Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe
-
Size
455KB
-
MD5
65e251e656c2c2e1f9aad7aa2fcea49a
-
SHA1
b25cd800bef136d8e665ff4023ab73e35e62bc2c
-
SHA256
0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4
-
SHA512
de865be3d62817aafe5b921fc7967d70fc94764a8da39240c6c16f541beb6ae877ab901d4e3abae32675a277ea8d43d44581e8b0e4f046ac401cba0080b7c563
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/5052-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/608-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-915-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-928-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-965-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-993-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-1339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4196 5rflllx.exe 1500 rfrllll.exe 1100 9jppp.exe 608 tnttbt.exe 1696 3llxrrr.exe 4592 hthttt.exe 1812 1bhhnn.exe 3988 llrlffx.exe 3724 nnbtnh.exe 2424 hbnnbb.exe 4976 nbnhhb.exe 2572 djvpj.exe 4996 xxfxxxx.exe 808 9hnhbb.exe 1032 pdddd.exe 2124 1frlfrr.exe 4436 9vvpj.exe 4864 jjvpd.exe 2620 xrlfllx.exe 4872 djppj.exe 2316 nnnnbb.exe 2640 dpjjv.exe 732 btnnbt.exe 4632 nnbbtt.exe 740 lrxlxrl.exe 3416 fxxrxxl.exe 4992 jddvp.exe 912 lfrlflf.exe 1492 9bhhbh.exe 4656 flrlxfx.exe 1644 9tbbtb.exe 1776 jvjjd.exe 3972 btnhhb.exe 1068 lrxrlff.exe 3176 lrrfxrl.exe 1976 5hhhhh.exe 756 jjddv.exe 4716 pvdvj.exe 1044 xxrrfxl.exe 4124 hbnhbh.exe 3932 djpjd.exe 116 5fllllr.exe 4476 rrxlfff.exe 1016 hntnhh.exe 4644 dvddv.exe 3132 fxxxrxx.exe 4472 bttnnn.exe 4340 vddjd.exe 2576 3rxlfff.exe 3036 btnhbh.exe 4852 ppjdd.exe 1532 flxrlll.exe 1100 tbbbtt.exe 4972 5ntnhh.exe 4188 vpvvp.exe 2472 ffrrfff.exe 1200 5nbhbh.exe 2364 tthhbb.exe 2268 7jjdd.exe 4552 rflrllr.exe 396 rxrllrr.exe 4520 3tttnn.exe 1704 jjvpv.exe 2404 rlffrxr.exe -
resource yara_rule behavioral2/memory/5052-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/608-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-965-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-993-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 4196 5052 0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe 83 PID 5052 wrote to memory of 4196 5052 0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe 83 PID 5052 wrote to memory of 4196 5052 0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe 83 PID 4196 wrote to memory of 1500 4196 5rflllx.exe 84 PID 4196 wrote to memory of 1500 4196 5rflllx.exe 84 PID 4196 wrote to memory of 1500 4196 5rflllx.exe 84 PID 1500 wrote to memory of 1100 1500 rfrllll.exe 85 PID 1500 wrote to memory of 1100 1500 rfrllll.exe 85 PID 1500 wrote to memory of 1100 1500 rfrllll.exe 85 PID 1100 wrote to memory of 608 1100 9jppp.exe 86 PID 1100 wrote to memory of 608 1100 9jppp.exe 86 PID 1100 wrote to memory of 608 1100 9jppp.exe 86 PID 608 wrote to memory of 1696 608 tnttbt.exe 87 PID 608 wrote to memory of 1696 608 tnttbt.exe 87 PID 608 wrote to memory of 1696 608 tnttbt.exe 87 PID 1696 wrote to memory of 4592 1696 3llxrrr.exe 88 PID 1696 wrote to memory of 4592 1696 3llxrrr.exe 88 PID 1696 wrote to memory of 4592 1696 3llxrrr.exe 88 PID 4592 wrote to memory of 1812 4592 hthttt.exe 89 PID 4592 wrote to memory of 1812 4592 hthttt.exe 89 PID 4592 wrote to memory of 1812 4592 hthttt.exe 89 PID 1812 wrote to memory of 3988 1812 1bhhnn.exe 90 PID 1812 wrote to memory of 3988 1812 1bhhnn.exe 90 PID 1812 wrote to memory of 3988 1812 1bhhnn.exe 90 PID 3988 wrote to memory of 3724 3988 llrlffx.exe 91 PID 3988 wrote to memory of 3724 3988 llrlffx.exe 91 PID 3988 wrote to memory of 3724 3988 llrlffx.exe 91 PID 3724 wrote to memory of 2424 3724 nnbtnh.exe 92 PID 3724 wrote to memory of 2424 3724 nnbtnh.exe 92 PID 3724 wrote to memory of 2424 3724 nnbtnh.exe 92 PID 2424 wrote to memory of 4976 2424 hbnnbb.exe 93 PID 2424 wrote to memory of 4976 2424 hbnnbb.exe 93 PID 2424 wrote to memory of 4976 2424 hbnnbb.exe 93 PID 4976 wrote to memory of 2572 4976 nbnhhb.exe 94 PID 4976 wrote to memory of 2572 4976 nbnhhb.exe 94 PID 4976 wrote to memory of 2572 4976 nbnhhb.exe 94 PID 2572 wrote to memory of 4996 2572 djvpj.exe 95 PID 2572 wrote to memory of 4996 2572 djvpj.exe 95 PID 2572 wrote to memory of 4996 2572 djvpj.exe 95 PID 4996 wrote to memory of 808 4996 xxfxxxx.exe 96 PID 4996 wrote to memory of 808 4996 xxfxxxx.exe 96 PID 4996 wrote to memory of 808 4996 xxfxxxx.exe 96 PID 808 wrote to memory of 1032 808 9hnhbb.exe 97 PID 808 wrote to memory of 1032 808 9hnhbb.exe 97 PID 808 wrote to memory of 1032 808 9hnhbb.exe 97 PID 1032 wrote to memory of 2124 1032 pdddd.exe 98 PID 1032 wrote to memory of 2124 1032 pdddd.exe 98 PID 1032 wrote to memory of 2124 1032 pdddd.exe 98 PID 2124 wrote to memory of 4436 2124 1frlfrr.exe 99 PID 2124 wrote to memory of 4436 2124 1frlfrr.exe 99 PID 2124 wrote to memory of 4436 2124 1frlfrr.exe 99 PID 4436 wrote to memory of 4864 4436 9vvpj.exe 100 PID 4436 wrote to memory of 4864 4436 9vvpj.exe 100 PID 4436 wrote to memory of 4864 4436 9vvpj.exe 100 PID 4864 wrote to memory of 2620 4864 jjvpd.exe 101 PID 4864 wrote to memory of 2620 4864 jjvpd.exe 101 PID 4864 wrote to memory of 2620 4864 jjvpd.exe 101 PID 2620 wrote to memory of 4872 2620 xrlfllx.exe 102 PID 2620 wrote to memory of 4872 2620 xrlfllx.exe 102 PID 2620 wrote to memory of 4872 2620 xrlfllx.exe 102 PID 4872 wrote to memory of 2316 4872 djppj.exe 103 PID 4872 wrote to memory of 2316 4872 djppj.exe 103 PID 4872 wrote to memory of 2316 4872 djppj.exe 103 PID 2316 wrote to memory of 2640 2316 nnnnbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe"C:\Users\Admin\AppData\Local\Temp\0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\5rflllx.exec:\5rflllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\rfrllll.exec:\rfrllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\9jppp.exec:\9jppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\tnttbt.exec:\tnttbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\3llxrrr.exec:\3llxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\hthttt.exec:\hthttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\1bhhnn.exec:\1bhhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\llrlffx.exec:\llrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\nnbtnh.exec:\nnbtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\hbnnbb.exec:\hbnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\nbnhhb.exec:\nbnhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\djvpj.exec:\djvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\9hnhbb.exec:\9hnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\pdddd.exec:\pdddd.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\1frlfrr.exec:\1frlfrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\9vvpj.exec:\9vvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\jjvpd.exec:\jjvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\xrlfllx.exec:\xrlfllx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\djppj.exec:\djppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\nnnnbb.exec:\nnnnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\dpjjv.exec:\dpjjv.exe23⤵
- Executes dropped EXE
PID:2640 -
\??\c:\btnnbt.exec:\btnnbt.exe24⤵
- Executes dropped EXE
PID:732 -
\??\c:\nnbbtt.exec:\nnbbtt.exe25⤵
- Executes dropped EXE
PID:4632 -
\??\c:\lrxlxrl.exec:\lrxlxrl.exe26⤵
- Executes dropped EXE
PID:740 -
\??\c:\fxxrxxl.exec:\fxxrxxl.exe27⤵
- Executes dropped EXE
PID:3416 -
\??\c:\jddvp.exec:\jddvp.exe28⤵
- Executes dropped EXE
PID:4992 -
\??\c:\lfrlflf.exec:\lfrlflf.exe29⤵
- Executes dropped EXE
PID:912 -
\??\c:\9bhhbh.exec:\9bhhbh.exe30⤵
- Executes dropped EXE
PID:1492 -
\??\c:\flrlxfx.exec:\flrlxfx.exe31⤵
- Executes dropped EXE
PID:4656 -
\??\c:\9tbbtb.exec:\9tbbtb.exe32⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jvjjd.exec:\jvjjd.exe33⤵
- Executes dropped EXE
PID:1776 -
\??\c:\btnhhb.exec:\btnhhb.exe34⤵
- Executes dropped EXE
PID:3972 -
\??\c:\lrxrlff.exec:\lrxrlff.exe35⤵
- Executes dropped EXE
PID:1068 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe36⤵
- Executes dropped EXE
PID:3176 -
\??\c:\5hhhhh.exec:\5hhhhh.exe37⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jjddv.exec:\jjddv.exe38⤵
- Executes dropped EXE
PID:756 -
\??\c:\pvdvj.exec:\pvdvj.exe39⤵
- Executes dropped EXE
PID:4716 -
\??\c:\xxrrfxl.exec:\xxrrfxl.exe40⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hbnhbh.exec:\hbnhbh.exe41⤵
- Executes dropped EXE
PID:4124 -
\??\c:\djpjd.exec:\djpjd.exe42⤵
- Executes dropped EXE
PID:3932 -
\??\c:\5fllllr.exec:\5fllllr.exe43⤵
- Executes dropped EXE
PID:116 -
\??\c:\rrxlfff.exec:\rrxlfff.exe44⤵
- Executes dropped EXE
PID:4476 -
\??\c:\hntnhh.exec:\hntnhh.exe45⤵
- Executes dropped EXE
PID:1016 -
\??\c:\dvddv.exec:\dvddv.exe46⤵
- Executes dropped EXE
PID:4644 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3132 -
\??\c:\bttnnn.exec:\bttnnn.exe48⤵
- Executes dropped EXE
PID:4472 -
\??\c:\vddjd.exec:\vddjd.exe49⤵
- Executes dropped EXE
PID:4340 -
\??\c:\3rxlfff.exec:\3rxlfff.exe50⤵
- Executes dropped EXE
PID:2576 -
\??\c:\btnhbh.exec:\btnhbh.exe51⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ppjdd.exec:\ppjdd.exe52⤵
- Executes dropped EXE
PID:4852 -
\??\c:\flxrlll.exec:\flxrlll.exe53⤵
- Executes dropped EXE
PID:1532 -
\??\c:\tbbbtt.exec:\tbbbtt.exe54⤵
- Executes dropped EXE
PID:1100 -
\??\c:\5ntnhh.exec:\5ntnhh.exe55⤵
- Executes dropped EXE
PID:4972 -
\??\c:\vpvvp.exec:\vpvvp.exe56⤵
- Executes dropped EXE
PID:4188 -
\??\c:\ffrrfff.exec:\ffrrfff.exe57⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5nbhbh.exec:\5nbhbh.exe58⤵
- Executes dropped EXE
PID:1200 -
\??\c:\tthhbb.exec:\tthhbb.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\7jjdd.exec:\7jjdd.exe60⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rflrllr.exec:\rflrllr.exe61⤵
- Executes dropped EXE
PID:4552 -
\??\c:\rxrllrr.exec:\rxrllrr.exe62⤵
- Executes dropped EXE
PID:396 -
\??\c:\3tttnn.exec:\3tttnn.exe63⤵
- Executes dropped EXE
PID:4520 -
\??\c:\jjvpv.exec:\jjvpv.exe64⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rlffrxr.exec:\rlffrxr.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\bnhhhh.exec:\bnhhhh.exe66⤵PID:2572
-
\??\c:\htnnnh.exec:\htnnnh.exe67⤵PID:4996
-
\??\c:\ppvpj.exec:\ppvpj.exe68⤵PID:808
-
\??\c:\xxrrffr.exec:\xxrrffr.exe69⤵PID:2616
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe70⤵PID:4052
-
\??\c:\nhtnbb.exec:\nhtnbb.exe71⤵PID:1580
-
\??\c:\7pvpj.exec:\7pvpj.exe72⤵PID:3092
-
\??\c:\xfllrrf.exec:\xfllrrf.exe73⤵PID:1292
-
\??\c:\1fffxxx.exec:\1fffxxx.exe74⤵PID:4328
-
\??\c:\bthbbb.exec:\bthbbb.exe75⤵PID:3648
-
\??\c:\btttnb.exec:\btttnb.exe76⤵PID:2792
-
\??\c:\vpdpv.exec:\vpdpv.exe77⤵PID:3020
-
\??\c:\5fxxlrr.exec:\5fxxlrr.exe78⤵PID:388
-
\??\c:\nnnhbb.exec:\nnnhbb.exe79⤵PID:2316
-
\??\c:\httnhn.exec:\httnhn.exe80⤵PID:3440
-
\??\c:\vvjdv.exec:\vvjdv.exe81⤵PID:5080
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe82⤵PID:3968
-
\??\c:\bhnhbb.exec:\bhnhbb.exe83⤵PID:4632
-
\??\c:\nnnhhn.exec:\nnnhhn.exe84⤵PID:4300
-
\??\c:\vpdvd.exec:\vpdvd.exe85⤵PID:5112
-
\??\c:\fxrxllr.exec:\fxrxllr.exe86⤵PID:4992
-
\??\c:\tthbtt.exec:\tthbtt.exe87⤵PID:2968
-
\??\c:\hhtnnt.exec:\hhtnnt.exe88⤵PID:1904
-
\??\c:\7vddv.exec:\7vddv.exe89⤵PID:1836
-
\??\c:\1xlxrrr.exec:\1xlxrrr.exe90⤵PID:2552
-
\??\c:\hbhhbb.exec:\hbhhbb.exe91⤵PID:1756
-
\??\c:\vjdjd.exec:\vjdjd.exe92⤵PID:2864
-
\??\c:\rrfrllf.exec:\rrfrllf.exe93⤵PID:2300
-
\??\c:\ffffxff.exec:\ffffxff.exe94⤵PID:5092
-
\??\c:\hthbtt.exec:\hthbtt.exe95⤵PID:3096
-
\??\c:\tnbbtt.exec:\tnbbtt.exe96⤵PID:3236
-
\??\c:\pjddj.exec:\pjddj.exe97⤵PID:3260
-
\??\c:\5flrxxx.exec:\5flrxxx.exe98⤵PID:3956
-
\??\c:\bthhbb.exec:\bthhbb.exe99⤵PID:2244
-
\??\c:\pjvpp.exec:\pjvpp.exe100⤵
- System Location Discovery: System Language Discovery
PID:4528 -
\??\c:\rlxrllf.exec:\rlxrllf.exe101⤵
- System Location Discovery: System Language Discovery
PID:4988 -
\??\c:\ntnntt.exec:\ntnntt.exe102⤵PID:668
-
\??\c:\3dpjd.exec:\3dpjd.exe103⤵PID:1688
-
\??\c:\xlxrlll.exec:\xlxrlll.exe104⤵PID:3448
-
\??\c:\rlxfxrl.exec:\rlxfxrl.exe105⤵PID:1916
-
\??\c:\3htnth.exec:\3htnth.exe106⤵PID:428
-
\??\c:\dpdvj.exec:\dpdvj.exe107⤵PID:4480
-
\??\c:\xfrlfff.exec:\xfrlfff.exe108⤵PID:5084
-
\??\c:\7xffxfx.exec:\7xffxfx.exe109⤵PID:5052
-
\??\c:\bttttt.exec:\bttttt.exe110⤵PID:1064
-
\??\c:\5pjdv.exec:\5pjdv.exe111⤵PID:4912
-
\??\c:\djpjd.exec:\djpjd.exe112⤵PID:3436
-
\??\c:\fxfxllx.exec:\fxfxllx.exe113⤵PID:2716
-
\??\c:\tnttnn.exec:\tnttnn.exe114⤵PID:1968
-
\??\c:\dvdvj.exec:\dvdvj.exe115⤵PID:4228
-
\??\c:\djpjj.exec:\djpjj.exe116⤵PID:1052
-
\??\c:\frxrllr.exec:\frxrllr.exe117⤵PID:1196
-
\??\c:\9nntnn.exec:\9nntnn.exe118⤵PID:1696
-
\??\c:\vpjjj.exec:\vpjjj.exe119⤵PID:1280
-
\??\c:\9pddd.exec:\9pddd.exe120⤵PID:2704
-
\??\c:\llrlfff.exec:\llrlfff.exe121⤵PID:3628
-
\??\c:\hhhhhn.exec:\hhhhhn.exe122⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-