Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe
-
Size
456KB
-
MD5
a0556a6fe30d03855a4a054ddd183b10
-
SHA1
c78d8c659a1d7bbc2e8e2fcb0b221dd98413ef0a
-
SHA256
0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cab
-
SHA512
8075b21bbc03ab331a7f8adb3a46ec1a38f72b02609203139e879b2e9abd516b554cccbb5e6bef21e972b62f49b30ff0e0552279f68fb58e488bf74b3d1fde8b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4880-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-1135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-1142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-1161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-1605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 924 rxrflxf.exe 3672 djvjd.exe 4000 1llfrlf.exe 4808 ntbhnn.exe 2636 3nhttt.exe 4192 1nnbnn.exe 4716 lxlrxlx.exe 880 vppjd.exe 4148 bbhbnn.exe 4636 7flxfxf.exe 4940 tnhbtn.exe 5028 rxffffr.exe 4068 5jddv.exe 4824 hbhthb.exe 3844 jjddv.exe 864 rfxxrll.exe 628 hhtnhh.exe 2532 3dvvj.exe 2368 5bhbbh.exe 1344 ppvvv.exe 1304 lfxrfxf.exe 2764 tnnhbt.exe 3628 pjppp.exe 1092 httthh.exe 3408 5pvpv.exe 2832 lffxlll.exe 4704 ntnhnn.exe 2632 5rrllff.exe 4756 jvjjj.exe 696 vpppp.exe 1428 7pdvj.exe 2780 nntnhh.exe 1228 3rfrrfl.exe 2708 hnbbnt.exe 2812 dddvv.exe 2816 rrlllll.exe 592 fxlrxfr.exe 4620 3dvjd.exe 3452 rxrxlfx.exe 4236 thnhnb.exe 4340 jvdjj.exe 4968 3pjdd.exe 208 1xrffff.exe 4064 hbnnhb.exe 4376 ddppp.exe 4364 vjddd.exe 4344 nnbhhh.exe 924 pjvpp.exe 4524 7lllfff.exe 4000 lrxxfff.exe 2676 nbnnhh.exe 4020 ttnnnn.exe 3688 3vdvj.exe 4516 rrxfrrr.exe 4844 hhbnnt.exe 1120 7djdp.exe 880 lflfxrr.exe 1772 hbbtnn.exe 4744 bntnhh.exe 4832 djdpj.exe 4052 fxfxrrr.exe 3500 nhbnhh.exe 3948 jjppj.exe 1676 lrrlffx.exe -
resource yara_rule behavioral2/memory/4880-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-1135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-1142-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4880 wrote to memory of 924 4880 0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe 82 PID 4880 wrote to memory of 924 4880 0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe 82 PID 4880 wrote to memory of 924 4880 0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe 82 PID 924 wrote to memory of 3672 924 rxrflxf.exe 83 PID 924 wrote to memory of 3672 924 rxrflxf.exe 83 PID 924 wrote to memory of 3672 924 rxrflxf.exe 83 PID 3672 wrote to memory of 4000 3672 djvjd.exe 84 PID 3672 wrote to memory of 4000 3672 djvjd.exe 84 PID 3672 wrote to memory of 4000 3672 djvjd.exe 84 PID 4000 wrote to memory of 4808 4000 1llfrlf.exe 85 PID 4000 wrote to memory of 4808 4000 1llfrlf.exe 85 PID 4000 wrote to memory of 4808 4000 1llfrlf.exe 85 PID 4808 wrote to memory of 2636 4808 ntbhnn.exe 86 PID 4808 wrote to memory of 2636 4808 ntbhnn.exe 86 PID 4808 wrote to memory of 2636 4808 ntbhnn.exe 86 PID 2636 wrote to memory of 4192 2636 3nhttt.exe 87 PID 2636 wrote to memory of 4192 2636 3nhttt.exe 87 PID 2636 wrote to memory of 4192 2636 3nhttt.exe 87 PID 4192 wrote to memory of 4716 4192 1nnbnn.exe 88 PID 4192 wrote to memory of 4716 4192 1nnbnn.exe 88 PID 4192 wrote to memory of 4716 4192 1nnbnn.exe 88 PID 4716 wrote to memory of 880 4716 lxlrxlx.exe 89 PID 4716 wrote to memory of 880 4716 lxlrxlx.exe 89 PID 4716 wrote to memory of 880 4716 lxlrxlx.exe 89 PID 880 wrote to memory of 4148 880 vppjd.exe 90 PID 880 wrote to memory of 4148 880 vppjd.exe 90 PID 880 wrote to memory of 4148 880 vppjd.exe 90 PID 4148 wrote to memory of 4636 4148 bbhbnn.exe 91 PID 4148 wrote to memory of 4636 4148 bbhbnn.exe 91 PID 4148 wrote to memory of 4636 4148 bbhbnn.exe 91 PID 4636 wrote to memory of 4940 4636 7flxfxf.exe 92 PID 4636 wrote to memory of 4940 4636 7flxfxf.exe 92 PID 4636 wrote to memory of 4940 4636 7flxfxf.exe 92 PID 4940 wrote to memory of 5028 4940 tnhbtn.exe 93 PID 4940 wrote to memory of 5028 4940 tnhbtn.exe 93 PID 4940 wrote to memory of 5028 4940 tnhbtn.exe 93 PID 5028 wrote to memory of 4068 5028 rxffffr.exe 94 PID 5028 wrote to memory of 4068 5028 rxffffr.exe 94 PID 5028 wrote to memory of 4068 5028 rxffffr.exe 94 PID 4068 wrote to memory of 4824 4068 5jddv.exe 95 PID 4068 wrote to memory of 4824 4068 5jddv.exe 95 PID 4068 wrote to memory of 4824 4068 5jddv.exe 95 PID 4824 wrote to memory of 3844 4824 hbhthb.exe 96 PID 4824 wrote to memory of 3844 4824 hbhthb.exe 96 PID 4824 wrote to memory of 3844 4824 hbhthb.exe 96 PID 3844 wrote to memory of 864 3844 jjddv.exe 97 PID 3844 wrote to memory of 864 3844 jjddv.exe 97 PID 3844 wrote to memory of 864 3844 jjddv.exe 97 PID 864 wrote to memory of 628 864 rfxxrll.exe 98 PID 864 wrote to memory of 628 864 rfxxrll.exe 98 PID 864 wrote to memory of 628 864 rfxxrll.exe 98 PID 628 wrote to memory of 2532 628 hhtnhh.exe 99 PID 628 wrote to memory of 2532 628 hhtnhh.exe 99 PID 628 wrote to memory of 2532 628 hhtnhh.exe 99 PID 2532 wrote to memory of 2368 2532 3dvvj.exe 100 PID 2532 wrote to memory of 2368 2532 3dvvj.exe 100 PID 2532 wrote to memory of 2368 2532 3dvvj.exe 100 PID 2368 wrote to memory of 1344 2368 5bhbbh.exe 101 PID 2368 wrote to memory of 1344 2368 5bhbbh.exe 101 PID 2368 wrote to memory of 1344 2368 5bhbbh.exe 101 PID 1344 wrote to memory of 1304 1344 ppvvv.exe 102 PID 1344 wrote to memory of 1304 1344 ppvvv.exe 102 PID 1344 wrote to memory of 1304 1344 ppvvv.exe 102 PID 1304 wrote to memory of 2764 1304 lfxrfxf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe"C:\Users\Admin\AppData\Local\Temp\0947bb18e9de5c828054f18179a78d81d4c8e5e51234907c9b3a54a822a20cabN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\rxrflxf.exec:\rxrflxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\djvjd.exec:\djvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\1llfrlf.exec:\1llfrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\ntbhnn.exec:\ntbhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\3nhttt.exec:\3nhttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\1nnbnn.exec:\1nnbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\lxlrxlx.exec:\lxlrxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\vppjd.exec:\vppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\bbhbnn.exec:\bbhbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\7flxfxf.exec:\7flxfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\tnhbtn.exec:\tnhbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\rxffffr.exec:\rxffffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\5jddv.exec:\5jddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\hbhthb.exec:\hbhthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\jjddv.exec:\jjddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\rfxxrll.exec:\rfxxrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\hhtnhh.exec:\hhtnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\3dvvj.exec:\3dvvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\5bhbbh.exec:\5bhbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\ppvvv.exec:\ppvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\lfxrfxf.exec:\lfxrfxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\tnnhbt.exec:\tnnhbt.exe23⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pjppp.exec:\pjppp.exe24⤵
- Executes dropped EXE
PID:3628 -
\??\c:\httthh.exec:\httthh.exe25⤵
- Executes dropped EXE
PID:1092 -
\??\c:\5pvpv.exec:\5pvpv.exe26⤵
- Executes dropped EXE
PID:3408 -
\??\c:\lffxlll.exec:\lffxlll.exe27⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ntnhnn.exec:\ntnhnn.exe28⤵
- Executes dropped EXE
PID:4704 -
\??\c:\5rrllff.exec:\5rrllff.exe29⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jvjjj.exec:\jvjjj.exe30⤵
- Executes dropped EXE
PID:4756 -
\??\c:\vpppp.exec:\vpppp.exe31⤵
- Executes dropped EXE
PID:696 -
\??\c:\7pdvj.exec:\7pdvj.exe32⤵
- Executes dropped EXE
PID:1428 -
\??\c:\nntnhh.exec:\nntnhh.exe33⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3rfrrfl.exec:\3rfrrfl.exe34⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hnbbnt.exec:\hnbbnt.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dddvv.exec:\dddvv.exe36⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rrlllll.exec:\rrlllll.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe38⤵
- Executes dropped EXE
PID:592 -
\??\c:\3dvjd.exec:\3dvjd.exe39⤵
- Executes dropped EXE
PID:4620 -
\??\c:\rxrxlfx.exec:\rxrxlfx.exe40⤵
- Executes dropped EXE
PID:3452 -
\??\c:\thnhnb.exec:\thnhnb.exe41⤵
- Executes dropped EXE
PID:4236 -
\??\c:\jvdjj.exec:\jvdjj.exe42⤵
- Executes dropped EXE
PID:4340 -
\??\c:\3pjdd.exec:\3pjdd.exe43⤵
- Executes dropped EXE
PID:4968 -
\??\c:\1xrffff.exec:\1xrffff.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:208 -
\??\c:\hbnnhb.exec:\hbnnhb.exe45⤵
- Executes dropped EXE
PID:4064 -
\??\c:\ddppp.exec:\ddppp.exe46⤵
- Executes dropped EXE
PID:4376 -
\??\c:\vjddd.exec:\vjddd.exe47⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nnbhhh.exec:\nnbhhh.exe48⤵
- Executes dropped EXE
PID:4344 -
\??\c:\pjvpp.exec:\pjvpp.exe49⤵
- Executes dropped EXE
PID:924 -
\??\c:\7lllfff.exec:\7lllfff.exe50⤵
- Executes dropped EXE
PID:4524 -
\??\c:\lrxxfff.exec:\lrxxfff.exe51⤵
- Executes dropped EXE
PID:4000 -
\??\c:\nbnnhh.exec:\nbnnhh.exe52⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ttnnnn.exec:\ttnnnn.exe53⤵
- Executes dropped EXE
PID:4020 -
\??\c:\3vdvj.exec:\3vdvj.exe54⤵
- Executes dropped EXE
PID:3688 -
\??\c:\rrxfrrr.exec:\rrxfrrr.exe55⤵
- Executes dropped EXE
PID:4516 -
\??\c:\hhbnnt.exec:\hhbnnt.exe56⤵
- Executes dropped EXE
PID:4844 -
\??\c:\7djdp.exec:\7djdp.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1120 -
\??\c:\lflfxrr.exec:\lflfxrr.exe58⤵
- Executes dropped EXE
PID:880 -
\??\c:\hbbtnn.exec:\hbbtnn.exe59⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bntnhh.exec:\bntnhh.exe60⤵
- Executes dropped EXE
PID:4744 -
\??\c:\djdpj.exec:\djdpj.exe61⤵
- Executes dropped EXE
PID:4832 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe62⤵
- Executes dropped EXE
PID:4052 -
\??\c:\nhbnhh.exec:\nhbnhh.exe63⤵
- Executes dropped EXE
PID:3500 -
\??\c:\jjppj.exec:\jjppj.exe64⤵
- Executes dropped EXE
PID:3948 -
\??\c:\lrrlffx.exec:\lrrlffx.exe65⤵
- Executes dropped EXE
PID:1676 -
\??\c:\bbhtbt.exec:\bbhtbt.exe66⤵PID:4176
-
\??\c:\7nnbnh.exec:\7nnbnh.exe67⤵PID:1336
-
\??\c:\3dvvj.exec:\3dvvj.exe68⤵PID:4824
-
\??\c:\rxxrlfr.exec:\rxxrlfr.exe69⤵PID:4928
-
\??\c:\3xrfxxl.exec:\3xrfxxl.exe70⤵PID:3892
-
\??\c:\1bthbt.exec:\1bthbt.exe71⤵PID:3432
-
\??\c:\5bbthh.exec:\5bbthh.exe72⤵PID:4424
-
\??\c:\9pjvp.exec:\9pjvp.exe73⤵PID:4976
-
\??\c:\7rrlxxl.exec:\7rrlxxl.exe74⤵PID:3784
-
\??\c:\nbtnhn.exec:\nbtnhn.exe75⤵PID:4188
-
\??\c:\pddpd.exec:\pddpd.exe76⤵PID:1344
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe77⤵PID:1304
-
\??\c:\thnntn.exec:\thnntn.exe78⤵PID:3476
-
\??\c:\pdpdp.exec:\pdpdp.exe79⤵PID:2476
-
\??\c:\1vjvp.exec:\1vjvp.exe80⤵PID:2620
-
\??\c:\3fxrllf.exec:\3fxrllf.exe81⤵PID:1092
-
\??\c:\ddvdv.exec:\ddvdv.exe82⤵PID:1764
-
\??\c:\ppdpj.exec:\ppdpj.exe83⤵PID:4920
-
\??\c:\3rrllxf.exec:\3rrllxf.exe84⤵PID:2832
-
\??\c:\bnnhhb.exec:\bnnhhb.exe85⤵PID:2828
-
\??\c:\vdvjv.exec:\vdvjv.exe86⤵PID:448
-
\??\c:\1jdpd.exec:\1jdpd.exe87⤵PID:4816
-
\??\c:\xrfxffx.exec:\xrfxffx.exe88⤵PID:816
-
\??\c:\9tnhhn.exec:\9tnhhn.exe89⤵PID:3484
-
\??\c:\dvvdv.exec:\dvvdv.exe90⤵PID:1584
-
\??\c:\jdpjd.exec:\jdpjd.exe91⤵PID:4560
-
\??\c:\9xlfffx.exec:\9xlfffx.exe92⤵PID:1604
-
\??\c:\7hhbbb.exec:\7hhbbb.exe93⤵PID:1068
-
\??\c:\5dvdj.exec:\5dvdj.exe94⤵PID:720
-
\??\c:\jpvpv.exec:\jpvpv.exe95⤵PID:3176
-
\??\c:\xrffffx.exec:\xrffffx.exe96⤵PID:3608
-
\??\c:\3tbttt.exec:\3tbttt.exe97⤵PID:556
-
\??\c:\9pjpp.exec:\9pjpp.exe98⤵PID:464
-
\??\c:\xrxrlll.exec:\xrxrlll.exe99⤵PID:4620
-
\??\c:\tntttt.exec:\tntttt.exe100⤵PID:3452
-
\??\c:\ddjjj.exec:\ddjjj.exe101⤵PID:2020
-
\??\c:\pddvv.exec:\pddvv.exe102⤵PID:2568
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe103⤵PID:3708
-
\??\c:\hhhnnb.exec:\hhhnnb.exe104⤵PID:3576
-
\??\c:\9dvpj.exec:\9dvpj.exe105⤵PID:928
-
\??\c:\fxlxlxl.exec:\fxlxlxl.exe106⤵PID:1520
-
\??\c:\bhnnth.exec:\bhnnth.exe107⤵PID:1008
-
\??\c:\ppvpv.exec:\ppvpv.exe108⤵PID:2308
-
\??\c:\xxffllf.exec:\xxffllf.exe109⤵PID:4204
-
\??\c:\bhhthb.exec:\bhhthb.exe110⤵PID:2920
-
\??\c:\dpdvp.exec:\dpdvp.exe111⤵PID:1756
-
\??\c:\lfrlffx.exec:\lfrlffx.exe112⤵PID:60
-
\??\c:\thhhht.exec:\thhhht.exe113⤵PID:4540
-
\??\c:\pjppj.exec:\pjppj.exe114⤵PID:2636
-
\??\c:\ppdvj.exec:\ppdvj.exe115⤵PID:4608
-
\??\c:\nbbttn.exec:\nbbttn.exe116⤵PID:1852
-
\??\c:\nntttt.exec:\nntttt.exe117⤵PID:740
-
\??\c:\jjppv.exec:\jjppv.exe118⤵PID:1120
-
\??\c:\flxrfll.exec:\flxrfll.exe119⤵PID:880
-
\??\c:\hhtnnh.exec:\hhtnnh.exe120⤵PID:440
-
\??\c:\ddppj.exec:\ddppj.exe121⤵PID:3456
-
\??\c:\lrxrrxf.exec:\lrxrrxf.exe122⤵PID:4984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-