Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 19:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
49e06b3aa40553a121927ef233d0b17b862653dbfc8a807b8832b18fa36741e2.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
49e06b3aa40553a121927ef233d0b17b862653dbfc8a807b8832b18fa36741e2.exe
-
Size
459KB
-
MD5
8e1473a8bf4c66c85e7508a46a0ce45d
-
SHA1
3f91d440be7113d81db12b999016cf3d7ae5d854
-
SHA256
49e06b3aa40553a121927ef233d0b17b862653dbfc8a807b8832b18fa36741e2
-
SHA512
be1d97fabdf6e57f2c5ee9371b5c51f7e5938980c75e71cc23b498d3a4fae2405e7456dbaf285757411b4b31390e769c16416fed069fd935d9e3e3c7e71c852d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeye:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/5920-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5232-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6040-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5140-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5132-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5892-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5144-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5500-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5424-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5444-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5856-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5216-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5908-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5632-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5264-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5268-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6116-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5244-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6004-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6096-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5244-852-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-1106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-1491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5232 djdpp.exe 5268 tnnnnt.exe 2092 xrfffff.exe 3864 tttnhn.exe 5264 jdddv.exe 5632 9lrllrl.exe 1496 thtttt.exe 1908 1nthbh.exe 5908 pvjjj.exe 1756 xlxrrxx.exe 6040 rflrxxx.exe 4156 btnhhh.exe 4468 vpppp.exe 3996 jdjjj.exe 4612 flxxlrx.exe 4568 ttnnbb.exe 4688 nbhhbh.exe 4764 djvvv.exe 4864 lfrrfll.exe 4664 tnntbh.exe 1652 9pdvj.exe 5216 xrxxxff.exe 3384 lrrlffx.exe 4940 pvddj.exe 4656 ppvpp.exe 4996 frxxfll.exe 5028 htnhbn.exe 2416 9dppp.exe 4496 xxxrlll.exe 5856 tbtttb.exe 4492 hthhbb.exe 2904 pvddd.exe 2896 rxllxxl.exe 4780 1nbtbb.exe 1660 nthbbb.exe 4704 pdjjv.exe 5652 rrxxxff.exe 5860 rffrlfx.exe 5444 tnthbb.exe 1384 pjjdj.exe 5424 lllllll.exe 1112 7xxfffl.exe 5500 hhtnnt.exe 1984 pvjpj.exe 5140 vvdvd.exe 2452 rxrrxxl.exe 5144 1bbbtb.exe 1876 nnbhhh.exe 3208 3jppp.exe 3544 5lxrrrf.exe 5892 frfffxx.exe 5248 nbnhhh.exe 4476 vvjvp.exe 4504 jvdvv.exe 4036 fxrxllf.exe 5996 ttbbtb.exe 1992 btnnhh.exe 2832 vvddd.exe 4164 lrfxxff.exe 4152 rlrrrff.exe 3720 tntnnh.exe 548 jjppp.exe 5132 ddjjp.exe 4692 xxllrxf.exe -
resource yara_rule behavioral2/memory/5920-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5268-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5232-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6040-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5140-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5132-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5892-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5144-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5500-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5424-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5444-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5856-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5216-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5908-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5632-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5264-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5268-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6116-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5244-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6004-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6096-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5252-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5244-852-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5920 wrote to memory of 5232 5920 49e06b3aa40553a121927ef233d0b17b862653dbfc8a807b8832b18fa36741e2.exe 87 PID 5920 wrote to memory of 5232 5920 49e06b3aa40553a121927ef233d0b17b862653dbfc8a807b8832b18fa36741e2.exe 87 PID 5920 wrote to memory of 5232 5920 49e06b3aa40553a121927ef233d0b17b862653dbfc8a807b8832b18fa36741e2.exe 87 PID 5232 wrote to memory of 5268 5232 djdpp.exe 88 PID 5232 wrote to memory of 5268 5232 djdpp.exe 88 PID 5232 wrote to memory of 5268 5232 djdpp.exe 88 PID 5268 wrote to memory of 2092 5268 tnnnnt.exe 89 PID 5268 wrote to memory of 2092 5268 tnnnnt.exe 89 PID 5268 wrote to memory of 2092 5268 tnnnnt.exe 89 PID 2092 wrote to memory of 3864 2092 xrfffff.exe 90 PID 2092 wrote to memory of 3864 2092 xrfffff.exe 90 PID 2092 wrote to memory of 3864 2092 xrfffff.exe 90 PID 3864 wrote to memory of 5264 3864 tttnhn.exe 91 PID 3864 wrote to memory of 5264 3864 tttnhn.exe 91 PID 3864 wrote to memory of 5264 3864 tttnhn.exe 91 PID 5264 wrote to memory of 5632 5264 jdddv.exe 92 PID 5264 wrote to memory of 5632 5264 jdddv.exe 92 PID 5264 wrote to memory of 5632 5264 jdddv.exe 92 PID 5632 wrote to memory of 1496 5632 9lrllrl.exe 93 PID 5632 wrote to memory of 1496 5632 9lrllrl.exe 93 PID 5632 wrote to memory of 1496 5632 9lrllrl.exe 93 PID 1496 wrote to memory of 1908 1496 thtttt.exe 94 PID 1496 wrote to memory of 1908 1496 thtttt.exe 94 PID 1496 wrote to memory of 1908 1496 thtttt.exe 94 PID 1908 wrote to memory of 5908 1908 1nthbh.exe 95 PID 1908 wrote to memory of 5908 1908 1nthbh.exe 95 PID 1908 wrote to memory of 5908 1908 1nthbh.exe 95 PID 5908 wrote to memory of 1756 5908 pvjjj.exe 96 PID 5908 wrote to memory of 1756 5908 pvjjj.exe 96 PID 5908 wrote to memory of 1756 5908 pvjjj.exe 96 PID 1756 wrote to memory of 6040 1756 xlxrrxx.exe 97 PID 1756 wrote to memory of 6040 1756 xlxrrxx.exe 97 PID 1756 wrote to memory of 6040 1756 xlxrrxx.exe 97 PID 6040 wrote to memory of 4156 6040 rflrxxx.exe 98 PID 6040 wrote to memory of 4156 6040 rflrxxx.exe 98 PID 6040 wrote to memory of 4156 6040 rflrxxx.exe 98 PID 4156 wrote to memory of 4468 4156 btnhhh.exe 99 PID 4156 wrote to memory of 4468 4156 btnhhh.exe 99 PID 4156 wrote to memory of 4468 4156 btnhhh.exe 99 PID 4468 wrote to memory of 3996 4468 vpppp.exe 100 PID 4468 wrote to memory of 3996 4468 vpppp.exe 100 PID 4468 wrote to memory of 3996 4468 vpppp.exe 100 PID 3996 wrote to memory of 4612 3996 jdjjj.exe 101 PID 3996 wrote to memory of 4612 3996 jdjjj.exe 101 PID 3996 wrote to memory of 4612 3996 jdjjj.exe 101 PID 4612 wrote to memory of 4568 4612 flxxlrx.exe 102 PID 4612 wrote to memory of 4568 4612 flxxlrx.exe 102 PID 4612 wrote to memory of 4568 4612 flxxlrx.exe 102 PID 4568 wrote to memory of 4688 4568 ttnnbb.exe 103 PID 4568 wrote to memory of 4688 4568 ttnnbb.exe 103 PID 4568 wrote to memory of 4688 4568 ttnnbb.exe 103 PID 4688 wrote to memory of 4764 4688 nbhhbh.exe 104 PID 4688 wrote to memory of 4764 4688 nbhhbh.exe 104 PID 4688 wrote to memory of 4764 4688 nbhhbh.exe 104 PID 4764 wrote to memory of 4864 4764 djvvv.exe 105 PID 4764 wrote to memory of 4864 4764 djvvv.exe 105 PID 4764 wrote to memory of 4864 4764 djvvv.exe 105 PID 4864 wrote to memory of 4664 4864 lfrrfll.exe 106 PID 4864 wrote to memory of 4664 4864 lfrrfll.exe 106 PID 4864 wrote to memory of 4664 4864 lfrrfll.exe 106 PID 4664 wrote to memory of 1652 4664 tnntbh.exe 107 PID 4664 wrote to memory of 1652 4664 tnntbh.exe 107 PID 4664 wrote to memory of 1652 4664 tnntbh.exe 107 PID 1652 wrote to memory of 5216 1652 9pdvj.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\49e06b3aa40553a121927ef233d0b17b862653dbfc8a807b8832b18fa36741e2.exe"C:\Users\Admin\AppData\Local\Temp\49e06b3aa40553a121927ef233d0b17b862653dbfc8a807b8832b18fa36741e2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5920 -
\??\c:\djdpp.exec:\djdpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
\??\c:\tnnnnt.exec:\tnnnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
\??\c:\xrfffff.exec:\xrfffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\tttnhn.exec:\tttnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\jdddv.exec:\jdddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
\??\c:\9lrllrl.exec:\9lrllrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
\??\c:\thtttt.exec:\thtttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\1nthbh.exec:\1nthbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\pvjjj.exec:\pvjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
\??\c:\xlxrrxx.exec:\xlxrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\rflrxxx.exec:\rflrxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
\??\c:\btnhhh.exec:\btnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\vpppp.exec:\vpppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\jdjjj.exec:\jdjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\flxxlrx.exec:\flxxlrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\ttnnbb.exec:\ttnnbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\nbhhbh.exec:\nbhhbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\djvvv.exec:\djvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\lfrrfll.exec:\lfrrfll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\tnntbh.exec:\tnntbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\9pdvj.exec:\9pdvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\xrxxxff.exec:\xrxxxff.exe23⤵
- Executes dropped EXE
PID:5216 -
\??\c:\lrrlffx.exec:\lrrlffx.exe24⤵
- Executes dropped EXE
PID:3384 -
\??\c:\pvddj.exec:\pvddj.exe25⤵
- Executes dropped EXE
PID:4940 -
\??\c:\ppvpp.exec:\ppvpp.exe26⤵
- Executes dropped EXE
PID:4656 -
\??\c:\frxxfll.exec:\frxxfll.exe27⤵
- Executes dropped EXE
PID:4996 -
\??\c:\htnhbn.exec:\htnhbn.exe28⤵
- Executes dropped EXE
PID:5028 -
\??\c:\9dppp.exec:\9dppp.exe29⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xxxrlll.exec:\xxxrlll.exe30⤵
- Executes dropped EXE
PID:4496 -
\??\c:\tbtttb.exec:\tbtttb.exe31⤵
- Executes dropped EXE
PID:5856 -
\??\c:\hthhbb.exec:\hthhbb.exe32⤵
- Executes dropped EXE
PID:4492 -
\??\c:\pvddd.exec:\pvddd.exe33⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rxllxxl.exec:\rxllxxl.exe34⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1nbtbb.exec:\1nbtbb.exe35⤵
- Executes dropped EXE
PID:4780 -
\??\c:\nthbbb.exec:\nthbbb.exe36⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdjjv.exec:\pdjjv.exe37⤵
- Executes dropped EXE
PID:4704 -
\??\c:\rrxxxff.exec:\rrxxxff.exe38⤵
- Executes dropped EXE
PID:5652 -
\??\c:\rffrlfx.exec:\rffrlfx.exe39⤵
- Executes dropped EXE
PID:5860 -
\??\c:\tnthbb.exec:\tnthbb.exe40⤵
- Executes dropped EXE
PID:5444 -
\??\c:\pjjdj.exec:\pjjdj.exe41⤵
- Executes dropped EXE
PID:1384 -
\??\c:\lllllll.exec:\lllllll.exe42⤵
- Executes dropped EXE
PID:5424 -
\??\c:\7xxfffl.exec:\7xxfffl.exe43⤵
- Executes dropped EXE
PID:1112 -
\??\c:\hhtnnt.exec:\hhtnnt.exe44⤵
- Executes dropped EXE
PID:5500 -
\??\c:\pvjpj.exec:\pvjpj.exe45⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vvdvd.exec:\vvdvd.exe46⤵
- Executes dropped EXE
PID:5140 -
\??\c:\rxrrxxl.exec:\rxrrxxl.exe47⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1bbbtb.exec:\1bbbtb.exe48⤵
- Executes dropped EXE
PID:5144 -
\??\c:\nnbhhh.exec:\nnbhhh.exe49⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3jppp.exec:\3jppp.exe50⤵
- Executes dropped EXE
PID:3208 -
\??\c:\5lxrrrf.exec:\5lxrrrf.exe51⤵
- Executes dropped EXE
PID:3544 -
\??\c:\frfffxx.exec:\frfffxx.exe52⤵
- Executes dropped EXE
PID:5892 -
\??\c:\nbnhhh.exec:\nbnhhh.exe53⤵
- Executes dropped EXE
PID:5248 -
\??\c:\vvjvp.exec:\vvjvp.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4476 -
\??\c:\jvdvv.exec:\jvdvv.exe55⤵
- Executes dropped EXE
PID:4504 -
\??\c:\fxrxllf.exec:\fxrxllf.exe56⤵
- Executes dropped EXE
PID:4036 -
\??\c:\ttbbtb.exec:\ttbbtb.exe57⤵
- Executes dropped EXE
PID:5996 -
\??\c:\btnnhh.exec:\btnnhh.exe58⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vvddd.exec:\vvddd.exe59⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lrfxxff.exec:\lrfxxff.exe60⤵
- Executes dropped EXE
PID:4164 -
\??\c:\rlrrrff.exec:\rlrrrff.exe61⤵
- Executes dropped EXE
PID:4152 -
\??\c:\tntnnh.exec:\tntnnh.exe62⤵
- Executes dropped EXE
PID:3720 -
\??\c:\jjppp.exec:\jjppp.exe63⤵
- Executes dropped EXE
PID:548 -
\??\c:\ddjjp.exec:\ddjjp.exe64⤵
- Executes dropped EXE
PID:5132 -
\??\c:\xxllrxf.exec:\xxllrxf.exe65⤵
- Executes dropped EXE
PID:4692 -
\??\c:\nbnttt.exec:\nbnttt.exe66⤵PID:652
-
\??\c:\5vvvv.exec:\5vvvv.exe67⤵PID:2412
-
\??\c:\lrllrxx.exec:\lrllrxx.exe68⤵PID:3916
-
\??\c:\fffflrx.exec:\fffflrx.exe69⤵PID:1728
-
\??\c:\dpjjp.exec:\dpjjp.exe70⤵PID:4128
-
\??\c:\fffffff.exec:\fffffff.exe71⤵PID:2868
-
\??\c:\lrffrxx.exec:\lrffrxx.exe72⤵PID:5332
-
\??\c:\vdvvv.exec:\vdvvv.exe73⤵PID:1032
-
\??\c:\1ddvp.exec:\1ddvp.exe74⤵PID:6116
-
\??\c:\rlrxrff.exec:\rlrxrff.exe75⤵PID:2060
-
\??\c:\bntttt.exec:\bntttt.exe76⤵PID:4252
-
\??\c:\vpvdd.exec:\vpvdd.exe77⤵PID:1848
-
\??\c:\rrlrrxr.exec:\rrlrrxr.exe78⤵PID:1716
-
\??\c:\btbbtt.exec:\btbbtt.exe79⤵PID:4004
-
\??\c:\djppv.exec:\djppv.exe80⤵PID:5244
-
\??\c:\9jdvv.exec:\9jdvv.exe81⤵PID:5224
-
\??\c:\xxllrrx.exec:\xxllrrx.exe82⤵PID:5412
-
\??\c:\jjddp.exec:\jjddp.exe83⤵PID:2852
-
\??\c:\fxrlrfx.exec:\fxrlrfx.exe84⤵PID:4404
-
\??\c:\htbtbn.exec:\htbtbn.exe85⤵PID:6004
-
\??\c:\bnntbh.exec:\bnntbh.exe86⤵PID:4512
-
\??\c:\vjppj.exec:\vjppj.exe87⤵PID:2364
-
\??\c:\rxllrxl.exec:\rxllrxl.exe88⤵PID:5980
-
\??\c:\bthhhn.exec:\bthhhn.exe89⤵PID:2696
-
\??\c:\jjvdj.exec:\jjvdj.exe90⤵PID:6044
-
\??\c:\hbnntb.exec:\hbnntb.exe91⤵PID:376
-
\??\c:\bhnnbh.exec:\bhnnbh.exe92⤵PID:5900
-
\??\c:\jpppp.exec:\jpppp.exe93⤵PID:5260
-
\??\c:\lfrlrrr.exec:\lfrlrrr.exe94⤵PID:3532
-
\??\c:\bbhhhn.exec:\bbhhhn.exe95⤵PID:5604
-
\??\c:\vjppv.exec:\vjppv.exe96⤵PID:4544
-
\??\c:\xrxxxff.exec:\xrxxxff.exe97⤵PID:4608
-
\??\c:\fxfflrr.exec:\fxfflrr.exe98⤵PID:2524
-
\??\c:\nhbtbh.exec:\nhbtbh.exe99⤵PID:4568
-
\??\c:\dvddd.exec:\dvddd.exe100⤵PID:4864
-
\??\c:\9rlfxfx.exec:\9rlfxfx.exe101⤵PID:4876
-
\??\c:\nhnnhh.exec:\nhnnhh.exe102⤵PID:2276
-
\??\c:\htntbb.exec:\htntbb.exe103⤵PID:4560
-
\??\c:\jdppv.exec:\jdppv.exe104⤵PID:3384
-
\??\c:\rflfxxr.exec:\rflfxxr.exe105⤵PID:4816
-
\??\c:\ffxxxll.exec:\ffxxxll.exe106⤵PID:4656
-
\??\c:\bnbttt.exec:\bnbttt.exe107⤵PID:2804
-
\??\c:\pjvpj.exec:\pjvpj.exe108⤵PID:4968
-
\??\c:\dvdvv.exec:\dvdvv.exe109⤵PID:3784
-
\??\c:\rrfxlrf.exec:\rrfxlrf.exe110⤵
- System Location Discovery: System Language Discovery
PID:5856 -
\??\c:\tthhbh.exec:\tthhbh.exe111⤵PID:2904
-
\??\c:\hbbbtb.exec:\hbbbtb.exe112⤵PID:4516
-
\??\c:\vppdv.exec:\vppdv.exe113⤵PID:5740
-
\??\c:\fxllfff.exec:\fxllfff.exe114⤵PID:1952
-
\??\c:\7lllrrf.exec:\7lllrrf.exe115⤵PID:5652
-
\??\c:\bbbhbb.exec:\bbbhbb.exe116⤵PID:1052
-
\??\c:\pjppp.exec:\pjppp.exe117⤵PID:2044
-
\??\c:\dpddv.exec:\dpddv.exe118⤵
- System Location Discovery: System Language Discovery
PID:1384 -
\??\c:\xrxrlrr.exec:\xrxrlrr.exe119⤵PID:4808
-
\??\c:\hthbtb.exec:\hthbtb.exe120⤵PID:4452
-
\??\c:\nhbttn.exec:\nhbttn.exe121⤵PID:6028
-
\??\c:\vjvpp.exec:\vjvpp.exe122⤵PID:3768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-