Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 09:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
75eafe8847178b986c0f9af748edd551b7b147e84432ed7c5f20d07725b690a1.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
75eafe8847178b986c0f9af748edd551b7b147e84432ed7c5f20d07725b690a1.exe
-
Size
454KB
-
MD5
dc32a8627276fff8d876abb49b9ba70f
-
SHA1
a22ffe3387df68403de5ade06b2c2028d8f783a2
-
SHA256
75eafe8847178b986c0f9af748edd551b7b147e84432ed7c5f20d07725b690a1
-
SHA512
933f0deb24ec46eccf2e0109047c1730d829fac017e37ec31b490c591bccbd48d0673fbf7b0ac2adeb3c7302ad41e18e2a6e6260ee239e34f219fb516bad718d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4688-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/796-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/828-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-806-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-985-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-1073-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-1564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3076 thnntt.exe 2052 xfrlfxr.exe 208 vpppj.exe 664 ddpdd.exe 4988 fxfllfx.exe 4192 pjdjd.exe 3596 xxxrfxr.exe 3748 9httnh.exe 2528 frfrllf.exe 1636 bbhbtt.exe 3988 frrlflf.exe 2692 tnbbhh.exe 3948 vvddv.exe 3000 1tnhtt.exe 796 jjdvj.exe 1720 thtbbn.exe 3664 jpjjj.exe 3252 btbhnb.exe 3616 ddjdd.exe 4496 5xrlfxr.exe 412 jvvvp.exe 4512 1rrlxxr.exe 2732 nbhhbb.exe 4640 jddvv.exe 5008 rrxxrrl.exe 4288 frrfxxf.exe 3384 1tbnhh.exe 1216 pvdvv.exe 852 vvjjd.exe 4636 lxxlxxf.exe 4592 5tttnn.exe 4040 ttnhbt.exe 1012 hnbhnn.exe 1304 jpddv.exe 4716 frrrrrl.exe 4948 9dvjv.exe 384 3lfxrfx.exe 4632 xfxflxf.exe 2256 hhbbtt.exe 2004 djjjd.exe 4832 fxxxrll.exe 5108 hhhbtn.exe 4840 pjjpv.exe 5032 lflfrrl.exe 4668 hthbtt.exe 4028 bnnhhh.exe 4872 pdjdv.exe 4676 xxxxrll.exe 4488 5ttnhn.exe 4068 9bhnhb.exe 4360 vpjjd.exe 400 3lllfff.exe 4688 7bthtn.exe 3156 nhbttt.exe 828 9vjdd.exe 4164 rlllxxr.exe 3736 nbtnnn.exe 2784 ppvvv.exe 4560 vjjdv.exe 4988 xrxrxrx.exe 1656 tbhbtt.exe 904 9jpjj.exe 3576 vdjdv.exe 3480 5llffxx.exe -
resource yara_rule behavioral2/memory/4688-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/796-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/828-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-775-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 3076 4688 75eafe8847178b986c0f9af748edd551b7b147e84432ed7c5f20d07725b690a1.exe 82 PID 4688 wrote to memory of 3076 4688 75eafe8847178b986c0f9af748edd551b7b147e84432ed7c5f20d07725b690a1.exe 82 PID 4688 wrote to memory of 3076 4688 75eafe8847178b986c0f9af748edd551b7b147e84432ed7c5f20d07725b690a1.exe 82 PID 3076 wrote to memory of 2052 3076 thnntt.exe 83 PID 3076 wrote to memory of 2052 3076 thnntt.exe 83 PID 3076 wrote to memory of 2052 3076 thnntt.exe 83 PID 2052 wrote to memory of 208 2052 xfrlfxr.exe 84 PID 2052 wrote to memory of 208 2052 xfrlfxr.exe 84 PID 2052 wrote to memory of 208 2052 xfrlfxr.exe 84 PID 208 wrote to memory of 664 208 vpppj.exe 85 PID 208 wrote to memory of 664 208 vpppj.exe 85 PID 208 wrote to memory of 664 208 vpppj.exe 85 PID 664 wrote to memory of 4988 664 ddpdd.exe 86 PID 664 wrote to memory of 4988 664 ddpdd.exe 86 PID 664 wrote to memory of 4988 664 ddpdd.exe 86 PID 4988 wrote to memory of 4192 4988 fxfllfx.exe 87 PID 4988 wrote to memory of 4192 4988 fxfllfx.exe 87 PID 4988 wrote to memory of 4192 4988 fxfllfx.exe 87 PID 4192 wrote to memory of 3596 4192 pjdjd.exe 88 PID 4192 wrote to memory of 3596 4192 pjdjd.exe 88 PID 4192 wrote to memory of 3596 4192 pjdjd.exe 88 PID 3596 wrote to memory of 3748 3596 xxxrfxr.exe 89 PID 3596 wrote to memory of 3748 3596 xxxrfxr.exe 89 PID 3596 wrote to memory of 3748 3596 xxxrfxr.exe 89 PID 3748 wrote to memory of 2528 3748 9httnh.exe 90 PID 3748 wrote to memory of 2528 3748 9httnh.exe 90 PID 3748 wrote to memory of 2528 3748 9httnh.exe 90 PID 2528 wrote to memory of 1636 2528 frfrllf.exe 91 PID 2528 wrote to memory of 1636 2528 frfrllf.exe 91 PID 2528 wrote to memory of 1636 2528 frfrllf.exe 91 PID 1636 wrote to memory of 3988 1636 bbhbtt.exe 92 PID 1636 wrote to memory of 3988 1636 bbhbtt.exe 92 PID 1636 wrote to memory of 3988 1636 bbhbtt.exe 92 PID 3988 wrote to memory of 2692 3988 frrlflf.exe 93 PID 3988 wrote to memory of 2692 3988 frrlflf.exe 93 PID 3988 wrote to memory of 2692 3988 frrlflf.exe 93 PID 2692 wrote to memory of 3948 2692 tnbbhh.exe 94 PID 2692 wrote to memory of 3948 2692 tnbbhh.exe 94 PID 2692 wrote to memory of 3948 2692 tnbbhh.exe 94 PID 3948 wrote to memory of 3000 3948 vvddv.exe 95 PID 3948 wrote to memory of 3000 3948 vvddv.exe 95 PID 3948 wrote to memory of 3000 3948 vvddv.exe 95 PID 3000 wrote to memory of 796 3000 1tnhtt.exe 96 PID 3000 wrote to memory of 796 3000 1tnhtt.exe 96 PID 3000 wrote to memory of 796 3000 1tnhtt.exe 96 PID 796 wrote to memory of 1720 796 jjdvj.exe 97 PID 796 wrote to memory of 1720 796 jjdvj.exe 97 PID 796 wrote to memory of 1720 796 jjdvj.exe 97 PID 1720 wrote to memory of 3664 1720 thtbbn.exe 98 PID 1720 wrote to memory of 3664 1720 thtbbn.exe 98 PID 1720 wrote to memory of 3664 1720 thtbbn.exe 98 PID 3664 wrote to memory of 3252 3664 jpjjj.exe 99 PID 3664 wrote to memory of 3252 3664 jpjjj.exe 99 PID 3664 wrote to memory of 3252 3664 jpjjj.exe 99 PID 3252 wrote to memory of 3616 3252 btbhnb.exe 100 PID 3252 wrote to memory of 3616 3252 btbhnb.exe 100 PID 3252 wrote to memory of 3616 3252 btbhnb.exe 100 PID 3616 wrote to memory of 4496 3616 ddjdd.exe 101 PID 3616 wrote to memory of 4496 3616 ddjdd.exe 101 PID 3616 wrote to memory of 4496 3616 ddjdd.exe 101 PID 4496 wrote to memory of 412 4496 5xrlfxr.exe 102 PID 4496 wrote to memory of 412 4496 5xrlfxr.exe 102 PID 4496 wrote to memory of 412 4496 5xrlfxr.exe 102 PID 412 wrote to memory of 4512 412 jvvvp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\75eafe8847178b986c0f9af748edd551b7b147e84432ed7c5f20d07725b690a1.exe"C:\Users\Admin\AppData\Local\Temp\75eafe8847178b986c0f9af748edd551b7b147e84432ed7c5f20d07725b690a1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\thnntt.exec:\thnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\vpppj.exec:\vpppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\ddpdd.exec:\ddpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\fxfllfx.exec:\fxfllfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\pjdjd.exec:\pjdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\xxxrfxr.exec:\xxxrfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\9httnh.exec:\9httnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\frfrllf.exec:\frfrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\bbhbtt.exec:\bbhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\frrlflf.exec:\frrlflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\tnbbhh.exec:\tnbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vvddv.exec:\vvddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\1tnhtt.exec:\1tnhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\jjdvj.exec:\jjdvj.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\thtbbn.exec:\thtbbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\jpjjj.exec:\jpjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\btbhnb.exec:\btbhnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\ddjdd.exec:\ddjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\5xrlfxr.exec:\5xrlfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\jvvvp.exec:\jvvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\1rrlxxr.exec:\1rrlxxr.exe23⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nbhhbb.exec:\nbhhbb.exe24⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jddvv.exec:\jddvv.exe25⤵
- Executes dropped EXE
PID:4640 -
\??\c:\rrxxrrl.exec:\rrxxrrl.exe26⤵
- Executes dropped EXE
PID:5008 -
\??\c:\frrfxxf.exec:\frrfxxf.exe27⤵
- Executes dropped EXE
PID:4288 -
\??\c:\1tbnhh.exec:\1tbnhh.exe28⤵
- Executes dropped EXE
PID:3384 -
\??\c:\pvdvv.exec:\pvdvv.exe29⤵
- Executes dropped EXE
PID:1216 -
\??\c:\vvjjd.exec:\vvjjd.exe30⤵
- Executes dropped EXE
PID:852 -
\??\c:\lxxlxxf.exec:\lxxlxxf.exe31⤵
- Executes dropped EXE
PID:4636 -
\??\c:\5tttnn.exec:\5tttnn.exe32⤵
- Executes dropped EXE
PID:4592 -
\??\c:\ttnhbt.exec:\ttnhbt.exe33⤵
- Executes dropped EXE
PID:4040 -
\??\c:\hnbhnn.exec:\hnbhnn.exe34⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jpddv.exec:\jpddv.exe35⤵
- Executes dropped EXE
PID:1304 -
\??\c:\frrrrrl.exec:\frrrrrl.exe36⤵
- Executes dropped EXE
PID:4716 -
\??\c:\9dvjv.exec:\9dvjv.exe37⤵
- Executes dropped EXE
PID:4948 -
\??\c:\3lfxrfx.exec:\3lfxrfx.exe38⤵
- Executes dropped EXE
PID:384 -
\??\c:\xfxflxf.exec:\xfxflxf.exe39⤵
- Executes dropped EXE
PID:4632 -
\??\c:\hhbbtt.exec:\hhbbtt.exe40⤵
- Executes dropped EXE
PID:2256 -
\??\c:\djjjd.exec:\djjjd.exe41⤵
- Executes dropped EXE
PID:2004 -
\??\c:\fxxxrll.exec:\fxxxrll.exe42⤵
- Executes dropped EXE
PID:4832 -
\??\c:\hhhbtn.exec:\hhhbtn.exe43⤵
- Executes dropped EXE
PID:5108 -
\??\c:\pjjpv.exec:\pjjpv.exe44⤵
- Executes dropped EXE
PID:4840 -
\??\c:\lflfrrl.exec:\lflfrrl.exe45⤵
- Executes dropped EXE
PID:5032 -
\??\c:\hthbtt.exec:\hthbtt.exe46⤵
- Executes dropped EXE
PID:4668 -
\??\c:\bnnhhh.exec:\bnnhhh.exe47⤵
- Executes dropped EXE
PID:4028 -
\??\c:\pdjdv.exec:\pdjdv.exe48⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xxxxrll.exec:\xxxxrll.exe49⤵
- Executes dropped EXE
PID:4676 -
\??\c:\5ttnhn.exec:\5ttnhn.exe50⤵
- Executes dropped EXE
PID:4488 -
\??\c:\9bhnhb.exec:\9bhnhb.exe51⤵
- Executes dropped EXE
PID:4068 -
\??\c:\vpjjd.exec:\vpjjd.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4360 -
\??\c:\3lllfff.exec:\3lllfff.exe53⤵
- Executes dropped EXE
PID:400 -
\??\c:\7bthtn.exec:\7bthtn.exe54⤵
- Executes dropped EXE
PID:4688 -
\??\c:\nhbttt.exec:\nhbttt.exe55⤵
- Executes dropped EXE
PID:3156 -
\??\c:\9vjdd.exec:\9vjdd.exe56⤵
- Executes dropped EXE
PID:828 -
\??\c:\rlllxxr.exec:\rlllxxr.exe57⤵
- Executes dropped EXE
PID:4164 -
\??\c:\nbtnnn.exec:\nbtnnn.exe58⤵
- Executes dropped EXE
PID:3736 -
\??\c:\ppvvv.exec:\ppvvv.exe59⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vjjdv.exec:\vjjdv.exe60⤵
- Executes dropped EXE
PID:4560 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe61⤵
- Executes dropped EXE
PID:4988 -
\??\c:\tbhbtt.exec:\tbhbtt.exe62⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9jpjj.exec:\9jpjj.exe63⤵
- Executes dropped EXE
PID:904 -
\??\c:\vdjdv.exec:\vdjdv.exe64⤵
- Executes dropped EXE
PID:3576 -
\??\c:\5llffxx.exec:\5llffxx.exe65⤵
- Executes dropped EXE
PID:3480 -
\??\c:\nttnhb.exec:\nttnhb.exe66⤵PID:348
-
\??\c:\vppjd.exec:\vppjd.exe67⤵PID:4364
-
\??\c:\fffxrlf.exec:\fffxrlf.exe68⤵
- System Location Discovery: System Language Discovery
PID:1244 -
\??\c:\nbbbtn.exec:\nbbbtn.exe69⤵PID:1748
-
\??\c:\bbbbtt.exec:\bbbbtt.exe70⤵PID:4852
-
\??\c:\7jjdp.exec:\7jjdp.exe71⤵PID:2184
-
\??\c:\pdpjv.exec:\pdpjv.exe72⤵
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\rxxrlff.exec:\rxxrlff.exe73⤵PID:2180
-
\??\c:\7hnnbb.exec:\7hnnbb.exe74⤵PID:2916
-
\??\c:\vjdjp.exec:\vjdjp.exe75⤵PID:1332
-
\??\c:\ffxxlfx.exec:\ffxxlfx.exe76⤵PID:1484
-
\??\c:\bnbnhn.exec:\bnbnhn.exe77⤵PID:2868
-
\??\c:\jdpjd.exec:\jdpjd.exe78⤵PID:1924
-
\??\c:\5rxrffl.exec:\5rxrffl.exe79⤵PID:212
-
\??\c:\dpvjv.exec:\dpvjv.exe80⤵PID:3616
-
\??\c:\jvvpd.exec:\jvvpd.exe81⤵PID:876
-
\??\c:\llxrlff.exec:\llxrlff.exe82⤵PID:1236
-
\??\c:\thhtnn.exec:\thhtnn.exe83⤵PID:4320
-
\??\c:\9ddpd.exec:\9ddpd.exe84⤵PID:4184
-
\??\c:\3ppjj.exec:\3ppjj.exe85⤵PID:4308
-
\??\c:\3xrlxxl.exec:\3xrlxxl.exe86⤵PID:1268
-
\??\c:\1hhbbt.exec:\1hhbbt.exe87⤵PID:3564
-
\??\c:\jvpjd.exec:\jvpjd.exe88⤵PID:4564
-
\??\c:\7fxrllf.exec:\7fxrllf.exe89⤵PID:4520
-
\??\c:\ntbttt.exec:\ntbttt.exe90⤵PID:5020
-
\??\c:\hbbtbb.exec:\hbbtbb.exe91⤵PID:4424
-
\??\c:\dpjdp.exec:\dpjdp.exe92⤵PID:5016
-
\??\c:\ffllfll.exec:\ffllfll.exe93⤵PID:1112
-
\??\c:\hbhbtn.exec:\hbhbtn.exe94⤵PID:2360
-
\??\c:\tnnnhh.exec:\tnnnhh.exe95⤵
- System Location Discovery: System Language Discovery
PID:852 -
\??\c:\jjddv.exec:\jjddv.exe96⤵PID:4568
-
\??\c:\rrrxrfx.exec:\rrrxrfx.exe97⤵PID:1488
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe98⤵PID:2448
-
\??\c:\nhtnnn.exec:\nhtnnn.exe99⤵PID:1496
-
\??\c:\3vvjv.exec:\3vvjv.exe100⤵PID:3332
-
\??\c:\lxxfxfx.exec:\lxxfxfx.exe101⤵PID:2988
-
\??\c:\bnbbtt.exec:\bnbbtt.exe102⤵PID:4716
-
\??\c:\vppjj.exec:\vppjj.exe103⤵PID:3792
-
\??\c:\dpvvp.exec:\dpvvp.exe104⤵PID:384
-
\??\c:\lxlxlfx.exec:\lxlxlfx.exe105⤵PID:388
-
\??\c:\tbhhbb.exec:\tbhhbb.exe106⤵PID:4664
-
\??\c:\pdjjj.exec:\pdjjj.exe107⤵PID:2424
-
\??\c:\pddvv.exec:\pddvv.exe108⤵PID:312
-
\??\c:\3fffxxx.exec:\3fffxxx.exe109⤵PID:1324
-
\??\c:\hbnhbb.exec:\hbnhbb.exe110⤵PID:1712
-
\??\c:\dvvpd.exec:\dvvpd.exe111⤵PID:4432
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe112⤵PID:3052
-
\??\c:\hbhbnn.exec:\hbhbnn.exe113⤵PID:4140
-
\??\c:\1nhbtn.exec:\1nhbtn.exe114⤵PID:4028
-
\??\c:\dddvp.exec:\dddvp.exe115⤵PID:1424
-
\??\c:\xlfrfrl.exec:\xlfrfrl.exe116⤵PID:4676
-
\??\c:\9tnhtb.exec:\9tnhtb.exe117⤵PID:4488
-
\??\c:\nnbhbt.exec:\nnbhbt.exe118⤵PID:4068
-
\??\c:\5jjjd.exec:\5jjjd.exe119⤵PID:3368
-
\??\c:\llrlrrx.exec:\llrlrrx.exe120⤵PID:216
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe121⤵PID:4688
-
\??\c:\bnbbbn.exec:\bnbbbn.exe122⤵PID:4516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-