Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe
-
Size
455KB
-
MD5
67b70c6e5e6847b4beacabaf4252bab2
-
SHA1
2c3d0532c625043bdac6cca809ce50a0b5f6187c
-
SHA256
aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83
-
SHA512
199a9ec6c6133e530daf182b983c9c5fb22d74e82d1f3d33548f4e73e5264da446403763a051dfff820d39daaac411aa50f19e48607ddec9aea8cb1a90191b18
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/876-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-1046-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-1102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-1231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-1425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-1589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1976 flrlffx.exe 3000 bbbtnn.exe 3964 dvdvd.exe 4028 lfflflx.exe 3036 lrrlxrl.exe 3220 btnhtt.exe 4048 9vvpj.exe 220 ddjjj.exe 1040 1rrlxxr.exe 1384 7ntnnn.exe 1600 bbnbbb.exe 216 jvvpj.exe 4052 lxfflrx.exe 1416 htbtnn.exe 4276 jddvp.exe 2304 9vppj.exe 4652 xfflfff.exe 1900 thnhbt.exe 3724 jvdjv.exe 3572 pdjvp.exe 4264 rlrfxrr.exe 4912 3hhnbb.exe 1308 vpvdp.exe 4500 fflflff.exe 3260 5rffxrf.exe 812 bnbttn.exe 2040 jdjdd.exe 1964 fxxxllf.exe 1736 bbbttt.exe 3164 hbbtnn.exe 2952 ppdvp.exe 5024 frxlffx.exe 1684 nbbthh.exe 1656 1jpdd.exe 4820 1ppjd.exe 2324 1ffxrrl.exe 2784 1htntt.exe 1680 hbbthh.exe 932 pdvpj.exe 4376 xlxrrlf.exe 4816 5fxrxxf.exe 3584 3ntntt.exe 3704 djpdv.exe 2612 jdjvp.exe 4892 xlrfxrf.exe 2624 htbbhb.exe 392 ttbthh.exe 4340 dddvj.exe 2088 rlfxlfx.exe 3860 rllfxxr.exe 708 ntbtnt.exe 1472 vvjdj.exe 4572 9jpdv.exe 1920 xlfxrlf.exe 3332 htbthb.exe 3692 nntnnb.exe 4416 5vdvp.exe 5100 xrrlfxr.exe 1924 3hhhbh.exe 4324 9tthbb.exe 3108 7djdp.exe 4320 rllfrrr.exe 1340 lfxrlxr.exe 3668 7hhbbb.exe -
resource yara_rule behavioral2/memory/876-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-1046-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-1065-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 876 wrote to memory of 1976 876 aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe 83 PID 876 wrote to memory of 1976 876 aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe 83 PID 876 wrote to memory of 1976 876 aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe 83 PID 1976 wrote to memory of 3000 1976 flrlffx.exe 84 PID 1976 wrote to memory of 3000 1976 flrlffx.exe 84 PID 1976 wrote to memory of 3000 1976 flrlffx.exe 84 PID 3000 wrote to memory of 3964 3000 bbbtnn.exe 85 PID 3000 wrote to memory of 3964 3000 bbbtnn.exe 85 PID 3000 wrote to memory of 3964 3000 bbbtnn.exe 85 PID 3964 wrote to memory of 4028 3964 dvdvd.exe 86 PID 3964 wrote to memory of 4028 3964 dvdvd.exe 86 PID 3964 wrote to memory of 4028 3964 dvdvd.exe 86 PID 4028 wrote to memory of 3036 4028 lfflflx.exe 87 PID 4028 wrote to memory of 3036 4028 lfflflx.exe 87 PID 4028 wrote to memory of 3036 4028 lfflflx.exe 87 PID 3036 wrote to memory of 3220 3036 lrrlxrl.exe 88 PID 3036 wrote to memory of 3220 3036 lrrlxrl.exe 88 PID 3036 wrote to memory of 3220 3036 lrrlxrl.exe 88 PID 3220 wrote to memory of 4048 3220 btnhtt.exe 89 PID 3220 wrote to memory of 4048 3220 btnhtt.exe 89 PID 3220 wrote to memory of 4048 3220 btnhtt.exe 89 PID 4048 wrote to memory of 220 4048 9vvpj.exe 90 PID 4048 wrote to memory of 220 4048 9vvpj.exe 90 PID 4048 wrote to memory of 220 4048 9vvpj.exe 90 PID 220 wrote to memory of 1040 220 ddjjj.exe 91 PID 220 wrote to memory of 1040 220 ddjjj.exe 91 PID 220 wrote to memory of 1040 220 ddjjj.exe 91 PID 1040 wrote to memory of 1384 1040 1rrlxxr.exe 92 PID 1040 wrote to memory of 1384 1040 1rrlxxr.exe 92 PID 1040 wrote to memory of 1384 1040 1rrlxxr.exe 92 PID 1384 wrote to memory of 1600 1384 7ntnnn.exe 93 PID 1384 wrote to memory of 1600 1384 7ntnnn.exe 93 PID 1384 wrote to memory of 1600 1384 7ntnnn.exe 93 PID 1600 wrote to memory of 216 1600 bbnbbb.exe 94 PID 1600 wrote to memory of 216 1600 bbnbbb.exe 94 PID 1600 wrote to memory of 216 1600 bbnbbb.exe 94 PID 216 wrote to memory of 4052 216 jvvpj.exe 95 PID 216 wrote to memory of 4052 216 jvvpj.exe 95 PID 216 wrote to memory of 4052 216 jvvpj.exe 95 PID 4052 wrote to memory of 1416 4052 lxfflrx.exe 96 PID 4052 wrote to memory of 1416 4052 lxfflrx.exe 96 PID 4052 wrote to memory of 1416 4052 lxfflrx.exe 96 PID 1416 wrote to memory of 4276 1416 htbtnn.exe 97 PID 1416 wrote to memory of 4276 1416 htbtnn.exe 97 PID 1416 wrote to memory of 4276 1416 htbtnn.exe 97 PID 4276 wrote to memory of 2304 4276 jddvp.exe 98 PID 4276 wrote to memory of 2304 4276 jddvp.exe 98 PID 4276 wrote to memory of 2304 4276 jddvp.exe 98 PID 2304 wrote to memory of 4652 2304 9vppj.exe 158 PID 2304 wrote to memory of 4652 2304 9vppj.exe 158 PID 2304 wrote to memory of 4652 2304 9vppj.exe 158 PID 4652 wrote to memory of 1900 4652 xfflfff.exe 100 PID 4652 wrote to memory of 1900 4652 xfflfff.exe 100 PID 4652 wrote to memory of 1900 4652 xfflfff.exe 100 PID 1900 wrote to memory of 3724 1900 thnhbt.exe 101 PID 1900 wrote to memory of 3724 1900 thnhbt.exe 101 PID 1900 wrote to memory of 3724 1900 thnhbt.exe 101 PID 3724 wrote to memory of 3572 3724 jvdjv.exe 102 PID 3724 wrote to memory of 3572 3724 jvdjv.exe 102 PID 3724 wrote to memory of 3572 3724 jvdjv.exe 102 PID 3572 wrote to memory of 4264 3572 pdjvp.exe 103 PID 3572 wrote to memory of 4264 3572 pdjvp.exe 103 PID 3572 wrote to memory of 4264 3572 pdjvp.exe 103 PID 4264 wrote to memory of 4912 4264 rlrfxrr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe"C:\Users\Admin\AppData\Local\Temp\aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\flrlffx.exec:\flrlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\bbbtnn.exec:\bbbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\dvdvd.exec:\dvdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\lfflflx.exec:\lfflflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\btnhtt.exec:\btnhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\9vvpj.exec:\9vvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\ddjjj.exec:\ddjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\1rrlxxr.exec:\1rrlxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\7ntnnn.exec:\7ntnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\bbnbbb.exec:\bbnbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\jvvpj.exec:\jvvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\lxfflrx.exec:\lxfflrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\htbtnn.exec:\htbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\jddvp.exec:\jddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\9vppj.exec:\9vppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\xfflfff.exec:\xfflfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\thnhbt.exec:\thnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\jvdjv.exec:\jvdjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\pdjvp.exec:\pdjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\rlrfxrr.exec:\rlrfxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\3hhnbb.exec:\3hhnbb.exe23⤵
- Executes dropped EXE
PID:4912 -
\??\c:\vpvdp.exec:\vpvdp.exe24⤵
- Executes dropped EXE
PID:1308 -
\??\c:\fflflff.exec:\fflflff.exe25⤵
- Executes dropped EXE
PID:4500 -
\??\c:\5rffxrf.exec:\5rffxrf.exe26⤵
- Executes dropped EXE
PID:3260 -
\??\c:\bnbttn.exec:\bnbttn.exe27⤵
- Executes dropped EXE
PID:812 -
\??\c:\jdjdd.exec:\jdjdd.exe28⤵
- Executes dropped EXE
PID:2040 -
\??\c:\fxxxllf.exec:\fxxxllf.exe29⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bbbttt.exec:\bbbttt.exe30⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hbbtnn.exec:\hbbtnn.exe31⤵
- Executes dropped EXE
PID:3164 -
\??\c:\ppdvp.exec:\ppdvp.exe32⤵
- Executes dropped EXE
PID:2952 -
\??\c:\frxlffx.exec:\frxlffx.exe33⤵
- Executes dropped EXE
PID:5024 -
\??\c:\nbbthh.exec:\nbbthh.exe34⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1jpdd.exec:\1jpdd.exe35⤵
- Executes dropped EXE
PID:1656 -
\??\c:\1ppjd.exec:\1ppjd.exe36⤵
- Executes dropped EXE
PID:4820 -
\??\c:\1ffxrrl.exec:\1ffxrrl.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1htntt.exec:\1htntt.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hbbthh.exec:\hbbthh.exe39⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pdvpj.exec:\pdvpj.exe40⤵
- Executes dropped EXE
PID:932 -
\??\c:\xlxrrlf.exec:\xlxrrlf.exe41⤵
- Executes dropped EXE
PID:4376 -
\??\c:\5fxrxxf.exec:\5fxrxxf.exe42⤵
- Executes dropped EXE
PID:4816 -
\??\c:\3ntntt.exec:\3ntntt.exe43⤵
- Executes dropped EXE
PID:3584 -
\??\c:\djpdv.exec:\djpdv.exe44⤵
- Executes dropped EXE
PID:3704 -
\??\c:\jdjvp.exec:\jdjvp.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xlrfxrf.exec:\xlrfxrf.exe46⤵
- Executes dropped EXE
PID:4892 -
\??\c:\htbbhb.exec:\htbbhb.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\ttbthh.exec:\ttbthh.exe48⤵
- Executes dropped EXE
PID:392 -
\??\c:\dddvj.exec:\dddvj.exe49⤵
- Executes dropped EXE
PID:4340 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe50⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rllfxxr.exec:\rllfxxr.exe51⤵
- Executes dropped EXE
PID:3860 -
\??\c:\ntbtnt.exec:\ntbtnt.exe52⤵
- Executes dropped EXE
PID:708 -
\??\c:\vvjdj.exec:\vvjdj.exe53⤵
- Executes dropped EXE
PID:1472 -
\??\c:\9jpdv.exec:\9jpdv.exe54⤵
- Executes dropped EXE
PID:4572 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe55⤵
- Executes dropped EXE
PID:1920 -
\??\c:\htbthb.exec:\htbthb.exe56⤵
- Executes dropped EXE
PID:3332 -
\??\c:\nntnnb.exec:\nntnnb.exe57⤵
- Executes dropped EXE
PID:3692 -
\??\c:\5vdvp.exec:\5vdvp.exe58⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe59⤵
- Executes dropped EXE
PID:5100 -
\??\c:\3hhhbh.exec:\3hhhbh.exe60⤵
- Executes dropped EXE
PID:1924 -
\??\c:\9tthbb.exec:\9tthbb.exe61⤵
- Executes dropped EXE
PID:4324 -
\??\c:\7djdp.exec:\7djdp.exe62⤵
- Executes dropped EXE
PID:3108 -
\??\c:\rllfrrr.exec:\rllfrrr.exe63⤵
- Executes dropped EXE
PID:4320 -
\??\c:\lfxrlxr.exec:\lfxrlxr.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1340 -
\??\c:\7hhbbb.exec:\7hhbbb.exe65⤵
- Executes dropped EXE
PID:3668 -
\??\c:\djjdj.exec:\djjdj.exe66⤵PID:224
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe67⤵PID:1888
-
\??\c:\httnhh.exec:\httnhh.exe68⤵PID:2600
-
\??\c:\1bhbbb.exec:\1bhbbb.exe69⤵PID:3780
-
\??\c:\jjjdp.exec:\jjjdp.exe70⤵PID:2684
-
\??\c:\xrrfxff.exec:\xrrfxff.exe71⤵PID:1488
-
\??\c:\bnhbtn.exec:\bnhbtn.exe72⤵PID:1160
-
\??\c:\dppjv.exec:\dppjv.exe73⤵PID:5012
-
\??\c:\rllrllf.exec:\rllrllf.exe74⤵PID:4032
-
\??\c:\3hnhhh.exec:\3hnhhh.exe75⤵PID:1844
-
\??\c:\pppjd.exec:\pppjd.exe76⤵PID:1864
-
\??\c:\rflfrrl.exec:\rflfrrl.exe77⤵PID:4652
-
\??\c:\hnnhbb.exec:\hnnhbb.exe78⤵PID:4728
-
\??\c:\1vppv.exec:\1vppv.exe79⤵PID:3252
-
\??\c:\fflfxlf.exec:\fflfxlf.exe80⤵PID:1604
-
\??\c:\ntbtbb.exec:\ntbtbb.exe81⤵PID:4488
-
\??\c:\ddpjp.exec:\ddpjp.exe82⤵PID:1308
-
\??\c:\vppjj.exec:\vppjj.exe83⤵PID:1332
-
\??\c:\rrrxxxr.exec:\rrrxxxr.exe84⤵PID:2188
-
\??\c:\thbttt.exec:\thbttt.exe85⤵PID:468
-
\??\c:\ddjdd.exec:\ddjdd.exe86⤵PID:1080
-
\??\c:\xxfxxff.exec:\xxfxxff.exe87⤵PID:32
-
\??\c:\7ntnhh.exec:\7ntnhh.exe88⤵PID:1612
-
\??\c:\vpvvp.exec:\vpvvp.exe89⤵PID:3984
-
\??\c:\3dpjj.exec:\3dpjj.exe90⤵PID:4700
-
\??\c:\1ffxrfl.exec:\1ffxrfl.exe91⤵PID:1684
-
\??\c:\5tbtnn.exec:\5tbtnn.exe92⤵PID:3228
-
\??\c:\1djjj.exec:\1djjj.exe93⤵
- System Location Discovery: System Language Discovery
PID:2060 -
\??\c:\vpjjj.exec:\vpjjj.exe94⤵PID:1716
-
\??\c:\lrlrlrl.exec:\lrlrlrl.exe95⤵PID:4556
-
\??\c:\hhnnnn.exec:\hhnnnn.exe96⤵PID:3284
-
\??\c:\jvjjj.exec:\jvjjj.exe97⤵PID:1880
-
\??\c:\9tbbtb.exec:\9tbbtb.exe98⤵PID:3656
-
\??\c:\jdddv.exec:\jdddv.exe99⤵PID:3704
-
\??\c:\rffxxll.exec:\rffxxll.exe100⤵PID:4164
-
\??\c:\nntttt.exec:\nntttt.exe101⤵PID:2624
-
\??\c:\jpdvp.exec:\jpdvp.exe102⤵PID:4544
-
\??\c:\nhhhht.exec:\nhhhht.exe103⤵PID:2088
-
\??\c:\7dvvj.exec:\7dvvj.exe104⤵PID:2648
-
\??\c:\xrfffff.exec:\xrfffff.exe105⤵PID:1916
-
\??\c:\9bbhbh.exec:\9bbhbh.exe106⤵PID:4024
-
\??\c:\httnnb.exec:\httnnb.exe107⤵PID:1300
-
\??\c:\dvjjp.exec:\dvjjp.exe108⤵PID:3372
-
\??\c:\9xxxrxr.exec:\9xxxrxr.exe109⤵PID:2628
-
\??\c:\rfxrllr.exec:\rfxrllr.exe110⤵PID:4588
-
\??\c:\5bbbbh.exec:\5bbbbh.exe111⤵PID:3996
-
\??\c:\vjjjj.exec:\vjjjj.exe112⤵PID:4408
-
\??\c:\rfrlffx.exec:\rfrlffx.exe113⤵PID:4384
-
\??\c:\bbnnhh.exec:\bbnnhh.exe114⤵PID:4836
-
\??\c:\xrffrrx.exec:\xrffrrx.exe115⤵PID:5036
-
\??\c:\tnnbbh.exec:\tnnbbh.exe116⤵PID:4148
-
\??\c:\pdvdj.exec:\pdvdj.exe117⤵PID:4404
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe118⤵PID:1120
-
\??\c:\thnhbb.exec:\thnhbb.exe119⤵PID:2244
-
\??\c:\pjdvj.exec:\pjdvj.exe120⤵PID:1976
-
\??\c:\rflllfx.exec:\rflllfx.exe121⤵PID:4916
-
\??\c:\hbnhnh.exec:\hbnhnh.exe122⤵PID:2056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-