Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe
-
Size
457KB
-
MD5
66900a973f941e9a8af51fe715e4a112
-
SHA1
3903ee28689e8fad2d6bbc1a7b9363992929fafa
-
SHA256
5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f
-
SHA512
a7b11736757d757570efe5cf50bdbe96ff13e314bf6e5203dcf6b9c300b3daf75916c85b8e3f9d5ea8e51a8f71f62da8ec05637056abb8a241b6288e586e7b95
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeSc:q7Tc2NYHUrAwfMp3CDF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3260-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5836-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5180-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5416-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/780-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5152-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5872-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5900-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5576-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5220-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5288-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5864-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5904-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5760-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5404-897-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6084-1080-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-1191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5676-1273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3224 llxfflr.exe 5108 1dvjj.exe 2280 pjppj.exe 5864 lfrrrxx.exe 5836 htbhht.exe 5288 dpvpv.exe 640 9vjdv.exe 5900 9rffxfr.exe 2744 nnnttt.exe 4260 jjvvp.exe 5220 lfrllll.exe 5104 tnbhnt.exe 3076 vjddj.exe 5576 1rfxxxr.exe 1324 hhnnnt.exe 4584 ddjdd.exe 4472 rlxflff.exe 4696 xrfrrrx.exe 4820 ttbtnh.exe 4948 dvdjj.exe 4848 5rrfflf.exe 1524 3xrrfrf.exe 5756 bbnhhn.exe 4368 pjpvv.exe 4664 frxxxxx.exe 4636 xxfxxxx.exe 4952 bthhnt.exe 2276 3jjjd.exe 4828 dvjpp.exe 5092 9rrrlll.exe 3148 bhnnnt.exe 4152 bthhhn.exe 5872 vdjvv.exe 1652 xxffflf.exe 4904 xfxxflx.exe 2532 tnhbbh.exe 1380 jpvdj.exe 5356 xxrrrxx.exe 5152 1rrllrr.exe 1908 hbtbnn.exe 2136 vdppv.exe 628 flxrrxf.exe 4508 lxrfrxl.exe 816 bhnhhh.exe 2120 ddjjp.exe 1096 xrffflr.exe 2908 xlrffxr.exe 4644 ttbbbh.exe 1972 5pdjv.exe 1784 fxlrxxf.exe 1292 xrxrrrr.exe 2548 bbttnn.exe 2352 jjppd.exe 3104 rxffrxl.exe 780 rxxxflr.exe 3232 1thbht.exe 4576 vdjjj.exe 5416 9lxfxrf.exe 5892 llxrrff.exe 1052 hnbbnt.exe 1808 jjvdd.exe 5180 pjvpd.exe 2748 xfxxxxr.exe 3152 pvppp.exe -
resource yara_rule behavioral2/memory/3260-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5836-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5180-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5416-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/780-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5152-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5872-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5576-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5220-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5288-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5864-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5904-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5760-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5336-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5404-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-1051-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3260 wrote to memory of 3224 3260 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 85 PID 3260 wrote to memory of 3224 3260 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 85 PID 3260 wrote to memory of 3224 3260 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 85 PID 3224 wrote to memory of 5108 3224 llxfflr.exe 86 PID 3224 wrote to memory of 5108 3224 llxfflr.exe 86 PID 3224 wrote to memory of 5108 3224 llxfflr.exe 86 PID 5108 wrote to memory of 2280 5108 1dvjj.exe 87 PID 5108 wrote to memory of 2280 5108 1dvjj.exe 87 PID 5108 wrote to memory of 2280 5108 1dvjj.exe 87 PID 2280 wrote to memory of 5864 2280 pjppj.exe 88 PID 2280 wrote to memory of 5864 2280 pjppj.exe 88 PID 2280 wrote to memory of 5864 2280 pjppj.exe 88 PID 5864 wrote to memory of 5836 5864 lfrrrxx.exe 89 PID 5864 wrote to memory of 5836 5864 lfrrrxx.exe 89 PID 5864 wrote to memory of 5836 5864 lfrrrxx.exe 89 PID 5836 wrote to memory of 5288 5836 htbhht.exe 90 PID 5836 wrote to memory of 5288 5836 htbhht.exe 90 PID 5836 wrote to memory of 5288 5836 htbhht.exe 90 PID 5288 wrote to memory of 640 5288 dpvpv.exe 91 PID 5288 wrote to memory of 640 5288 dpvpv.exe 91 PID 5288 wrote to memory of 640 5288 dpvpv.exe 91 PID 640 wrote to memory of 5900 640 9vjdv.exe 92 PID 640 wrote to memory of 5900 640 9vjdv.exe 92 PID 640 wrote to memory of 5900 640 9vjdv.exe 92 PID 5900 wrote to memory of 2744 5900 9rffxfr.exe 93 PID 5900 wrote to memory of 2744 5900 9rffxfr.exe 93 PID 5900 wrote to memory of 2744 5900 9rffxfr.exe 93 PID 2744 wrote to memory of 4260 2744 nnnttt.exe 94 PID 2744 wrote to memory of 4260 2744 nnnttt.exe 94 PID 2744 wrote to memory of 4260 2744 nnnttt.exe 94 PID 4260 wrote to memory of 5220 4260 jjvvp.exe 95 PID 4260 wrote to memory of 5220 4260 jjvvp.exe 95 PID 4260 wrote to memory of 5220 4260 jjvvp.exe 95 PID 5220 wrote to memory of 5104 5220 lfrllll.exe 96 PID 5220 wrote to memory of 5104 5220 lfrllll.exe 96 PID 5220 wrote to memory of 5104 5220 lfrllll.exe 96 PID 5104 wrote to memory of 3076 5104 tnbhnt.exe 97 PID 5104 wrote to memory of 3076 5104 tnbhnt.exe 97 PID 5104 wrote to memory of 3076 5104 tnbhnt.exe 97 PID 3076 wrote to memory of 5576 3076 vjddj.exe 98 PID 3076 wrote to memory of 5576 3076 vjddj.exe 98 PID 3076 wrote to memory of 5576 3076 vjddj.exe 98 PID 5576 wrote to memory of 1324 5576 1rfxxxr.exe 99 PID 5576 wrote to memory of 1324 5576 1rfxxxr.exe 99 PID 5576 wrote to memory of 1324 5576 1rfxxxr.exe 99 PID 1324 wrote to memory of 4584 1324 hhnnnt.exe 100 PID 1324 wrote to memory of 4584 1324 hhnnnt.exe 100 PID 1324 wrote to memory of 4584 1324 hhnnnt.exe 100 PID 4584 wrote to memory of 4472 4584 ddjdd.exe 101 PID 4584 wrote to memory of 4472 4584 ddjdd.exe 101 PID 4584 wrote to memory of 4472 4584 ddjdd.exe 101 PID 4472 wrote to memory of 4696 4472 rlxflff.exe 102 PID 4472 wrote to memory of 4696 4472 rlxflff.exe 102 PID 4472 wrote to memory of 4696 4472 rlxflff.exe 102 PID 4696 wrote to memory of 4820 4696 xrfrrrx.exe 103 PID 4696 wrote to memory of 4820 4696 xrfrrrx.exe 103 PID 4696 wrote to memory of 4820 4696 xrfrrrx.exe 103 PID 4820 wrote to memory of 4948 4820 ttbtnh.exe 104 PID 4820 wrote to memory of 4948 4820 ttbtnh.exe 104 PID 4820 wrote to memory of 4948 4820 ttbtnh.exe 104 PID 4948 wrote to memory of 4848 4948 dvdjj.exe 105 PID 4948 wrote to memory of 4848 4948 dvdjj.exe 105 PID 4948 wrote to memory of 4848 4948 dvdjj.exe 105 PID 4848 wrote to memory of 1524 4848 5rrfflf.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe"C:\Users\Admin\AppData\Local\Temp\5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\llxfflr.exec:\llxfflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\1dvjj.exec:\1dvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\pjppj.exec:\pjppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
\??\c:\htbhht.exec:\htbhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
\??\c:\dpvpv.exec:\dpvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
\??\c:\9vjdv.exec:\9vjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\9rffxfr.exec:\9rffxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
\??\c:\nnnttt.exec:\nnnttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jjvvp.exec:\jjvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\lfrllll.exec:\lfrllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
\??\c:\tnbhnt.exec:\tnbhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\vjddj.exec:\vjddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\1rfxxxr.exec:\1rfxxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
\??\c:\hhnnnt.exec:\hhnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\ddjdd.exec:\ddjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\rlxflff.exec:\rlxflff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\xrfrrrx.exec:\xrfrrrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\ttbtnh.exec:\ttbtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\dvdjj.exec:\dvdjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\5rrfflf.exec:\5rrfflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\3xrrfrf.exec:\3xrrfrf.exe23⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bbnhhn.exec:\bbnhhn.exe24⤵
- Executes dropped EXE
PID:5756 -
\??\c:\pjpvv.exec:\pjpvv.exe25⤵
- Executes dropped EXE
PID:4368 -
\??\c:\frxxxxx.exec:\frxxxxx.exe26⤵
- Executes dropped EXE
PID:4664 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe27⤵
- Executes dropped EXE
PID:4636 -
\??\c:\bthhnt.exec:\bthhnt.exe28⤵
- Executes dropped EXE
PID:4952 -
\??\c:\3jjjd.exec:\3jjjd.exe29⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dvjpp.exec:\dvjpp.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4828 -
\??\c:\9rrrlll.exec:\9rrrlll.exe31⤵
- Executes dropped EXE
PID:5092 -
\??\c:\bhnnnt.exec:\bhnnnt.exe32⤵
- Executes dropped EXE
PID:3148 -
\??\c:\bthhhn.exec:\bthhhn.exe33⤵
- Executes dropped EXE
PID:4152 -
\??\c:\vdjvv.exec:\vdjvv.exe34⤵
- Executes dropped EXE
PID:5872 -
\??\c:\xxffflf.exec:\xxffflf.exe35⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xfxxflx.exec:\xfxxflx.exe36⤵
- Executes dropped EXE
PID:4904 -
\??\c:\tnhbbh.exec:\tnhbbh.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jpvdj.exec:\jpvdj.exe38⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xxrrrxx.exec:\xxrrrxx.exe39⤵
- Executes dropped EXE
PID:5356 -
\??\c:\1rrllrr.exec:\1rrllrr.exe40⤵
- Executes dropped EXE
PID:5152 -
\??\c:\hbtbnn.exec:\hbtbnn.exe41⤵
- Executes dropped EXE
PID:1908 -
\??\c:\vdppv.exec:\vdppv.exe42⤵
- Executes dropped EXE
PID:2136 -
\??\c:\flxrrxf.exec:\flxrrxf.exe43⤵
- Executes dropped EXE
PID:628 -
\??\c:\lxrfrxl.exec:\lxrfrxl.exe44⤵
- Executes dropped EXE
PID:4508 -
\??\c:\bhnhhh.exec:\bhnhhh.exe45⤵
- Executes dropped EXE
PID:816 -
\??\c:\ddjjp.exec:\ddjjp.exe46⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xrffflr.exec:\xrffflr.exe47⤵
- Executes dropped EXE
PID:1096 -
\??\c:\xlrffxr.exec:\xlrffxr.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ttbbbh.exec:\ttbbbh.exe49⤵
- Executes dropped EXE
PID:4644 -
\??\c:\5pdjv.exec:\5pdjv.exe50⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe51⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe52⤵
- Executes dropped EXE
PID:1292 -
\??\c:\bbttnn.exec:\bbttnn.exe53⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jjppd.exec:\jjppd.exe54⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rxffrxl.exec:\rxffrxl.exe55⤵
- Executes dropped EXE
PID:3104 -
\??\c:\rxxxflr.exec:\rxxxflr.exe56⤵
- Executes dropped EXE
PID:780 -
\??\c:\1thbht.exec:\1thbht.exe57⤵
- Executes dropped EXE
PID:3232 -
\??\c:\vdjjj.exec:\vdjjj.exe58⤵
- Executes dropped EXE
PID:4576 -
\??\c:\9lxfxrf.exec:\9lxfxrf.exe59⤵
- Executes dropped EXE
PID:5416 -
\??\c:\llxrrff.exec:\llxrrff.exe60⤵
- Executes dropped EXE
PID:5892 -
\??\c:\hnbbnt.exec:\hnbbnt.exe61⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jjvdd.exec:\jjvdd.exe62⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pjvpd.exec:\pjvpd.exe63⤵
- Executes dropped EXE
PID:5180 -
\??\c:\xfxxxxr.exec:\xfxxxxr.exe64⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pvppp.exec:\pvppp.exe65⤵
- Executes dropped EXE
PID:3152 -
\??\c:\xxffffl.exec:\xxffffl.exe66⤵PID:3136
-
\??\c:\7fllfll.exec:\7fllfll.exe67⤵PID:3576
-
\??\c:\tbnnth.exec:\tbnnth.exe68⤵PID:3100
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe69⤵PID:1872
-
\??\c:\hhbnht.exec:\hhbnht.exe70⤵PID:4268
-
\??\c:\pppjj.exec:\pppjj.exe71⤵PID:4496
-
\??\c:\vpvvv.exec:\vpvvv.exe72⤵PID:1884
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe73⤵
- System Location Discovery: System Language Discovery
PID:4488 -
\??\c:\ttbbtb.exec:\ttbbtb.exe74⤵PID:5124
-
\??\c:\7dppp.exec:\7dppp.exe75⤵PID:2588
-
\??\c:\xflllrx.exec:\xflllrx.exe76⤵PID:4700
-
\??\c:\7hhhhn.exec:\7hhhhn.exe77⤵PID:2028
-
\??\c:\nbnnhn.exec:\nbnnhn.exe78⤵PID:3204
-
\??\c:\jdjdv.exec:\jdjdv.exe79⤵PID:3484
-
\??\c:\dddvv.exec:\dddvv.exe80⤵PID:2688
-
\??\c:\lxlfllf.exec:\lxlfllf.exe81⤵PID:3528
-
\??\c:\tnttnb.exec:\tnttnb.exe82⤵PID:1560
-
\??\c:\9jpjj.exec:\9jpjj.exe83⤵PID:244
-
\??\c:\ffrlffr.exec:\ffrlffr.exe84⤵PID:3184
-
\??\c:\xfrrllf.exec:\xfrrllf.exe85⤵PID:4340
-
\??\c:\tbhhhn.exec:\tbhhhn.exe86⤵PID:2968
-
\??\c:\jdvvj.exec:\jdvvj.exe87⤵PID:5412
-
\??\c:\xrfxffx.exec:\xrfxffx.exe88⤵PID:4424
-
\??\c:\nnttnt.exec:\nnttnt.exe89⤵PID:5204
-
\??\c:\7jdvv.exec:\7jdvv.exe90⤵PID:824
-
\??\c:\flrrxfl.exec:\flrrxfl.exe91⤵PID:5792
-
\??\c:\tnbbhh.exec:\tnbbhh.exe92⤵PID:452
-
\??\c:\1dppd.exec:\1dppd.exe93⤵PID:5904
-
\??\c:\fxlffrr.exec:\fxlffrr.exe94⤵PID:2372
-
\??\c:\nnbttt.exec:\nnbttt.exe95⤵PID:1396
-
\??\c:\hhnttb.exec:\hhnttb.exe96⤵PID:3156
-
\??\c:\3pvpv.exec:\3pvpv.exe97⤵PID:736
-
\??\c:\1flfflr.exec:\1flfflr.exe98⤵PID:4080
-
\??\c:\ttbtth.exec:\ttbtth.exe99⤵PID:3544
-
\??\c:\vdvvp.exec:\vdvvp.exe100⤵PID:4588
-
\??\c:\5jjpp.exec:\5jjpp.exe101⤵PID:4908
-
\??\c:\rflrffr.exec:\rflrffr.exe102⤵PID:4792
-
\??\c:\1bnbbh.exec:\1bnbbh.exe103⤵PID:4684
-
\??\c:\ppvvv.exec:\ppvvv.exe104⤵PID:4972
-
\??\c:\xrrrrxl.exec:\xrrrrxl.exe105⤵PID:5224
-
\??\c:\ttbbbh.exec:\ttbbbh.exe106⤵PID:1772
-
\??\c:\tbttnn.exec:\tbttnn.exe107⤵PID:4664
-
\??\c:\5dpjd.exec:\5dpjd.exe108⤵PID:2780
-
\??\c:\xxllxxl.exec:\xxllxxl.exe109⤵PID:1712
-
\??\c:\ttnnnt.exec:\ttnnnt.exe110⤵
- System Location Discovery: System Language Discovery
PID:376 -
\??\c:\hbbnhn.exec:\hbbnhn.exe111⤵PID:4828
-
\??\c:\djjpv.exec:\djjpv.exe112⤵PID:5064
-
\??\c:\xfxxlfx.exec:\xfxxlfx.exe113⤵PID:4804
-
\??\c:\nhtnnh.exec:\nhtnnh.exe114⤵PID:5336
-
\??\c:\bbbbbh.exec:\bbbbbh.exe115⤵PID:2492
-
\??\c:\7pvpj.exec:\7pvpj.exe116⤵PID:4944
-
\??\c:\1xlfrrf.exec:\1xlfrrf.exe117⤵PID:3088
-
\??\c:\rffffll.exec:\rffffll.exe118⤵PID:4640
-
\??\c:\bbnntt.exec:\bbnntt.exe119⤵PID:4548
-
\??\c:\jjvvv.exec:\jjvvv.exe120⤵PID:1908
-
\??\c:\ddvpp.exec:\ddvpp.exe121⤵PID:1012
-
\??\c:\rrffllr.exec:\rrffllr.exe122⤵PID:6116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-