lxllrlr.exe 99 PID 2872 wrote to memory of 2904 2872 lxllrlr.exe 99 PID 2904 wrote to memory of 2244 2904 hbhbhb.exe 100 PID 2904 wrote to memory of 2244 2904 hbhbhb.exe 100 PID 2904 wrote to memory of 2244 2904 hbhbhb.exe 100 PID 2244 wrote to memory of 1088 2244 pjdjj.exe 101 PID 2244 wrote to memory of 1088 2244 pjdjj.exe 101 PID 2244 wrote to memory of 1088 2244 pjdjj.exe 101 PID 1088 wrote to memory of 4652 1088 jdpjv.exe 102 PID 1088 wrote to memory of 4652 1088 jdpjv.exe 102 PID 1088 wrote to memory of 4652 1088 jdpjv.exe 102 PID 4652 wrote to memory of 3940 4652 xrrlfxx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce94f91f14606ad5d92ecfa1bf328b2277502cf48785e8d9ea25b260e23c059d.exe"C:\Users\Admin\AppData\Local\Temp\ce94f91f14606ad5d92ecfa1bf328b2277502cf48785e8d9ea25b260e23c059d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\tnnbtt.exec:\tnnbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\frlffxr.exec:\frlffxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\xllfxrl.exec:\xllfxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\ttnhbb.exec:\ttnhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\ddpjd.exec:\ddpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\djjdj.exec:\djjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\tnttbb.exec:\tnttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\pdjdd.exec:\pdjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\dpvjd.exec:\dpvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\1nnhhh.exec:\1nnhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\nnhhbb.exec:\nnhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\dpvvj.exec:\dpvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\rfxxfxr.exec:\rfxxfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\nhthnn.exec:\nhthnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\vpvdv.exec:\vpvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\bhnhbt.exec:\bhnhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\lxllrlr.exec:\lxllrlr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hbhbhb.exec:\hbhbhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\pjdjj.exec:\pjdjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\jdpjv.exec:\jdpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\5bnnbh.exec:\5bnnbh.exe23⤵
- Executes dropped EXE
PID:3940 -
\??\c:\jdvpj.exec:\jdvpj.exe24⤵
- Executes dropped EXE
PID:4628 -
\??\c:\lxrrlfl.exec:\lxrrlfl.exe25⤵
- Executes dropped EXE
PID:2996 -
\??\c:\5llfxfx.exec:\5llfxfx.exe26⤵
- Executes dropped EXE
PID:4100 -
\??\c:\nhhhbb.exec:\nhhhbb.exe27⤵
- Executes dropped EXE
PID:3696 -
\??\c:\9vdvp.exec:\9vdvp.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xxrfxrl.exec:\xxrfxrl.exe29⤵
- Executes dropped EXE
PID:3500 -
\??\c:\5ppjd.exec:\5ppjd.exe30⤵
- Executes dropped EXE
PID:4212 -
\??\c:\hnnhbb.exec:\hnnhbb.exe31⤵
- Executes dropped EXE
PID:4400 -
\??\c:\bhnhhh.exec:\bhnhhh.exe32⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lxrlrrl.exec:\lxrlrrl.exe33⤵
- Executes dropped EXE
PID:4916 -
\??\c:\3bhbtb.exec:\3bhbtb.exe34⤵
- Executes dropped EXE
PID:3244 -
\??\c:\rrllfff.exec:\rrllfff.exe35⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lflrllf.exec:\lflrllf.exe36⤵
- Executes dropped EXE
PID:3108 -
\??\c:\9ppjd.exec:\9ppjd.exe37⤵
- Executes dropped EXE
PID:3664 -
\??\c:\nhhtbn.exec:\nhhtbn.exe38⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nntnnb.exec:\nntnnb.exe39⤵
- Executes dropped EXE
PID:3276 -
\??\c:\5jpjj.exec:\5jpjj.exe40⤵
- Executes dropped EXE
PID:4168 -
\??\c:\xrllffl.exec:\xrllffl.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nbbttt.exec:\nbbttt.exe42⤵
- Executes dropped EXE
PID:3200 -
\??\c:\dvddd.exec:\dvddd.exe43⤵
- Executes dropped EXE
PID:264 -
\??\c:\llrrrxx.exec:\llrrrxx.exe44⤵
- Executes dropped EXE
PID:3516 -
\??\c:\1bbttt.exec:\1bbttt.exe45⤵
- Executes dropped EXE
PID:3576 -
\??\c:\vpddv.exec:\vpddv.exe46⤵
- Executes dropped EXE
PID:384 -
\??\c:\dvvpj.exec:\dvvpj.exe47⤵
- Executes dropped EXE
PID:632 -
\??\c:\xrfxlrr.exec:\xrfxlrr.exe48⤵
- Executes dropped EXE
PID:4236 -
\??\c:\thnhhn.exec:\thnhhn.exe49⤵
- Executes dropped EXE
PID:3240 -
\??\c:\vpppj.exec:\vpppj.exe50⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ffrlffx.exec:\ffrlffx.exe51⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bbbbtt.exec:\bbbbtt.exe52⤵
- Executes dropped EXE
PID:1172 -
\??\c:\jdjjp.exec:\jdjjp.exe53⤵
- Executes dropped EXE
PID:4788 -
\??\c:\ppvvd.exec:\ppvvd.exe54⤵
- Executes dropped EXE
PID:4312 -
\??\c:\lfffrrr.exec:\lfffrrr.exe55⤵
- Executes dropped EXE
PID:3568 -
\??\c:\nhhtnn.exec:\nhhtnn.exe56⤵
- Executes dropped EXE
PID:4420 -
\??\c:\7vvpj.exec:\7vvpj.exe57⤵
- Executes dropped EXE
PID:3512 -
\??\c:\pvjdj.exec:\pvjdj.exe58⤵
- Executes dropped EXE
PID:3604 -
\??\c:\xffxxff.exec:\xffxxff.exe59⤵
- Executes dropped EXE
PID:4304 -
\??\c:\tnnbbt.exec:\tnnbbt.exe60⤵
- Executes dropped EXE
PID:4780 -
\??\c:\ddjvp.exec:\ddjvp.exe61⤵
- Executes dropped EXE
PID:4204 -
\??\c:\lllfxfx.exec:\lllfxfx.exe62⤵
- Executes dropped EXE
PID:3408 -
\??\c:\btttnn.exec:\btttnn.exe63⤵
- Executes dropped EXE
PID:1400 -
\??\c:\jjddd.exec:\jjddd.exe64⤵
- Executes dropped EXE
PID:5068 -
\??\c:\fxfffff.exec:\fxfffff.exe65⤵
- Executes dropped EXE
PID:3676 -
\??\c:\tttnbt.exec:\tttnbt.exe66⤵PID:1912
-
\??\c:\hnhbtn.exec:\hnhbtn.exe67⤵PID:460
-
\??\c:\1jjvv.exec:\1jjvv.exe68⤵PID:3836
-
\??\c:\rrrlflf.exec:\rrrlflf.exe69⤵PID:3348
-
\??\c:\bntnhh.exec:\bntnhh.exe70⤵PID:4840
-
\??\c:\1ddvp.exec:\1ddvp.exe71⤵PID:2892
-
\??\c:\rlrxrlf.exec:\rlrxrlf.exe72⤵PID:2952
-
\??\c:\llfrffl.exec:\llfrffl.exe73⤵PID:4508
-
\??\c:\nttnnt.exec:\nttnnt.exe74⤵PID:1028
-
\??\c:\ddpdd.exec:\ddpdd.exe75⤵PID:4180
-
\??\c:\9flflff.exec:\9flflff.exe76⤵PID:3728
-
\??\c:\nnnhhb.exec:\nnnhhb.exe77⤵PID:4912
-
\??\c:\pdppv.exec:\pdppv.exe78⤵PID:2148
-
\??\c:\rflffrx.exec:\rflffrx.exe79⤵PID:4024
-
\??\c:\tttnnh.exec:\tttnnh.exe80⤵PID:2316
-
\??\c:\djdvp.exec:\djdvp.exe81⤵PID:1588
-
\??\c:\xrlfxrf.exec:\xrlfxrf.exe82⤵PID:3856
-
\??\c:\nbtnbb.exec:\nbtnbb.exe83⤵PID:3156
-
\??\c:\jdjjd.exec:\jdjjd.exe84⤵PID:3980
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe85⤵PID:1980
-
\??\c:\flrlffx.exec:\flrlffx.exe86⤵PID:4480
-
\??\c:\nhhbhh.exec:\nhhbhh.exe87⤵PID:4528
-
\??\c:\jjjjd.exec:\jjjjd.exe88⤵PID:2868
-
\??\c:\rllfxrx.exec:\rllfxrx.exe89⤵PID:4804
-
\??\c:\hthbbn.exec:\hthbbn.exe90⤵PID:1580
-
\??\c:\dvpjj.exec:\dvpjj.exe91⤵PID:4964
-
\??\c:\lffxxxx.exec:\lffxxxx.exe92⤵PID:2140
-
\??\c:\rrxlffx.exec:\rrxlffx.exe93⤵PID:3236
-
\??\c:\9tbtbt.exec:\9tbtbt.exe94⤵PID:4756
-
\??\c:\dvjdv.exec:\dvjdv.exe95⤵PID:4892
-
\??\c:\rffxxrf.exec:\rffxxrf.exe96⤵PID:4856
-
\??\c:\tbthnh.exec:\tbthnh.exe97⤵PID:4212
-
\??\c:\bnhbbb.exec:\bnhbbb.exe98⤵PID:1128
-
\??\c:\vdjpd.exec:\vdjpd.exe99⤵PID:2060
-
\??\c:\5rrlffx.exec:\5rrlffx.exe100⤵PID:3212
-
\??\c:\5rlfxfx.exec:\5rlfxfx.exe101⤵PID:544
-
\??\c:\jjddv.exec:\jjddv.exe102⤵PID:2380
-
\??\c:\vjvpp.exec:\vjvpp.exe103⤵PID:3028
-
\??\c:\fffxlfx.exec:\fffxlfx.exe104⤵PID:5016
-
\??\c:\tnnbnn.exec:\tnnbnn.exe105⤵PID:1776
-
\??\c:\7jvvp.exec:\7jvvp.exe106⤵PID:2396
-
\??\c:\xrlrffr.exec:\xrlrffr.exe107⤵PID:216
-
\??\c:\thnhnh.exec:\thnhnh.exe108⤵PID:3276
-
\??\c:\tnhhhh.exec:\tnhhhh.exe109⤵PID:4200
-
\??\c:\rllfxxx.exec:\rllfxxx.exe110⤵PID:4432
-
\??\c:\hnhbbb.exec:\hnhbbb.exe111⤵PID:4228
-
\??\c:\hhnhhb.exec:\hhnhhb.exe112⤵PID:264
-
\??\c:\5vpvv.exec:\5vpvv.exe113⤵PID:1916
-
\??\c:\frxrrlf.exec:\frxrrlf.exe114⤵PID:4268
-
\??\c:\9bnttt.exec:\9bnttt.exe115⤵PID:5052
-
\??\c:\ttttbb.exec:\ttttbb.exe116⤵PID:4576
-
\??\c:\ddjjp.exec:\ddjjp.exe117⤵PID:3756
-
\??\c:\5flffll.exec:\5flffll.exe118⤵PID:2052
-
\??\c:\1bnhbb.exec:\1bnhbb.exe119⤵PID:4388
-
\??\c:\1vpjj.exec:\1vpjj.exe120⤵PID:2504
-
\??\c:\flrrxxf.exec:\flrrxxf.exe121⤵PID:2412
-
\??\c:\nhnhhh.exec:\nhnhhh.exe122⤵PID:4324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-