Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 12:06
Behavioral task
behavioral1
Sample
f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe
Resource
win7-20240903-en
General
-
Target
f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe
-
Size
279KB
-
MD5
a6338d44d67e6aebf0ee9238d763e373
-
SHA1
61c94865eb4b69743729dd09f3f0c7b98e49cf42
-
SHA256
f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b
-
SHA512
93fa35a0db5440b5e08bfc1b82afe76090372412ae5c4a051a333934ae79655fee36a6a386401dfac89be3b5effc2c2f2c3495024427285e31518309280563cc
-
SSDEEP
6144:ncm4FmowdHoS6rW3NNTvBu6wo2J4JAgNXkArR/rtXOLtu4J6KvvLp3OKtUuuuTEO:14wFHoSeM/Tpu6w14JAOkIRhOBu4JhvB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1236-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/692-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-426-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-470-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-492-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-496-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-506-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-519-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-592-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-650-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-664-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-757-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-806-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-840-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-874-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-1164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3pjjd.exebtbbhh.exerlfxrrr.exejjpdd.exe5ntbtt.exevvddv.exedjvpp.exedpvvp.exepvjdd.exebbnnhh.exe7rflxrx.exebnnnbt.exexfflrxr.exe1ntnbh.exedvddp.exelxfllfl.exe1pdvv.exeflrrrrr.exepjjjj.exe5lxrlrl.exedppjd.exehnntbh.exevppvv.exellrlrxx.exedvjdd.exexllflfr.exerxrrrrr.exehhntnn.exentnhbb.exehntttb.exejpddp.exevvvdj.exeffxxxll.exedvdpp.exellxlxrf.exe5nhhhh.exetbbbtt.exevvvpv.exebntbtb.exetttbbt.exe9ddjj.exeffrfxfl.exedpvvd.exelllrxff.exe3ttnnh.exebnbbtb.exejvdpd.exe1rxfflr.exethtttb.exedvvvj.exelrlffxf.exehntnth.exejjdpp.exedvvdv.exe3llrxxx.exetthhnn.exejppvv.exerlfffll.exenhhhtn.exepddjj.exefrfllrx.exehtbbhb.exejdjdd.exerfxlfrx.exepid process 1868 3pjjd.exe 1108 btbbhh.exe 2532 rlfxrrr.exe 448 jjpdd.exe 3684 5ntbtt.exe 3428 vvddv.exe 4736 djvpp.exe 4716 dpvvp.exe 532 pvjdd.exe 3760 bbnnhh.exe 2120 7rflxrx.exe 4480 bnnnbt.exe 3244 xfflrxr.exe 4684 1ntnbh.exe 5108 dvddp.exe 4772 lxfllfl.exe 692 1pdvv.exe 2052 flrrrrr.exe 2320 pjjjj.exe 2456 5lxrlrl.exe 3448 dppjd.exe 3612 hnntbh.exe 3640 vppvv.exe 548 llrlrxx.exe 2220 dvjdd.exe 2224 xllflfr.exe 3568 rxrrrrr.exe 1984 hhntnn.exe 4364 ntnhbb.exe 1760 hntttb.exe 2620 jpddp.exe 2528 vvvdj.exe 4748 ffxxxll.exe 888 dvdpp.exe 2724 llxlxrf.exe 1944 5nhhhh.exe 4916 tbbbtt.exe 1928 vvvpv.exe 4352 bntbtb.exe 1028 tttbbt.exe 3396 9ddjj.exe 4440 ffrfxfl.exe 1664 dpvvd.exe 1856 lllrxff.exe 5100 3ttnnh.exe 3516 bnbbtb.exe 376 jvdpd.exe 952 1rxfflr.exe 3428 thtttb.exe 2100 dvvvj.exe 1136 lrlffxf.exe 4716 hntnth.exe 4300 jjdpp.exe 4108 dvvdv.exe 4800 3llrxxx.exe 4444 tthhnn.exe 4756 jppvv.exe 4220 rlfffll.exe 3244 nhhhtn.exe 368 pddjj.exe 1544 frfllrx.exe 4768 htbbhb.exe 2384 jdjdd.exe 1316 rfxlfrx.exe -
Processes:
resource yara_rule behavioral2/memory/1236-0-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\3pjjd.exe upx behavioral2/memory/1236-5-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\btbbhh.exe upx behavioral2/memory/1868-11-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\rlfxrrr.exe upx behavioral2/memory/1108-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-19-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\jjpdd.exe upx behavioral2/memory/448-29-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\5ntbtt.exe upx C:\vvddv.exe upx behavioral2/memory/3684-35-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\djvpp.exe upx behavioral2/memory/3428-41-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\dpvvp.exe upx behavioral2/memory/4716-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-48-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\pvjdd.exe upx behavioral2/memory/4716-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-59-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\bbnnhh.exe upx C:\7rflxrx.exe upx C:\bnnnbt.exe upx behavioral2/memory/2120-71-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\xfflrxr.exe upx behavioral2/memory/4480-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-82-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\dvddp.exe upx \??\c:\1ntnbh.exe upx behavioral2/memory/4684-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/692-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-109-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\flrrrrr.exe upx \??\c:\1pdvv.exe upx behavioral2/memory/5108-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-98-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\lxfllfl.exe upx C:\pjjjj.exe upx \??\c:\5lxrlrl.exe upx behavioral2/memory/2320-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-125-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\dppjd.exe upx C:\hnntbh.exe upx behavioral2/memory/3448-132-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\vppvv.exe upx behavioral2/memory/3612-138-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\llrlrxx.exe upx behavioral2/memory/3640-144-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\dvjdd.exe upx C:\xllflfr.exe upx behavioral2/memory/2220-153-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\rxrrrrr.exe upx behavioral2/memory/3568-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-159-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\hhntnn.exe upx behavioral2/memory/1984-172-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\ntnhbb.exe upx C:\hntttb.exe upx C:\jpddp.exe upx behavioral2/memory/1760-182-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\vvvdj.exe upx behavioral2/memory/4748-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
tbhbtb.exevjjjv.exe9jvvp.exefllllrx.exe7lflllr.exedjddd.exeppppd.exe9bhntn.exelxllrrf.exepdjjd.exepvjvj.exebhhhtb.exerrfrrll.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrrll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe3pjjd.exebtbbhh.exerlfxrrr.exejjpdd.exe5ntbtt.exevvddv.exedjvpp.exedpvvp.exepvjdd.exebbnnhh.exe7rflxrx.exebnnnbt.exexfflrxr.exe1ntnbh.exedvddp.exelxfllfl.exe1pdvv.exeflrrrrr.exepjjjj.exe5lxrlrl.exedppjd.exedescription pid process target process PID 1236 wrote to memory of 1868 1236 f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe 3pjjd.exe PID 1236 wrote to memory of 1868 1236 f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe 3pjjd.exe PID 1236 wrote to memory of 1868 1236 f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe 3pjjd.exe PID 1868 wrote to memory of 1108 1868 3pjjd.exe btbbhh.exe PID 1868 wrote to memory of 1108 1868 3pjjd.exe btbbhh.exe PID 1868 wrote to memory of 1108 1868 3pjjd.exe btbbhh.exe PID 1108 wrote to memory of 2532 1108 btbbhh.exe rlfxrrr.exe PID 1108 wrote to memory of 2532 1108 btbbhh.exe rlfxrrr.exe PID 1108 wrote to memory of 2532 1108 btbbhh.exe rlfxrrr.exe PID 2532 wrote to memory of 448 2532 rlfxrrr.exe jjpdd.exe PID 2532 wrote to memory of 448 2532 rlfxrrr.exe jjpdd.exe PID 2532 wrote to memory of 448 2532 rlfxrrr.exe jjpdd.exe PID 448 wrote to memory of 3684 448 jjpdd.exe 5ntbtt.exe PID 448 wrote to memory of 3684 448 jjpdd.exe 5ntbtt.exe PID 448 wrote to memory of 3684 448 jjpdd.exe 5ntbtt.exe PID 3684 wrote to memory of 3428 3684 5ntbtt.exe vvddv.exe PID 3684 wrote to memory of 3428 3684 5ntbtt.exe vvddv.exe PID 3684 wrote to memory of 3428 3684 5ntbtt.exe vvddv.exe PID 3428 wrote to memory of 4736 3428 vvddv.exe djvpp.exe PID 3428 wrote to memory of 4736 3428 vvddv.exe djvpp.exe PID 3428 wrote to memory of 4736 3428 vvddv.exe djvpp.exe PID 4736 wrote to memory of 4716 4736 djvpp.exe dpvvp.exe PID 4736 wrote to memory of 4716 4736 djvpp.exe dpvvp.exe PID 4736 wrote to memory of 4716 4736 djvpp.exe dpvvp.exe PID 4716 wrote to memory of 532 4716 dpvvp.exe pvjdd.exe PID 4716 wrote to memory of 532 4716 dpvvp.exe pvjdd.exe PID 4716 wrote to memory of 532 4716 dpvvp.exe pvjdd.exe PID 532 wrote to memory of 3760 532 pvjdd.exe bbnnhh.exe PID 532 wrote to memory of 3760 532 pvjdd.exe bbnnhh.exe PID 532 wrote to memory of 3760 532 pvjdd.exe bbnnhh.exe PID 3760 wrote to memory of 2120 3760 bbnnhh.exe 7rflxrx.exe PID 3760 wrote to memory of 2120 3760 bbnnhh.exe 7rflxrx.exe PID 3760 wrote to memory of 2120 3760 bbnnhh.exe 7rflxrx.exe PID 2120 wrote to memory of 4480 2120 7rflxrx.exe bnnnbt.exe PID 2120 wrote to memory of 4480 2120 7rflxrx.exe bnnnbt.exe PID 2120 wrote to memory of 4480 2120 7rflxrx.exe bnnnbt.exe PID 4480 wrote to memory of 3244 4480 bnnnbt.exe xfflrxr.exe PID 4480 wrote to memory of 3244 4480 bnnnbt.exe xfflrxr.exe PID 4480 wrote to memory of 3244 4480 bnnnbt.exe xfflrxr.exe PID 3244 wrote to memory of 4684 3244 xfflrxr.exe 1ntnbh.exe PID 3244 wrote to memory of 4684 3244 xfflrxr.exe 1ntnbh.exe PID 3244 wrote to memory of 4684 3244 xfflrxr.exe 1ntnbh.exe PID 4684 wrote to memory of 5108 4684 1ntnbh.exe dvddp.exe PID 4684 wrote to memory of 5108 4684 1ntnbh.exe dvddp.exe PID 4684 wrote to memory of 5108 4684 1ntnbh.exe dvddp.exe PID 5108 wrote to memory of 4772 5108 dvddp.exe lxfllfl.exe PID 5108 wrote to memory of 4772 5108 dvddp.exe lxfllfl.exe PID 5108 wrote to memory of 4772 5108 dvddp.exe lxfllfl.exe PID 4772 wrote to memory of 692 4772 lxfllfl.exe 1pdvv.exe PID 4772 wrote to memory of 692 4772 lxfllfl.exe 1pdvv.exe PID 4772 wrote to memory of 692 4772 lxfllfl.exe 1pdvv.exe PID 692 wrote to memory of 2052 692 1pdvv.exe flrrrrr.exe PID 692 wrote to memory of 2052 692 1pdvv.exe flrrrrr.exe PID 692 wrote to memory of 2052 692 1pdvv.exe flrrrrr.exe PID 2052 wrote to memory of 2320 2052 flrrrrr.exe pjjjj.exe PID 2052 wrote to memory of 2320 2052 flrrrrr.exe pjjjj.exe PID 2052 wrote to memory of 2320 2052 flrrrrr.exe pjjjj.exe PID 2320 wrote to memory of 2456 2320 pjjjj.exe 5lxrlrl.exe PID 2320 wrote to memory of 2456 2320 pjjjj.exe 5lxrlrl.exe PID 2320 wrote to memory of 2456 2320 pjjjj.exe 5lxrlrl.exe PID 2456 wrote to memory of 3448 2456 5lxrlrl.exe dppjd.exe PID 2456 wrote to memory of 3448 2456 5lxrlrl.exe dppjd.exe PID 2456 wrote to memory of 3448 2456 5lxrlrl.exe dppjd.exe PID 3448 wrote to memory of 3612 3448 dppjd.exe hnntbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe"C:\Users\Admin\AppData\Local\Temp\f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\3pjjd.exec:\3pjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\btbbhh.exec:\btbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jjpdd.exec:\jjpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\5ntbtt.exec:\5ntbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\vvddv.exec:\vvddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\djvpp.exec:\djvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\dpvvp.exec:\dpvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\pvjdd.exec:\pvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\bbnnhh.exec:\bbnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\7rflxrx.exec:\7rflxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\bnnnbt.exec:\bnnnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\xfflrxr.exec:\xfflrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\1ntnbh.exec:\1ntnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\dvddp.exec:\dvddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\lxfllfl.exec:\lxfllfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\1pdvv.exec:\1pdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\flrrrrr.exec:\flrrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\pjjjj.exec:\pjjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\5lxrlrl.exec:\5lxrlrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\dppjd.exec:\dppjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\hnntbh.exec:\hnntbh.exe23⤵
- Executes dropped EXE
PID:3612 -
\??\c:\vppvv.exec:\vppvv.exe24⤵
- Executes dropped EXE
PID:3640 -
\??\c:\llrlrxx.exec:\llrlrxx.exe25⤵
- Executes dropped EXE
PID:548 -
\??\c:\dvjdd.exec:\dvjdd.exe26⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xllflfr.exec:\xllflfr.exe27⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rxrrrrr.exec:\rxrrrrr.exe28⤵
- Executes dropped EXE
PID:3568 -
\??\c:\hhntnn.exec:\hhntnn.exe29⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ntnhbb.exec:\ntnhbb.exe30⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hntttb.exec:\hntttb.exe31⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jpddp.exec:\jpddp.exe32⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vvvdj.exec:\vvvdj.exe33⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ffxxxll.exec:\ffxxxll.exe34⤵
- Executes dropped EXE
PID:4748 -
\??\c:\dvdpp.exec:\dvdpp.exe35⤵
- Executes dropped EXE
PID:888 -
\??\c:\llxlxrf.exec:\llxlxrf.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5nhhhh.exec:\5nhhhh.exe37⤵
- Executes dropped EXE
PID:1944 -
\??\c:\tbbbtt.exec:\tbbbtt.exe38⤵
- Executes dropped EXE
PID:4916 -
\??\c:\vvvpv.exec:\vvvpv.exe39⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bntbtb.exec:\bntbtb.exe40⤵
- Executes dropped EXE
PID:4352 -
\??\c:\tttbbt.exec:\tttbbt.exe41⤵
- Executes dropped EXE
PID:1028 -
\??\c:\9ddjj.exec:\9ddjj.exe42⤵
- Executes dropped EXE
PID:3396 -
\??\c:\ffrfxfl.exec:\ffrfxfl.exe43⤵
- Executes dropped EXE
PID:4440 -
\??\c:\dpvvd.exec:\dpvvd.exe44⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lllrxff.exec:\lllrxff.exe45⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3ttnnh.exec:\3ttnnh.exe46⤵
- Executes dropped EXE
PID:5100 -
\??\c:\bnbbtb.exec:\bnbbtb.exe47⤵
- Executes dropped EXE
PID:3516 -
\??\c:\jvdpd.exec:\jvdpd.exe48⤵
- Executes dropped EXE
PID:376 -
\??\c:\1rxfflr.exec:\1rxfflr.exe49⤵
- Executes dropped EXE
PID:952 -
\??\c:\thtttb.exec:\thtttb.exe50⤵
- Executes dropped EXE
PID:3428 -
\??\c:\dvvvj.exec:\dvvvj.exe51⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lrlffxf.exec:\lrlffxf.exe52⤵
- Executes dropped EXE
PID:1136 -
\??\c:\hntnth.exec:\hntnth.exe53⤵
- Executes dropped EXE
PID:4716 -
\??\c:\jjdpp.exec:\jjdpp.exe54⤵
- Executes dropped EXE
PID:4300 -
\??\c:\dvvdv.exec:\dvvdv.exe55⤵
- Executes dropped EXE
PID:4108 -
\??\c:\3llrxxx.exec:\3llrxxx.exe56⤵
- Executes dropped EXE
PID:4800 -
\??\c:\tthhnn.exec:\tthhnn.exe57⤵
- Executes dropped EXE
PID:4444 -
\??\c:\jppvv.exec:\jppvv.exe58⤵
- Executes dropped EXE
PID:4756 -
\??\c:\rlfffll.exec:\rlfffll.exe59⤵
- Executes dropped EXE
PID:4220 -
\??\c:\nhhhtn.exec:\nhhhtn.exe60⤵
- Executes dropped EXE
PID:3244 -
\??\c:\pddjj.exec:\pddjj.exe61⤵
- Executes dropped EXE
PID:368 -
\??\c:\frfllrx.exec:\frfllrx.exe62⤵
- Executes dropped EXE
PID:1544 -
\??\c:\htbbhb.exec:\htbbhb.exe63⤵
- Executes dropped EXE
PID:4768 -
\??\c:\jdjdd.exec:\jdjdd.exe64⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rfxlfrx.exec:\rfxlfrx.exe65⤵
- Executes dropped EXE
PID:1316 -
\??\c:\htnbbn.exec:\htnbbn.exe66⤵PID:2780
-
\??\c:\vdddd.exec:\vdddd.exe67⤵PID:3324
-
\??\c:\lrxrlrf.exec:\lrxrlrf.exe68⤵PID:1004
-
\??\c:\bhhhtb.exec:\bhhhtb.exe69⤵
- System Location Discovery: System Language Discovery
PID:3576 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe70⤵PID:2988
-
\??\c:\tbhhnt.exec:\tbhhnt.exe71⤵PID:3476
-
\??\c:\vdppd.exec:\vdppd.exe72⤵PID:1420
-
\??\c:\hnhtbn.exec:\hnhtbn.exe73⤵PID:3532
-
\??\c:\djppp.exec:\djppp.exe74⤵PID:3692
-
\??\c:\9rxfflr.exec:\9rxfflr.exe75⤵PID:3868
-
\??\c:\tbhnnb.exec:\tbhnnb.exe76⤵PID:2740
-
\??\c:\djvjv.exec:\djvjv.exe77⤵PID:2224
-
\??\c:\rrllxlx.exec:\rrllxlx.exe78⤵PID:3704
-
\??\c:\nntttb.exec:\nntttb.exe79⤵PID:1268
-
\??\c:\bnbbbh.exec:\bnbbbh.exe80⤵PID:3960
-
\??\c:\pvjvj.exec:\pvjvj.exe81⤵
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\lllrrrl.exec:\lllrrrl.exe82⤵PID:2676
-
\??\c:\hnntbh.exec:\hnntbh.exe83⤵PID:1124
-
\??\c:\ppvdp.exec:\ppvdp.exe84⤵PID:1804
-
\??\c:\dpvdj.exec:\dpvdj.exe85⤵PID:3616
-
\??\c:\xrxrxfl.exec:\xrxrxfl.exe86⤵PID:3964
-
\??\c:\hnnhnt.exec:\hnnhnt.exe87⤵PID:1484
-
\??\c:\7hnnnt.exec:\7hnnnt.exe88⤵PID:4352
-
\??\c:\jdppd.exec:\jdppd.exe89⤵PID:3696
-
\??\c:\dvjpp.exec:\dvjpp.exe90⤵PID:2556
-
\??\c:\xfxffll.exec:\xfxffll.exe91⤵PID:2652
-
\??\c:\htbnbh.exec:\htbnbh.exe92⤵PID:3128
-
\??\c:\djpjp.exec:\djpjp.exe93⤵PID:4280
-
\??\c:\ppvvp.exec:\ppvvp.exe94⤵PID:936
-
\??\c:\lfxrlxx.exec:\lfxrlxx.exe95⤵PID:4956
-
\??\c:\nbnthb.exec:\nbnthb.exe96⤵PID:392
-
\??\c:\dpjjv.exec:\dpjjv.exe97⤵PID:836
-
\??\c:\lxxfxlx.exec:\lxxfxlx.exe98⤵PID:1136
-
\??\c:\ttthnn.exec:\ttthnn.exe99⤵PID:3920
-
\??\c:\pdjjd.exec:\pdjjd.exe100⤵
- System Location Discovery: System Language Discovery
PID:4328 -
\??\c:\rfrlfff.exec:\rfrlfff.exe101⤵PID:1540
-
\??\c:\nnthbt.exec:\nnthbt.exe102⤵PID:2120
-
\??\c:\vdvpj.exec:\vdvpj.exe103⤵PID:4904
-
\??\c:\llxrrrr.exec:\llxrrrr.exe104⤵PID:4444
-
\??\c:\rrfrrll.exec:\rrfrrll.exe105⤵
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\1hnttb.exec:\1hnttb.exe106⤵PID:3408
-
\??\c:\jvjjp.exec:\jvjjp.exe107⤵PID:1636
-
\??\c:\ffxfffr.exec:\ffxfffr.exe108⤵PID:1456
-
\??\c:\3vvvj.exec:\3vvvj.exe109⤵PID:3916
-
\??\c:\bnnnnh.exec:\bnnnnh.exe110⤵PID:5108
-
\??\c:\llrrlll.exec:\llrrlll.exe111⤵PID:5104
-
\??\c:\nnhntb.exec:\nnhntb.exe112⤵PID:2720
-
\??\c:\dpjjv.exec:\dpjjv.exe113⤵PID:4720
-
\??\c:\rxxxllr.exec:\rxxxllr.exe114⤵PID:692
-
\??\c:\lrxrffl.exec:\lrxrffl.exe115⤵PID:2052
-
\??\c:\bbhhhh.exec:\bbhhhh.exe116⤵PID:2900
-
\??\c:\1ddvv.exec:\1ddvv.exe117⤵PID:2172
-
\??\c:\3rxxxff.exec:\3rxxxff.exe118⤵PID:2180
-
\??\c:\tbnhbh.exec:\tbnhbh.exe119⤵PID:3316
-
\??\c:\9nbtnb.exec:\9nbtnb.exe120⤵PID:1296
-
\??\c:\vdpvp.exec:\vdpvp.exe121⤵PID:4960
-
\??\c:\lrrrrxx.exec:\lrrrrxx.exe122⤵PID:1416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-