Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe
-
Size
455KB
-
MD5
a396c6182b8886a2a8247faa8f4cbb80
-
SHA1
c5a6dd5df9d3ce6b0ecfb155d81c18ef0d7e4858
-
SHA256
acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134
-
SHA512
f6b025a112b5e2d539b9645e19fed8d6276e66266c8265891eec98942340bba8a2578c4f73697274d378bb11c765528958d88810aefeccd4414fa13f438a863c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeh:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4784-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-1049-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-1146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-1168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-1743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4316 5flfflf.exe 5024 lfrrxfl.exe 1984 hbnbtn.exe 4984 xrfxlfx.exe 1480 vjjjj.exe 4904 nnbtbt.exe 4844 lxfrfxr.exe 516 hbthth.exe 4404 fxrfxrl.exe 3464 3ththb.exe 2412 7lxlxlx.exe 732 nhnhtt.exe 3508 jdvjv.exe 1900 9nbbnb.exe 1196 jpvpd.exe 4452 xxxrllf.exe 2664 9nnnhb.exe 3996 lrxrlll.exe 4948 pjpvp.exe 3588 3fxrffx.exe 3064 vpdvp.exe 1400 xxxrffl.exe 4816 hbtnnh.exe 3524 lxfllll.exe 1488 nhbtnh.exe 2792 pdddv.exe 2244 fllfrfx.exe 3320 7jdvp.exe 2320 9ffxrlx.exe 2280 bbbnht.exe 4080 frrlfxr.exe 3316 hnbbtn.exe 4320 jjddd.exe 3888 frlxlxr.exe 1696 nbbnhb.exe 1068 vvvdp.exe 4668 fllxflx.exe 452 hnbthh.exe 3412 bbnhnt.exe 652 ppjvd.exe 1968 lrrflfr.exe 648 ttnbhb.exe 4024 1ppdp.exe 1912 fllxrfx.exe 4364 ntthtn.exe 3188 nhhbbb.exe 3584 jjdpd.exe 4836 frlxfxr.exe 2032 5frfrlx.exe 3552 7bbtbt.exe 864 7vvjv.exe 4984 9xrxxlr.exe 3640 1rfxrxr.exe 2372 bbbbtt.exe 1172 jjjvv.exe 1652 xflflfr.exe 1872 lfllrll.exe 3896 thtttn.exe 3328 jddpj.exe 560 xflfxff.exe 3464 1htnhb.exe 2064 jddvp.exe 2160 vpjpd.exe 3092 rrrfrlx.exe -
resource yara_rule behavioral2/memory/4316-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-1049-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-1146-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xflxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4784 wrote to memory of 4316 4784 acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe 82 PID 4784 wrote to memory of 4316 4784 acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe 82 PID 4784 wrote to memory of 4316 4784 acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe 82 PID 4316 wrote to memory of 5024 4316 5flfflf.exe 83 PID 4316 wrote to memory of 5024 4316 5flfflf.exe 83 PID 4316 wrote to memory of 5024 4316 5flfflf.exe 83 PID 5024 wrote to memory of 1984 5024 lfrrxfl.exe 84 PID 5024 wrote to memory of 1984 5024 lfrrxfl.exe 84 PID 5024 wrote to memory of 1984 5024 lfrrxfl.exe 84 PID 1984 wrote to memory of 4984 1984 hbnbtn.exe 85 PID 1984 wrote to memory of 4984 1984 hbnbtn.exe 85 PID 1984 wrote to memory of 4984 1984 hbnbtn.exe 85 PID 4984 wrote to memory of 1480 4984 xrfxlfx.exe 86 PID 4984 wrote to memory of 1480 4984 xrfxlfx.exe 86 PID 4984 wrote to memory of 1480 4984 xrfxlfx.exe 86 PID 1480 wrote to memory of 4904 1480 vjjjj.exe 87 PID 1480 wrote to memory of 4904 1480 vjjjj.exe 87 PID 1480 wrote to memory of 4904 1480 vjjjj.exe 87 PID 4904 wrote to memory of 4844 4904 nnbtbt.exe 88 PID 4904 wrote to memory of 4844 4904 nnbtbt.exe 88 PID 4904 wrote to memory of 4844 4904 nnbtbt.exe 88 PID 4844 wrote to memory of 516 4844 lxfrfxr.exe 89 PID 4844 wrote to memory of 516 4844 lxfrfxr.exe 89 PID 4844 wrote to memory of 516 4844 lxfrfxr.exe 89 PID 516 wrote to memory of 4404 516 hbthth.exe 90 PID 516 wrote to memory of 4404 516 hbthth.exe 90 PID 516 wrote to memory of 4404 516 hbthth.exe 90 PID 4404 wrote to memory of 3464 4404 fxrfxrl.exe 91 PID 4404 wrote to memory of 3464 4404 fxrfxrl.exe 91 PID 4404 wrote to memory of 3464 4404 fxrfxrl.exe 91 PID 3464 wrote to memory of 2412 3464 3ththb.exe 92 PID 3464 wrote to memory of 2412 3464 3ththb.exe 92 PID 3464 wrote to memory of 2412 3464 3ththb.exe 92 PID 2412 wrote to memory of 732 2412 7lxlxlx.exe 93 PID 2412 wrote to memory of 732 2412 7lxlxlx.exe 93 PID 2412 wrote to memory of 732 2412 7lxlxlx.exe 93 PID 732 wrote to memory of 3508 732 nhnhtt.exe 94 PID 732 wrote to memory of 3508 732 nhnhtt.exe 94 PID 732 wrote to memory of 3508 732 nhnhtt.exe 94 PID 3508 wrote to memory of 1900 3508 jdvjv.exe 95 PID 3508 wrote to memory of 1900 3508 jdvjv.exe 95 PID 3508 wrote to memory of 1900 3508 jdvjv.exe 95 PID 1900 wrote to memory of 1196 1900 9nbbnb.exe 96 PID 1900 wrote to memory of 1196 1900 9nbbnb.exe 96 PID 1900 wrote to memory of 1196 1900 9nbbnb.exe 96 PID 1196 wrote to memory of 4452 1196 jpvpd.exe 97 PID 1196 wrote to memory of 4452 1196 jpvpd.exe 97 PID 1196 wrote to memory of 4452 1196 jpvpd.exe 97 PID 4452 wrote to memory of 2664 4452 xxxrllf.exe 98 PID 4452 wrote to memory of 2664 4452 xxxrllf.exe 98 PID 4452 wrote to memory of 2664 4452 xxxrllf.exe 98 PID 2664 wrote to memory of 3996 2664 9nnnhb.exe 99 PID 2664 wrote to memory of 3996 2664 9nnnhb.exe 99 PID 2664 wrote to memory of 3996 2664 9nnnhb.exe 99 PID 3996 wrote to memory of 4948 3996 lrxrlll.exe 100 PID 3996 wrote to memory of 4948 3996 lrxrlll.exe 100 PID 3996 wrote to memory of 4948 3996 lrxrlll.exe 100 PID 4948 wrote to memory of 3588 4948 pjpvp.exe 101 PID 4948 wrote to memory of 3588 4948 pjpvp.exe 101 PID 4948 wrote to memory of 3588 4948 pjpvp.exe 101 PID 3588 wrote to memory of 3064 3588 3fxrffx.exe 102 PID 3588 wrote to memory of 3064 3588 3fxrffx.exe 102 PID 3588 wrote to memory of 3064 3588 3fxrffx.exe 102 PID 3064 wrote to memory of 1400 3064 vpdvp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe"C:\Users\Admin\AppData\Local\Temp\acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\5flfflf.exec:\5flfflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\hbnbtn.exec:\hbnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\xrfxlfx.exec:\xrfxlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\vjjjj.exec:\vjjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\nnbtbt.exec:\nnbtbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\lxfrfxr.exec:\lxfrfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\hbthth.exec:\hbthth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\3ththb.exec:\3ththb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\7lxlxlx.exec:\7lxlxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\nhnhtt.exec:\nhnhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\jdvjv.exec:\jdvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\9nbbnb.exec:\9nbbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\jpvpd.exec:\jpvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\xxxrllf.exec:\xxxrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\9nnnhb.exec:\9nnnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lrxrlll.exec:\lrxrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\pjpvp.exec:\pjpvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\3fxrffx.exec:\3fxrffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\vpdvp.exec:\vpdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xxxrffl.exec:\xxxrffl.exe23⤵
- Executes dropped EXE
PID:1400 -
\??\c:\hbtnnh.exec:\hbtnnh.exe24⤵
- Executes dropped EXE
PID:4816 -
\??\c:\lxfllll.exec:\lxfllll.exe25⤵
- Executes dropped EXE
PID:3524 -
\??\c:\nhbtnh.exec:\nhbtnh.exe26⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pdddv.exec:\pdddv.exe27⤵
- Executes dropped EXE
PID:2792 -
\??\c:\fllfrfx.exec:\fllfrfx.exe28⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7jdvp.exec:\7jdvp.exe29⤵
- Executes dropped EXE
PID:3320 -
\??\c:\9ffxrlx.exec:\9ffxrlx.exe30⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bbbnht.exec:\bbbnht.exe31⤵
- Executes dropped EXE
PID:2280 -
\??\c:\frrlfxr.exec:\frrlfxr.exe32⤵
- Executes dropped EXE
PID:4080 -
\??\c:\hnbbtn.exec:\hnbbtn.exe33⤵
- Executes dropped EXE
PID:3316 -
\??\c:\jjddd.exec:\jjddd.exe34⤵
- Executes dropped EXE
PID:4320 -
\??\c:\frlxlxr.exec:\frlxlxr.exe35⤵
- Executes dropped EXE
PID:3888 -
\??\c:\nbbnhb.exec:\nbbnhb.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vvvdp.exec:\vvvdp.exe37⤵
- Executes dropped EXE
PID:1068 -
\??\c:\fllxflx.exec:\fllxflx.exe38⤵
- Executes dropped EXE
PID:4668 -
\??\c:\hnbthh.exec:\hnbthh.exe39⤵
- Executes dropped EXE
PID:452 -
\??\c:\bbnhnt.exec:\bbnhnt.exe40⤵
- Executes dropped EXE
PID:3412 -
\??\c:\ppjvd.exec:\ppjvd.exe41⤵
- Executes dropped EXE
PID:652 -
\??\c:\lrrflfr.exec:\lrrflfr.exe42⤵
- Executes dropped EXE
PID:1968 -
\??\c:\ttnbhb.exec:\ttnbhb.exe43⤵
- Executes dropped EXE
PID:648 -
\??\c:\1ppdp.exec:\1ppdp.exe44⤵
- Executes dropped EXE
PID:4024 -
\??\c:\fllxrfx.exec:\fllxrfx.exe45⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ntthtn.exec:\ntthtn.exe46⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nhhbbb.exec:\nhhbbb.exe47⤵
- Executes dropped EXE
PID:3188 -
\??\c:\jjdpd.exec:\jjdpd.exe48⤵
- Executes dropped EXE
PID:3584 -
\??\c:\frlxfxr.exec:\frlxfxr.exe49⤵
- Executes dropped EXE
PID:4836 -
\??\c:\5frfrlx.exec:\5frfrlx.exe50⤵
- Executes dropped EXE
PID:2032 -
\??\c:\7bbtbt.exec:\7bbtbt.exe51⤵
- Executes dropped EXE
PID:3552 -
\??\c:\7vvjv.exec:\7vvjv.exe52⤵
- Executes dropped EXE
PID:864 -
\??\c:\9xrxxlr.exec:\9xrxxlr.exe53⤵
- Executes dropped EXE
PID:4984 -
\??\c:\1rfxrxr.exec:\1rfxrxr.exe54⤵
- Executes dropped EXE
PID:3640 -
\??\c:\bbbbtt.exec:\bbbbtt.exe55⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jjjvv.exec:\jjjvv.exe56⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xflflfr.exec:\xflflfr.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lfllrll.exec:\lfllrll.exe58⤵
- Executes dropped EXE
PID:1872 -
\??\c:\thtttn.exec:\thtttn.exe59⤵
- Executes dropped EXE
PID:3896 -
\??\c:\jddpj.exec:\jddpj.exe60⤵
- Executes dropped EXE
PID:3328 -
\??\c:\xflfxff.exec:\xflfxff.exe61⤵
- Executes dropped EXE
PID:560 -
\??\c:\1htnhb.exec:\1htnhb.exe62⤵
- Executes dropped EXE
PID:3464 -
\??\c:\jddvp.exec:\jddvp.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\vpjpd.exec:\vpjpd.exe64⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rrrfrlx.exec:\rrrfrlx.exe65⤵
- Executes dropped EXE
PID:3092 -
\??\c:\tnhbtt.exec:\tnhbtt.exe66⤵PID:3044
-
\??\c:\vvdvd.exec:\vvdvd.exe67⤵PID:3204
-
\??\c:\fxfrlll.exec:\fxfrlll.exe68⤵PID:2936
-
\??\c:\nbbtth.exec:\nbbtth.exe69⤵PID:4268
-
\??\c:\jvdvv.exec:\jvdvv.exe70⤵PID:244
-
\??\c:\jdjvv.exec:\jdjvv.exe71⤵PID:4744
-
\??\c:\rxxlxrf.exec:\rxxlxrf.exe72⤵PID:1980
-
\??\c:\bttbth.exec:\bttbth.exe73⤵PID:4356
-
\??\c:\pdvpj.exec:\pdvpj.exe74⤵PID:3720
-
\??\c:\pvdpd.exec:\pvdpd.exe75⤵PID:2424
-
\??\c:\lfrrfff.exec:\lfrrfff.exe76⤵PID:3580
-
\??\c:\7nthhb.exec:\7nthhb.exe77⤵PID:3592
-
\??\c:\djdjv.exec:\djdjv.exe78⤵PID:3460
-
\??\c:\3lfxrll.exec:\3lfxrll.exe79⤵PID:2344
-
\??\c:\hhnbnn.exec:\hhnbnn.exe80⤵PID:4816
-
\??\c:\3bnhtn.exec:\3bnhtn.exe81⤵PID:4588
-
\??\c:\pddvj.exec:\pddvj.exe82⤵PID:3836
-
\??\c:\fxxrllf.exec:\fxxrllf.exe83⤵PID:1488
-
\??\c:\hbtnbt.exec:\hbtnbt.exe84⤵
- System Location Discovery: System Language Discovery
PID:4576 -
\??\c:\9bnbtn.exec:\9bnbtn.exe85⤵PID:1168
-
\??\c:\dppdv.exec:\dppdv.exe86⤵PID:3784
-
\??\c:\xxxrlff.exec:\xxxrlff.exe87⤵PID:4520
-
\??\c:\nhhttn.exec:\nhhttn.exe88⤵PID:4144
-
\??\c:\5ttnht.exec:\5ttnht.exe89⤵PID:4572
-
\??\c:\dppvv.exec:\dppvv.exe90⤵PID:2280
-
\??\c:\xxxxfll.exec:\xxxxfll.exe91⤵PID:2700
-
\??\c:\hbtnbt.exec:\hbtnbt.exe92⤵PID:3168
-
\??\c:\nhhthb.exec:\nhhthb.exe93⤵PID:3172
-
\??\c:\1ppvp.exec:\1ppvp.exe94⤵PID:4540
-
\??\c:\rxrlrlx.exec:\rxrlrlx.exe95⤵PID:5008
-
\??\c:\bbtnbt.exec:\bbtnbt.exe96⤵PID:1072
-
\??\c:\dddpj.exec:\dddpj.exe97⤵PID:2092
-
\??\c:\xrxfrlr.exec:\xrxfrlr.exe98⤵PID:4592
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe99⤵PID:3980
-
\??\c:\thnhhh.exec:\thnhhh.exe100⤵PID:4136
-
\??\c:\vjppd.exec:\vjppd.exe101⤵PID:4940
-
\??\c:\3llfffx.exec:\3llfffx.exe102⤵PID:1968
-
\??\c:\tnhtht.exec:\tnhtht.exe103⤵PID:648
-
\??\c:\pddvv.exec:\pddvv.exe104⤵PID:4024
-
\??\c:\7ffxllf.exec:\7ffxllf.exe105⤵PID:4420
-
\??\c:\flffxrf.exec:\flffxrf.exe106⤵PID:4360
-
\??\c:\1hbnbb.exec:\1hbnbb.exe107⤵PID:3492
-
\??\c:\9vvpj.exec:\9vvpj.exe108⤵PID:3584
-
\??\c:\rxxfrlf.exec:\rxxfrlf.exe109⤵PID:696
-
\??\c:\xrxllff.exec:\xrxllff.exe110⤵PID:4968
-
\??\c:\nhbhbt.exec:\nhbhbt.exe111⤵PID:1984
-
\??\c:\dvvjv.exec:\dvvjv.exe112⤵PID:4416
-
\??\c:\9djdj.exec:\9djdj.exe113⤵PID:1204
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe114⤵PID:3740
-
\??\c:\1hnhhh.exec:\1hnhhh.exe115⤵PID:3760
-
\??\c:\hhhtbt.exec:\hhhtbt.exe116⤵PID:5004
-
\??\c:\7jdpd.exec:\7jdpd.exe117⤵PID:464
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe118⤵PID:3296
-
\??\c:\lxrlxrf.exec:\lxrlxrf.exe119⤵PID:1964
-
\??\c:\hhnbth.exec:\hhnbth.exe120⤵PID:2552
-
\??\c:\djpdp.exec:\djpdp.exe121⤵PID:3728
-
\??\c:\7vdpd.exec:\7vdpd.exe122⤵PID:2940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-