Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 00:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe
-
Size
453KB
-
MD5
bbe31385d99e814b600ddd4270855f23
-
SHA1
1a63aba1061bb0a082e9ec9ce5fbb806883f0376
-
SHA256
74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82
-
SHA512
d942c75dc38dc3753477141fa63e6e0c6e50dbcf414ba9923e6568e4f709fbc4af048a140ab20d3020ce1896e39cf6b4b1c767e58d4e729d9b92e7b7f910c426
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3184-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3948 dpvjd.exe 2360 rfrlffr.exe 2684 bnhhht.exe 3648 vpvvd.exe 2768 nhhtbb.exe 4224 rlrrfrx.exe 1596 nbbhht.exe 224 rrrlrrf.exe 3152 jvdjp.exe 4576 1frrrrr.exe 3208 pvvvp.exe 4064 lrrxxxx.exe 3180 rrxrfrx.exe 4376 rlxxlfr.exe 3408 thnhhh.exe 1980 jpjdv.exe 4000 thtttb.exe 1152 lfxllxf.exe 440 rrxxflx.exe 4976 hnnhhn.exe 1608 ppvvd.exe 1008 vvddp.exe 4996 thntbh.exe 4668 pvpvv.exe 2452 xllfrrx.exe 4824 pjjdj.exe 3632 ttbhhn.exe 3892 xfxfrxx.exe 4596 bhbntb.exe 3020 jjpjd.exe 344 llllfll.exe 2776 nthbnh.exe 672 rrlxflr.exe 4100 3tbnth.exe 1864 jdddp.exe 4864 fxxrrfx.exe 2188 bhbhhb.exe 4380 jddvv.exe 3100 lxrrlrr.exe 380 pvddj.exe 4460 lrxffff.exe 3104 hbbhhn.exe 2664 hnhhhn.exe 756 nhttth.exe 2360 ddjvv.exe 4776 xrxfllr.exe 5076 3nhhbh.exe 588 7ntttt.exe 3980 lrrfffx.exe 1984 bntbnt.exe 3308 jjvvp.exe 4884 7frrxfl.exe 2268 thhbth.exe 4692 vdjdv.exe 3752 rfllfll.exe 3592 tbhbhh.exe 2808 pvdpp.exe 3520 rffxxrr.exe 3516 hbbbth.exe 868 tnhhnt.exe 3168 pdjdj.exe 4984 ttnhhh.exe 1820 tnhbbt.exe 3620 dvpdd.exe -
resource yara_rule behavioral2/memory/3184-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-502-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3184 wrote to memory of 3948 3184 74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe 83 PID 3184 wrote to memory of 3948 3184 74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe 83 PID 3184 wrote to memory of 3948 3184 74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe 83 PID 3948 wrote to memory of 2360 3948 dpvjd.exe 84 PID 3948 wrote to memory of 2360 3948 dpvjd.exe 84 PID 3948 wrote to memory of 2360 3948 dpvjd.exe 84 PID 2360 wrote to memory of 2684 2360 rfrlffr.exe 85 PID 2360 wrote to memory of 2684 2360 rfrlffr.exe 85 PID 2360 wrote to memory of 2684 2360 rfrlffr.exe 85 PID 2684 wrote to memory of 3648 2684 bnhhht.exe 89 PID 2684 wrote to memory of 3648 2684 bnhhht.exe 89 PID 2684 wrote to memory of 3648 2684 bnhhht.exe 89 PID 3648 wrote to memory of 2768 3648 vpvvd.exe 90 PID 3648 wrote to memory of 2768 3648 vpvvd.exe 90 PID 3648 wrote to memory of 2768 3648 vpvvd.exe 90 PID 2768 wrote to memory of 4224 2768 nhhtbb.exe 91 PID 2768 wrote to memory of 4224 2768 nhhtbb.exe 91 PID 2768 wrote to memory of 4224 2768 nhhtbb.exe 91 PID 4224 wrote to memory of 1596 4224 rlrrfrx.exe 92 PID 4224 wrote to memory of 1596 4224 rlrrfrx.exe 92 PID 4224 wrote to memory of 1596 4224 rlrrfrx.exe 92 PID 1596 wrote to memory of 224 1596 nbbhht.exe 93 PID 1596 wrote to memory of 224 1596 nbbhht.exe 93 PID 1596 wrote to memory of 224 1596 nbbhht.exe 93 PID 224 wrote to memory of 3152 224 rrrlrrf.exe 94 PID 224 wrote to memory of 3152 224 rrrlrrf.exe 94 PID 224 wrote to memory of 3152 224 rrrlrrf.exe 94 PID 3152 wrote to memory of 4576 3152 jvdjp.exe 95 PID 3152 wrote to memory of 4576 3152 jvdjp.exe 95 PID 3152 wrote to memory of 4576 3152 jvdjp.exe 95 PID 4576 wrote to memory of 3208 4576 1frrrrr.exe 96 PID 4576 wrote to memory of 3208 4576 1frrrrr.exe 96 PID 4576 wrote to memory of 3208 4576 1frrrrr.exe 96 PID 3208 wrote to memory of 4064 3208 pvvvp.exe 97 PID 3208 wrote to memory of 4064 3208 pvvvp.exe 97 PID 3208 wrote to memory of 4064 3208 pvvvp.exe 97 PID 4064 wrote to memory of 3180 4064 lrrxxxx.exe 98 PID 4064 wrote to memory of 3180 4064 lrrxxxx.exe 98 PID 4064 wrote to memory of 3180 4064 lrrxxxx.exe 98 PID 3180 wrote to memory of 4376 3180 rrxrfrx.exe 99 PID 3180 wrote to memory of 4376 3180 rrxrfrx.exe 99 PID 3180 wrote to memory of 4376 3180 rrxrfrx.exe 99 PID 4376 wrote to memory of 3408 4376 rlxxlfr.exe 100 PID 4376 wrote to memory of 3408 4376 rlxxlfr.exe 100 PID 4376 wrote to memory of 3408 4376 rlxxlfr.exe 100 PID 3408 wrote to memory of 1980 3408 thnhhh.exe 101 PID 3408 wrote to memory of 1980 3408 thnhhh.exe 101 PID 3408 wrote to memory of 1980 3408 thnhhh.exe 101 PID 1980 wrote to memory of 4000 1980 jpjdv.exe 102 PID 1980 wrote to memory of 4000 1980 jpjdv.exe 102 PID 1980 wrote to memory of 4000 1980 jpjdv.exe 102 PID 4000 wrote to memory of 1152 4000 thtttb.exe 103 PID 4000 wrote to memory of 1152 4000 thtttb.exe 103 PID 4000 wrote to memory of 1152 4000 thtttb.exe 103 PID 1152 wrote to memory of 440 1152 lfxllxf.exe 104 PID 1152 wrote to memory of 440 1152 lfxllxf.exe 104 PID 1152 wrote to memory of 440 1152 lfxllxf.exe 104 PID 440 wrote to memory of 4976 440 rrxxflx.exe 105 PID 440 wrote to memory of 4976 440 rrxxflx.exe 105 PID 440 wrote to memory of 4976 440 rrxxflx.exe 105 PID 4976 wrote to memory of 1608 4976 hnnhhn.exe 106 PID 4976 wrote to memory of 1608 4976 hnnhhn.exe 106 PID 4976 wrote to memory of 1608 4976 hnnhhn.exe 106 PID 1608 wrote to memory of 1008 1608 ppvvd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe"C:\Users\Admin\AppData\Local\Temp\74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\dpvjd.exec:\dpvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\rfrlffr.exec:\rfrlffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\bnhhht.exec:\bnhhht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vpvvd.exec:\vpvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\nhhtbb.exec:\nhhtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rlrrfrx.exec:\rlrrfrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\nbbhht.exec:\nbbhht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\rrrlrrf.exec:\rrrlrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\jvdjp.exec:\jvdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\1frrrrr.exec:\1frrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\pvvvp.exec:\pvvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\lrrxxxx.exec:\lrrxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\rrxrfrx.exec:\rrxrfrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\rlxxlfr.exec:\rlxxlfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\thnhhh.exec:\thnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\jpjdv.exec:\jpjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\thtttb.exec:\thtttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\lfxllxf.exec:\lfxllxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\rrxxflx.exec:\rrxxflx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\hnnhhn.exec:\hnnhhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\ppvvd.exec:\ppvvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\vvddp.exec:\vvddp.exe23⤵
- Executes dropped EXE
PID:1008 -
\??\c:\thntbh.exec:\thntbh.exe24⤵
- Executes dropped EXE
PID:4996 -
\??\c:\pvpvv.exec:\pvpvv.exe25⤵
- Executes dropped EXE
PID:4668 -
\??\c:\xllfrrx.exec:\xllfrrx.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pjjdj.exec:\pjjdj.exe27⤵
- Executes dropped EXE
PID:4824 -
\??\c:\ttbhhn.exec:\ttbhhn.exe28⤵
- Executes dropped EXE
PID:3632 -
\??\c:\xfxfrxx.exec:\xfxfrxx.exe29⤵
- Executes dropped EXE
PID:3892 -
\??\c:\bhbntb.exec:\bhbntb.exe30⤵
- Executes dropped EXE
PID:4596 -
\??\c:\jjpjd.exec:\jjpjd.exe31⤵
- Executes dropped EXE
PID:3020 -
\??\c:\llllfll.exec:\llllfll.exe32⤵
- Executes dropped EXE
PID:344 -
\??\c:\nthbnh.exec:\nthbnh.exe33⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rrlxflr.exec:\rrlxflr.exe34⤵
- Executes dropped EXE
PID:672 -
\??\c:\3tbnth.exec:\3tbnth.exe35⤵
- Executes dropped EXE
PID:4100 -
\??\c:\jdddp.exec:\jdddp.exe36⤵
- Executes dropped EXE
PID:1864 -
\??\c:\fxxrrfx.exec:\fxxrrfx.exe37⤵
- Executes dropped EXE
PID:4864 -
\??\c:\bhbhhb.exec:\bhbhhb.exe38⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jddvv.exec:\jddvv.exe39⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe40⤵
- Executes dropped EXE
PID:3100 -
\??\c:\pvddj.exec:\pvddj.exe41⤵
- Executes dropped EXE
PID:380 -
\??\c:\lrxffff.exec:\lrxffff.exe42⤵
- Executes dropped EXE
PID:4460 -
\??\c:\hbbhhn.exec:\hbbhhn.exe43⤵
- Executes dropped EXE
PID:3104 -
\??\c:\hnhhhn.exec:\hnhhhn.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nhttth.exec:\nhttth.exe45⤵
- Executes dropped EXE
PID:756 -
\??\c:\ddjvv.exec:\ddjvv.exe46⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xrxfllr.exec:\xrxfllr.exe47⤵
- Executes dropped EXE
PID:4776 -
\??\c:\3nhhbh.exec:\3nhhbh.exe48⤵
- Executes dropped EXE
PID:5076 -
\??\c:\7ntttt.exec:\7ntttt.exe49⤵
- Executes dropped EXE
PID:588 -
\??\c:\lrrfffx.exec:\lrrfffx.exe50⤵
- Executes dropped EXE
PID:3980 -
\??\c:\bntbnt.exec:\bntbnt.exe51⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jjvvp.exec:\jjvvp.exe52⤵
- Executes dropped EXE
PID:3308 -
\??\c:\7frrxfl.exec:\7frrxfl.exe53⤵
- Executes dropped EXE
PID:4884 -
\??\c:\thhbth.exec:\thhbth.exe54⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vdjdv.exec:\vdjdv.exe55⤵
- Executes dropped EXE
PID:4692 -
\??\c:\rfllfll.exec:\rfllfll.exe56⤵
- Executes dropped EXE
PID:3752 -
\??\c:\tbhbhh.exec:\tbhbhh.exe57⤵
- Executes dropped EXE
PID:3592 -
\??\c:\pvdpp.exec:\pvdpp.exe58⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rffxxrr.exec:\rffxxrr.exe59⤵
- Executes dropped EXE
PID:3520 -
\??\c:\hbbbth.exec:\hbbbth.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3516 -
\??\c:\tnhhnt.exec:\tnhhnt.exe61⤵
- Executes dropped EXE
PID:868 -
\??\c:\pdjdj.exec:\pdjdj.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3168 -
\??\c:\ttnhhh.exec:\ttnhhh.exe63⤵
- Executes dropped EXE
PID:4984 -
\??\c:\tnhbbt.exec:\tnhbbt.exe64⤵
- Executes dropped EXE
PID:1820 -
\??\c:\dvpdd.exec:\dvpdd.exe65⤵
- Executes dropped EXE
PID:3620 -
\??\c:\flrflrr.exec:\flrflrr.exe66⤵PID:4248
-
\??\c:\nhhhbh.exec:\nhhhbh.exe67⤵PID:760
-
\??\c:\jpddd.exec:\jpddd.exe68⤵PID:1752
-
\??\c:\xllllrx.exec:\xllllrx.exe69⤵PID:3436
-
\??\c:\xfxxrxr.exec:\xfxxrxr.exe70⤵PID:1408
-
\??\c:\ttbnht.exec:\ttbnht.exe71⤵PID:3012
-
\??\c:\pvjpj.exec:\pvjpj.exe72⤵PID:4976
-
\??\c:\lxffxrl.exec:\lxffxrl.exe73⤵PID:432
-
\??\c:\ntnhbb.exec:\ntnhbb.exe74⤵PID:2888
-
\??\c:\nhhnnt.exec:\nhhnnt.exe75⤵PID:4612
-
\??\c:\jjvpd.exec:\jjvpd.exe76⤵PID:4216
-
\??\c:\ffxflff.exec:\ffxflff.exe77⤵PID:1880
-
\??\c:\nbhnnb.exec:\nbhnnb.exe78⤵PID:1440
-
\??\c:\dvdjj.exec:\dvdjj.exe79⤵PID:2872
-
\??\c:\lrxffll.exec:\lrxffll.exe80⤵PID:3916
-
\??\c:\xxfrxrf.exec:\xxfrxrf.exe81⤵PID:656
-
\??\c:\ththhb.exec:\ththhb.exe82⤵PID:4972
-
\??\c:\vvdpd.exec:\vvdpd.exe83⤵PID:4596
-
\??\c:\xfffxff.exec:\xfffxff.exe84⤵PID:4848
-
\??\c:\hnhbtt.exec:\hnhbtt.exe85⤵PID:4580
-
\??\c:\ppvvd.exec:\ppvvd.exe86⤵PID:2084
-
\??\c:\frfflrx.exec:\frfflrx.exe87⤵PID:4420
-
\??\c:\flfrlfl.exec:\flfrlfl.exe88⤵PID:3552
-
\??\c:\thbbtn.exec:\thbbtn.exe89⤵PID:4380
-
\??\c:\jvjjp.exec:\jvjjp.exe90⤵PID:3100
-
\??\c:\5llrxxx.exec:\5llrxxx.exe91⤵PID:380
-
\??\c:\bntnhh.exec:\bntnhh.exe92⤵PID:4304
-
\??\c:\jdddd.exec:\jdddd.exe93⤵PID:2248
-
\??\c:\rrfflff.exec:\rrfflff.exe94⤵PID:4888
-
\??\c:\bhnhnt.exec:\bhnhnt.exe95⤵PID:3288
-
\??\c:\xlfrrlf.exec:\xlfrrlf.exe96⤵PID:4968
-
\??\c:\ntnthb.exec:\ntnthb.exe97⤵PID:4520
-
\??\c:\1ffxxxr.exec:\1ffxxxr.exe98⤵PID:3360
-
\??\c:\rrllxll.exec:\rrllxll.exe99⤵PID:4168
-
\??\c:\pjdvd.exec:\pjdvd.exe100⤵PID:3356
-
\??\c:\ntbttt.exec:\ntbttt.exe101⤵PID:1532
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe102⤵PID:4148
-
\??\c:\btbhhh.exec:\btbhhh.exe103⤵PID:400
-
\??\c:\ddvpp.exec:\ddvpp.exe104⤵PID:1664
-
\??\c:\llrllrr.exec:\llrllrr.exe105⤵PID:2764
-
\??\c:\bnhhtb.exec:\bnhhtb.exe106⤵PID:5040
-
\??\c:\vppjd.exec:\vppjd.exe107⤵PID:776
-
\??\c:\rxllffr.exec:\rxllffr.exe108⤵PID:3048
-
\??\c:\bhbhbb.exec:\bhbhbb.exe109⤵PID:3520
-
\??\c:\ddvpj.exec:\ddvpj.exe110⤵PID:3516
-
\??\c:\rrllfxl.exec:\rrllfxl.exe111⤵PID:1892
-
\??\c:\bhtnbn.exec:\bhtnbn.exe112⤵PID:4256
-
\??\c:\pddpp.exec:\pddpp.exe113⤵PID:4124
-
\??\c:\rffflxx.exec:\rffflxx.exe114⤵PID:1820
-
\??\c:\nnnhtt.exec:\nnnhtt.exe115⤵PID:2972
-
\??\c:\1rlfrff.exec:\1rlfrff.exe116⤵PID:2908
-
\??\c:\fxrlfrl.exec:\fxrlfrl.exe117⤵PID:2208
-
\??\c:\jpdjj.exec:\jpdjj.exe118⤵PID:3376
-
\??\c:\llrxxfl.exec:\llrxxfl.exe119⤵PID:4632
-
\??\c:\ttbnnn.exec:\ttbnnn.exe120⤵
- System Location Discovery: System Language Discovery
PID:1720 -
\??\c:\ddvpp.exec:\ddvpp.exe121⤵PID:1292
-
\??\c:\xrlxrfx.exec:\xrlxrfx.exe122⤵PID:3644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-