Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 09:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe
-
Size
454KB
-
MD5
b247a8511adfe30f9b4f0741d46b6f37
-
SHA1
ccefe69e256d4f83bddf901fe0ee1563f984f114
-
SHA256
61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d
-
SHA512
464c243e7a2eb7297bcd1fa34764dfafb0336a78a5c12ecabbf882694dc79cf5279f79e44ab88d7a90e7334d3364e95e6f9e225ae2bf486681a6e41723aa5c94
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeaP:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2324-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-878-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-906-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4540 5rlxrxr.exe 2396 rrlxxxr.exe 3304 pjddv.exe 3208 xrfffrf.exe 212 flxxffr.exe 2240 vpjdv.exe 1692 1rxrlrr.exe 2228 llrlfrl.exe 4032 rllllrl.exe 1320 jdvpp.exe 804 7jdvp.exe 4416 fxflfrr.exe 3916 ttbbhn.exe 1724 dddvp.exe 404 lrxxrxl.exe 2096 ntttnt.exe 4244 xrrffrx.exe 2696 flrffrr.exe 376 ttbttt.exe 1100 3hhhnb.exe 2192 djjjd.exe 2276 tbhbhh.exe 4076 rllllll.exe 5016 nnbbtt.exe 3920 xffxrrl.exe 4664 pppjd.exe 2296 7bntnb.exe 4196 vdjvv.exe 1408 5pppj.exe 4496 jjddd.exe 4988 htttnb.exe 2024 vvdjd.exe 4256 nhbbbb.exe 1000 vddvv.exe 3964 pvvvd.exe 1792 3jjdd.exe 644 xffxflr.exe 2088 hntthh.exe 4608 dpdvv.exe 4672 rrxllrr.exe 732 7dppj.exe 2076 lllfxxr.exe 3468 xffffll.exe 1904 5thbnt.exe 400 7jvdd.exe 1016 rlrrlll.exe 2356 ffrllrf.exe 3012 bhbttn.exe 4360 1jddj.exe 3248 xfllxfl.exe 688 bhbtnn.exe 3516 tttnhh.exe 3592 9vvpp.exe 5024 1rxflrf.exe 5048 htthbt.exe 4800 1hhbtt.exe 3260 jdvvj.exe 4176 flflxfl.exe 4444 llfrrxf.exe 3376 nhhbbh.exe 4572 pjjjj.exe 4936 ddddd.exe 540 frrlrff.exe 4032 ntnbtb.exe -
resource yara_rule behavioral2/memory/2324-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-878-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 4540 2324 61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe 83 PID 2324 wrote to memory of 4540 2324 61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe 83 PID 2324 wrote to memory of 4540 2324 61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe 83 PID 4540 wrote to memory of 2396 4540 5rlxrxr.exe 84 PID 4540 wrote to memory of 2396 4540 5rlxrxr.exe 84 PID 4540 wrote to memory of 2396 4540 5rlxrxr.exe 84 PID 2396 wrote to memory of 3304 2396 rrlxxxr.exe 85 PID 2396 wrote to memory of 3304 2396 rrlxxxr.exe 85 PID 2396 wrote to memory of 3304 2396 rrlxxxr.exe 85 PID 3304 wrote to memory of 3208 3304 pjddv.exe 86 PID 3304 wrote to memory of 3208 3304 pjddv.exe 86 PID 3304 wrote to memory of 3208 3304 pjddv.exe 86 PID 3208 wrote to memory of 212 3208 xrfffrf.exe 87 PID 3208 wrote to memory of 212 3208 xrfffrf.exe 87 PID 3208 wrote to memory of 212 3208 xrfffrf.exe 87 PID 212 wrote to memory of 2240 212 flxxffr.exe 88 PID 212 wrote to memory of 2240 212 flxxffr.exe 88 PID 212 wrote to memory of 2240 212 flxxffr.exe 88 PID 2240 wrote to memory of 1692 2240 vpjdv.exe 89 PID 2240 wrote to memory of 1692 2240 vpjdv.exe 89 PID 2240 wrote to memory of 1692 2240 vpjdv.exe 89 PID 1692 wrote to memory of 2228 1692 1rxrlrr.exe 90 PID 1692 wrote to memory of 2228 1692 1rxrlrr.exe 90 PID 1692 wrote to memory of 2228 1692 1rxrlrr.exe 90 PID 2228 wrote to memory of 4032 2228 llrlfrl.exe 91 PID 2228 wrote to memory of 4032 2228 llrlfrl.exe 91 PID 2228 wrote to memory of 4032 2228 llrlfrl.exe 91 PID 4032 wrote to memory of 1320 4032 rllllrl.exe 92 PID 4032 wrote to memory of 1320 4032 rllllrl.exe 92 PID 4032 wrote to memory of 1320 4032 rllllrl.exe 92 PID 1320 wrote to memory of 804 1320 jdvpp.exe 93 PID 1320 wrote to memory of 804 1320 jdvpp.exe 93 PID 1320 wrote to memory of 804 1320 jdvpp.exe 93 PID 804 wrote to memory of 4416 804 7jdvp.exe 94 PID 804 wrote to memory of 4416 804 7jdvp.exe 94 PID 804 wrote to memory of 4416 804 7jdvp.exe 94 PID 4416 wrote to memory of 3916 4416 fxflfrr.exe 95 PID 4416 wrote to memory of 3916 4416 fxflfrr.exe 95 PID 4416 wrote to memory of 3916 4416 fxflfrr.exe 95 PID 3916 wrote to memory of 1724 3916 ttbbhn.exe 96 PID 3916 wrote to memory of 1724 3916 ttbbhn.exe 96 PID 3916 wrote to memory of 1724 3916 ttbbhn.exe 96 PID 1724 wrote to memory of 404 1724 dddvp.exe 97 PID 1724 wrote to memory of 404 1724 dddvp.exe 97 PID 1724 wrote to memory of 404 1724 dddvp.exe 97 PID 404 wrote to memory of 2096 404 lrxxrxl.exe 98 PID 404 wrote to memory of 2096 404 lrxxrxl.exe 98 PID 404 wrote to memory of 2096 404 lrxxrxl.exe 98 PID 2096 wrote to memory of 4244 2096 ntttnt.exe 99 PID 2096 wrote to memory of 4244 2096 ntttnt.exe 99 PID 2096 wrote to memory of 4244 2096 ntttnt.exe 99 PID 4244 wrote to memory of 2696 4244 xrrffrx.exe 100 PID 4244 wrote to memory of 2696 4244 xrrffrx.exe 100 PID 4244 wrote to memory of 2696 4244 xrrffrx.exe 100 PID 2696 wrote to memory of 376 2696 flrffrr.exe 101 PID 2696 wrote to memory of 376 2696 flrffrr.exe 101 PID 2696 wrote to memory of 376 2696 flrffrr.exe 101 PID 376 wrote to memory of 1100 376 ttbttt.exe 102 PID 376 wrote to memory of 1100 376 ttbttt.exe 102 PID 376 wrote to memory of 1100 376 ttbttt.exe 102 PID 1100 wrote to memory of 2192 1100 3hhhnb.exe 103 PID 1100 wrote to memory of 2192 1100 3hhhnb.exe 103 PID 1100 wrote to memory of 2192 1100 3hhhnb.exe 103 PID 2192 wrote to memory of 2276 2192 djjjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe"C:\Users\Admin\AppData\Local\Temp\61afc63e8392d2ea4664f099b6012a674860a54325553089010a5f18e3d6819d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\5rlxrxr.exec:\5rlxrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\rrlxxxr.exec:\rrlxxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\pjddv.exec:\pjddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\xrfffrf.exec:\xrfffrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\flxxffr.exec:\flxxffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\vpjdv.exec:\vpjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\1rxrlrr.exec:\1rxrlrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\llrlfrl.exec:\llrlfrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\rllllrl.exec:\rllllrl.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\jdvpp.exec:\jdvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\7jdvp.exec:\7jdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\fxflfrr.exec:\fxflfrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\ttbbhn.exec:\ttbbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\dddvp.exec:\dddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\lrxxrxl.exec:\lrxxrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\ntttnt.exec:\ntttnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\xrrffrx.exec:\xrrffrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\flrffrr.exec:\flrffrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\ttbttt.exec:\ttbttt.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\3hhhnb.exec:\3hhhnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\djjjd.exec:\djjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\tbhbhh.exec:\tbhbhh.exe23⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rllllll.exec:\rllllll.exe24⤵
- Executes dropped EXE
PID:4076 -
\??\c:\nnbbtt.exec:\nnbbtt.exe25⤵
- Executes dropped EXE
PID:5016 -
\??\c:\xffxrrl.exec:\xffxrrl.exe26⤵
- Executes dropped EXE
PID:3920 -
\??\c:\pppjd.exec:\pppjd.exe27⤵
- Executes dropped EXE
PID:4664 -
\??\c:\7bntnb.exec:\7bntnb.exe28⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vdjvv.exec:\vdjvv.exe29⤵
- Executes dropped EXE
PID:4196 -
\??\c:\5pppj.exec:\5pppj.exe30⤵
- Executes dropped EXE
PID:1408 -
\??\c:\jjddd.exec:\jjddd.exe31⤵
- Executes dropped EXE
PID:4496 -
\??\c:\htttnb.exec:\htttnb.exe32⤵
- Executes dropped EXE
PID:4988 -
\??\c:\vvdjd.exec:\vvdjd.exe33⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nhbbbb.exec:\nhbbbb.exe34⤵
- Executes dropped EXE
PID:4256 -
\??\c:\vddvv.exec:\vddvv.exe35⤵
- Executes dropped EXE
PID:1000 -
\??\c:\pvvvd.exec:\pvvvd.exe36⤵
- Executes dropped EXE
PID:3964 -
\??\c:\3jjdd.exec:\3jjdd.exe37⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xffxflr.exec:\xffxflr.exe38⤵
- Executes dropped EXE
PID:644 -
\??\c:\hntthh.exec:\hntthh.exe39⤵
- Executes dropped EXE
PID:2088 -
\??\c:\dpdvv.exec:\dpdvv.exe40⤵
- Executes dropped EXE
PID:4608 -
\??\c:\rrxllrr.exec:\rrxllrr.exe41⤵
- Executes dropped EXE
PID:4672 -
\??\c:\7dppj.exec:\7dppj.exe42⤵
- Executes dropped EXE
PID:732 -
\??\c:\lllfxxr.exec:\lllfxxr.exe43⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xffffll.exec:\xffffll.exe44⤵
- Executes dropped EXE
PID:3468 -
\??\c:\5thbnt.exec:\5thbnt.exe45⤵
- Executes dropped EXE
PID:1904 -
\??\c:\7jvdd.exec:\7jvdd.exe46⤵
- Executes dropped EXE
PID:400 -
\??\c:\rlrrlll.exec:\rlrrlll.exe47⤵
- Executes dropped EXE
PID:1016 -
\??\c:\ffrllrf.exec:\ffrllrf.exe48⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bhbttn.exec:\bhbttn.exe49⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1jddj.exec:\1jddj.exe50⤵
- Executes dropped EXE
PID:4360 -
\??\c:\xfllxfl.exec:\xfllxfl.exe51⤵
- Executes dropped EXE
PID:3248 -
\??\c:\bhbtnn.exec:\bhbtnn.exe52⤵
- Executes dropped EXE
PID:688 -
\??\c:\tttnhh.exec:\tttnhh.exe53⤵
- Executes dropped EXE
PID:3516 -
\??\c:\9vvpp.exec:\9vvpp.exe54⤵
- Executes dropped EXE
PID:3592 -
\??\c:\1rxflrf.exec:\1rxflrf.exe55⤵
- Executes dropped EXE
PID:5024 -
\??\c:\htthbt.exec:\htthbt.exe56⤵
- Executes dropped EXE
PID:5048 -
\??\c:\1hhbtt.exec:\1hhbtt.exe57⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jdvvj.exec:\jdvvj.exe58⤵
- Executes dropped EXE
PID:3260 -
\??\c:\flflxfl.exec:\flflxfl.exe59⤵
- Executes dropped EXE
PID:4176 -
\??\c:\llfrrxf.exec:\llfrrxf.exe60⤵
- Executes dropped EXE
PID:4444 -
\??\c:\nhhbbh.exec:\nhhbbh.exe61⤵
- Executes dropped EXE
PID:3376 -
\??\c:\pjjjj.exec:\pjjjj.exe62⤵
- Executes dropped EXE
PID:4572 -
\??\c:\ddddd.exec:\ddddd.exe63⤵
- Executes dropped EXE
PID:4936 -
\??\c:\frrlrff.exec:\frrlrff.exe64⤵
- Executes dropped EXE
PID:540 -
\??\c:\ntnbtb.exec:\ntnbtb.exe65⤵
- Executes dropped EXE
PID:4032 -
\??\c:\jvdjd.exec:\jvdjd.exe66⤵PID:808
-
\??\c:\1fxxxff.exec:\1fxxxff.exe67⤵PID:432
-
\??\c:\5rrrrxx.exec:\5rrrrxx.exe68⤵PID:2152
-
\??\c:\hhhbbb.exec:\hhhbbb.exe69⤵PID:932
-
\??\c:\3vppp.exec:\3vppp.exe70⤵PID:632
-
\??\c:\xrlffxx.exec:\xrlffxx.exe71⤵PID:3020
-
\??\c:\ttthbt.exec:\ttthbt.exe72⤵PID:2416
-
\??\c:\vvppj.exec:\vvppj.exe73⤵PID:4056
-
\??\c:\9xxlffx.exec:\9xxlffx.exe74⤵PID:5040
-
\??\c:\hbhbtt.exec:\hbhbtt.exe75⤵PID:2080
-
\??\c:\1pjdd.exec:\1pjdd.exe76⤵PID:4084
-
\??\c:\9llfrff.exec:\9llfrff.exe77⤵PID:1848
-
\??\c:\hnnnnn.exec:\hnnnnn.exe78⤵PID:2696
-
\??\c:\bhbbtb.exec:\bhbbtb.exe79⤵PID:3940
-
\??\c:\djjdd.exec:\djjdd.exe80⤵PID:2888
-
\??\c:\fxfxxlf.exec:\fxfxxlf.exe81⤵PID:4356
-
\??\c:\9bttnn.exec:\9bttnn.exe82⤵PID:2704
-
\??\c:\jjjvp.exec:\jjjvp.exe83⤵PID:2308
-
\??\c:\xxrrlll.exec:\xxrrlll.exe84⤵PID:2212
-
\??\c:\nthbhh.exec:\nthbhh.exe85⤵PID:4448
-
\??\c:\5dvpv.exec:\5dvpv.exe86⤵PID:2892
-
\??\c:\5ppjj.exec:\5ppjj.exe87⤵PID:4600
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe88⤵PID:2268
-
\??\c:\1nnnnt.exec:\1nnnnt.exe89⤵PID:4452
-
\??\c:\pvddd.exec:\pvddd.exe90⤵PID:912
-
\??\c:\5dvvv.exec:\5dvvv.exe91⤵PID:4240
-
\??\c:\llrllll.exec:\llrllll.exe92⤵PID:544
-
\??\c:\ttnnhn.exec:\ttnnhn.exe93⤵
- System Location Discovery: System Language Discovery
PID:4484 -
\??\c:\jpjdj.exec:\jpjdj.exe94⤵PID:5028
-
\??\c:\flfrxfr.exec:\flfrxfr.exe95⤵PID:1456
-
\??\c:\tnhbtt.exec:\tnhbtt.exe96⤵PID:748
-
\??\c:\vppjj.exec:\vppjj.exe97⤵PID:4088
-
\??\c:\ddjpj.exec:\ddjpj.exe98⤵PID:3444
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe99⤵PID:1980
-
\??\c:\5ttnhh.exec:\5ttnhh.exe100⤵PID:1000
-
\??\c:\jpjdd.exec:\jpjdd.exe101⤵PID:3148
-
\??\c:\flrfxxx.exec:\flrfxxx.exe102⤵PID:2348
-
\??\c:\flllfrr.exec:\flllfrr.exe103⤵PID:4948
-
\??\c:\bbnnbb.exec:\bbnnbb.exe104⤵PID:2088
-
\??\c:\5jjdv.exec:\5jjdv.exe105⤵PID:3996
-
\??\c:\7pdvd.exec:\7pdvd.exe106⤵PID:1428
-
\??\c:\9lxxxrr.exec:\9lxxxrr.exe107⤵PID:4844
-
\??\c:\ntnhtn.exec:\ntnhtn.exe108⤵PID:552
-
\??\c:\jdjpj.exec:\jdjpj.exe109⤵PID:4068
-
\??\c:\1jjjp.exec:\1jjjp.exe110⤵PID:3000
-
\??\c:\ffxxfxf.exec:\ffxxfxf.exe111⤵PID:2692
-
\??\c:\bbhbhh.exec:\bbhbhh.exe112⤵PID:220
-
\??\c:\vpjvp.exec:\vpjvp.exe113⤵PID:1436
-
\??\c:\1lxxrrl.exec:\1lxxrrl.exe114⤵PID:848
-
\??\c:\ffxrrlf.exec:\ffxrrlf.exe115⤵PID:4428
-
\??\c:\htbtnh.exec:\htbtnh.exe116⤵PID:4812
-
\??\c:\jdpjj.exec:\jdpjj.exe117⤵PID:3504
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe118⤵PID:4464
-
\??\c:\9lxrllf.exec:\9lxrllf.exe119⤵PID:1540
-
\??\c:\7tnbtn.exec:\7tnbtn.exe120⤵PID:836
-
\??\c:\djjdv.exec:\djjdv.exe121⤵PID:3508
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-