Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 12:06
Behavioral task
behavioral1
Sample
f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe
-
Size
279KB
-
MD5
a6338d44d67e6aebf0ee9238d763e373
-
SHA1
61c94865eb4b69743729dd09f3f0c7b98e49cf42
-
SHA256
f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b
-
SHA512
93fa35a0db5440b5e08bfc1b82afe76090372412ae5c4a051a333934ae79655fee36a6a386401dfac89be3b5effc2c2f2c3495024427285e31518309280563cc
-
SSDEEP
6144:ncm4FmowdHoS6rW3NNTvBu6wo2J4JAgNXkArR/rtXOLtu4J6KvvLp3OKtUuuuTEO:14wFHoSeM/Tpu6w14JAOkIRhOBu4JhvB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1236-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/692-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-426-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-470-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-492-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-496-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-506-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-519-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-592-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-650-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-664-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-757-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-806-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-840-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-874-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-1164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1868 3pjjd.exe 1108 btbbhh.exe 2532 rlfxrrr.exe 448 jjpdd.exe 3684 5ntbtt.exe 3428 vvddv.exe 4736 djvpp.exe 4716 dpvvp.exe 532 pvjdd.exe 3760 bbnnhh.exe 2120 7rflxrx.exe 4480 bnnnbt.exe 3244 xfflrxr.exe 4684 1ntnbh.exe 5108 dvddp.exe 4772 lxfllfl.exe 692 1pdvv.exe 2052 flrrrrr.exe 2320 pjjjj.exe 2456 5lxrlrl.exe 3448 dppjd.exe 3612 hnntbh.exe 3640 vppvv.exe 548 llrlrxx.exe 2220 dvjdd.exe 2224 xllflfr.exe 3568 rxrrrrr.exe 1984 hhntnn.exe 4364 ntnhbb.exe 1760 hntttb.exe 2620 jpddp.exe 2528 vvvdj.exe 4748 ffxxxll.exe 888 dvdpp.exe 2724 llxlxrf.exe 1944 5nhhhh.exe 4916 tbbbtt.exe 1928 vvvpv.exe 4352 bntbtb.exe 1028 tttbbt.exe 3396 9ddjj.exe 4440 ffrfxfl.exe 1664 dpvvd.exe 1856 lllrxff.exe 5100 3ttnnh.exe 3516 bnbbtb.exe 376 jvdpd.exe 952 1rxfflr.exe 3428 thtttb.exe 2100 dvvvj.exe 1136 lrlffxf.exe 4716 hntnth.exe 4300 jjdpp.exe 4108 dvvdv.exe 4800 3llrxxx.exe 4444 tthhnn.exe 4756 jppvv.exe 4220 rlfffll.exe 3244 nhhhtn.exe 368 pddjj.exe 1544 frfllrx.exe 4768 htbbhb.exe 2384 jdjdd.exe 1316 rfxlfrx.exe -
resource yara_rule behavioral2/memory/1236-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000e000000023b88-3.dat upx behavioral2/memory/1236-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000b000000023b91-9.dat upx behavioral2/memory/1868-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023b95-13.dat upx behavioral2/memory/1108-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023b96-22.dat upx behavioral2/memory/448-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023b97-27.dat upx behavioral2/files/0x000a000000023b99-33.dat upx behavioral2/memory/3684-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023b9a-39.dat upx behavioral2/memory/3428-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023b9b-46.dat upx behavioral2/memory/4716-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023b9c-52.dat upx behavioral2/memory/4716-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023b9d-60.dat upx behavioral2/files/0x000a000000023b9e-65.dat upx behavioral2/files/0x000a000000023b9f-69.dat upx behavioral2/memory/2120-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000b000000023b92-76.dat upx behavioral2/memory/4480-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023ba2-88.dat upx behavioral2/files/0x000a000000023ba1-84.dat upx behavioral2/memory/4684-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/692-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023ba5-108.dat upx behavioral2/files/0x0031000000023ba4-102.dat upx behavioral2/memory/5108-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023ba3-95.dat upx behavioral2/files/0x0058000000023ba6-113.dat upx behavioral2/files/0x000a000000023ba7-119.dat upx behavioral2/memory/2320-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023ba8-126.dat upx behavioral2/files/0x000a000000023ba9-130.dat upx behavioral2/memory/3448-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023baa-136.dat upx behavioral2/memory/3612-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023bab-142.dat upx behavioral2/memory/3640-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023bac-149.dat upx behavioral2/files/0x000a000000023bad-154.dat upx behavioral2/memory/2220-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023bae-158.dat upx behavioral2/memory/3568-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023baf-165.dat upx behavioral2/memory/1984-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023bb0-170.dat upx behavioral2/files/0x000a000000023bb1-176.dat upx behavioral2/files/0x000a000000023bb2-180.dat upx behavioral2/memory/1760-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000a000000023bb3-188.dat upx behavioral2/memory/4748-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrrll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 1868 1236 f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe 83 PID 1236 wrote to memory of 1868 1236 f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe 83 PID 1236 wrote to memory of 1868 1236 f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe 83 PID 1868 wrote to memory of 1108 1868 3pjjd.exe 84 PID 1868 wrote to memory of 1108 1868 3pjjd.exe 84 PID 1868 wrote to memory of 1108 1868 3pjjd.exe 84 PID 1108 wrote to memory of 2532 1108 btbbhh.exe 85 PID 1108 wrote to memory of 2532 1108 btbbhh.exe 85 PID 1108 wrote to memory of 2532 1108 btbbhh.exe 85 PID 2532 wrote to memory of 448 2532 rlfxrrr.exe 86 PID 2532 wrote to memory of 448 2532 rlfxrrr.exe 86 PID 2532 wrote to memory of 448 2532 rlfxrrr.exe 86 PID 448 wrote to memory of 3684 448 jjpdd.exe 87 PID 448 wrote to memory of 3684 448 jjpdd.exe 87 PID 448 wrote to memory of 3684 448 jjpdd.exe 87 PID 3684 wrote to memory of 3428 3684 5ntbtt.exe 88 PID 3684 wrote to memory of 3428 3684 5ntbtt.exe 88 PID 3684 wrote to memory of 3428 3684 5ntbtt.exe 88 PID 3428 wrote to memory of 4736 3428 vvddv.exe 89 PID 3428 wrote to memory of 4736 3428 vvddv.exe 89 PID 3428 wrote to memory of 4736 3428 vvddv.exe 89 PID 4736 wrote to memory of 4716 4736 djvpp.exe 90 PID 4736 wrote to memory of 4716 4736 djvpp.exe 90 PID 4736 wrote to memory of 4716 4736 djvpp.exe 90 PID 4716 wrote to memory of 532 4716 dpvvp.exe 91 PID 4716 wrote to memory of 532 4716 dpvvp.exe 91 PID 4716 wrote to memory of 532 4716 dpvvp.exe 91 PID 532 wrote to memory of 3760 532 pvjdd.exe 92 PID 532 wrote to memory of 3760 532 pvjdd.exe 92 PID 532 wrote to memory of 3760 532 pvjdd.exe 92 PID 3760 wrote to memory of 2120 3760 bbnnhh.exe 93 PID 3760 wrote to memory of 2120 3760 bbnnhh.exe 93 PID 3760 wrote to memory of 2120 3760 bbnnhh.exe 93 PID 2120 wrote to memory of 4480 2120 7rflxrx.exe 94 PID 2120 wrote to memory of 4480 2120 7rflxrx.exe 94 PID 2120 wrote to memory of 4480 2120 7rflxrx.exe 94 PID 4480 wrote to memory of 3244 4480 bnnnbt.exe 95 PID 4480 wrote to memory of 3244 4480 bnnnbt.exe 95 PID 4480 wrote to memory of 3244 4480 bnnnbt.exe 95 PID 3244 wrote to memory of 4684 3244 xfflrxr.exe 96 PID 3244 wrote to memory of 4684 3244 xfflrxr.exe 96 PID 3244 wrote to memory of 4684 3244 xfflrxr.exe 96 PID 4684 wrote to memory of 5108 4684 1ntnbh.exe 97 PID 4684 wrote to memory of 5108 4684 1ntnbh.exe 97 PID 4684 wrote to memory of 5108 4684 1ntnbh.exe 97 PID 5108 wrote to memory of 4772 5108 dvddp.exe 98 PID 5108 wrote to memory of 4772 5108 dvddp.exe 98 PID 5108 wrote to memory of 4772 5108 dvddp.exe 98 PID 4772 wrote to memory of 692 4772 lxfllfl.exe 99 PID 4772 wrote to memory of 692 4772 lxfllfl.exe 99 PID 4772 wrote to memory of 692 4772 lxfllfl.exe 99 PID 692 wrote to memory of 2052 692 1pdvv.exe 100 PID 692 wrote to memory of 2052 692 1pdvv.exe 100 PID 692 wrote to memory of 2052 692 1pdvv.exe 100 PID 2052 wrote to memory of 2320 2052 flrrrrr.exe 101 PID 2052 wrote to memory of 2320 2052 flrrrrr.exe 101 PID 2052 wrote to memory of 2320 2052 flrrrrr.exe 101 PID 2320 wrote to memory of 2456 2320 pjjjj.exe 102 PID 2320 wrote to memory of 2456 2320 pjjjj.exe 102 PID 2320 wrote to memory of 2456 2320 pjjjj.exe 102 PID 2456 wrote to memory of 3448 2456 5lxrlrl.exe 103 PID 2456 wrote to memory of 3448 2456 5lxrlrl.exe 103 PID 2456 wrote to memory of 3448 2456 5lxrlrl.exe 103 PID 3448 wrote to memory of 3612 3448 dppjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe"C:\Users\Admin\AppData\Local\Temp\f3f46d5d76f5ab03b21f514c90b7de29941cc0c245b2afff940b092363b3ec6b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\3pjjd.exec:\3pjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\btbbhh.exec:\btbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jjpdd.exec:\jjpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\5ntbtt.exec:\5ntbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\vvddv.exec:\vvddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\djvpp.exec:\djvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\dpvvp.exec:\dpvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\pvjdd.exec:\pvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\bbnnhh.exec:\bbnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\7rflxrx.exec:\7rflxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\bnnnbt.exec:\bnnnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\xfflrxr.exec:\xfflrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\1ntnbh.exec:\1ntnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\dvddp.exec:\dvddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\lxfllfl.exec:\lxfllfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\1pdvv.exec:\1pdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\flrrrrr.exec:\flrrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\pjjjj.exec:\pjjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\5lxrlrl.exec:\5lxrlrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\dppjd.exec:\dppjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\hnntbh.exec:\hnntbh.exe23⤵
- Executes dropped EXE
PID:3612 -
\??\c:\vppvv.exec:\vppvv.exe24⤵
- Executes dropped EXE
PID:3640 -
\??\c:\llrlrxx.exec:\llrlrxx.exe25⤵
- Executes dropped EXE
PID:548 -
\??\c:\dvjdd.exec:\dvjdd.exe26⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xllflfr.exec:\xllflfr.exe27⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rxrrrrr.exec:\rxrrrrr.exe28⤵
- Executes dropped EXE
PID:3568 -
\??\c:\hhntnn.exec:\hhntnn.exe29⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ntnhbb.exec:\ntnhbb.exe30⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hntttb.exec:\hntttb.exe31⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jpddp.exec:\jpddp.exe32⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vvvdj.exec:\vvvdj.exe33⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ffxxxll.exec:\ffxxxll.exe34⤵
- Executes dropped EXE
PID:4748 -
\??\c:\dvdpp.exec:\dvdpp.exe35⤵
- Executes dropped EXE
PID:888 -
\??\c:\llxlxrf.exec:\llxlxrf.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5nhhhh.exec:\5nhhhh.exe37⤵
- Executes dropped EXE
PID:1944 -
\??\c:\tbbbtt.exec:\tbbbtt.exe38⤵
- Executes dropped EXE
PID:4916 -
\??\c:\vvvpv.exec:\vvvpv.exe39⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bntbtb.exec:\bntbtb.exe40⤵
- Executes dropped EXE
PID:4352 -
\??\c:\tttbbt.exec:\tttbbt.exe41⤵
- Executes dropped EXE
PID:1028 -
\??\c:\9ddjj.exec:\9ddjj.exe42⤵
- Executes dropped EXE
PID:3396 -
\??\c:\ffrfxfl.exec:\ffrfxfl.exe43⤵
- Executes dropped EXE
PID:4440 -
\??\c:\dpvvd.exec:\dpvvd.exe44⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lllrxff.exec:\lllrxff.exe45⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3ttnnh.exec:\3ttnnh.exe46⤵
- Executes dropped EXE
PID:5100 -
\??\c:\bnbbtb.exec:\bnbbtb.exe47⤵
- Executes dropped EXE
PID:3516 -
\??\c:\jvdpd.exec:\jvdpd.exe48⤵
- Executes dropped EXE
PID:376 -
\??\c:\1rxfflr.exec:\1rxfflr.exe49⤵
- Executes dropped EXE
PID:952 -
\??\c:\thtttb.exec:\thtttb.exe50⤵
- Executes dropped EXE
PID:3428 -
\??\c:\dvvvj.exec:\dvvvj.exe51⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lrlffxf.exec:\lrlffxf.exe52⤵
- Executes dropped EXE
PID:1136 -
\??\c:\hntnth.exec:\hntnth.exe53⤵
- Executes dropped EXE
PID:4716 -
\??\c:\jjdpp.exec:\jjdpp.exe54⤵
- Executes dropped EXE
PID:4300 -
\??\c:\dvvdv.exec:\dvvdv.exe55⤵
- Executes dropped EXE
PID:4108 -
\??\c:\3llrxxx.exec:\3llrxxx.exe56⤵
- Executes dropped EXE
PID:4800 -
\??\c:\tthhnn.exec:\tthhnn.exe57⤵
- Executes dropped EXE
PID:4444 -
\??\c:\jppvv.exec:\jppvv.exe58⤵
- Executes dropped EXE
PID:4756 -
\??\c:\rlfffll.exec:\rlfffll.exe59⤵
- Executes dropped EXE
PID:4220 -
\??\c:\nhhhtn.exec:\nhhhtn.exe60⤵
- Executes dropped EXE
PID:3244 -
\??\c:\pddjj.exec:\pddjj.exe61⤵
- Executes dropped EXE
PID:368 -
\??\c:\frfllrx.exec:\frfllrx.exe62⤵
- Executes dropped EXE
PID:1544 -
\??\c:\htbbhb.exec:\htbbhb.exe63⤵
- Executes dropped EXE
PID:4768 -
\??\c:\jdjdd.exec:\jdjdd.exe64⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rfxlfrx.exec:\rfxlfrx.exe65⤵
- Executes dropped EXE
PID:1316 -
\??\c:\htnbbn.exec:\htnbbn.exe66⤵PID:2780
-
\??\c:\vdddd.exec:\vdddd.exe67⤵PID:3324
-
\??\c:\lrxrlrf.exec:\lrxrlrf.exe68⤵PID:1004
-
\??\c:\bhhhtb.exec:\bhhhtb.exe69⤵
- System Location Discovery: System Language Discovery
PID:3576 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe70⤵PID:2988
-
\??\c:\tbhhnt.exec:\tbhhnt.exe71⤵PID:3476
-
\??\c:\vdppd.exec:\vdppd.exe72⤵PID:1420
-
\??\c:\hnhtbn.exec:\hnhtbn.exe73⤵PID:3532
-
\??\c:\djppp.exec:\djppp.exe74⤵PID:3692
-
\??\c:\9rxfflr.exec:\9rxfflr.exe75⤵PID:3868
-
\??\c:\tbhnnb.exec:\tbhnnb.exe76⤵PID:2740
-
\??\c:\djvjv.exec:\djvjv.exe77⤵PID:2224
-
\??\c:\rrllxlx.exec:\rrllxlx.exe78⤵PID:3704
-
\??\c:\nntttb.exec:\nntttb.exe79⤵PID:1268
-
\??\c:\bnbbbh.exec:\bnbbbh.exe80⤵PID:3960
-
\??\c:\pvjvj.exec:\pvjvj.exe81⤵
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\lllrrrl.exec:\lllrrrl.exe82⤵PID:2676
-
\??\c:\hnntbh.exec:\hnntbh.exe83⤵PID:1124
-
\??\c:\ppvdp.exec:\ppvdp.exe84⤵PID:1804
-
\??\c:\dpvdj.exec:\dpvdj.exe85⤵PID:3616
-
\??\c:\xrxrxfl.exec:\xrxrxfl.exe86⤵PID:3964
-
\??\c:\hnnhnt.exec:\hnnhnt.exe87⤵PID:1484
-
\??\c:\7hnnnt.exec:\7hnnnt.exe88⤵PID:4352
-
\??\c:\jdppd.exec:\jdppd.exe89⤵PID:3696
-
\??\c:\dvjpp.exec:\dvjpp.exe90⤵PID:2556
-
\??\c:\xfxffll.exec:\xfxffll.exe91⤵PID:2652
-
\??\c:\htbnbh.exec:\htbnbh.exe92⤵PID:3128
-
\??\c:\djpjp.exec:\djpjp.exe93⤵PID:4280
-
\??\c:\ppvvp.exec:\ppvvp.exe94⤵PID:936
-
\??\c:\lfxrlxx.exec:\lfxrlxx.exe95⤵PID:4956
-
\??\c:\nbnthb.exec:\nbnthb.exe96⤵PID:392
-
\??\c:\dpjjv.exec:\dpjjv.exe97⤵PID:836
-
\??\c:\lxxfxlx.exec:\lxxfxlx.exe98⤵PID:1136
-
\??\c:\ttthnn.exec:\ttthnn.exe99⤵PID:3920
-
\??\c:\pdjjd.exec:\pdjjd.exe100⤵
- System Location Discovery: System Language Discovery
PID:4328 -
\??\c:\rfrlfff.exec:\rfrlfff.exe101⤵PID:1540
-
\??\c:\nnthbt.exec:\nnthbt.exe102⤵PID:2120
-
\??\c:\vdvpj.exec:\vdvpj.exe103⤵PID:4904
-
\??\c:\llxrrrr.exec:\llxrrrr.exe104⤵PID:4444
-
\??\c:\rrfrrll.exec:\rrfrrll.exe105⤵
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\1hnttb.exec:\1hnttb.exe106⤵PID:3408
-
\??\c:\jvjjp.exec:\jvjjp.exe107⤵PID:1636
-
\??\c:\ffxfffr.exec:\ffxfffr.exe108⤵PID:1456
-
\??\c:\3vvvj.exec:\3vvvj.exe109⤵PID:3916
-
\??\c:\bnnnnh.exec:\bnnnnh.exe110⤵PID:5108
-
\??\c:\llrrlll.exec:\llrrlll.exe111⤵PID:5104
-
\??\c:\nnhntb.exec:\nnhntb.exe112⤵PID:2720
-
\??\c:\dpjjv.exec:\dpjjv.exe113⤵PID:4720
-
\??\c:\rxxxllr.exec:\rxxxllr.exe114⤵PID:692
-
\??\c:\lrxrffl.exec:\lrxrffl.exe115⤵PID:2052
-
\??\c:\bbhhhh.exec:\bbhhhh.exe116⤵PID:2900
-
\??\c:\1ddvv.exec:\1ddvv.exe117⤵PID:2172
-
\??\c:\3rxxxff.exec:\3rxxxff.exe118⤵PID:2180
-
\??\c:\tbnhbh.exec:\tbnhbh.exe119⤵PID:3316
-
\??\c:\9nbtnb.exec:\9nbtnb.exe120⤵PID:1296
-
\??\c:\vdpvp.exec:\vdpvp.exe121⤵PID:4960
-
\??\c:\lrrrrxx.exec:\lrrrrxx.exe122⤵PID:1416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-