Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa3185f055f6bcba8c51079afb0a1b936417d860b3c9ca30e43317c85115bed1N.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
aa3185f055f6bcba8c51079afb0a1b936417d860b3c9ca30e43317c85115bed1N.exe
-
Size
453KB
-
MD5
07d322900b6440a93012c76cb0e13cc0
-
SHA1
2d2d3cc95c1e9951c80653757a9b340d0655a839
-
SHA256
aa3185f055f6bcba8c51079afb0a1b936417d860b3c9ca30e43317c85115bed1
-
SHA512
11874ffdc10009e9b35ad5a9f09b1044186aa04bffb52bb7ab11cc75fbaad4ba277521ffba44ad2021949a3e6d99c326f3e0565227feee2d7c13844a75486e2e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2948-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-792-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-1050-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-1073-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-1150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-1246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-1529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2948 vvdvv.exe 3112 9lxfrrl.exe 4920 lflllrr.exe 2728 dppjd.exe 536 frxrllx.exe 4032 lffxrrl.exe 4012 thnnnh.exe 1960 1lxrrxl.exe 456 tbnhbt.exe 3320 vdpjd.exe 3612 5xffxfx.exe 4776 tntnnn.exe 980 bhhbhh.exe 4528 rlxrrxr.exe 4656 rxlffff.exe 1080 9hntnb.exe 5004 pdpjp.exe 3240 5rrlffx.exe 844 nbhhtt.exe 1576 vdddd.exe 3624 pvjdv.exe 3952 lflxrrl.exe 372 tbnnhh.exe 4780 9vjdd.exe 4180 3rrrlrx.exe 2860 rrffxxx.exe 1672 nhnnnn.exe 4544 jjvvv.exe 4620 jjvvv.exe 2020 fflxxff.exe 2396 3lxrrxx.exe 3904 hnhhbb.exe 2004 3jvjj.exe 1312 pjjpp.exe 3424 lfrrrrx.exe 4932 hnbbbh.exe 1604 btnnhb.exe 1144 pjppd.exe 1132 1llfxrr.exe 2188 rrlrrff.exe 5032 tbtbbh.exe 1956 5bhhht.exe 4588 pdppj.exe 2340 fflrrrr.exe 2276 xfxxrrr.exe 1424 nnhnbt.exe 3340 vvpdv.exe 220 vjvvv.exe 4752 rffxrrl.exe 4636 9nhbbb.exe 1964 1hnnnh.exe 3448 jdppj.exe 1268 xfrrrrr.exe 624 fxrrrll.exe 1796 ttbbhh.exe 4992 pvppp.exe 2684 rrxrlrr.exe 3924 1jpdd.exe 1856 rxlffll.exe 5064 bntttb.exe 4424 llrrrrx.exe 4748 tbhbhh.exe 3108 dvjjd.exe 1116 jjvpj.exe -
resource yara_rule behavioral2/memory/2948-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-1050-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-1073-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffxllf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 2948 4456 aa3185f055f6bcba8c51079afb0a1b936417d860b3c9ca30e43317c85115bed1N.exe 82 PID 4456 wrote to memory of 2948 4456 aa3185f055f6bcba8c51079afb0a1b936417d860b3c9ca30e43317c85115bed1N.exe 82 PID 4456 wrote to memory of 2948 4456 aa3185f055f6bcba8c51079afb0a1b936417d860b3c9ca30e43317c85115bed1N.exe 82 PID 2948 wrote to memory of 3112 2948 vvdvv.exe 83 PID 2948 wrote to memory of 3112 2948 vvdvv.exe 83 PID 2948 wrote to memory of 3112 2948 vvdvv.exe 83 PID 3112 wrote to memory of 4920 3112 9lxfrrl.exe 84 PID 3112 wrote to memory of 4920 3112 9lxfrrl.exe 84 PID 3112 wrote to memory of 4920 3112 9lxfrrl.exe 84 PID 4920 wrote to memory of 2728 4920 lflllrr.exe 85 PID 4920 wrote to memory of 2728 4920 lflllrr.exe 85 PID 4920 wrote to memory of 2728 4920 lflllrr.exe 85 PID 2728 wrote to memory of 536 2728 dppjd.exe 86 PID 2728 wrote to memory of 536 2728 dppjd.exe 86 PID 2728 wrote to memory of 536 2728 dppjd.exe 86 PID 536 wrote to memory of 4032 536 frxrllx.exe 87 PID 536 wrote to memory of 4032 536 frxrllx.exe 87 PID 536 wrote to memory of 4032 536 frxrllx.exe 87 PID 4032 wrote to memory of 4012 4032 lffxrrl.exe 88 PID 4032 wrote to memory of 4012 4032 lffxrrl.exe 88 PID 4032 wrote to memory of 4012 4032 lffxrrl.exe 88 PID 4012 wrote to memory of 1960 4012 thnnnh.exe 89 PID 4012 wrote to memory of 1960 4012 thnnnh.exe 89 PID 4012 wrote to memory of 1960 4012 thnnnh.exe 89 PID 1960 wrote to memory of 456 1960 1lxrrxl.exe 90 PID 1960 wrote to memory of 456 1960 1lxrrxl.exe 90 PID 1960 wrote to memory of 456 1960 1lxrrxl.exe 90 PID 456 wrote to memory of 3320 456 tbnhbt.exe 91 PID 456 wrote to memory of 3320 456 tbnhbt.exe 91 PID 456 wrote to memory of 3320 456 tbnhbt.exe 91 PID 3320 wrote to memory of 3612 3320 vdpjd.exe 92 PID 3320 wrote to memory of 3612 3320 vdpjd.exe 92 PID 3320 wrote to memory of 3612 3320 vdpjd.exe 92 PID 3612 wrote to memory of 4776 3612 5xffxfx.exe 93 PID 3612 wrote to memory of 4776 3612 5xffxfx.exe 93 PID 3612 wrote to memory of 4776 3612 5xffxfx.exe 93 PID 4776 wrote to memory of 980 4776 tntnnn.exe 94 PID 4776 wrote to memory of 980 4776 tntnnn.exe 94 PID 4776 wrote to memory of 980 4776 tntnnn.exe 94 PID 980 wrote to memory of 4528 980 bhhbhh.exe 95 PID 980 wrote to memory of 4528 980 bhhbhh.exe 95 PID 980 wrote to memory of 4528 980 bhhbhh.exe 95 PID 4528 wrote to memory of 4656 4528 rlxrrxr.exe 96 PID 4528 wrote to memory of 4656 4528 rlxrrxr.exe 96 PID 4528 wrote to memory of 4656 4528 rlxrrxr.exe 96 PID 4656 wrote to memory of 1080 4656 rxlffff.exe 97 PID 4656 wrote to memory of 1080 4656 rxlffff.exe 97 PID 4656 wrote to memory of 1080 4656 rxlffff.exe 97 PID 1080 wrote to memory of 5004 1080 9hntnb.exe 98 PID 1080 wrote to memory of 5004 1080 9hntnb.exe 98 PID 1080 wrote to memory of 5004 1080 9hntnb.exe 98 PID 5004 wrote to memory of 3240 5004 pdpjp.exe 99 PID 5004 wrote to memory of 3240 5004 pdpjp.exe 99 PID 5004 wrote to memory of 3240 5004 pdpjp.exe 99 PID 3240 wrote to memory of 844 3240 5rrlffx.exe 100 PID 3240 wrote to memory of 844 3240 5rrlffx.exe 100 PID 3240 wrote to memory of 844 3240 5rrlffx.exe 100 PID 844 wrote to memory of 1576 844 nbhhtt.exe 101 PID 844 wrote to memory of 1576 844 nbhhtt.exe 101 PID 844 wrote to memory of 1576 844 nbhhtt.exe 101 PID 1576 wrote to memory of 3624 1576 vdddd.exe 102 PID 1576 wrote to memory of 3624 1576 vdddd.exe 102 PID 1576 wrote to memory of 3624 1576 vdddd.exe 102 PID 3624 wrote to memory of 3952 3624 pvjdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa3185f055f6bcba8c51079afb0a1b936417d860b3c9ca30e43317c85115bed1N.exe"C:\Users\Admin\AppData\Local\Temp\aa3185f055f6bcba8c51079afb0a1b936417d860b3c9ca30e43317c85115bed1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\vvdvv.exec:\vvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\9lxfrrl.exec:\9lxfrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\lflllrr.exec:\lflllrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\dppjd.exec:\dppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\frxrllx.exec:\frxrllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\lffxrrl.exec:\lffxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\thnnnh.exec:\thnnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\1lxrrxl.exec:\1lxrrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\tbnhbt.exec:\tbnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\vdpjd.exec:\vdpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\5xffxfx.exec:\5xffxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\tntnnn.exec:\tntnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\bhhbhh.exec:\bhhbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\rlxrrxr.exec:\rlxrrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\rxlffff.exec:\rxlffff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\9hntnb.exec:\9hntnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\pdpjp.exec:\pdpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\5rrlffx.exec:\5rrlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\nbhhtt.exec:\nbhhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\vdddd.exec:\vdddd.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\pvjdv.exec:\pvjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\lflxrrl.exec:\lflxrrl.exe23⤵
- Executes dropped EXE
PID:3952 -
\??\c:\tbnnhh.exec:\tbnnhh.exe24⤵
- Executes dropped EXE
PID:372 -
\??\c:\9vjdd.exec:\9vjdd.exe25⤵
- Executes dropped EXE
PID:4780 -
\??\c:\3rrrlrx.exec:\3rrrlrx.exe26⤵
- Executes dropped EXE
PID:4180 -
\??\c:\rrffxxx.exec:\rrffxxx.exe27⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nhnnnn.exec:\nhnnnn.exe28⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jjvvv.exec:\jjvvv.exe29⤵
- Executes dropped EXE
PID:4544 -
\??\c:\jjvvv.exec:\jjvvv.exe30⤵
- Executes dropped EXE
PID:4620 -
\??\c:\fflxxff.exec:\fflxxff.exe31⤵
- Executes dropped EXE
PID:2020 -
\??\c:\3lxrrxx.exec:\3lxrrxx.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hnhhbb.exec:\hnhhbb.exe33⤵
- Executes dropped EXE
PID:3904 -
\??\c:\3jvjj.exec:\3jvjj.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pjjpp.exec:\pjjpp.exe35⤵
- Executes dropped EXE
PID:1312 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe36⤵
- Executes dropped EXE
PID:3424 -
\??\c:\hnbbbh.exec:\hnbbbh.exe37⤵
- Executes dropped EXE
PID:4932 -
\??\c:\btnnhb.exec:\btnnhb.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pjppd.exec:\pjppd.exe39⤵
- Executes dropped EXE
PID:1144 -
\??\c:\1llfxrr.exec:\1llfxrr.exe40⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rrlrrff.exec:\rrlrrff.exe41⤵
- Executes dropped EXE
PID:2188 -
\??\c:\tbtbbh.exec:\tbtbbh.exe42⤵
- Executes dropped EXE
PID:5032 -
\??\c:\5bhhht.exec:\5bhhht.exe43⤵
- Executes dropped EXE
PID:1956 -
\??\c:\pdppj.exec:\pdppj.exe44⤵
- Executes dropped EXE
PID:4588 -
\??\c:\fflrrrr.exec:\fflrrrr.exe45⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xfxxrrr.exec:\xfxxrrr.exe46⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nnhnbt.exec:\nnhnbt.exe47⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vvpdv.exec:\vvpdv.exe48⤵
- Executes dropped EXE
PID:3340 -
\??\c:\vjvvv.exec:\vjvvv.exe49⤵
- Executes dropped EXE
PID:220 -
\??\c:\rffxrrl.exec:\rffxrrl.exe50⤵
- Executes dropped EXE
PID:4752 -
\??\c:\9nhbbb.exec:\9nhbbb.exe51⤵
- Executes dropped EXE
PID:4636 -
\??\c:\1hnnnh.exec:\1hnnnh.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jdppj.exec:\jdppj.exe53⤵
- Executes dropped EXE
PID:3448 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe54⤵
- Executes dropped EXE
PID:1268 -
\??\c:\fxrrrll.exec:\fxrrrll.exe55⤵
- Executes dropped EXE
PID:624 -
\??\c:\ttbbhh.exec:\ttbbhh.exe56⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pvppp.exec:\pvppp.exe57⤵
- Executes dropped EXE
PID:4992 -
\??\c:\rrxrlrr.exec:\rrxrlrr.exe58⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1jpdd.exec:\1jpdd.exe59⤵
- Executes dropped EXE
PID:3924 -
\??\c:\rxlffll.exec:\rxlffll.exe60⤵
- Executes dropped EXE
PID:1856 -
\??\c:\bntttb.exec:\bntttb.exe61⤵
- Executes dropped EXE
PID:5064 -
\??\c:\llrrrrx.exec:\llrrrrx.exe62⤵
- Executes dropped EXE
PID:4424 -
\??\c:\tbhbhh.exec:\tbhbhh.exe63⤵
- Executes dropped EXE
PID:4748 -
\??\c:\dvjjd.exec:\dvjjd.exe64⤵
- Executes dropped EXE
PID:3108 -
\??\c:\jjvpj.exec:\jjvpj.exe65⤵
- Executes dropped EXE
PID:1116 -
\??\c:\fxlllrr.exec:\fxlllrr.exe66⤵PID:3184
-
\??\c:\7xffxff.exec:\7xffxff.exe67⤵
- System Location Discovery: System Language Discovery
PID:4484 -
\??\c:\jdpvd.exec:\jdpvd.exe68⤵PID:1644
-
\??\c:\xxffflr.exec:\xxffflr.exe69⤵PID:688
-
\??\c:\nntbbh.exec:\nntbbh.exe70⤵PID:2300
-
\??\c:\jvvpv.exec:\jvvpv.exe71⤵PID:2588
-
\??\c:\fllxrrx.exec:\fllxrrx.exe72⤵PID:4064
-
\??\c:\jdjjj.exec:\jdjjj.exe73⤵PID:964
-
\??\c:\frffxfl.exec:\frffxfl.exe74⤵PID:2028
-
\??\c:\jdjjd.exec:\jdjjd.exe75⤵PID:556
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe76⤵PID:2796
-
\??\c:\nbnhhn.exec:\nbnhhn.exe77⤵PID:2140
-
\??\c:\bbnnnn.exec:\bbnnnn.exe78⤵PID:4444
-
\??\c:\ntbntn.exec:\ntbntn.exe79⤵PID:3612
-
\??\c:\7pppp.exec:\7pppp.exe80⤵PID:1444
-
\??\c:\rllffxr.exec:\rllffxr.exe81⤵PID:4828
-
\??\c:\bnnhhh.exec:\bnnhhh.exe82⤵PID:4528
-
\??\c:\pjpjj.exec:\pjpjj.exe83⤵PID:4280
-
\??\c:\xlrlfff.exec:\xlrlfff.exe84⤵PID:2688
-
\??\c:\bhbbhn.exec:\bhbbhn.exe85⤵PID:4168
-
\??\c:\nhttnb.exec:\nhttnb.exe86⤵PID:1932
-
\??\c:\ddppj.exec:\ddppj.exe87⤵PID:836
-
\??\c:\rxxrllf.exec:\rxxrllf.exe88⤵PID:4796
-
\??\c:\hhbthb.exec:\hhbthb.exe89⤵PID:516
-
\??\c:\dvdvv.exec:\dvdvv.exe90⤵PID:5036
-
\??\c:\fllfxrf.exec:\fllfxrf.exe91⤵PID:2100
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe92⤵PID:1252
-
\??\c:\1hnnhn.exec:\1hnnhn.exe93⤵PID:2480
-
\??\c:\pjppp.exec:\pjppp.exe94⤵PID:2960
-
\??\c:\rxfllxf.exec:\rxfllxf.exe95⤵PID:1492
-
\??\c:\rrffffl.exec:\rrffffl.exe96⤵PID:4544
-
\??\c:\tnttth.exec:\tnttth.exe97⤵PID:2020
-
\??\c:\3dppj.exec:\3dppj.exe98⤵PID:1568
-
\??\c:\llfrrxf.exec:\llfrrxf.exe99⤵PID:2396
-
\??\c:\bbnnnn.exec:\bbnnnn.exe100⤵PID:1364
-
\??\c:\vvppj.exec:\vvppj.exe101⤵PID:3420
-
\??\c:\rlfflrl.exec:\rlfflrl.exe102⤵PID:1744
-
\??\c:\xxxxrxf.exec:\xxxxrxf.exe103⤵PID:744
-
\??\c:\3nntth.exec:\3nntth.exe104⤵PID:2012
-
\??\c:\pvpjd.exec:\pvpjd.exe105⤵PID:1132
-
\??\c:\frlllxx.exec:\frlllxx.exe106⤵PID:4200
-
\??\c:\fllllrr.exec:\fllllrr.exe107⤵PID:880
-
\??\c:\nntbbh.exec:\nntbbh.exe108⤵PID:4248
-
\??\c:\jjvjj.exec:\jjvjj.exe109⤵PID:5092
-
\??\c:\xfrxlrx.exec:\xfrxlrx.exe110⤵PID:2384
-
\??\c:\thttth.exec:\thttth.exe111⤵PID:2340
-
\??\c:\tbtnnh.exec:\tbtnnh.exe112⤵PID:2276
-
\??\c:\vvvvj.exec:\vvvvj.exe113⤵PID:320
-
\??\c:\7djdd.exec:\7djdd.exe114⤵PID:2248
-
\??\c:\xxflrlr.exec:\xxflrlr.exe115⤵PID:1580
-
\??\c:\hbnttb.exec:\hbnttb.exe116⤵PID:1224
-
\??\c:\thtttt.exec:\thtttt.exe117⤵PID:4384
-
\??\c:\ddppj.exec:\ddppj.exe118⤵PID:2200
-
\??\c:\rxrlxxl.exec:\rxrlxxl.exe119⤵PID:848
-
\??\c:\1xllrxl.exec:\1xllrxl.exe120⤵PID:2680
-
\??\c:\9bhhbb.exec:\9bhhbb.exe121⤵PID:4644
-
\??\c:\vdjdv.exec:\vdjdv.exe122⤵PID:5104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-