Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac18c100873cca81761a720fd3120b120da9c6d80f24442283edab16d0cbc916.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
ac18c100873cca81761a720fd3120b120da9c6d80f24442283edab16d0cbc916.exe
-
Size
348KB
-
MD5
1326b5c7b08f20b36cf03360dc6cd782
-
SHA1
6327d0d3811e2940f38c96623a7d74ad214d4a19
-
SHA256
ac18c100873cca81761a720fd3120b120da9c6d80f24442283edab16d0cbc916
-
SHA512
36935529082031ea55a328a69a24bc72042afc7fb5cd8a123c73a1ebae732d308bae0c2075a3994337be7dee46ac59d755d77419a7509b37ad753fd6c28e39e6
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA+:l7TcbWXZshJX2VGd+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4780-5-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3616-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4324-14-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2876-19-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2764-25-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1528-43-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2356-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4612-53-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2492-58-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3436-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2928-72-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2052-78-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3232-102-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4380-96-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4572-95-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3048-89-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2428-109-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3452-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4724-126-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3584-66-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2964-141-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1012-147-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5108-152-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1692-159-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5028-165-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3300-166-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1236-176-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3780-183-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3332-187-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3424-201-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2188-205-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4896-209-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/508-222-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5060-235-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4836-254-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1528-258-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2984-262-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4868-278-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3308-282-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2928-289-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2060-293-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3048-300-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2948-307-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1196-311-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3656-324-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4552-337-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2868-350-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3560-357-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4448-367-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1736-380-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4608-384-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1972-403-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3900-407-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3840-442-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2008-464-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2560-489-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3468-520-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2964-542-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2016-585-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3040-589-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4212-653-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2972-660-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2248-1442-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4780 pddvv.exe 4324 rrlfffx.exe 2876 nnnhhh.exe 2764 7dpjp.exe 4512 rlxxffl.exe 1528 xrlxffr.exe 2356 xfxffxx.exe 4612 thnntn.exe 2492 3jjdj.exe 3436 rxfxllf.exe 3584 pddvv.exe 2928 xlfxxlf.exe 2052 xllffxr.exe 3048 hhhttn.exe 4572 btbtbb.exe 4380 5hbbbh.exe 3232 vpjvv.exe 2428 rxlfrfx.exe 3452 rrxfllf.exe 4724 lflfrrl.exe 1496 pvjdv.exe 4552 flrlffr.exe 2964 pdpjd.exe 1012 ttnhhh.exe 5108 lxrllll.exe 1692 bhbtbt.exe 5028 3xlfxxr.exe 3300 xffrllf.exe 1236 1hnntt.exe 3780 lxlffxx.exe 3332 9hhhbb.exe 3776 fxfllff.exe 4504 vpvdv.exe 4308 xfxrlrr.exe 3424 nhtnnn.exe 2188 3vpdd.exe 4896 pjjdv.exe 4020 rlrlflf.exe 3388 hbnhbh.exe 4288 1jpjd.exe 508 3rrlfrl.exe 4260 hnbtnn.exe 4452 jdjdv.exe 4624 djjdv.exe 5060 rllfxxx.exe 4508 xfrrllf.exe 4120 tnhhtt.exe 636 lrffflf.exe 2972 ffrrrxx.exe 4740 hhbttt.exe 4836 vpjjd.exe 1528 lllffff.exe 2984 nbnhhb.exe 2856 vvddp.exe 4612 vvjdd.exe 2492 3xrlxxf.exe 2596 hhthtt.exe 4868 vdvdd.exe 3308 1vdjj.exe 3004 xrrxllx.exe 2928 3bhhbb.exe 2060 vvjjp.exe 1268 frxrxxx.exe 3048 llrrxff.exe -
resource yara_rule behavioral2/memory/4780-5-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3616-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4324-14-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2876-19-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1528-35-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2764-25-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2356-41-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1528-43-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2356-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4612-53-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2492-58-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3436-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2928-72-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2052-78-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3232-102-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4380-96-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4572-95-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3048-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2428-109-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3452-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4724-126-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4552-131-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3584-66-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2964-141-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1012-147-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5108-152-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1692-159-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5028-165-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3300-166-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1236-176-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3780-183-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3332-187-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3424-201-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2188-205-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4896-209-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/508-222-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5060-235-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4836-254-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1528-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2984-262-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4868-278-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3308-282-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2928-289-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2060-293-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3048-300-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2948-307-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1196-311-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3656-324-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4552-337-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2868-350-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3560-357-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4448-367-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1736-380-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4608-384-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1972-403-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3900-407-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3840-438-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3840-442-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2008-464-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2560-489-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3468-520-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2964-542-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2016-585-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3040-589-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3616 wrote to memory of 4780 3616 ac18c100873cca81761a720fd3120b120da9c6d80f24442283edab16d0cbc916.exe 82 PID 3616 wrote to memory of 4780 3616 ac18c100873cca81761a720fd3120b120da9c6d80f24442283edab16d0cbc916.exe 82 PID 3616 wrote to memory of 4780 3616 ac18c100873cca81761a720fd3120b120da9c6d80f24442283edab16d0cbc916.exe 82 PID 4780 wrote to memory of 4324 4780 pddvv.exe 83 PID 4780 wrote to memory of 4324 4780 pddvv.exe 83 PID 4780 wrote to memory of 4324 4780 pddvv.exe 83 PID 4324 wrote to memory of 2876 4324 rrlfffx.exe 84 PID 4324 wrote to memory of 2876 4324 rrlfffx.exe 84 PID 4324 wrote to memory of 2876 4324 rrlfffx.exe 84 PID 2876 wrote to memory of 2764 2876 nnnhhh.exe 85 PID 2876 wrote to memory of 2764 2876 nnnhhh.exe 85 PID 2876 wrote to memory of 2764 2876 nnnhhh.exe 85 PID 2764 wrote to memory of 4512 2764 7dpjp.exe 86 PID 2764 wrote to memory of 4512 2764 7dpjp.exe 86 PID 2764 wrote to memory of 4512 2764 7dpjp.exe 86 PID 4512 wrote to memory of 1528 4512 rlxxffl.exe 87 PID 4512 wrote to memory of 1528 4512 rlxxffl.exe 87 PID 4512 wrote to memory of 1528 4512 rlxxffl.exe 87 PID 1528 wrote to memory of 2356 1528 xrlxffr.exe 88 PID 1528 wrote to memory of 2356 1528 xrlxffr.exe 88 PID 1528 wrote to memory of 2356 1528 xrlxffr.exe 88 PID 2356 wrote to memory of 4612 2356 xfxffxx.exe 89 PID 2356 wrote to memory of 4612 2356 xfxffxx.exe 89 PID 2356 wrote to memory of 4612 2356 xfxffxx.exe 89 PID 4612 wrote to memory of 2492 4612 thnntn.exe 90 PID 4612 wrote to memory of 2492 4612 thnntn.exe 90 PID 4612 wrote to memory of 2492 4612 thnntn.exe 90 PID 2492 wrote to memory of 3436 2492 3jjdj.exe 91 PID 2492 wrote to memory of 3436 2492 3jjdj.exe 91 PID 2492 wrote to memory of 3436 2492 3jjdj.exe 91 PID 3436 wrote to memory of 3584 3436 rxfxllf.exe 92 PID 3436 wrote to memory of 3584 3436 rxfxllf.exe 92 PID 3436 wrote to memory of 3584 3436 rxfxllf.exe 92 PID 3584 wrote to memory of 2928 3584 pddvv.exe 93 PID 3584 wrote to memory of 2928 3584 pddvv.exe 93 PID 3584 wrote to memory of 2928 3584 pddvv.exe 93 PID 2928 wrote to memory of 2052 2928 xlfxxlf.exe 94 PID 2928 wrote to memory of 2052 2928 xlfxxlf.exe 94 PID 2928 wrote to memory of 2052 2928 xlfxxlf.exe 94 PID 2052 wrote to memory of 3048 2052 xllffxr.exe 95 PID 2052 wrote to memory of 3048 2052 xllffxr.exe 95 PID 2052 wrote to memory of 3048 2052 xllffxr.exe 95 PID 3048 wrote to memory of 4572 3048 hhhttn.exe 96 PID 3048 wrote to memory of 4572 3048 hhhttn.exe 96 PID 3048 wrote to memory of 4572 3048 hhhttn.exe 96 PID 4572 wrote to memory of 4380 4572 btbtbb.exe 97 PID 4572 wrote to memory of 4380 4572 btbtbb.exe 97 PID 4572 wrote to memory of 4380 4572 btbtbb.exe 97 PID 4380 wrote to memory of 3232 4380 5hbbbh.exe 98 PID 4380 wrote to memory of 3232 4380 5hbbbh.exe 98 PID 4380 wrote to memory of 3232 4380 5hbbbh.exe 98 PID 3232 wrote to memory of 2428 3232 vpjvv.exe 99 PID 3232 wrote to memory of 2428 3232 vpjvv.exe 99 PID 3232 wrote to memory of 2428 3232 vpjvv.exe 99 PID 2428 wrote to memory of 3452 2428 rxlfrfx.exe 100 PID 2428 wrote to memory of 3452 2428 rxlfrfx.exe 100 PID 2428 wrote to memory of 3452 2428 rxlfrfx.exe 100 PID 3452 wrote to memory of 4724 3452 rrxfllf.exe 101 PID 3452 wrote to memory of 4724 3452 rrxfllf.exe 101 PID 3452 wrote to memory of 4724 3452 rrxfllf.exe 101 PID 4724 wrote to memory of 1496 4724 lflfrrl.exe 102 PID 4724 wrote to memory of 1496 4724 lflfrrl.exe 102 PID 4724 wrote to memory of 1496 4724 lflfrrl.exe 102 PID 1496 wrote to memory of 4552 1496 pvjdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac18c100873cca81761a720fd3120b120da9c6d80f24442283edab16d0cbc916.exe"C:\Users\Admin\AppData\Local\Temp\ac18c100873cca81761a720fd3120b120da9c6d80f24442283edab16d0cbc916.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\pddvv.exec:\pddvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\rrlfffx.exec:\rrlfffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\nnnhhh.exec:\nnnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\7dpjp.exec:\7dpjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rlxxffl.exec:\rlxxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\xrlxffr.exec:\xrlxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xfxffxx.exec:\xfxffxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\thnntn.exec:\thnntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\3jjdj.exec:\3jjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\rxfxllf.exec:\rxfxllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\pddvv.exec:\pddvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\xlfxxlf.exec:\xlfxxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xllffxr.exec:\xllffxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\hhhttn.exec:\hhhttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\btbtbb.exec:\btbtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\5hbbbh.exec:\5hbbbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\vpjvv.exec:\vpjvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\rxlfrfx.exec:\rxlfrfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\rrxfllf.exec:\rrxfllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\lflfrrl.exec:\lflfrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\pvjdv.exec:\pvjdv.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\flrlffr.exec:\flrlffr.exe23⤵
- Executes dropped EXE
PID:4552 -
\??\c:\pdpjd.exec:\pdpjd.exe24⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ttnhhh.exec:\ttnhhh.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\lxrllll.exec:\lxrllll.exe26⤵
- Executes dropped EXE
PID:5108 -
\??\c:\bhbtbt.exec:\bhbtbt.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3xlfxxr.exec:\3xlfxxr.exe28⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xffrllf.exec:\xffrllf.exe29⤵
- Executes dropped EXE
PID:3300 -
\??\c:\1hnntt.exec:\1hnntt.exe30⤵
- Executes dropped EXE
PID:1236 -
\??\c:\lxlffxx.exec:\lxlffxx.exe31⤵
- Executes dropped EXE
PID:3780 -
\??\c:\9hhhbb.exec:\9hhhbb.exe32⤵
- Executes dropped EXE
PID:3332 -
\??\c:\fxfllff.exec:\fxfllff.exe33⤵
- Executes dropped EXE
PID:3776 -
\??\c:\vpvdv.exec:\vpvdv.exe34⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xfxrlrr.exec:\xfxrlrr.exe35⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nhtnnn.exec:\nhtnnn.exe36⤵
- Executes dropped EXE
PID:3424 -
\??\c:\3vpdd.exec:\3vpdd.exe37⤵
- Executes dropped EXE
PID:2188 -
\??\c:\pjjdv.exec:\pjjdv.exe38⤵
- Executes dropped EXE
PID:4896 -
\??\c:\rlrlflf.exec:\rlrlflf.exe39⤵
- Executes dropped EXE
PID:4020 -
\??\c:\hbnhbh.exec:\hbnhbh.exe40⤵
- Executes dropped EXE
PID:3388 -
\??\c:\1jpjd.exec:\1jpjd.exe41⤵
- Executes dropped EXE
PID:4288 -
\??\c:\3rrlfrl.exec:\3rrlfrl.exe42⤵
- Executes dropped EXE
PID:508 -
\??\c:\hnbtnn.exec:\hnbtnn.exe43⤵
- Executes dropped EXE
PID:4260 -
\??\c:\jdjdv.exec:\jdjdv.exe44⤵
- Executes dropped EXE
PID:4452 -
\??\c:\djjdv.exec:\djjdv.exe45⤵
- Executes dropped EXE
PID:4624 -
\??\c:\rllfxxx.exec:\rllfxxx.exe46⤵
- Executes dropped EXE
PID:5060 -
\??\c:\xfrrllf.exec:\xfrrllf.exe47⤵
- Executes dropped EXE
PID:4508 -
\??\c:\tnhhtt.exec:\tnhhtt.exe48⤵
- Executes dropped EXE
PID:4120 -
\??\c:\lrffflf.exec:\lrffflf.exe49⤵
- Executes dropped EXE
PID:636 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe50⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hhbttt.exec:\hhbttt.exe51⤵
- Executes dropped EXE
PID:4740 -
\??\c:\vpjjd.exec:\vpjjd.exe52⤵
- Executes dropped EXE
PID:4836 -
\??\c:\lllffff.exec:\lllffff.exe53⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nbnhhb.exec:\nbnhhb.exe54⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vvddp.exec:\vvddp.exe55⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vvjdd.exec:\vvjdd.exe56⤵
- Executes dropped EXE
PID:4612 -
\??\c:\3xrlxxf.exec:\3xrlxxf.exe57⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hhthtt.exec:\hhthtt.exe58⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vdvdd.exec:\vdvdd.exe59⤵
- Executes dropped EXE
PID:4868 -
\??\c:\1vdjj.exec:\1vdjj.exe60⤵
- Executes dropped EXE
PID:3308 -
\??\c:\xrrxllx.exec:\xrrxllx.exe61⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3bhhbb.exec:\3bhhbb.exe62⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vvjjp.exec:\vvjjp.exe63⤵
- Executes dropped EXE
PID:2060 -
\??\c:\frxrxxx.exec:\frxrxxx.exe64⤵
- Executes dropped EXE
PID:1268 -
\??\c:\llrrxff.exec:\llrrxff.exe65⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5bhhhh.exec:\5bhhhh.exe66⤵PID:2660
-
\??\c:\vdppp.exec:\vdppp.exe67⤵PID:2948
-
\??\c:\fxfxllf.exec:\fxfxllf.exe68⤵PID:1196
-
\??\c:\1hbbbh.exec:\1hbbbh.exe69⤵PID:1132
-
\??\c:\3jjjd.exec:\3jjjd.exe70⤵PID:3532
-
\??\c:\rxlrrrx.exec:\rxlrrrx.exe71⤵PID:3260
-
\??\c:\9thhbh.exec:\9thhbh.exe72⤵PID:3656
-
\??\c:\1bhbhh.exec:\1bhbhh.exe73⤵PID:2668
-
\??\c:\jvvdd.exec:\jvvdd.exe74⤵PID:2696
-
\??\c:\rflffxx.exec:\rflffxx.exe75⤵PID:1000
-
\??\c:\tnhhnt.exec:\tnhhnt.exe76⤵PID:4552
-
\??\c:\htnnnn.exec:\htnnnn.exe77⤵PID:744
-
\??\c:\dvjvd.exec:\dvjvd.exe78⤵PID:4936
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe79⤵PID:5036
-
\??\c:\9nhntt.exec:\9nhntt.exe80⤵PID:2868
-
\??\c:\vjpjj.exec:\vjpjj.exe81⤵PID:1284
-
\??\c:\3rfxrrx.exec:\3rfxrrx.exe82⤵PID:3560
-
\??\c:\nhtbtb.exec:\nhtbtb.exe83⤵PID:1136
-
\??\c:\jdjdd.exec:\jdjdd.exe84⤵PID:3056
-
\??\c:\ppvpj.exec:\ppvpj.exe85⤵PID:4448
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe86⤵PID:3080
-
\??\c:\nbbttb.exec:\nbbttb.exe87⤵PID:3408
-
\??\c:\nnttnt.exec:\nnttnt.exe88⤵PID:2400
-
\??\c:\vdppv.exec:\vdppv.exe89⤵PID:1736
-
\??\c:\jvjdd.exec:\jvjdd.exe90⤵PID:4608
-
\??\c:\bnbtbb.exec:\bnbtbb.exe91⤵PID:1256
-
\??\c:\pdjdd.exec:\pdjdd.exe92⤵PID:3676
-
\??\c:\vdpjd.exec:\vdpjd.exe93⤵PID:2116
-
\??\c:\9xrllll.exec:\9xrllll.exe94⤵PID:2956
-
\??\c:\rlrllxr.exec:\rlrllxr.exe95⤵PID:3688
-
\??\c:\9nbttn.exec:\9nbttn.exe96⤵PID:1972
-
\??\c:\bbnhbb.exec:\bbnhbb.exe97⤵PID:3900
-
\??\c:\9djdv.exec:\9djdv.exe98⤵PID:4896
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe99⤵PID:4020
-
\??\c:\1ntnhh.exec:\1ntnhh.exe100⤵PID:1560
-
\??\c:\pjjjj.exec:\pjjjj.exe101⤵PID:4652
-
\??\c:\vjdvp.exec:\vjdvp.exe102⤵PID:1620
-
\??\c:\7xlffrl.exec:\7xlffrl.exe103⤵PID:4440
-
\??\c:\bbtnhh.exec:\bbtnhh.exe104⤵PID:4260
-
\??\c:\thtnhb.exec:\thtnhb.exe105⤵PID:2884
-
\??\c:\dvdjj.exec:\dvdjj.exe106⤵PID:4624
-
\??\c:\ffrlfff.exec:\ffrlfff.exe107⤵PID:4392
-
\??\c:\tntnnn.exec:\tntnnn.exe108⤵PID:3840
-
\??\c:\bttnhb.exec:\bttnhb.exe109⤵PID:2164
-
\??\c:\jpvdv.exec:\jpvdv.exe110⤵PID:3120
-
\??\c:\xfrllfx.exec:\xfrllfx.exe111⤵PID:1232
-
\??\c:\hnbthb.exec:\hnbthb.exe112⤵PID:3728
-
\??\c:\9jdvv.exec:\9jdvv.exe113⤵PID:4656
-
\??\c:\pjvvv.exec:\pjvvv.exe114⤵PID:4176
-
\??\c:\fflllll.exec:\fflllll.exe115⤵PID:2008
-
\??\c:\3bhhnh.exec:\3bhhnh.exe116⤵PID:2356
-
\??\c:\vpjjj.exec:\vpjjj.exe117⤵PID:2412
-
\??\c:\llxllrx.exec:\llxllrx.exe118⤵PID:2416
-
\??\c:\hthhnn.exec:\hthhnn.exe119⤵PID:4172
-
\??\c:\bbnhhn.exec:\bbnhhn.exe120⤵
- System Location Discovery: System Language Discovery
PID:4112 -
\??\c:\vjvdd.exec:\vjvdd.exe121⤵PID:2360
-
\??\c:\9rxrxlr.exec:\9rxrxlr.exe122⤵PID:3584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-