Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 02:02
Behavioral task
behavioral1
Sample
521e9f633fb1dc0a6bc87ba668505520N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
521e9f633fb1dc0a6bc87ba668505520N.exe
-
Size
135KB
-
MD5
521e9f633fb1dc0a6bc87ba668505520
-
SHA1
a35d1c7deb39d6802b708e26965fc6cbae51f487
-
SHA256
8bd981c70f2ba386838090d0e275e00ccce379c100831189361e302caf386d01
-
SHA512
42a1d887c2cbc0cbd03eeb939836f5a09cadc608da9f5c90a322cc1528ae060d9239fb4f4c3d8d6644398b29bdbb7c19f53a1c2cf94f59e078e0b88e167d15cd
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4Jlyp0L:9cm4FmowdHoS4c6L
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1680-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1396-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2816-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4280-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1248-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/380-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2940-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1028-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-664-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-703-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-728-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-780-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-830-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-918-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 116 1vjjj.exe 744 fxxrrxx.exe 2800 dddpv.exe 220 frllflr.exe 3152 jjjdv.exe 1396 frlllrl.exe 1276 hbbtnt.exe 368 jvvvp.exe 1488 llfrlrr.exe 1684 hnnbhb.exe 2816 jvdvd.exe 3692 llllflf.exe 4280 htnbbb.exe 3024 vdvpv.exe 640 xllfxfr.exe 2128 thnnnn.exe 4068 dvvpd.exe 4476 nhtnnh.exe 1248 thntnt.exe 4860 lflfllr.exe 3608 pvdjp.exe 548 ffxfxll.exe 1016 bnbnth.exe 5092 bnhhnh.exe 2188 vvppp.exe 380 htbhbt.exe 3812 pdjvj.exe 2228 rflrlll.exe 1832 nnntbh.exe 3316 vvvvj.exe 3100 frxfffl.exe 2284 tntnnb.exe 2940 ddvjp.exe 4340 rlxxrlf.exe 3808 rxfxxrx.exe 116 thbbhh.exe 4424 5jvdv.exe 4064 vpdpj.exe 1340 rxxlfff.exe 3524 nbhbbb.exe 4456 1djpj.exe 972 hnttth.exe 1256 ppvpj.exe 2220 xlfrrrr.exe 3976 htnnnt.exe 1800 bhnthn.exe 4544 jvdpv.exe 2952 rrlfxxr.exe 216 bbhtbb.exe 4936 nnbhnb.exe 3692 djppv.exe 2912 rrlfrlf.exe 2168 ntbttn.exe 2140 jddvp.exe 1612 rffxllx.exe 4248 tnhbbt.exe 4468 vvdjd.exe 3032 frffrlr.exe 2176 bhhhhn.exe 5016 7dpdd.exe 1648 xffrxxx.exe 4852 tbnhbb.exe 2448 7vddd.exe 3568 xxlflrx.exe -
resource yara_rule behavioral2/memory/1680-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002341d-3.dat upx behavioral2/memory/1680-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/116-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347b-11.dat upx behavioral2/files/0x000700000002347c-13.dat upx behavioral2/memory/744-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2800-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347d-24.dat upx behavioral2/memory/2800-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347e-27.dat upx behavioral2/memory/220-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347f-34.dat upx behavioral2/files/0x0007000000023480-39.dat upx behavioral2/memory/1396-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1276-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023481-46.dat upx behavioral2/files/0x0007000000023482-51.dat upx behavioral2/memory/368-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1488-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023483-58.dat upx behavioral2/memory/1684-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023484-65.dat upx behavioral2/memory/2816-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023485-70.dat upx behavioral2/memory/3692-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023486-76.dat upx behavioral2/memory/3692-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4280-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023487-82.dat upx behavioral2/files/0x0007000000023488-89.dat upx behavioral2/files/0x0007000000023489-92.dat upx behavioral2/memory/2128-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348a-99.dat upx behavioral2/files/0x000700000002348b-104.dat upx behavioral2/memory/4476-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348c-110.dat upx behavioral2/files/0x000b00000002346f-114.dat upx behavioral2/memory/1248-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4860-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3608-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348d-123.dat upx behavioral2/files/0x000700000002348e-127.dat upx behavioral2/files/0x000700000002348f-132.dat upx behavioral2/memory/548-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5092-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023491-146.dat upx behavioral2/memory/1016-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023490-138.dat upx behavioral2/memory/2188-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023493-151.dat upx behavioral2/files/0x0007000000023494-157.dat upx behavioral2/memory/3812-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/380-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023495-163.dat upx behavioral2/memory/3812-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023496-168.dat upx behavioral2/memory/2228-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023497-174.dat upx behavioral2/memory/3316-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023498-178.dat upx behavioral2/files/0x0007000000023499-183.dat upx behavioral2/memory/2284-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2940-191-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 116 1680 521e9f633fb1dc0a6bc87ba668505520N.exe 84 PID 1680 wrote to memory of 116 1680 521e9f633fb1dc0a6bc87ba668505520N.exe 84 PID 1680 wrote to memory of 116 1680 521e9f633fb1dc0a6bc87ba668505520N.exe 84 PID 116 wrote to memory of 744 116 1vjjj.exe 85 PID 116 wrote to memory of 744 116 1vjjj.exe 85 PID 116 wrote to memory of 744 116 1vjjj.exe 85 PID 744 wrote to memory of 2800 744 fxxrrxx.exe 86 PID 744 wrote to memory of 2800 744 fxxrrxx.exe 86 PID 744 wrote to memory of 2800 744 fxxrrxx.exe 86 PID 2800 wrote to memory of 220 2800 dddpv.exe 87 PID 2800 wrote to memory of 220 2800 dddpv.exe 87 PID 2800 wrote to memory of 220 2800 dddpv.exe 87 PID 220 wrote to memory of 3152 220 frllflr.exe 88 PID 220 wrote to memory of 3152 220 frllflr.exe 88 PID 220 wrote to memory of 3152 220 frllflr.exe 88 PID 3152 wrote to memory of 1396 3152 jjjdv.exe 89 PID 3152 wrote to memory of 1396 3152 jjjdv.exe 89 PID 3152 wrote to memory of 1396 3152 jjjdv.exe 89 PID 1396 wrote to memory of 1276 1396 frlllrl.exe 90 PID 1396 wrote to memory of 1276 1396 frlllrl.exe 90 PID 1396 wrote to memory of 1276 1396 frlllrl.exe 90 PID 1276 wrote to memory of 368 1276 hbbtnt.exe 91 PID 1276 wrote to memory of 368 1276 hbbtnt.exe 91 PID 1276 wrote to memory of 368 1276 hbbtnt.exe 91 PID 368 wrote to memory of 1488 368 jvvvp.exe 92 PID 368 wrote to memory of 1488 368 jvvvp.exe 92 PID 368 wrote to memory of 1488 368 jvvvp.exe 92 PID 1488 wrote to memory of 1684 1488 llfrlrr.exe 93 PID 1488 wrote to memory of 1684 1488 llfrlrr.exe 93 PID 1488 wrote to memory of 1684 1488 llfrlrr.exe 93 PID 1684 wrote to memory of 2816 1684 hnnbhb.exe 94 PID 1684 wrote to memory of 2816 1684 hnnbhb.exe 94 PID 1684 wrote to memory of 2816 1684 hnnbhb.exe 94 PID 2816 wrote to memory of 3692 2816 jvdvd.exe 95 PID 2816 wrote to memory of 3692 2816 jvdvd.exe 95 PID 2816 wrote to memory of 3692 2816 jvdvd.exe 95 PID 3692 wrote to memory of 4280 3692 llllflf.exe 96 PID 3692 wrote to memory of 4280 3692 llllflf.exe 96 PID 3692 wrote to memory of 4280 3692 llllflf.exe 96 PID 4280 wrote to memory of 3024 4280 htnbbb.exe 97 PID 4280 wrote to memory of 3024 4280 htnbbb.exe 97 PID 4280 wrote to memory of 3024 4280 htnbbb.exe 97 PID 3024 wrote to memory of 640 3024 vdvpv.exe 98 PID 3024 wrote to memory of 640 3024 vdvpv.exe 98 PID 3024 wrote to memory of 640 3024 vdvpv.exe 98 PID 640 wrote to memory of 2128 640 xllfxfr.exe 99 PID 640 wrote to memory of 2128 640 xllfxfr.exe 99 PID 640 wrote to memory of 2128 640 xllfxfr.exe 99 PID 2128 wrote to memory of 4068 2128 thnnnn.exe 101 PID 2128 wrote to memory of 4068 2128 thnnnn.exe 101 PID 2128 wrote to memory of 4068 2128 thnnnn.exe 101 PID 4068 wrote to memory of 4476 4068 dvvpd.exe 102 PID 4068 wrote to memory of 4476 4068 dvvpd.exe 102 PID 4068 wrote to memory of 4476 4068 dvvpd.exe 102 PID 4476 wrote to memory of 1248 4476 nhtnnh.exe 103 PID 4476 wrote to memory of 1248 4476 nhtnnh.exe 103 PID 4476 wrote to memory of 1248 4476 nhtnnh.exe 103 PID 1248 wrote to memory of 4860 1248 thntnt.exe 105 PID 1248 wrote to memory of 4860 1248 thntnt.exe 105 PID 1248 wrote to memory of 4860 1248 thntnt.exe 105 PID 4860 wrote to memory of 3608 4860 lflfllr.exe 106 PID 4860 wrote to memory of 3608 4860 lflfllr.exe 106 PID 4860 wrote to memory of 3608 4860 lflfllr.exe 106 PID 3608 wrote to memory of 548 3608 pvdjp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\521e9f633fb1dc0a6bc87ba668505520N.exe"C:\Users\Admin\AppData\Local\Temp\521e9f633fb1dc0a6bc87ba668505520N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\1vjjj.exec:\1vjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\fxxrrxx.exec:\fxxrrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\dddpv.exec:\dddpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\frllflr.exec:\frllflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\jjjdv.exec:\jjjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\frlllrl.exec:\frlllrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\hbbtnt.exec:\hbbtnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\jvvvp.exec:\jvvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\llfrlrr.exec:\llfrlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\hnnbhb.exec:\hnnbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\jvdvd.exec:\jvdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\llllflf.exec:\llllflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\htnbbb.exec:\htnbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\vdvpv.exec:\vdvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\xllfxfr.exec:\xllfxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\thnnnn.exec:\thnnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\dvvpd.exec:\dvvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\nhtnnh.exec:\nhtnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\thntnt.exec:\thntnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\lflfllr.exec:\lflfllr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\pvdjp.exec:\pvdjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\ffxfxll.exec:\ffxfxll.exe23⤵
- Executes dropped EXE
PID:548 -
\??\c:\bnbnth.exec:\bnbnth.exe24⤵
- Executes dropped EXE
PID:1016 -
\??\c:\bnhhnh.exec:\bnhhnh.exe25⤵
- Executes dropped EXE
PID:5092 -
\??\c:\vvppp.exec:\vvppp.exe26⤵
- Executes dropped EXE
PID:2188 -
\??\c:\htbhbt.exec:\htbhbt.exe27⤵
- Executes dropped EXE
PID:380 -
\??\c:\pdjvj.exec:\pdjvj.exe28⤵
- Executes dropped EXE
PID:3812 -
\??\c:\rflrlll.exec:\rflrlll.exe29⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nnntbh.exec:\nnntbh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832 -
\??\c:\vvvvj.exec:\vvvvj.exe31⤵
- Executes dropped EXE
PID:3316 -
\??\c:\frxfffl.exec:\frxfffl.exe32⤵
- Executes dropped EXE
PID:3100 -
\??\c:\tntnnb.exec:\tntnnb.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ddvjp.exec:\ddvjp.exe34⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rlxxrlf.exec:\rlxxrlf.exe35⤵
- Executes dropped EXE
PID:4340 -
\??\c:\rxfxxrx.exec:\rxfxxrx.exe36⤵
- Executes dropped EXE
PID:3808 -
\??\c:\thbbhh.exec:\thbbhh.exe37⤵
- Executes dropped EXE
PID:116 -
\??\c:\5jvdv.exec:\5jvdv.exe38⤵
- Executes dropped EXE
PID:4424 -
\??\c:\vpdpj.exec:\vpdpj.exe39⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rxxlfff.exec:\rxxlfff.exe40⤵
- Executes dropped EXE
PID:1340 -
\??\c:\nbhbbb.exec:\nbhbbb.exe41⤵
- Executes dropped EXE
PID:3524 -
\??\c:\1djpj.exec:\1djpj.exe42⤵
- Executes dropped EXE
PID:4456 -
\??\c:\hnttth.exec:\hnttth.exe43⤵
- Executes dropped EXE
PID:972 -
\??\c:\ppvpj.exec:\ppvpj.exe44⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xlfrrrr.exec:\xlfrrrr.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\htnnnt.exec:\htnnnt.exe46⤵
- Executes dropped EXE
PID:3976 -
\??\c:\bhnthn.exec:\bhnthn.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jvdpv.exec:\jvdpv.exe48⤵
- Executes dropped EXE
PID:4544 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe49⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bbhtbb.exec:\bbhtbb.exe50⤵
- Executes dropped EXE
PID:216 -
\??\c:\nnbhnb.exec:\nnbhnb.exe51⤵
- Executes dropped EXE
PID:4936 -
\??\c:\djppv.exec:\djppv.exe52⤵
- Executes dropped EXE
PID:3692 -
\??\c:\rrlfrlf.exec:\rrlfrlf.exe53⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ntbttn.exec:\ntbttn.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jddvp.exec:\jddvp.exe55⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rffxllx.exec:\rffxllx.exe56⤵
- Executes dropped EXE
PID:1612 -
\??\c:\tnhbbt.exec:\tnhbbt.exe57⤵
- Executes dropped EXE
PID:4248 -
\??\c:\vvdjd.exec:\vvdjd.exe58⤵
- Executes dropped EXE
PID:4468 -
\??\c:\frffrlr.exec:\frffrlr.exe59⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bhhhhn.exec:\bhhhhn.exe60⤵
- Executes dropped EXE
PID:2176 -
\??\c:\7dpdd.exec:\7dpdd.exe61⤵
- Executes dropped EXE
PID:5016 -
\??\c:\xffrxxx.exec:\xffrxxx.exe62⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tbnhbb.exec:\tbnhbb.exe63⤵
- Executes dropped EXE
PID:4852 -
\??\c:\7vddd.exec:\7vddd.exe64⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xxlflrx.exec:\xxlflrx.exe65⤵
- Executes dropped EXE
PID:3568 -
\??\c:\nbnnhb.exec:\nbnnhb.exe66⤵PID:3796
-
\??\c:\vvvvv.exec:\vvvvv.exe67⤵PID:1016
-
\??\c:\rlllffl.exec:\rlllffl.exe68⤵PID:3296
-
\??\c:\7rfxrxr.exec:\7rfxrxr.exe69⤵PID:2328
-
\??\c:\nnhhhh.exec:\nnhhhh.exe70⤵PID:2188
-
\??\c:\vdvjd.exec:\vdvjd.exe71⤵PID:4692
-
\??\c:\lxfxxfx.exec:\lxfxxfx.exe72⤵PID:4472
-
\??\c:\xrxxrrf.exec:\xrxxrrf.exe73⤵PID:1960
-
\??\c:\bbbbhh.exec:\bbbbhh.exe74⤵PID:1936
-
\??\c:\jvddv.exec:\jvddv.exe75⤵PID:4028
-
\??\c:\tbnbnn.exec:\tbnbnn.exe76⤵PID:3316
-
\??\c:\jppjd.exec:\jppjd.exe77⤵PID:3648
-
\??\c:\djpjd.exec:\djpjd.exe78⤵PID:4432
-
\??\c:\xlrrxrl.exec:\xlrrxrl.exe79⤵PID:4368
-
\??\c:\nnnhbh.exec:\nnnhbh.exe80⤵PID:1028
-
\??\c:\pvpvv.exec:\pvpvv.exe81⤵PID:4360
-
\??\c:\dddvv.exec:\dddvv.exe82⤵PID:2096
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe83⤵PID:3376
-
\??\c:\pjvdd.exec:\pjvdd.exe84⤵PID:2836
-
\??\c:\xfllxxx.exec:\xfllxxx.exe85⤵PID:2676
-
\??\c:\9tbbht.exec:\9tbbht.exe86⤵PID:2320
-
\??\c:\ddddd.exec:\ddddd.exe87⤵PID:3440
-
\??\c:\pvvvp.exec:\pvvvp.exe88⤵PID:1688
-
\??\c:\hhhhhh.exec:\hhhhhh.exe89⤵PID:436
-
\??\c:\ttttbh.exec:\ttttbh.exe90⤵PID:4988
-
\??\c:\jddjj.exec:\jddjj.exe91⤵PID:2104
-
\??\c:\rxlrrxr.exec:\rxlrrxr.exe92⤵PID:3704
-
\??\c:\rlxlfrx.exec:\rlxlfrx.exe93⤵PID:3204
-
\??\c:\hbnhhn.exec:\hbnhhn.exe94⤵PID:1932
-
\??\c:\ppddd.exec:\ppddd.exe95⤵PID:4880
-
\??\c:\rfrlxxf.exec:\rfrlxxf.exe96⤵PID:2160
-
\??\c:\bthnnb.exec:\bthnnb.exe97⤵PID:1488
-
\??\c:\hbbhht.exec:\hbbhht.exe98⤵PID:3008
-
\??\c:\ppppj.exec:\ppppj.exe99⤵PID:3400
-
\??\c:\rllfffr.exec:\rllfffr.exe100⤵PID:2028
-
\??\c:\pvjpp.exec:\pvjpp.exe101⤵PID:3228
-
\??\c:\djjpp.exec:\djjpp.exe102⤵PID:3024
-
\??\c:\rxflllf.exec:\rxflllf.exe103⤵PID:4588
-
\??\c:\thtttt.exec:\thtttt.exe104⤵PID:2656
-
\??\c:\fffxxxx.exec:\fffxxxx.exe105⤵PID:4820
-
\??\c:\bthntt.exec:\bthntt.exe106⤵PID:3236
-
\??\c:\djppv.exec:\djppv.exe107⤵PID:5020
-
\??\c:\xffrrlx.exec:\xffrrlx.exe108⤵PID:4476
-
\??\c:\bhhtnt.exec:\bhhtnt.exe109⤵PID:3616
-
\??\c:\bnhbth.exec:\bnhbth.exe110⤵PID:4132
-
\??\c:\pjvdv.exec:\pjvdv.exe111⤵PID:1608
-
\??\c:\xxlrlxf.exec:\xxlrlxf.exe112⤵PID:3608
-
\??\c:\bbtnnt.exec:\bbtnnt.exe113⤵PID:4872
-
\??\c:\jddvv.exec:\jddvv.exe114⤵PID:2212
-
\??\c:\jddvv.exec:\jddvv.exe115⤵PID:3264
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe116⤵PID:2760
-
\??\c:\hbtbbh.exec:\hbtbbh.exe117⤵PID:5092
-
\??\c:\hhbhth.exec:\hhbhth.exe118⤵PID:1408
-
\??\c:\ppppj.exec:\ppppj.exe119⤵PID:3924
-
\??\c:\jvvvp.exec:\jvvvp.exe120⤵PID:4256
-
\??\c:\7lffxrl.exec:\7lffxrl.exe121⤵PID:3416
-
\??\c:\tbnhbb.exec:\tbnhbb.exe122⤵PID:2544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-