Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 18:08
Behavioral task
behavioral1
Sample
a98575878cbe576519e2cd8d5776cc90N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
a98575878cbe576519e2cd8d5776cc90N.exe
-
Size
213KB
-
MD5
a98575878cbe576519e2cd8d5776cc90
-
SHA1
a83aba869f6b73f09a3a4e40eef299849d015022
-
SHA256
045d58e7af75b20c84cfa5e804cf8457a7b16118bc1c557d5ae3c664c7e1d5e6
-
SHA512
a55b65afddf455d8efcdf31b6a9b98c50f7ef00758693bbed4600dfa118e95783c021b28beda8e7d4704e6eba9af89701f5b8ab50f17777d154eb39942eadfd1
-
SSDEEP
6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+ltx:V4wFHoSBK/ubLcfXx
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/596-5-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4728-12-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1532-16-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1872-22-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2928-25-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3616-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5028-40-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4500-53-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2204-70-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1944-93-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2844-87-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4608-106-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2236-125-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2904-134-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4928-159-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1128-172-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4204-188-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2724-196-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1284-222-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2020-229-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3676-237-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4340-245-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1700-252-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1784-263-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1280-267-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4116-286-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4360-291-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2824-259-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4356-241-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1368-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3132-231-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3044-226-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2436-218-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1836-323-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3520-200-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2004-167-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5096-333-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2900-154-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1212-141-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3848-143-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3168-344-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/996-340-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2260-124-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1548-111-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5064-96-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4412-81-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3844-75-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4940-59-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4288-46-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1988-414-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4572-439-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/940-464-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4132-480-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1888-484-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2844-581-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4112-639-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/516-691-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4912-710-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4640-846-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1168-1272-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2236-1282-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2904-1292-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4308-1401-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4728 pdvjp.exe 1532 rxfflfl.exe 2928 nnbhbb.exe 1872 nnbnnb.exe 3616 jdpjv.exe 5028 fxllffx.exe 4288 xxfxffl.exe 4500 jpvpp.exe 4940 jvddp.exe 3148 xlrlrrr.exe 2204 1nttbb.exe 3844 jdjjv.exe 4412 vpppj.exe 2844 lfllrrr.exe 5064 7lllfll.exe 1944 bbnhhh.exe 4608 ppddv.exe 1548 rrxrffx.exe 2376 tnnhhb.exe 2260 vdpdp.exe 2236 vpppp.exe 2904 lflrllr.exe 1212 bhtntt.exe 3848 jjppv.exe 2900 vvjjj.exe 4928 lffrfxf.exe 2004 hhbbbn.exe 3124 tbnnbb.exe 1128 1vvpp.exe 4304 5llfxlf.exe 4204 bbhbbb.exe 372 jdjdj.exe 2724 fxrrlrr.exe 3520 9rxrlll.exe 3764 tthbtt.exe 4464 bbttnn.exe 3728 jjvdd.exe 924 lfrlrrl.exe 4084 fxrlfxr.exe 2436 5hhbbb.exe 1284 vppjj.exe 3044 pjppv.exe 3132 rrxxrrf.exe 2020 rllfxxx.exe 3676 htttnh.exe 4356 bnbtnt.exe 4340 pvvpj.exe 1792 vpvpj.exe 1700 lrrrlll.exe 2312 nhnhhh.exe 2824 hbnnht.exe 1784 vvjdp.exe 1280 jvdjd.exe 3464 9lxrxxr.exe 896 hhhhtb.exe 3700 bnbbtt.exe 376 pjvpv.exe 4844 vvjdd.exe 4116 3jpvp.exe 4360 lfxrrrl.exe 3040 xflfxxr.exe 4160 tnnhbb.exe 2120 5hnhtt.exe 940 djjdv.exe -
resource yara_rule behavioral2/memory/596-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000900000002346d-6.dat upx behavioral2/memory/596-5-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234d1-9.dat upx behavioral2/memory/4728-12-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234d2-15.dat upx behavioral2/memory/1532-16-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234d3-21.dat upx behavioral2/memory/1872-22-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2928-25-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3616-30-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3616-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234d5-35.dat upx behavioral2/files/0x00070000000234d6-41.dat upx behavioral2/memory/5028-40-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4500-53-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234d9-57.dat upx behavioral2/memory/2204-70-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234db-68.dat upx behavioral2/files/0x00070000000234dc-76.dat upx behavioral2/files/0x00070000000234de-88.dat upx behavioral2/memory/1944-93-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234df-91.dat upx behavioral2/memory/2844-87-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4608-106-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234e1-105.dat upx behavioral2/files/0x00070000000234e3-115.dat upx behavioral2/memory/2236-125-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234e6-135.dat upx behavioral2/memory/2904-134-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2900-147-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234ea-160.dat upx behavioral2/memory/4928-159-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234eb-164.dat upx behavioral2/files/0x00070000000234ec-169.dat upx behavioral2/memory/1128-172-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4304-177-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00080000000234ce-181.dat upx behavioral2/files/0x00070000000234ed-189.dat upx behavioral2/memory/4204-188-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2724-196-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1284-222-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2020-229-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3676-237-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4340-245-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1700-252-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1784-263-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1280-267-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4116-286-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3040-289-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4360-291-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2824-259-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4356-241-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1368-307-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3132-231-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3044-226-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2436-218-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1836-323-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3520-200-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000400000001da42-176.dat upx behavioral2/memory/2004-167-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5096-333-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2900-154-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000234e9-153.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 596 wrote to memory of 4728 596 a98575878cbe576519e2cd8d5776cc90N.exe 84 PID 596 wrote to memory of 4728 596 a98575878cbe576519e2cd8d5776cc90N.exe 84 PID 596 wrote to memory of 4728 596 a98575878cbe576519e2cd8d5776cc90N.exe 84 PID 4728 wrote to memory of 1532 4728 pdvjp.exe 85 PID 4728 wrote to memory of 1532 4728 pdvjp.exe 85 PID 4728 wrote to memory of 1532 4728 pdvjp.exe 85 PID 1532 wrote to memory of 2928 1532 rxfflfl.exe 86 PID 1532 wrote to memory of 2928 1532 rxfflfl.exe 86 PID 1532 wrote to memory of 2928 1532 rxfflfl.exe 86 PID 2928 wrote to memory of 1872 2928 nnbhbb.exe 87 PID 2928 wrote to memory of 1872 2928 nnbhbb.exe 87 PID 2928 wrote to memory of 1872 2928 nnbhbb.exe 87 PID 1872 wrote to memory of 3616 1872 nnbnnb.exe 88 PID 1872 wrote to memory of 3616 1872 nnbnnb.exe 88 PID 1872 wrote to memory of 3616 1872 nnbnnb.exe 88 PID 3616 wrote to memory of 5028 3616 jdpjv.exe 178 PID 3616 wrote to memory of 5028 3616 jdpjv.exe 178 PID 3616 wrote to memory of 5028 3616 jdpjv.exe 178 PID 5028 wrote to memory of 4288 5028 fxllffx.exe 179 PID 5028 wrote to memory of 4288 5028 fxllffx.exe 179 PID 5028 wrote to memory of 4288 5028 fxllffx.exe 179 PID 4288 wrote to memory of 4500 4288 xxfxffl.exe 91 PID 4288 wrote to memory of 4500 4288 xxfxffl.exe 91 PID 4288 wrote to memory of 4500 4288 xxfxffl.exe 91 PID 4500 wrote to memory of 4940 4500 jpvpp.exe 190 PID 4500 wrote to memory of 4940 4500 jpvpp.exe 190 PID 4500 wrote to memory of 4940 4500 jpvpp.exe 190 PID 4940 wrote to memory of 3148 4940 jvddp.exe 93 PID 4940 wrote to memory of 3148 4940 jvddp.exe 93 PID 4940 wrote to memory of 3148 4940 jvddp.exe 93 PID 3148 wrote to memory of 2204 3148 xlrlrrr.exe 94 PID 3148 wrote to memory of 2204 3148 xlrlrrr.exe 94 PID 3148 wrote to memory of 2204 3148 xlrlrrr.exe 94 PID 2204 wrote to memory of 3844 2204 1nttbb.exe 96 PID 2204 wrote to memory of 3844 2204 1nttbb.exe 96 PID 2204 wrote to memory of 3844 2204 1nttbb.exe 96 PID 3844 wrote to memory of 4412 3844 jdjjv.exe 97 PID 3844 wrote to memory of 4412 3844 jdjjv.exe 97 PID 3844 wrote to memory of 4412 3844 jdjjv.exe 97 PID 4412 wrote to memory of 2844 4412 vpppj.exe 98 PID 4412 wrote to memory of 2844 4412 vpppj.exe 98 PID 4412 wrote to memory of 2844 4412 vpppj.exe 98 PID 2844 wrote to memory of 5064 2844 lfllrrr.exe 99 PID 2844 wrote to memory of 5064 2844 lfllrrr.exe 99 PID 2844 wrote to memory of 5064 2844 lfllrrr.exe 99 PID 5064 wrote to memory of 1944 5064 7lllfll.exe 192 PID 5064 wrote to memory of 1944 5064 7lllfll.exe 192 PID 5064 wrote to memory of 1944 5064 7lllfll.exe 192 PID 1944 wrote to memory of 4608 1944 bbnhhh.exe 102 PID 1944 wrote to memory of 4608 1944 bbnhhh.exe 102 PID 1944 wrote to memory of 4608 1944 bbnhhh.exe 102 PID 4608 wrote to memory of 1548 4608 ppddv.exe 103 PID 4608 wrote to memory of 1548 4608 ppddv.exe 103 PID 4608 wrote to memory of 1548 4608 ppddv.exe 103 PID 1548 wrote to memory of 2376 1548 rrxrffx.exe 104 PID 1548 wrote to memory of 2376 1548 rrxrffx.exe 104 PID 1548 wrote to memory of 2376 1548 rrxrffx.exe 104 PID 2376 wrote to memory of 2260 2376 tnnhhb.exe 197 PID 2376 wrote to memory of 2260 2376 tnnhhb.exe 197 PID 2376 wrote to memory of 2260 2376 tnnhhb.exe 197 PID 2260 wrote to memory of 2236 2260 vdpdp.exe 106 PID 2260 wrote to memory of 2236 2260 vdpdp.exe 106 PID 2260 wrote to memory of 2236 2260 vdpdp.exe 106 PID 2236 wrote to memory of 2904 2236 vpppp.exe 202
Processes
-
C:\Users\Admin\AppData\Local\Temp\a98575878cbe576519e2cd8d5776cc90N.exe"C:\Users\Admin\AppData\Local\Temp\a98575878cbe576519e2cd8d5776cc90N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\pdvjp.exec:\pdvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\rxfflfl.exec:\rxfflfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\nnbhbb.exec:\nnbhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\nnbnnb.exec:\nnbnnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\jdpjv.exec:\jdpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\fxllffx.exec:\fxllffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\xxfxffl.exec:\xxfxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\jpvpp.exec:\jpvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\jvddp.exec:\jvddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\xlrlrrr.exec:\xlrlrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\1nttbb.exec:\1nttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\jdjjv.exec:\jdjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\vpppj.exec:\vpppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\lfllrrr.exec:\lfllrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\7lllfll.exec:\7lllfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\bbnhhh.exec:\bbnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\ppddv.exec:\ppddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\rrxrffx.exec:\rrxrffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\tnnhhb.exec:\tnnhhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\vdpdp.exec:\vdpdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\vpppp.exec:\vpppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\lflrllr.exec:\lflrllr.exe23⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bhtntt.exec:\bhtntt.exe24⤵
- Executes dropped EXE
PID:1212 -
\??\c:\jjppv.exec:\jjppv.exe25⤵
- Executes dropped EXE
PID:3848 -
\??\c:\vvjjj.exec:\vvjjj.exe26⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lffrfxf.exec:\lffrfxf.exe27⤵
- Executes dropped EXE
PID:4928 -
\??\c:\hhbbbn.exec:\hhbbbn.exe28⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tbnnbb.exec:\tbnnbb.exe29⤵
- Executes dropped EXE
PID:3124 -
\??\c:\1vvpp.exec:\1vvpp.exe30⤵
- Executes dropped EXE
PID:1128 -
\??\c:\5llfxlf.exec:\5llfxlf.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4304 -
\??\c:\bbhbbb.exec:\bbhbbb.exe32⤵
- Executes dropped EXE
PID:4204 -
\??\c:\jdjdj.exec:\jdjdj.exe33⤵
- Executes dropped EXE
PID:372 -
\??\c:\fxrrlrr.exec:\fxrrlrr.exe34⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9rxrlll.exec:\9rxrlll.exe35⤵
- Executes dropped EXE
PID:3520 -
\??\c:\tthbtt.exec:\tthbtt.exe36⤵
- Executes dropped EXE
PID:3764 -
\??\c:\bbttnn.exec:\bbttnn.exe37⤵
- Executes dropped EXE
PID:4464 -
\??\c:\jjvdd.exec:\jjvdd.exe38⤵
- Executes dropped EXE
PID:3728 -
\??\c:\lfrlrrl.exec:\lfrlrrl.exe39⤵
- Executes dropped EXE
PID:924 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe40⤵
- Executes dropped EXE
PID:4084 -
\??\c:\5hhbbb.exec:\5hhbbb.exe41⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vppjj.exec:\vppjj.exe42⤵
- Executes dropped EXE
PID:1284 -
\??\c:\pjppv.exec:\pjppv.exe43⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rrxxrrf.exec:\rrxxrrf.exe44⤵
- Executes dropped EXE
PID:3132 -
\??\c:\rllfxxx.exec:\rllfxxx.exe45⤵
- Executes dropped EXE
PID:2020 -
\??\c:\htttnh.exec:\htttnh.exe46⤵
- Executes dropped EXE
PID:3676 -
\??\c:\bnbtnt.exec:\bnbtnt.exe47⤵
- Executes dropped EXE
PID:4356 -
\??\c:\pvvpj.exec:\pvvpj.exe48⤵
- Executes dropped EXE
PID:4340 -
\??\c:\vpvpj.exec:\vpvpj.exe49⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lrrrlll.exec:\lrrrlll.exe50⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nhnhhh.exec:\nhnhhh.exe51⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hbnnht.exec:\hbnnht.exe52⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vvjdp.exec:\vvjdp.exe53⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jvdjd.exec:\jvdjd.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280 -
\??\c:\9lxrxxr.exec:\9lxrxxr.exe55⤵
- Executes dropped EXE
PID:3464 -
\??\c:\hhhhtb.exec:\hhhhtb.exe56⤵
- Executes dropped EXE
PID:896 -
\??\c:\bnbbtt.exec:\bnbbtt.exe57⤵
- Executes dropped EXE
PID:3700 -
\??\c:\pjvpv.exec:\pjvpv.exe58⤵
- Executes dropped EXE
PID:376 -
\??\c:\vvjdd.exec:\vvjdd.exe59⤵
- Executes dropped EXE
PID:4844 -
\??\c:\3jpvp.exec:\3jpvp.exe60⤵
- Executes dropped EXE
PID:4116 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe61⤵
- Executes dropped EXE
PID:4360 -
\??\c:\xflfxxr.exec:\xflfxxr.exe62⤵
- Executes dropped EXE
PID:3040 -
\??\c:\tnnhbb.exec:\tnnhbb.exe63⤵
- Executes dropped EXE
PID:4160 -
\??\c:\5hnhtt.exec:\5hnhtt.exe64⤵
- Executes dropped EXE
PID:2120 -
\??\c:\djjdv.exec:\djjdv.exe65⤵
- Executes dropped EXE
PID:940 -
\??\c:\pvdvv.exec:\pvdvv.exe66⤵PID:1368
-
\??\c:\lxfxrff.exec:\lxfxrff.exe67⤵PID:1564
-
\??\c:\frxrrff.exec:\frxrrff.exe68⤵PID:2156
-
\??\c:\htbbbh.exec:\htbbbh.exe69⤵PID:1388
-
\??\c:\nhhbtb.exec:\nhhbtb.exe70⤵PID:4748
-
\??\c:\dvjjd.exec:\dvjjd.exe71⤵PID:1836
-
\??\c:\pvppj.exec:\pvppj.exe72⤵PID:4928
-
\??\c:\ffrlfff.exec:\ffrlfff.exe73⤵PID:1356
-
\??\c:\1rxrrrl.exec:\1rxrrrl.exe74⤵PID:5096
-
\??\c:\7lrlffx.exec:\7lrlffx.exe75⤵PID:1028
-
\??\c:\jvvvp.exec:\jvvvp.exe76⤵PID:996
-
\??\c:\jdddd.exec:\jdddd.exe77⤵PID:3168
-
\??\c:\xrxrllf.exec:\xrxrllf.exe78⤵PID:1520
-
\??\c:\ntbbth.exec:\ntbbth.exe79⤵PID:1360
-
\??\c:\tnnhbb.exec:\tnnhbb.exe80⤵PID:1780
-
\??\c:\hbbbtn.exec:\hbbbtn.exe81⤵PID:2672
-
\??\c:\dvjjp.exec:\dvjjp.exe82⤵PID:3252
-
\??\c:\vvddv.exec:\vvddv.exe83⤵PID:3520
-
\??\c:\rrfxrrx.exec:\rrfxrrx.exe84⤵
- System Location Discovery: System Language Discovery
PID:648 -
\??\c:\7xxrlll.exec:\7xxrlll.exe85⤵PID:3012
-
\??\c:\bnnhbb.exec:\bnnhbb.exe86⤵PID:2600
-
\??\c:\thbthh.exec:\thbthh.exe87⤵PID:1352
-
\??\c:\9pjdv.exec:\9pjdv.exe88⤵PID:5008
-
\??\c:\vddvp.exec:\vddvp.exe89⤵PID:4140
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe90⤵PID:4648
-
\??\c:\hnhttn.exec:\hnhttn.exe91⤵PID:2948
-
\??\c:\hbbnht.exec:\hbbnht.exe92⤵PID:4012
-
\??\c:\jdpjd.exec:\jdpjd.exe93⤵PID:5028
-
\??\c:\3dvpj.exec:\3dvpj.exe94⤵PID:4288
-
\??\c:\xlllfff.exec:\xlllfff.exe95⤵PID:2020
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe96⤵PID:3676
-
\??\c:\fxrxxxr.exec:\fxrxxxr.exe97⤵PID:4356
-
\??\c:\btbbth.exec:\btbbth.exe98⤵PID:1896
-
\??\c:\hnthhb.exec:\hnthhb.exe99⤵PID:4916
-
\??\c:\jvvpd.exec:\jvvpd.exe100⤵PID:1988
-
\??\c:\dvpvp.exec:\dvpvp.exe101⤵PID:3556
-
\??\c:\rxrlxxr.exec:\rxrlxxr.exe102⤵PID:664
-
\??\c:\rlrllff.exec:\rlrllff.exe103⤵PID:3060
-
\??\c:\tbbtnn.exec:\tbbtnn.exe104⤵PID:1736
-
\??\c:\ttntth.exec:\ttntth.exe105⤵PID:4940
-
\??\c:\vjdvp.exec:\vjdvp.exe106⤵PID:2244
-
\??\c:\dvjdd.exec:\dvjdd.exe107⤵PID:1944
-
\??\c:\1xrrrxr.exec:\1xrrrxr.exe108⤵PID:4572
-
\??\c:\fffxxxx.exec:\fffxxxx.exe109⤵PID:1168
-
\??\c:\nhbbtt.exec:\nhbbtt.exe110⤵PID:3088
-
\??\c:\thhhbt.exec:\thhhbt.exe111⤵PID:4116
-
\??\c:\9pjvp.exec:\9pjvp.exe112⤵PID:2260
-
\??\c:\pjjvp.exec:\pjjvp.exe113⤵PID:4104
-
\??\c:\5llfrxr.exec:\5llfrxr.exe114⤵PID:4900
-
\??\c:\rxxlxrr.exec:\rxxlxrr.exe115⤵PID:3432
-
\??\c:\1bhhtt.exec:\1bhhtt.exe116⤵PID:940
-
\??\c:\thtnnb.exec:\thtnnb.exe117⤵PID:2904
-
\??\c:\thhbnh.exec:\thhbnh.exe118⤵PID:1416
-
\??\c:\7ppjd.exec:\7ppjd.exe119⤵PID:2968
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe120⤵PID:3964
-
\??\c:\lrlxrrf.exec:\lrlxrrf.exe121⤵PID:4132
-
\??\c:\ttbbtn.exec:\ttbbtn.exe122⤵PID:1888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-