Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 19:58
Behavioral task
behavioral1
Sample
b5cfbc928c0827c718cb06b9c139e7c0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
b5cfbc928c0827c718cb06b9c139e7c0N.exe
-
Size
297KB
-
MD5
b5cfbc928c0827c718cb06b9c139e7c0
-
SHA1
49ef46554a1a125093ef4b4953a010f6d55fe16b
-
SHA256
28d04411caf15cf0c311f67525fc833665a831a45f5e1f0ec9eb1420b5d5707b
-
SHA512
ce6ca083e4eefbd5b9d542e409d56398061f15417923c9823444f9715837331a2ae08062eb2ed9743e238f93f772734673fbfc0098521e6976d33ab6ad7ec8f7
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftO3:K4wFHoSQkuUHk1zBR/pMT9XvEhdfS
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4596-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3004-14-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5052-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2544-22-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3844-29-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2256-30-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4872-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4588-46-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2448-51-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2808-57-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5104-64-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5024-69-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2000-74-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2700-91-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3192-99-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3008-105-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2372-118-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1180-128-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4904-126-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3408-134-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2276-139-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/628-151-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1480-157-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3204-165-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1008-171-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/540-183-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/400-192-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4316-196-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4404-200-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1520-210-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3924-214-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3452-220-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4648-236-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3504-252-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1736-256-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2556-270-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4572-283-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1564-287-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/552-294-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2248-298-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3144-302-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4400-306-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2904-325-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5028-332-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4452-339-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4632-367-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2424-377-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1972-408-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2348-418-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1808-434-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2924-438-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2212-445-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1664-479-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1820-486-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1324-502-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2648-527-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5052-534-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3852-569-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4768-873-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1192-889-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1504-950-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4396-1246-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2856-1364-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5052 vvdpd.exe 3004 rxfxxxx.exe 2544 rllffxx.exe 3844 vdjjp.exe 2256 3bnnnt.exe 4872 vvvvv.exe 4588 9rxrxlf.exe 2448 bttnnn.exe 2808 lrxrxfr.exe 5104 9jjdv.exe 5024 jvvpj.exe 2000 hhhbhh.exe 2436 fxxlxlf.exe 464 tbhbtt.exe 2700 pdjdv.exe 1132 1lxrxxf.exe 3192 ttnnhn.exe 3008 jpvpv.exe 3060 rlfxfff.exe 2372 ttbbht.exe 4904 rxlllrl.exe 1180 nbnnnn.exe 3408 dvjjp.exe 2276 rlxrlxx.exe 664 nntbbh.exe 628 9djdv.exe 1480 xllfffr.exe 3204 rllfxrl.exe 1008 7djpj.exe 4776 ppvpv.exe 540 xrxxrxr.exe 1300 hbhbnn.exe 400 5pppd.exe 4316 frffxfl.exe 4404 bntnhb.exe 3196 vjdvd.exe 2424 flllfxl.exe 1520 hhtnhh.exe 3924 frrxllf.exe 2624 xfffxrl.exe 3452 7ppjd.exe 2796 lllfrrl.exe 4636 3thhtt.exe 624 vpdvv.exe 3308 fxrfrfr.exe 4648 bnhhth.exe 2344 djjvp.exe 1980 nhbtnn.exe 2760 3jpdv.exe 1252 lxfrllf.exe 3504 1frxrlf.exe 1736 1nnhbb.exe 3716 jdjjj.exe 1808 lffxfff.exe 5024 tnbtnn.exe 2556 nnnhhh.exe 3856 dvjdd.exe 1848 7rxxlfx.exe 732 tbnttt.exe 4572 9djjj.exe 1564 rxlfxxr.exe 2524 htbbtt.exe 552 pdppp.exe 2248 dvvvv.exe -
resource yara_rule behavioral2/memory/4596-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0009000000023419-4.dat upx behavioral2/memory/4596-8-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000800000002347c-10.dat upx behavioral2/memory/3004-14-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023480-13.dat upx behavioral2/memory/5052-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023481-21.dat upx behavioral2/memory/2544-22-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023483-28.dat upx behavioral2/memory/3844-29-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2256-30-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023484-33.dat upx behavioral2/memory/4872-37-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023485-39.dat upx behavioral2/files/0x0007000000023486-44.dat upx behavioral2/memory/4588-46-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2448-51-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023487-49.dat upx behavioral2/files/0x0007000000023488-55.dat upx behavioral2/memory/2808-57-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023489-61.dat upx behavioral2/memory/5104-64-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002348a-67.dat upx behavioral2/memory/5024-69-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002348b-75.dat upx behavioral2/memory/2000-74-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002348c-79.dat upx behavioral2/files/0x000800000002347d-84.dat upx behavioral2/memory/2700-91-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002348e-89.dat upx behavioral2/files/0x000700000002348f-95.dat upx behavioral2/memory/3192-99-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023490-101.dat upx behavioral2/memory/3008-105-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023491-107.dat upx behavioral2/files/0x0007000000023492-112.dat upx behavioral2/memory/2372-118-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023493-119.dat upx behavioral2/files/0x0007000000023494-123.dat upx behavioral2/memory/1180-128-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4904-126-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023495-130.dat upx behavioral2/memory/3408-134-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2276-139-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023496-137.dat upx behavioral2/files/0x0007000000023497-142.dat upx behavioral2/files/0x0007000000023498-148.dat upx behavioral2/memory/628-151-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023499-153.dat upx behavioral2/memory/1480-157-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002349a-159.dat upx behavioral2/memory/3204-165-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0002000000022b23-166.dat upx behavioral2/memory/1008-171-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0002000000022b25-172.dat upx behavioral2/files/0x000700000002349b-176.dat upx behavioral2/files/0x000700000002349c-181.dat upx behavioral2/memory/540-183-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/400-188-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/400-192-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4316-196-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4404-200-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1520-210-0x0000000000400000-0x0000000000434000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4596 wrote to memory of 5052 4596 b5cfbc928c0827c718cb06b9c139e7c0N.exe 83 PID 4596 wrote to memory of 5052 4596 b5cfbc928c0827c718cb06b9c139e7c0N.exe 83 PID 4596 wrote to memory of 5052 4596 b5cfbc928c0827c718cb06b9c139e7c0N.exe 83 PID 5052 wrote to memory of 3004 5052 vvdpd.exe 84 PID 5052 wrote to memory of 3004 5052 vvdpd.exe 84 PID 5052 wrote to memory of 3004 5052 vvdpd.exe 84 PID 3004 wrote to memory of 2544 3004 rxfxxxx.exe 85 PID 3004 wrote to memory of 2544 3004 rxfxxxx.exe 85 PID 3004 wrote to memory of 2544 3004 rxfxxxx.exe 85 PID 2544 wrote to memory of 3844 2544 rllffxx.exe 86 PID 2544 wrote to memory of 3844 2544 rllffxx.exe 86 PID 2544 wrote to memory of 3844 2544 rllffxx.exe 86 PID 3844 wrote to memory of 2256 3844 vdjjp.exe 87 PID 3844 wrote to memory of 2256 3844 vdjjp.exe 87 PID 3844 wrote to memory of 2256 3844 vdjjp.exe 87 PID 2256 wrote to memory of 4872 2256 3bnnnt.exe 88 PID 2256 wrote to memory of 4872 2256 3bnnnt.exe 88 PID 2256 wrote to memory of 4872 2256 3bnnnt.exe 88 PID 4872 wrote to memory of 4588 4872 vvvvv.exe 89 PID 4872 wrote to memory of 4588 4872 vvvvv.exe 89 PID 4872 wrote to memory of 4588 4872 vvvvv.exe 89 PID 4588 wrote to memory of 2448 4588 9rxrxlf.exe 91 PID 4588 wrote to memory of 2448 4588 9rxrxlf.exe 91 PID 4588 wrote to memory of 2448 4588 9rxrxlf.exe 91 PID 2448 wrote to memory of 2808 2448 bttnnn.exe 92 PID 2448 wrote to memory of 2808 2448 bttnnn.exe 92 PID 2448 wrote to memory of 2808 2448 bttnnn.exe 92 PID 2808 wrote to memory of 5104 2808 lrxrxfr.exe 94 PID 2808 wrote to memory of 5104 2808 lrxrxfr.exe 94 PID 2808 wrote to memory of 5104 2808 lrxrxfr.exe 94 PID 5104 wrote to memory of 5024 5104 9jjdv.exe 95 PID 5104 wrote to memory of 5024 5104 9jjdv.exe 95 PID 5104 wrote to memory of 5024 5104 9jjdv.exe 95 PID 5024 wrote to memory of 2000 5024 jvvpj.exe 96 PID 5024 wrote to memory of 2000 5024 jvvpj.exe 96 PID 5024 wrote to memory of 2000 5024 jvvpj.exe 96 PID 2000 wrote to memory of 2436 2000 hhhbhh.exe 97 PID 2000 wrote to memory of 2436 2000 hhhbhh.exe 97 PID 2000 wrote to memory of 2436 2000 hhhbhh.exe 97 PID 2436 wrote to memory of 464 2436 fxxlxlf.exe 98 PID 2436 wrote to memory of 464 2436 fxxlxlf.exe 98 PID 2436 wrote to memory of 464 2436 fxxlxlf.exe 98 PID 464 wrote to memory of 2700 464 tbhbtt.exe 100 PID 464 wrote to memory of 2700 464 tbhbtt.exe 100 PID 464 wrote to memory of 2700 464 tbhbtt.exe 100 PID 2700 wrote to memory of 1132 2700 pdjdv.exe 101 PID 2700 wrote to memory of 1132 2700 pdjdv.exe 101 PID 2700 wrote to memory of 1132 2700 pdjdv.exe 101 PID 1132 wrote to memory of 3192 1132 1lxrxxf.exe 102 PID 1132 wrote to memory of 3192 1132 1lxrxxf.exe 102 PID 1132 wrote to memory of 3192 1132 1lxrxxf.exe 102 PID 3192 wrote to memory of 3008 3192 ttnnhn.exe 103 PID 3192 wrote to memory of 3008 3192 ttnnhn.exe 103 PID 3192 wrote to memory of 3008 3192 ttnnhn.exe 103 PID 3008 wrote to memory of 3060 3008 jpvpv.exe 104 PID 3008 wrote to memory of 3060 3008 jpvpv.exe 104 PID 3008 wrote to memory of 3060 3008 jpvpv.exe 104 PID 3060 wrote to memory of 2372 3060 rlfxfff.exe 105 PID 3060 wrote to memory of 2372 3060 rlfxfff.exe 105 PID 3060 wrote to memory of 2372 3060 rlfxfff.exe 105 PID 2372 wrote to memory of 4904 2372 ttbbht.exe 106 PID 2372 wrote to memory of 4904 2372 ttbbht.exe 106 PID 2372 wrote to memory of 4904 2372 ttbbht.exe 106 PID 4904 wrote to memory of 1180 4904 rxlllrl.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5cfbc928c0827c718cb06b9c139e7c0N.exe"C:\Users\Admin\AppData\Local\Temp\b5cfbc928c0827c718cb06b9c139e7c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\vvdpd.exec:\vvdpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rllffxx.exec:\rllffxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\vdjjp.exec:\vdjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\3bnnnt.exec:\3bnnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\vvvvv.exec:\vvvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\9rxrxlf.exec:\9rxrxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\bttnnn.exec:\bttnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\lrxrxfr.exec:\lrxrxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\9jjdv.exec:\9jjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\jvvpj.exec:\jvvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\hhhbhh.exec:\hhhbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\fxxlxlf.exec:\fxxlxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\tbhbtt.exec:\tbhbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\pdjdv.exec:\pdjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\1lxrxxf.exec:\1lxrxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\ttnnhn.exec:\ttnnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\jpvpv.exec:\jpvpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rlfxfff.exec:\rlfxfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\ttbbht.exec:\ttbbht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\rxlllrl.exec:\rxlllrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\nbnnnn.exec:\nbnnnn.exe23⤵
- Executes dropped EXE
PID:1180 -
\??\c:\dvjjp.exec:\dvjjp.exe24⤵
- Executes dropped EXE
PID:3408 -
\??\c:\rlxrlxx.exec:\rlxrlxx.exe25⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nntbbh.exec:\nntbbh.exe26⤵
- Executes dropped EXE
PID:664 -
\??\c:\9djdv.exec:\9djdv.exe27⤵
- Executes dropped EXE
PID:628 -
\??\c:\xllfffr.exec:\xllfffr.exe28⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rllfxrl.exec:\rllfxrl.exe29⤵
- Executes dropped EXE
PID:3204 -
\??\c:\7djpj.exec:\7djpj.exe30⤵
- Executes dropped EXE
PID:1008 -
\??\c:\ppvpv.exec:\ppvpv.exe31⤵
- Executes dropped EXE
PID:4776 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe32⤵
- Executes dropped EXE
PID:540 -
\??\c:\hbhbnn.exec:\hbhbnn.exe33⤵
- Executes dropped EXE
PID:1300 -
\??\c:\5pppd.exec:\5pppd.exe34⤵
- Executes dropped EXE
PID:400 -
\??\c:\frffxfl.exec:\frffxfl.exe35⤵
- Executes dropped EXE
PID:4316 -
\??\c:\bntnhb.exec:\bntnhb.exe36⤵
- Executes dropped EXE
PID:4404 -
\??\c:\vjdvd.exec:\vjdvd.exe37⤵
- Executes dropped EXE
PID:3196 -
\??\c:\flllfxl.exec:\flllfxl.exe38⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hhtnhh.exec:\hhtnhh.exe39⤵
- Executes dropped EXE
PID:1520 -
\??\c:\frrxllf.exec:\frrxllf.exe40⤵
- Executes dropped EXE
PID:3924 -
\??\c:\xfffxrl.exec:\xfffxrl.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7ppjd.exec:\7ppjd.exe42⤵
- Executes dropped EXE
PID:3452 -
\??\c:\lllfrrl.exec:\lllfrrl.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\3thhtt.exec:\3thhtt.exe44⤵
- Executes dropped EXE
PID:4636 -
\??\c:\vpdvv.exec:\vpdvv.exe45⤵
- Executes dropped EXE
PID:624 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe46⤵
- Executes dropped EXE
PID:3308 -
\??\c:\bnhhth.exec:\bnhhth.exe47⤵
- Executes dropped EXE
PID:4648 -
\??\c:\djjvp.exec:\djjvp.exe48⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nhbtnn.exec:\nhbtnn.exe49⤵
- Executes dropped EXE
PID:1980 -
\??\c:\3jpdv.exec:\3jpdv.exe50⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lxfrllf.exec:\lxfrllf.exe51⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1frxrlf.exec:\1frxrlf.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3504 -
\??\c:\1nnhbb.exec:\1nnhbb.exe53⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jdjjj.exec:\jdjjj.exe54⤵
- Executes dropped EXE
PID:3716 -
\??\c:\lffxfff.exec:\lffxfff.exe55⤵
- Executes dropped EXE
PID:1808 -
\??\c:\tnbtnn.exec:\tnbtnn.exe56⤵
- Executes dropped EXE
PID:5024 -
\??\c:\nnnhhh.exec:\nnnhhh.exe57⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dvjdd.exec:\dvjdd.exe58⤵
- Executes dropped EXE
PID:3856 -
\??\c:\7rxxlfx.exec:\7rxxlfx.exe59⤵
- Executes dropped EXE
PID:1848 -
\??\c:\tbnttt.exec:\tbnttt.exe60⤵
- Executes dropped EXE
PID:732 -
\??\c:\9djjj.exec:\9djjj.exe61⤵
- Executes dropped EXE
PID:4572 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe62⤵
- Executes dropped EXE
PID:1564 -
\??\c:\htbbtt.exec:\htbbtt.exe63⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pdppp.exec:\pdppp.exe64⤵
- Executes dropped EXE
PID:552 -
\??\c:\dvvvv.exec:\dvvvv.exe65⤵
- Executes dropped EXE
PID:2248 -
\??\c:\frlfxxl.exec:\frlfxxl.exe66⤵PID:3144
-
\??\c:\tthttn.exec:\tthttn.exe67⤵PID:4400
-
\??\c:\pddpj.exec:\pddpj.exe68⤵PID:4812
-
\??\c:\rlrlffr.exec:\rlrlffr.exe69⤵PID:1504
-
\??\c:\nhtnbn.exec:\nhtnbn.exe70⤵PID:2372
-
\??\c:\ffrlfff.exec:\ffrlfff.exe71⤵PID:1840
-
\??\c:\ffxxxff.exec:\ffxxxff.exe72⤵PID:556
-
\??\c:\tthbhh.exec:\tthbhh.exe73⤵PID:2904
-
\??\c:\ddjpp.exec:\ddjpp.exe74⤵PID:1360
-
\??\c:\lrrrxfr.exec:\lrrrxfr.exe75⤵PID:5028
-
\??\c:\lrffrxx.exec:\lrffrxx.exe76⤵PID:3676
-
\??\c:\btnnnn.exec:\btnnnn.exe77⤵PID:4452
-
\??\c:\jvdvv.exec:\jvdvv.exe78⤵PID:4524
-
\??\c:\frrrrrl.exec:\frrrrrl.exe79⤵PID:3348
-
\??\c:\xflfllf.exec:\xflfllf.exe80⤵PID:220
-
\??\c:\bbtnnn.exec:\bbtnnn.exe81⤵PID:3992
-
\??\c:\vjpvv.exec:\vjpvv.exe82⤵PID:4908
-
\??\c:\vjvdj.exec:\vjvdj.exe83⤵PID:5068
-
\??\c:\ffrlxxx.exec:\ffrlxxx.exe84⤵PID:400
-
\??\c:\nhnhhh.exec:\nhnhhh.exe85⤵PID:4596
-
\??\c:\btbthh.exec:\btbthh.exe86⤵PID:4632
-
\??\c:\jvddv.exec:\jvddv.exe87⤵PID:4236
-
\??\c:\lxrlxff.exec:\lxrlxff.exe88⤵PID:372
-
\??\c:\7rrxrrr.exec:\7rrxrrr.exe89⤵PID:2424
-
\??\c:\nttttt.exec:\nttttt.exe90⤵PID:976
-
\??\c:\5pjjd.exec:\5pjjd.exe91⤵PID:808
-
\??\c:\5frlffx.exec:\5frlffx.exe92⤵PID:1164
-
\??\c:\5llxrll.exec:\5llxrll.exe93⤵PID:4308
-
\??\c:\nnbbnn.exec:\nnbbnn.exe94⤵PID:2672
-
\??\c:\3jjjv.exec:\3jjjv.exe95⤵PID:5060
-
\??\c:\llxxllf.exec:\llxxllf.exe96⤵PID:2504
-
\??\c:\ntbthb.exec:\ntbthb.exe97⤵PID:1812
-
\??\c:\vpjjv.exec:\vpjjv.exe98⤵PID:2244
-
\??\c:\lllfxxx.exec:\lllfxxx.exe99⤵PID:1972
-
\??\c:\ntbbtb.exec:\ntbbtb.exe100⤵PID:2344
-
\??\c:\vdvdv.exec:\vdvdv.exe101⤵PID:4184
-
\??\c:\rlllxlf.exec:\rlllxlf.exe102⤵PID:2348
-
\??\c:\5fffxfx.exec:\5fffxfx.exe103⤵PID:2628
-
\??\c:\jjvvv.exec:\jjvvv.exe104⤵PID:4836
-
\??\c:\1dppp.exec:\1dppp.exe105⤵PID:1676
-
\??\c:\5frlfff.exec:\5frlfff.exe106⤵PID:3716
-
\??\c:\5tnhbt.exec:\5tnhbt.exe107⤵PID:1808
-
\??\c:\hbbhbb.exec:\hbbhbb.exe108⤵PID:2924
-
\??\c:\dvdvp.exec:\dvdvp.exe109⤵
- System Location Discovery: System Language Discovery
PID:2556 -
\??\c:\frfrxxx.exec:\frfrxxx.exe110⤵PID:2212
-
\??\c:\bhtntb.exec:\bhtntb.exe111⤵PID:1948
-
\??\c:\pdvvp.exec:\pdvvp.exe112⤵PID:1516
-
\??\c:\9ffxrrl.exec:\9ffxrrl.exe113⤵PID:1236
-
\??\c:\bnbhbb.exec:\bnbhbb.exe114⤵PID:4208
-
\??\c:\hbttnn.exec:\hbttnn.exe115⤵
- System Location Discovery: System Language Discovery
PID:2524 -
\??\c:\3jjvj.exec:\3jjvj.exe116⤵PID:552
-
\??\c:\lxrflll.exec:\lxrflll.exe117⤵PID:1336
-
\??\c:\nbnnth.exec:\nbnnth.exe118⤵PID:1496
-
\??\c:\fxxxlll.exec:\fxxxlll.exe119⤵PID:1940
-
\??\c:\hbbttb.exec:\hbbttb.exe120⤵PID:4304
-
\??\c:\vppdv.exec:\vppdv.exe121⤵
- System Location Discovery: System Language Discovery
PID:1664 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe122⤵PID:1400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-