Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe
-
Size
455KB
-
MD5
0dd232fa9e6dbaf8f3b4bbc5d485d365
-
SHA1
ed60023357b13686f347090aff2e41dc1d8d758d
-
SHA256
e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6
-
SHA512
628c1b58882d86e55fec70d852abf4156cf36827e2a5955d92d450482c5711866f3c2497743ae8232bd34a95c88141a281367abcea70d487eef78e6b9a5a1eec
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT2:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/664-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-792-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-877-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-1152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3256 lfllfff.exe 3552 rfffrrl.exe 3748 llrrrfl.exe 4656 nbnbbb.exe 4564 rrxffrx.exe 2388 ddpjj.exe 1020 lfxxfrx.exe 4816 jjvdd.exe 4292 xxxxxxx.exe 1500 bttbnt.exe 4516 rflrfrl.exe 4388 bbnntb.exe 2976 rxlrrff.exe 4900 fflfllr.exe 4916 btbbbh.exe 3956 lfffxrr.exe 2696 nhhhnn.exe 1484 rrffffx.exe 4064 rlffrxx.exe 4756 xlfxrff.exe 2440 ffffxxr.exe 2604 pppvv.exe 2536 ttbbbh.exe 4848 pvddv.exe 1036 nbnnbn.exe 3752 pvddv.exe 4364 tnhhhn.exe 60 jjppv.exe 4660 nntttb.exe 888 vdjpv.exe 1416 hhtthh.exe 3480 rrfxxxx.exe 8 hhttnn.exe 3068 ppddd.exe 2032 llxrlll.exe 4940 jdvvv.exe 1888 ppvvj.exe 444 rlfffff.exe 3312 3tbbbn.exe 3768 pjpdd.exe 4640 xllrrrf.exe 1984 tthhnt.exe 4368 hhnbbb.exe 1084 vddvv.exe 1580 lfrlllf.exe 436 tttbbb.exe 3932 jjpdv.exe 4860 dvddd.exe 2116 frlffll.exe 3880 btbbbh.exe 2368 3dvpd.exe 1864 frrrxxr.exe 1936 hhtnhb.exe 4164 htbhhh.exe 4556 jvjjd.exe 3308 lllrrxr.exe 3080 bbhttt.exe 3532 nhnhhn.exe 4160 jpjjj.exe 4080 rfflrxl.exe 3876 nbhhhn.exe 3252 jdpjj.exe 4452 jpvvv.exe 2404 xfrllff.exe -
resource yara_rule behavioral2/memory/664-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-792-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 664 wrote to memory of 3256 664 e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe 82 PID 664 wrote to memory of 3256 664 e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe 82 PID 664 wrote to memory of 3256 664 e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe 82 PID 3256 wrote to memory of 3552 3256 lfllfff.exe 83 PID 3256 wrote to memory of 3552 3256 lfllfff.exe 83 PID 3256 wrote to memory of 3552 3256 lfllfff.exe 83 PID 3552 wrote to memory of 3748 3552 rfffrrl.exe 84 PID 3552 wrote to memory of 3748 3552 rfffrrl.exe 84 PID 3552 wrote to memory of 3748 3552 rfffrrl.exe 84 PID 3748 wrote to memory of 4656 3748 llrrrfl.exe 85 PID 3748 wrote to memory of 4656 3748 llrrrfl.exe 85 PID 3748 wrote to memory of 4656 3748 llrrrfl.exe 85 PID 4656 wrote to memory of 4564 4656 nbnbbb.exe 86 PID 4656 wrote to memory of 4564 4656 nbnbbb.exe 86 PID 4656 wrote to memory of 4564 4656 nbnbbb.exe 86 PID 4564 wrote to memory of 2388 4564 rrxffrx.exe 87 PID 4564 wrote to memory of 2388 4564 rrxffrx.exe 87 PID 4564 wrote to memory of 2388 4564 rrxffrx.exe 87 PID 2388 wrote to memory of 1020 2388 ddpjj.exe 88 PID 2388 wrote to memory of 1020 2388 ddpjj.exe 88 PID 2388 wrote to memory of 1020 2388 ddpjj.exe 88 PID 1020 wrote to memory of 4816 1020 lfxxfrx.exe 89 PID 1020 wrote to memory of 4816 1020 lfxxfrx.exe 89 PID 1020 wrote to memory of 4816 1020 lfxxfrx.exe 89 PID 4816 wrote to memory of 4292 4816 jjvdd.exe 90 PID 4816 wrote to memory of 4292 4816 jjvdd.exe 90 PID 4816 wrote to memory of 4292 4816 jjvdd.exe 90 PID 4292 wrote to memory of 1500 4292 xxxxxxx.exe 91 PID 4292 wrote to memory of 1500 4292 xxxxxxx.exe 91 PID 4292 wrote to memory of 1500 4292 xxxxxxx.exe 91 PID 1500 wrote to memory of 4516 1500 bttbnt.exe 92 PID 1500 wrote to memory of 4516 1500 bttbnt.exe 92 PID 1500 wrote to memory of 4516 1500 bttbnt.exe 92 PID 4516 wrote to memory of 4388 4516 rflrfrl.exe 93 PID 4516 wrote to memory of 4388 4516 rflrfrl.exe 93 PID 4516 wrote to memory of 4388 4516 rflrfrl.exe 93 PID 4388 wrote to memory of 2976 4388 bbnntb.exe 94 PID 4388 wrote to memory of 2976 4388 bbnntb.exe 94 PID 4388 wrote to memory of 2976 4388 bbnntb.exe 94 PID 2976 wrote to memory of 4900 2976 rxlrrff.exe 95 PID 2976 wrote to memory of 4900 2976 rxlrrff.exe 95 PID 2976 wrote to memory of 4900 2976 rxlrrff.exe 95 PID 4900 wrote to memory of 4916 4900 fflfllr.exe 96 PID 4900 wrote to memory of 4916 4900 fflfllr.exe 96 PID 4900 wrote to memory of 4916 4900 fflfllr.exe 96 PID 4916 wrote to memory of 3956 4916 btbbbh.exe 97 PID 4916 wrote to memory of 3956 4916 btbbbh.exe 97 PID 4916 wrote to memory of 3956 4916 btbbbh.exe 97 PID 3956 wrote to memory of 2696 3956 lfffxrr.exe 98 PID 3956 wrote to memory of 2696 3956 lfffxrr.exe 98 PID 3956 wrote to memory of 2696 3956 lfffxrr.exe 98 PID 2696 wrote to memory of 1484 2696 nhhhnn.exe 99 PID 2696 wrote to memory of 1484 2696 nhhhnn.exe 99 PID 2696 wrote to memory of 1484 2696 nhhhnn.exe 99 PID 1484 wrote to memory of 4064 1484 rrffffx.exe 100 PID 1484 wrote to memory of 4064 1484 rrffffx.exe 100 PID 1484 wrote to memory of 4064 1484 rrffffx.exe 100 PID 4064 wrote to memory of 4756 4064 rlffrxx.exe 101 PID 4064 wrote to memory of 4756 4064 rlffrxx.exe 101 PID 4064 wrote to memory of 4756 4064 rlffrxx.exe 101 PID 4756 wrote to memory of 2440 4756 xlfxrff.exe 102 PID 4756 wrote to memory of 2440 4756 xlfxrff.exe 102 PID 4756 wrote to memory of 2440 4756 xlfxrff.exe 102 PID 2440 wrote to memory of 2604 2440 ffffxxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe"C:\Users\Admin\AppData\Local\Temp\e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\lfllfff.exec:\lfllfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\rfffrrl.exec:\rfffrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\llrrrfl.exec:\llrrrfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\nbnbbb.exec:\nbnbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\rrxffrx.exec:\rrxffrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\ddpjj.exec:\ddpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lfxxfrx.exec:\lfxxfrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\jjvdd.exec:\jjvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\bttbnt.exec:\bttbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\rflrfrl.exec:\rflrfrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\bbnntb.exec:\bbnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\rxlrrff.exec:\rxlrrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\fflfllr.exec:\fflfllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\btbbbh.exec:\btbbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\lfffxrr.exec:\lfffxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\nhhhnn.exec:\nhhhnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\rrffffx.exec:\rrffffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\rlffrxx.exec:\rlffrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\xlfxrff.exec:\xlfxrff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\ffffxxr.exec:\ffffxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\pppvv.exec:\pppvv.exe23⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ttbbbh.exec:\ttbbbh.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2536 -
\??\c:\pvddv.exec:\pvddv.exe25⤵
- Executes dropped EXE
PID:4848 -
\??\c:\nbnnbn.exec:\nbnnbn.exe26⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pvddv.exec:\pvddv.exe27⤵
- Executes dropped EXE
PID:3752 -
\??\c:\tnhhhn.exec:\tnhhhn.exe28⤵
- Executes dropped EXE
PID:4364 -
\??\c:\jjppv.exec:\jjppv.exe29⤵
- Executes dropped EXE
PID:60 -
\??\c:\nntttb.exec:\nntttb.exe30⤵
- Executes dropped EXE
PID:4660 -
\??\c:\vdjpv.exec:\vdjpv.exe31⤵
- Executes dropped EXE
PID:888 -
\??\c:\hhtthh.exec:\hhtthh.exe32⤵
- Executes dropped EXE
PID:1416 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe33⤵
- Executes dropped EXE
PID:3480 -
\??\c:\hhttnn.exec:\hhttnn.exe34⤵
- Executes dropped EXE
PID:8 -
\??\c:\ppddd.exec:\ppddd.exe35⤵
- Executes dropped EXE
PID:3068 -
\??\c:\llxrlll.exec:\llxrlll.exe36⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jdvvv.exec:\jdvvv.exe37⤵
- Executes dropped EXE
PID:4940 -
\??\c:\ppvvj.exec:\ppvvj.exe38⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rlfffff.exec:\rlfffff.exe39⤵
- Executes dropped EXE
PID:444 -
\??\c:\3tbbbn.exec:\3tbbbn.exe40⤵
- Executes dropped EXE
PID:3312 -
\??\c:\pjpdd.exec:\pjpdd.exe41⤵
- Executes dropped EXE
PID:3768 -
\??\c:\xllrrrf.exec:\xllrrrf.exe42⤵
- Executes dropped EXE
PID:4640 -
\??\c:\tthhnt.exec:\tthhnt.exe43⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hhnbbb.exec:\hhnbbb.exe44⤵
- Executes dropped EXE
PID:4368 -
\??\c:\vddvv.exec:\vddvv.exe45⤵
- Executes dropped EXE
PID:1084 -
\??\c:\lfrlllf.exec:\lfrlllf.exe46⤵
- Executes dropped EXE
PID:1580 -
\??\c:\tttbbb.exec:\tttbbb.exe47⤵
- Executes dropped EXE
PID:436 -
\??\c:\jjpdv.exec:\jjpdv.exe48⤵
- Executes dropped EXE
PID:3932 -
\??\c:\dvddd.exec:\dvddd.exe49⤵
- Executes dropped EXE
PID:4860 -
\??\c:\frlffll.exec:\frlffll.exe50⤵
- Executes dropped EXE
PID:2116 -
\??\c:\btbbbh.exec:\btbbbh.exe51⤵
- Executes dropped EXE
PID:3880 -
\??\c:\3dvpd.exec:\3dvpd.exe52⤵
- Executes dropped EXE
PID:2368 -
\??\c:\frrrxxr.exec:\frrrxxr.exe53⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hhtnhb.exec:\hhtnhb.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\htbhhh.exec:\htbhhh.exe55⤵
- Executes dropped EXE
PID:4164 -
\??\c:\jvjjd.exec:\jvjjd.exe56⤵
- Executes dropped EXE
PID:4556 -
\??\c:\lllrrxr.exec:\lllrrxr.exe57⤵
- Executes dropped EXE
PID:3308 -
\??\c:\bbhttt.exec:\bbhttt.exe58⤵
- Executes dropped EXE
PID:3080 -
\??\c:\nhnhhn.exec:\nhnhhn.exe59⤵
- Executes dropped EXE
PID:3532 -
\??\c:\jpjjj.exec:\jpjjj.exe60⤵
- Executes dropped EXE
PID:4160 -
\??\c:\rfflrxl.exec:\rfflrxl.exe61⤵
- Executes dropped EXE
PID:4080 -
\??\c:\nbhhhn.exec:\nbhhhn.exe62⤵
- Executes dropped EXE
PID:3876 -
\??\c:\jdpjj.exec:\jdpjj.exe63⤵
- Executes dropped EXE
PID:3252 -
\??\c:\jpvvv.exec:\jpvvv.exe64⤵
- Executes dropped EXE
PID:4452 -
\??\c:\xfrllff.exec:\xfrllff.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1bhhnt.exec:\1bhhnt.exe66⤵PID:768
-
\??\c:\vpdjd.exec:\vpdjd.exe67⤵PID:2188
-
\??\c:\lllfxxf.exec:\lllfxxf.exe68⤵PID:4500
-
\??\c:\nnnbtb.exec:\nnnbtb.exe69⤵PID:1468
-
\??\c:\dvdpp.exec:\dvdpp.exe70⤵PID:4104
-
\??\c:\jvddj.exec:\jvddj.exe71⤵PID:3052
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe72⤵PID:4436
-
\??\c:\thntnn.exec:\thntnn.exe73⤵PID:3956
-
\??\c:\bnbbht.exec:\bnbbht.exe74⤵PID:1616
-
\??\c:\vdddd.exec:\vdddd.exe75⤵PID:1132
-
\??\c:\fxfffll.exec:\fxfffll.exe76⤵PID:3224
-
\??\c:\bnnhbb.exec:\bnnhbb.exe77⤵PID:960
-
\??\c:\bbnhhh.exec:\bbnhhh.exe78⤵PID:2244
-
\??\c:\pjvvj.exec:\pjvvj.exe79⤵PID:4884
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe80⤵PID:3064
-
\??\c:\bbhhbb.exec:\bbhhbb.exe81⤵PID:1256
-
\??\c:\jddvv.exec:\jddvv.exe82⤵PID:5044
-
\??\c:\rlllfll.exec:\rlllfll.exe83⤵PID:3408
-
\??\c:\htbhnn.exec:\htbhnn.exe84⤵PID:2252
-
\??\c:\hbnnnn.exec:\hbnnnn.exe85⤵PID:1732
-
\??\c:\ddjjv.exec:\ddjjv.exe86⤵PID:3600
-
\??\c:\lrrxxfl.exec:\lrrxxfl.exe87⤵PID:1208
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe88⤵PID:4444
-
\??\c:\bhhnnb.exec:\bhhnnb.exe89⤵PID:4872
-
\??\c:\7pppp.exec:\7pppp.exe90⤵PID:3504
-
\??\c:\xxllrrx.exec:\xxllrrx.exe91⤵PID:2060
-
\??\c:\xflfffx.exec:\xflfffx.exe92⤵PID:4908
-
\??\c:\nhhnnb.exec:\nhhnnb.exe93⤵PID:2912
-
\??\c:\jjddp.exec:\jjddp.exe94⤵PID:8
-
\??\c:\lxlllll.exec:\lxlllll.exe95⤵PID:2824
-
\??\c:\xflllxx.exec:\xflllxx.exe96⤵PID:2224
-
\??\c:\bthhbb.exec:\bthhbb.exe97⤵PID:2176
-
\??\c:\ppvpp.exec:\ppvpp.exe98⤵PID:4840
-
\??\c:\lrllrxr.exec:\lrllrxr.exe99⤵PID:3512
-
\??\c:\lfxflrx.exec:\lfxflrx.exe100⤵PID:1272
-
\??\c:\bbhnnb.exec:\bbhnnb.exe101⤵PID:2860
-
\??\c:\llxxrxf.exec:\llxxrxf.exe102⤵PID:3404
-
\??\c:\3lxxxff.exec:\3lxxxff.exe103⤵PID:1520
-
\??\c:\hnnnnt.exec:\hnnnnt.exe104⤵PID:2408
-
\??\c:\7jjjv.exec:\7jjjv.exe105⤵PID:2540
-
\??\c:\vpvvv.exec:\vpvvv.exe106⤵PID:4284
-
\??\c:\fxlllrr.exec:\fxlllrr.exe107⤵PID:4336
-
\??\c:\bbtttt.exec:\bbtttt.exe108⤵PID:2100
-
\??\c:\tbbhbh.exec:\tbbhbh.exe109⤵PID:1516
-
\??\c:\ddpjj.exec:\ddpjj.exe110⤵PID:5048
-
\??\c:\flxfflr.exec:\flxfflr.exe111⤵PID:528
-
\??\c:\hbbbbb.exec:\hbbbbb.exe112⤵PID:1804
-
\??\c:\pvddd.exec:\pvddd.exe113⤵PID:2872
-
\??\c:\djvvv.exec:\djvvv.exe114⤵PID:1452
-
\??\c:\llfllrf.exec:\llfllrf.exe115⤵PID:4376
-
\??\c:\thnnhn.exec:\thnnhn.exe116⤵PID:32
-
\??\c:\vpppj.exec:\vpppj.exe117⤵PID:3848
-
\??\c:\vddvp.exec:\vddvp.exe118⤵PID:1148
-
\??\c:\flxrflx.exec:\flxrflx.exe119⤵
- System Location Discovery: System Language Discovery
PID:264 -
\??\c:\bnbbbb.exec:\bnbbbb.exe120⤵PID:1348
-
\??\c:\7vvvj.exec:\7vvvj.exe121⤵PID:4160
-
\??\c:\xrfxrxx.exec:\xrfxrxx.exe122⤵PID:4080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-