Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 08:03
Behavioral task
behavioral1
Sample
c0c97b2042bd766208b674622fdb9270N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
c0c97b2042bd766208b674622fdb9270N.exe
-
Size
71KB
-
MD5
c0c97b2042bd766208b674622fdb9270
-
SHA1
499ffdd9ed464e140437d592d5bedb0ce33026a7
-
SHA256
61468abe27804a7969f3e412931ddae8930386559b7857a85fb1c5803a280972
-
SHA512
6070b1a8ae752df5b59826e8ce5b80f6c4a2aeb6c0c66170eb901059abfc73263082301a34f83fb68631f9c3698e71077de52d7b068184b248cb18922b67ce3a
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNlIQldqHiF48u9qll8:khOmTsF93UYfwC6GIoutpYcvldKiF4WI
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4808-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2144-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1264-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3332-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/496-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-601-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-682-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-812-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5080 ppddv.exe 2472 vpjjp.exe 4876 ffxrlfl.exe 3420 hbbtnn.exe 4708 htnhtt.exe 3532 9pvvv.exe 3348 xrrrrxx.exe 2296 xrffrrl.exe 884 nbnnhh.exe 5084 pvvvp.exe 3304 5jjpd.exe 3552 lxlfxxx.exe 688 ttttnh.exe 3396 1bhbhh.exe 4344 9jvvp.exe 3296 pdddd.exe 3520 lffxllf.exe 5092 xlfxxxf.exe 3812 nhhhbb.exe 4148 vppjj.exe 2640 rrrrlrl.exe 2144 rrlrllf.exe 2288 thhhbn.exe 4888 pjjdv.exe 4060 jvpdv.exe 2124 fxllxxr.exe 1700 hnntnn.exe 2240 5dvpj.exe 1604 vvjpd.exe 3260 xrrlxxx.exe 860 rfxlxrr.exe 1228 9bhbtn.exe 2800 5pdvp.exe 4564 pppvv.exe 3764 llxrffx.exe 4904 xrrfxfx.exe 2776 7hnhhh.exe 5052 hnhnbb.exe 4324 vdpdv.exe 3284 vppjv.exe 3816 xlrrlrl.exe 2036 tnnhbb.exe 1932 ppjdp.exe 1936 jjpjd.exe 4440 dpjpv.exe 3732 9rlfrrl.exe 4832 9rxrrlx.exe 3652 3tbbbb.exe 1348 3bbbbb.exe 2824 9dvdp.exe 1316 dvddj.exe 1740 lllfffx.exe 5104 lrfflrx.exe 3312 tntnnn.exe 2024 djjjd.exe 3704 3jvjd.exe 3552 djpjj.exe 2484 llfxlrr.exe 3200 nbtnhh.exe 3004 ntbbbt.exe 1264 7vpjv.exe 1472 jdddp.exe 5076 1ffrxlx.exe 1380 1xrfrlx.exe -
resource yara_rule behavioral2/memory/4808-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233e8-3.dat upx behavioral2/memory/4808-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5080-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023448-11.dat upx behavioral2/files/0x000700000002344c-13.dat upx behavioral2/memory/2472-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344d-21.dat upx behavioral2/memory/4876-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344e-27.dat upx behavioral2/memory/3420-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4708-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3532-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344f-35.dat upx behavioral2/files/0x0007000000023450-40.dat upx behavioral2/memory/3532-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3348-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023451-46.dat upx behavioral2/files/0x0007000000023452-52.dat upx behavioral2/memory/2296-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023453-58.dat upx behavioral2/memory/884-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023454-64.dat upx behavioral2/memory/5084-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023455-70.dat upx behavioral2/files/0x0007000000023456-75.dat upx behavioral2/files/0x0007000000023457-81.dat upx behavioral2/memory/3396-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023458-86.dat upx behavioral2/memory/4344-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345a-97.dat upx behavioral2/memory/3520-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3296-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345b-104.dat upx behavioral2/memory/3520-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5092-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023459-92.dat upx behavioral2/files/0x000700000002345d-111.dat upx behavioral2/memory/5092-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345e-118.dat upx behavioral2/memory/4148-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345f-122.dat upx behavioral2/files/0x0007000000023460-128.dat upx behavioral2/memory/2640-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2144-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023461-134.dat upx behavioral2/files/0x0007000000023462-140.dat upx behavioral2/memory/2288-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023463-146.dat upx behavioral2/memory/4888-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023464-152.dat upx behavioral2/memory/4060-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2124-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023465-160.dat upx behavioral2/files/0x0007000000023466-164.dat upx behavioral2/memory/1700-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023467-170.dat upx behavioral2/memory/2240-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023468-176.dat upx behavioral2/memory/3260-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023469-183.dat upx behavioral2/memory/860-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346a-187.dat upx behavioral2/memory/2800-197-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4808 wrote to memory of 5080 4808 c0c97b2042bd766208b674622fdb9270N.exe 83 PID 4808 wrote to memory of 5080 4808 c0c97b2042bd766208b674622fdb9270N.exe 83 PID 4808 wrote to memory of 5080 4808 c0c97b2042bd766208b674622fdb9270N.exe 83 PID 5080 wrote to memory of 2472 5080 ppddv.exe 84 PID 5080 wrote to memory of 2472 5080 ppddv.exe 84 PID 5080 wrote to memory of 2472 5080 ppddv.exe 84 PID 2472 wrote to memory of 4876 2472 vpjjp.exe 85 PID 2472 wrote to memory of 4876 2472 vpjjp.exe 85 PID 2472 wrote to memory of 4876 2472 vpjjp.exe 85 PID 4876 wrote to memory of 3420 4876 ffxrlfl.exe 86 PID 4876 wrote to memory of 3420 4876 ffxrlfl.exe 86 PID 4876 wrote to memory of 3420 4876 ffxrlfl.exe 86 PID 3420 wrote to memory of 4708 3420 hbbtnn.exe 87 PID 3420 wrote to memory of 4708 3420 hbbtnn.exe 87 PID 3420 wrote to memory of 4708 3420 hbbtnn.exe 87 PID 4708 wrote to memory of 3532 4708 htnhtt.exe 88 PID 4708 wrote to memory of 3532 4708 htnhtt.exe 88 PID 4708 wrote to memory of 3532 4708 htnhtt.exe 88 PID 3532 wrote to memory of 3348 3532 9pvvv.exe 89 PID 3532 wrote to memory of 3348 3532 9pvvv.exe 89 PID 3532 wrote to memory of 3348 3532 9pvvv.exe 89 PID 3348 wrote to memory of 2296 3348 xrrrrxx.exe 90 PID 3348 wrote to memory of 2296 3348 xrrrrxx.exe 90 PID 3348 wrote to memory of 2296 3348 xrrrrxx.exe 90 PID 2296 wrote to memory of 884 2296 xrffrrl.exe 92 PID 2296 wrote to memory of 884 2296 xrffrrl.exe 92 PID 2296 wrote to memory of 884 2296 xrffrrl.exe 92 PID 884 wrote to memory of 5084 884 nbnnhh.exe 93 PID 884 wrote to memory of 5084 884 nbnnhh.exe 93 PID 884 wrote to memory of 5084 884 nbnnhh.exe 93 PID 5084 wrote to memory of 3304 5084 pvvvp.exe 94 PID 5084 wrote to memory of 3304 5084 pvvvp.exe 94 PID 5084 wrote to memory of 3304 5084 pvvvp.exe 94 PID 3304 wrote to memory of 3552 3304 5jjpd.exe 95 PID 3304 wrote to memory of 3552 3304 5jjpd.exe 95 PID 3304 wrote to memory of 3552 3304 5jjpd.exe 95 PID 3552 wrote to memory of 688 3552 lxlfxxx.exe 96 PID 3552 wrote to memory of 688 3552 lxlfxxx.exe 96 PID 3552 wrote to memory of 688 3552 lxlfxxx.exe 96 PID 688 wrote to memory of 3396 688 ttttnh.exe 97 PID 688 wrote to memory of 3396 688 ttttnh.exe 97 PID 688 wrote to memory of 3396 688 ttttnh.exe 97 PID 3396 wrote to memory of 4344 3396 1bhbhh.exe 98 PID 3396 wrote to memory of 4344 3396 1bhbhh.exe 98 PID 3396 wrote to memory of 4344 3396 1bhbhh.exe 98 PID 4344 wrote to memory of 3296 4344 9jvvp.exe 99 PID 4344 wrote to memory of 3296 4344 9jvvp.exe 99 PID 4344 wrote to memory of 3296 4344 9jvvp.exe 99 PID 3296 wrote to memory of 3520 3296 pdddd.exe 100 PID 3296 wrote to memory of 3520 3296 pdddd.exe 100 PID 3296 wrote to memory of 3520 3296 pdddd.exe 100 PID 3520 wrote to memory of 5092 3520 lffxllf.exe 101 PID 3520 wrote to memory of 5092 3520 lffxllf.exe 101 PID 3520 wrote to memory of 5092 3520 lffxllf.exe 101 PID 5092 wrote to memory of 3812 5092 xlfxxxf.exe 102 PID 5092 wrote to memory of 3812 5092 xlfxxxf.exe 102 PID 5092 wrote to memory of 3812 5092 xlfxxxf.exe 102 PID 3812 wrote to memory of 4148 3812 nhhhbb.exe 103 PID 3812 wrote to memory of 4148 3812 nhhhbb.exe 103 PID 3812 wrote to memory of 4148 3812 nhhhbb.exe 103 PID 4148 wrote to memory of 2640 4148 vppjj.exe 105 PID 4148 wrote to memory of 2640 4148 vppjj.exe 105 PID 4148 wrote to memory of 2640 4148 vppjj.exe 105 PID 2640 wrote to memory of 2144 2640 rrrrlrl.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0c97b2042bd766208b674622fdb9270N.exe"C:\Users\Admin\AppData\Local\Temp\c0c97b2042bd766208b674622fdb9270N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\ppddv.exec:\ppddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\vpjjp.exec:\vpjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ffxrlfl.exec:\ffxrlfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\hbbtnn.exec:\hbbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\htnhtt.exec:\htnhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\9pvvv.exec:\9pvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\xrffrrl.exec:\xrffrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\nbnnhh.exec:\nbnnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\pvvvp.exec:\pvvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\5jjpd.exec:\5jjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\ttttnh.exec:\ttttnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\1bhbhh.exec:\1bhbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\9jvvp.exec:\9jvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\pdddd.exec:\pdddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\lffxllf.exec:\lffxllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\xlfxxxf.exec:\xlfxxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\nhhhbb.exec:\nhhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\vppjj.exec:\vppjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rrlrllf.exec:\rrlrllf.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\thhhbn.exec:\thhhbn.exe24⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjjdv.exec:\pjjdv.exe25⤵
- Executes dropped EXE
PID:4888 -
\??\c:\jvpdv.exec:\jvpdv.exe26⤵
- Executes dropped EXE
PID:4060 -
\??\c:\fxllxxr.exec:\fxllxxr.exe27⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hnntnn.exec:\hnntnn.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5dvpj.exec:\5dvpj.exe29⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vvjpd.exec:\vvjpd.exe30⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe31⤵
- Executes dropped EXE
PID:3260 -
\??\c:\rfxlxrr.exec:\rfxlxrr.exe32⤵
- Executes dropped EXE
PID:860 -
\??\c:\9bhbtn.exec:\9bhbtn.exe33⤵
- Executes dropped EXE
PID:1228 -
\??\c:\5pdvp.exec:\5pdvp.exe34⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pppvv.exec:\pppvv.exe35⤵
- Executes dropped EXE
PID:4564 -
\??\c:\llxrffx.exec:\llxrffx.exe36⤵
- Executes dropped EXE
PID:3764 -
\??\c:\xrrfxfx.exec:\xrrfxfx.exe37⤵
- Executes dropped EXE
PID:4904 -
\??\c:\7hnhhh.exec:\7hnhhh.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hnhnbb.exec:\hnhnbb.exe39⤵
- Executes dropped EXE
PID:5052 -
\??\c:\vdpdv.exec:\vdpdv.exe40⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vppjv.exec:\vppjv.exe41⤵
- Executes dropped EXE
PID:3284 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe42⤵
- Executes dropped EXE
PID:3816 -
\??\c:\tnhntn.exec:\tnhntn.exe43⤵PID:4448
-
\??\c:\tnnhbb.exec:\tnnhbb.exe44⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ppjdp.exec:\ppjdp.exe45⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jjpjd.exec:\jjpjd.exe46⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dpjpv.exec:\dpjpv.exe47⤵
- Executes dropped EXE
PID:4440 -
\??\c:\9rlfrrl.exec:\9rlfrrl.exe48⤵
- Executes dropped EXE
PID:3732 -
\??\c:\9rxrrlx.exec:\9rxrrlx.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4832 -
\??\c:\3tbbbb.exec:\3tbbbb.exe50⤵
- Executes dropped EXE
PID:3652 -
\??\c:\3bbbbb.exec:\3bbbbb.exe51⤵
- Executes dropped EXE
PID:1348 -
\??\c:\9dvdp.exec:\9dvdp.exe52⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dvddj.exec:\dvddj.exe53⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lllfffx.exec:\lllfffx.exe54⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lrfflrx.exec:\lrfflrx.exe55⤵
- Executes dropped EXE
PID:5104 -
\??\c:\tntnnn.exec:\tntnnn.exe56⤵
- Executes dropped EXE
PID:3312 -
\??\c:\djjjd.exec:\djjjd.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3jvjd.exec:\3jvjd.exe58⤵
- Executes dropped EXE
PID:3704 -
\??\c:\djpjj.exec:\djpjj.exe59⤵
- Executes dropped EXE
PID:3552 -
\??\c:\llfxlrr.exec:\llfxlrr.exe60⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nbtnhh.exec:\nbtnhh.exe61⤵
- Executes dropped EXE
PID:3200 -
\??\c:\ntbbbt.exec:\ntbbbt.exe62⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7vpjv.exec:\7vpjv.exe63⤵
- Executes dropped EXE
PID:1264 -
\??\c:\jdddp.exec:\jdddp.exe64⤵
- Executes dropped EXE
PID:1472 -
\??\c:\1ffrxlx.exec:\1ffrxlx.exe65⤵
- Executes dropped EXE
PID:5076 -
\??\c:\1xrfrlx.exec:\1xrfrlx.exe66⤵
- Executes dropped EXE
PID:1380 -
\??\c:\ttbbbh.exec:\ttbbbh.exe67⤵PID:5092
-
\??\c:\hbtbnn.exec:\hbtbnn.exe68⤵PID:2252
-
\??\c:\vppdv.exec:\vppdv.exe69⤵PID:2428
-
\??\c:\frfxrfx.exec:\frfxrfx.exe70⤵PID:3568
-
\??\c:\htttnn.exec:\htttnn.exe71⤵PID:3996
-
\??\c:\7hhhtt.exec:\7hhhtt.exe72⤵PID:2304
-
\??\c:\jddvp.exec:\jddvp.exe73⤵PID:444
-
\??\c:\dvppp.exec:\dvppp.exe74⤵PID:2184
-
\??\c:\lflxxxf.exec:\lflxxxf.exe75⤵PID:4668
-
\??\c:\lxlfllf.exec:\lxlfllf.exe76⤵PID:1952
-
\??\c:\btnttt.exec:\btnttt.exe77⤵PID:772
-
\??\c:\nhtttb.exec:\nhtttb.exe78⤵PID:5116
-
\??\c:\rllfxxr.exec:\rllfxxr.exe79⤵PID:2124
-
\??\c:\bbtnnh.exec:\bbtnnh.exe80⤵PID:408
-
\??\c:\bnbtbb.exec:\bnbtbb.exe81⤵PID:2948
-
\??\c:\btbhbh.exec:\btbhbh.exe82⤵PID:4976
-
\??\c:\jdvdd.exec:\jdvdd.exe83⤵PID:3596
-
\??\c:\jppjd.exec:\jppjd.exe84⤵PID:2380
-
\??\c:\9frlxxx.exec:\9frlxxx.exe85⤵PID:2176
-
\??\c:\frrrrrr.exec:\frrrrrr.exe86⤵PID:3272
-
\??\c:\btttbb.exec:\btttbb.exe87⤵PID:3308
-
\??\c:\jvdpd.exec:\jvdpd.exe88⤵PID:3216
-
\??\c:\vddjv.exec:\vddjv.exe89⤵PID:2128
-
\??\c:\rfflrfx.exec:\rfflrfx.exe90⤵PID:3012
-
\??\c:\xxffxfl.exec:\xxffxfl.exe91⤵PID:3332
-
\??\c:\bbthtn.exec:\bbthtn.exe92⤵PID:2960
-
\??\c:\pppjd.exec:\pppjd.exe93⤵PID:2420
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe94⤵PID:3624
-
\??\c:\xflllrl.exec:\xflllrl.exe95⤵PID:4324
-
\??\c:\nttbtt.exec:\nttbtt.exe96⤵PID:1232
-
\??\c:\3bhbtt.exec:\3bhbtt.exe97⤵PID:1948
-
\??\c:\jjpjp.exec:\jjpjp.exe98⤵PID:1636
-
\??\c:\vpvpp.exec:\vpvpp.exe99⤵PID:2424
-
\??\c:\dvvvp.exec:\dvvvp.exe100⤵PID:2308
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe101⤵PID:4424
-
\??\c:\xfllfxr.exec:\xfllfxr.exe102⤵PID:4680
-
\??\c:\tbbbbh.exec:\tbbbbh.exe103⤵PID:2400
-
\??\c:\nnnhbn.exec:\nnnhbn.exe104⤵PID:4832
-
\??\c:\dvdpj.exec:\dvdpj.exe105⤵PID:1408
-
\??\c:\5djdp.exec:\5djdp.exe106⤵PID:1348
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe107⤵PID:380
-
\??\c:\lflffff.exec:\lflffff.exe108⤵PID:1360
-
\??\c:\htbttb.exec:\htbttb.exe109⤵PID:3240
-
\??\c:\hnthtt.exec:\hnthtt.exe110⤵PID:5056
-
\??\c:\dvpjj.exec:\dvpjj.exe111⤵PID:496
-
\??\c:\9vpvj.exec:\9vpvj.exe112⤵PID:3684
-
\??\c:\rffxrfx.exec:\rffxrfx.exe113⤵PID:4908
-
\??\c:\lfffxxx.exec:\lfffxxx.exe114⤵PID:2368
-
\??\c:\nbhhbb.exec:\nbhhbb.exe115⤵PID:2744
-
\??\c:\thnhbh.exec:\thnhbh.exe116⤵PID:3092
-
\??\c:\1ddpd.exec:\1ddpd.exe117⤵PID:3784
-
\??\c:\pvvpv.exec:\pvvpv.exe118⤵PID:4016
-
\??\c:\5lllffx.exec:\5lllffx.exe119⤵PID:3668
-
\??\c:\flllllf.exec:\flllllf.exe120⤵PID:3520
-
\??\c:\nntntt.exec:\nntntt.exe121⤵PID:1220
-
\??\c:\htbtnn.exec:\htbtnn.exe122⤵PID:1804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-