Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe
Resource
win7-20240903-en
General
-
Target
a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe
-
Size
333KB
-
MD5
99c93ebfa22eaa5e393ef5ea1c1a94a6
-
SHA1
c8b93fe8d29aadcc95fdc8f17a2e458adb613463
-
SHA256
a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c
-
SHA512
01dcfe6e8680934213d1d0e26a8b76e84dae11398fd84a98ec3cbb631c18b0b888eba8a368a415c732b9c016fbed614b8f16ef23829b60499c229478985e0abf
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhD:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTz
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4544-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/324-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/560-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4544 vjvpd.exe 5100 xlxrlxx.exe 1760 nhhnnn.exe 4752 llxxffl.exe 4856 1flxrxl.exe 668 nhnnnn.exe 5012 dvppp.exe 3300 nhnhhh.exe 116 jjjjj.exe 3192 bhtntb.exe 2560 pvjjj.exe 3268 rxllfll.exe 4284 nbhbnn.exe 440 lxfxffx.exe 3548 bthtnn.exe 1556 dvjdd.exe 1084 xrxrrrl.exe 4472 hbnhhh.exe 1672 5vjjd.exe 1544 xfrllll.exe 3284 1htnhh.exe 1208 dvjjp.exe 1920 tbthtt.exe 1196 vjpjp.exe 2516 vpvjj.exe 3232 flrlfxr.exe 4412 5djjd.exe 3236 lrllxfx.exe 3840 vvvvp.exe 2916 pjdvv.exe 3924 tnnhhb.exe 1472 pvjdv.exe 1188 vpdvp.exe 2424 3bttbb.exe 4460 nbbbhn.exe 2544 ffrllff.exe 112 9thbbb.exe 4380 pjjjd.exe 324 lfxrxxr.exe 4544 1vjjv.exe 1600 frfxrrl.exe 4820 hhnhhh.exe 4552 jvvvd.exe 4044 xrxxrxx.exe 1520 hhbthb.exe 1116 vjpdj.exe 1560 jpppj.exe 3988 3rxxxfx.exe 2944 ttttnn.exe 668 hbntnn.exe 3176 dvvvd.exe 1572 1llfxff.exe 5020 hhnhhh.exe 3692 hhtttb.exe 3192 5vvvp.exe 4232 frlrrxl.exe 4648 nhnhbb.exe 5084 hbnhnh.exe 4284 dvddj.exe 440 3fllflf.exe 1224 9rrxxxr.exe 5008 hthbtt.exe 760 ddjdd.exe 3600 vpppd.exe -
resource yara_rule behavioral2/memory/4544-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/324-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/560-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/560-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-709-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 452 wrote to memory of 4544 452 a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe 83 PID 452 wrote to memory of 4544 452 a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe 83 PID 452 wrote to memory of 4544 452 a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe 83 PID 4544 wrote to memory of 5100 4544 vjvpd.exe 84 PID 4544 wrote to memory of 5100 4544 vjvpd.exe 84 PID 4544 wrote to memory of 5100 4544 vjvpd.exe 84 PID 5100 wrote to memory of 1760 5100 xlxrlxx.exe 85 PID 5100 wrote to memory of 1760 5100 xlxrlxx.exe 85 PID 5100 wrote to memory of 1760 5100 xlxrlxx.exe 85 PID 1760 wrote to memory of 4752 1760 nhhnnn.exe 86 PID 1760 wrote to memory of 4752 1760 nhhnnn.exe 86 PID 1760 wrote to memory of 4752 1760 nhhnnn.exe 86 PID 4752 wrote to memory of 4856 4752 llxxffl.exe 88 PID 4752 wrote to memory of 4856 4752 llxxffl.exe 88 PID 4752 wrote to memory of 4856 4752 llxxffl.exe 88 PID 4856 wrote to memory of 668 4856 1flxrxl.exe 91 PID 4856 wrote to memory of 668 4856 1flxrxl.exe 91 PID 4856 wrote to memory of 668 4856 1flxrxl.exe 91 PID 668 wrote to memory of 5012 668 nhnnnn.exe 92 PID 668 wrote to memory of 5012 668 nhnnnn.exe 92 PID 668 wrote to memory of 5012 668 nhnnnn.exe 92 PID 5012 wrote to memory of 3300 5012 dvppp.exe 93 PID 5012 wrote to memory of 3300 5012 dvppp.exe 93 PID 5012 wrote to memory of 3300 5012 dvppp.exe 93 PID 3300 wrote to memory of 116 3300 nhnhhh.exe 94 PID 3300 wrote to memory of 116 3300 nhnhhh.exe 94 PID 3300 wrote to memory of 116 3300 nhnhhh.exe 94 PID 116 wrote to memory of 3192 116 jjjjj.exe 95 PID 116 wrote to memory of 3192 116 jjjjj.exe 95 PID 116 wrote to memory of 3192 116 jjjjj.exe 95 PID 3192 wrote to memory of 2560 3192 bhtntb.exe 96 PID 3192 wrote to memory of 2560 3192 bhtntb.exe 96 PID 3192 wrote to memory of 2560 3192 bhtntb.exe 96 PID 2560 wrote to memory of 3268 2560 pvjjj.exe 97 PID 2560 wrote to memory of 3268 2560 pvjjj.exe 97 PID 2560 wrote to memory of 3268 2560 pvjjj.exe 97 PID 3268 wrote to memory of 4284 3268 rxllfll.exe 98 PID 3268 wrote to memory of 4284 3268 rxllfll.exe 98 PID 3268 wrote to memory of 4284 3268 rxllfll.exe 98 PID 4284 wrote to memory of 440 4284 nbhbnn.exe 99 PID 4284 wrote to memory of 440 4284 nbhbnn.exe 99 PID 4284 wrote to memory of 440 4284 nbhbnn.exe 99 PID 440 wrote to memory of 3548 440 lxfxffx.exe 100 PID 440 wrote to memory of 3548 440 lxfxffx.exe 100 PID 440 wrote to memory of 3548 440 lxfxffx.exe 100 PID 3548 wrote to memory of 1556 3548 bthtnn.exe 101 PID 3548 wrote to memory of 1556 3548 bthtnn.exe 101 PID 3548 wrote to memory of 1556 3548 bthtnn.exe 101 PID 1556 wrote to memory of 1084 1556 dvjdd.exe 102 PID 1556 wrote to memory of 1084 1556 dvjdd.exe 102 PID 1556 wrote to memory of 1084 1556 dvjdd.exe 102 PID 1084 wrote to memory of 4472 1084 xrxrrrl.exe 103 PID 1084 wrote to memory of 4472 1084 xrxrrrl.exe 103 PID 1084 wrote to memory of 4472 1084 xrxrrrl.exe 103 PID 4472 wrote to memory of 1672 4472 hbnhhh.exe 104 PID 4472 wrote to memory of 1672 4472 hbnhhh.exe 104 PID 4472 wrote to memory of 1672 4472 hbnhhh.exe 104 PID 1672 wrote to memory of 1544 1672 5vjjd.exe 105 PID 1672 wrote to memory of 1544 1672 5vjjd.exe 105 PID 1672 wrote to memory of 1544 1672 5vjjd.exe 105 PID 1544 wrote to memory of 3284 1544 xfrllll.exe 106 PID 1544 wrote to memory of 3284 1544 xfrllll.exe 106 PID 1544 wrote to memory of 3284 1544 xfrllll.exe 106 PID 3284 wrote to memory of 1208 3284 1htnhh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe"C:\Users\Admin\AppData\Local\Temp\a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\vjvpd.exec:\vjvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\xlxrlxx.exec:\xlxrlxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\nhhnnn.exec:\nhhnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\llxxffl.exec:\llxxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\1flxrxl.exec:\1flxrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\nhnnnn.exec:\nhnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\dvppp.exec:\dvppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\nhnhhh.exec:\nhnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\jjjjj.exec:\jjjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\bhtntb.exec:\bhtntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\pvjjj.exec:\pvjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rxllfll.exec:\rxllfll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\nbhbnn.exec:\nbhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\lxfxffx.exec:\lxfxffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\bthtnn.exec:\bthtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\dvjdd.exec:\dvjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\hbnhhh.exec:\hbnhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\5vjjd.exec:\5vjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\xfrllll.exec:\xfrllll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\1htnhh.exec:\1htnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\dvjjp.exec:\dvjjp.exe23⤵
- Executes dropped EXE
PID:1208 -
\??\c:\tbthtt.exec:\tbthtt.exe24⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vjpjp.exec:\vjpjp.exe25⤵
- Executes dropped EXE
PID:1196 -
\??\c:\vpvjj.exec:\vpvjj.exe26⤵
- Executes dropped EXE
PID:2516 -
\??\c:\flrlfxr.exec:\flrlfxr.exe27⤵
- Executes dropped EXE
PID:3232 -
\??\c:\5djjd.exec:\5djjd.exe28⤵
- Executes dropped EXE
PID:4412 -
\??\c:\lrllxfx.exec:\lrllxfx.exe29⤵
- Executes dropped EXE
PID:3236 -
\??\c:\vvvvp.exec:\vvvvp.exe30⤵
- Executes dropped EXE
PID:3840 -
\??\c:\pjdvv.exec:\pjdvv.exe31⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tnnhhb.exec:\tnnhhb.exe32⤵
- Executes dropped EXE
PID:3924 -
\??\c:\pvjdv.exec:\pvjdv.exe33⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vpdvp.exec:\vpdvp.exe34⤵
- Executes dropped EXE
PID:1188 -
\??\c:\3bttbb.exec:\3bttbb.exe35⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nbbbhn.exec:\nbbbhn.exe36⤵
- Executes dropped EXE
PID:4460 -
\??\c:\ffrllff.exec:\ffrllff.exe37⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9thbbb.exec:\9thbbb.exe38⤵
- Executes dropped EXE
PID:112 -
\??\c:\pjjjd.exec:\pjjjd.exe39⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lfxrxxr.exec:\lfxrxxr.exe40⤵
- Executes dropped EXE
PID:324 -
\??\c:\3jddv.exec:\3jddv.exe41⤵PID:1616
-
\??\c:\1vjjv.exec:\1vjjv.exe42⤵
- Executes dropped EXE
PID:4544 -
\??\c:\frfxrrl.exec:\frfxrrl.exe43⤵
- Executes dropped EXE
PID:1600 -
\??\c:\hhnhhh.exec:\hhnhhh.exe44⤵
- Executes dropped EXE
PID:4820 -
\??\c:\jvvvd.exec:\jvvvd.exe45⤵
- Executes dropped EXE
PID:4552 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe46⤵
- Executes dropped EXE
PID:4044 -
\??\c:\hhbthb.exec:\hhbthb.exe47⤵
- Executes dropped EXE
PID:1520 -
\??\c:\vjpdj.exec:\vjpdj.exe48⤵
- Executes dropped EXE
PID:1116 -
\??\c:\jpppj.exec:\jpppj.exe49⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3rxxxfx.exec:\3rxxxfx.exe50⤵
- Executes dropped EXE
PID:3988 -
\??\c:\ttttnn.exec:\ttttnn.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hbntnn.exec:\hbntnn.exe52⤵
- Executes dropped EXE
PID:668 -
\??\c:\dvvvd.exec:\dvvvd.exe53⤵
- Executes dropped EXE
PID:3176 -
\??\c:\1llfxff.exec:\1llfxff.exe54⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hhnhhh.exec:\hhnhhh.exe55⤵
- Executes dropped EXE
PID:5020 -
\??\c:\hhtttb.exec:\hhtttb.exe56⤵
- Executes dropped EXE
PID:3692 -
\??\c:\5vvvp.exec:\5vvvp.exe57⤵
- Executes dropped EXE
PID:3192 -
\??\c:\frlrrxl.exec:\frlrrxl.exe58⤵
- Executes dropped EXE
PID:4232 -
\??\c:\nhnhbb.exec:\nhnhbb.exe59⤵
- Executes dropped EXE
PID:4648 -
\??\c:\hbnhnh.exec:\hbnhnh.exe60⤵
- Executes dropped EXE
PID:5084 -
\??\c:\dvddj.exec:\dvddj.exe61⤵
- Executes dropped EXE
PID:4284 -
\??\c:\3fllflf.exec:\3fllflf.exe62⤵
- Executes dropped EXE
PID:440 -
\??\c:\9rrxxxr.exec:\9rrxxxr.exe63⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hthbtt.exec:\hthbtt.exe64⤵
- Executes dropped EXE
PID:5008 -
\??\c:\ddjdd.exec:\ddjdd.exe65⤵
- Executes dropped EXE
PID:760 -
\??\c:\vpppd.exec:\vpppd.exe66⤵
- Executes dropped EXE
PID:3600 -
\??\c:\fxlrffl.exec:\fxlrffl.exe67⤵PID:2616
-
\??\c:\rrxrxxl.exec:\rrxrxxl.exe68⤵PID:3720
-
\??\c:\bnttnn.exec:\bnttnn.exe69⤵PID:988
-
\??\c:\vdjjv.exec:\vdjjv.exe70⤵PID:1544
-
\??\c:\rlfxrfx.exec:\rlfxrfx.exe71⤵PID:3616
-
\??\c:\llrlxxf.exec:\llrlxxf.exe72⤵PID:1532
-
\??\c:\5bntnt.exec:\5bntnt.exe73⤵PID:1208
-
\??\c:\dvvpj.exec:\dvvpj.exe74⤵PID:1432
-
\??\c:\lflfxfx.exec:\lflfxfx.exe75⤵PID:4156
-
\??\c:\bthhhn.exec:\bthhhn.exe76⤵PID:1676
-
\??\c:\jppjp.exec:\jppjp.exe77⤵PID:4880
-
\??\c:\fflfrxr.exec:\fflfrxr.exe78⤵
- System Location Discovery: System Language Discovery
PID:4556 -
\??\c:\5rffflf.exec:\5rffflf.exe79⤵PID:1272
-
\??\c:\7bhbbb.exec:\7bhbbb.exe80⤵PID:5096
-
\??\c:\1jvvp.exec:\1jvvp.exe81⤵PID:3236
-
\??\c:\pdppv.exec:\pdppv.exe82⤵
- System Location Discovery: System Language Discovery
PID:3132 -
\??\c:\xrxfxfx.exec:\xrxfxfx.exe83⤵PID:3840
-
\??\c:\bhhhbt.exec:\bhhhbt.exe84⤵PID:232
-
\??\c:\dpjjj.exec:\dpjjj.exe85⤵PID:1512
-
\??\c:\tbtbnt.exec:\tbtbnt.exe86⤵PID:2740
-
\??\c:\tnhnhh.exec:\tnhnhh.exe87⤵PID:4012
-
\??\c:\llffxxx.exec:\llffxxx.exe88⤵PID:1872
-
\??\c:\5xfxrxr.exec:\5xfxrxr.exe89⤵PID:244
-
\??\c:\7nhhbb.exec:\7nhhbb.exe90⤵
- System Location Discovery: System Language Discovery
PID:3944 -
\??\c:\dvvpp.exec:\dvvpp.exe91⤵PID:776
-
\??\c:\frxrllf.exec:\frxrllf.exe92⤵PID:3624
-
\??\c:\9tbtnh.exec:\9tbtnh.exe93⤵PID:2612
-
\??\c:\ntbtnn.exec:\ntbtnn.exe94⤵PID:452
-
\??\c:\pjpjj.exec:\pjpjj.exe95⤵PID:4260
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe96⤵PID:4580
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe97⤵PID:4512
-
\??\c:\hhnnnn.exec:\hhnnnn.exe98⤵PID:4820
-
\??\c:\pdpdd.exec:\pdpdd.exe99⤵PID:2080
-
\??\c:\9djjj.exec:\9djjj.exe100⤵PID:3084
-
\??\c:\rrlffxr.exec:\rrlffxr.exe101⤵PID:4836
-
\??\c:\bbnnbt.exec:\bbnnbt.exe102⤵PID:5040
-
\??\c:\5bbbtb.exec:\5bbbtb.exe103⤵PID:4816
-
\??\c:\3pddp.exec:\3pddp.exe104⤵PID:1148
-
\??\c:\rfrxxrx.exec:\rfrxxrx.exe105⤵PID:3792
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe106⤵PID:560
-
\??\c:\tnttnt.exec:\tnttnt.exe107⤵PID:5012
-
\??\c:\vvddd.exec:\vvddd.exe108⤵PID:3928
-
\??\c:\dpvdv.exec:\dpvdv.exe109⤵PID:1968
-
\??\c:\fxfffll.exec:\fxfffll.exe110⤵PID:5072
-
\??\c:\bhtttb.exec:\bhtttb.exe111⤵PID:1104
-
\??\c:\jppvv.exec:\jppvv.exe112⤵PID:2296
-
\??\c:\vdvpp.exec:\vdvpp.exe113⤵PID:1692
-
\??\c:\frfxlrr.exec:\frfxlrr.exe114⤵PID:1804
-
\??\c:\1hhhbb.exec:\1hhhbb.exe115⤵PID:4808
-
\??\c:\ntnnhh.exec:\ntnnhh.exe116⤵PID:3040
-
\??\c:\djvdd.exec:\djvdd.exe117⤵PID:3228
-
\??\c:\dpjvp.exec:\dpjvp.exe118⤵PID:2448
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe119⤵PID:1440
-
\??\c:\thtnnt.exec:\thtnnt.exe120⤵PID:2960
-
\??\c:\dvpjv.exec:\dvpjv.exe121⤵PID:2928
-
\??\c:\lrrrlll.exec:\lrrrlll.exe122⤵PID:3288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-