Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 03:49
Static task
static1
Behavioral task
behavioral1
Sample
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe
Resource
win7-20240903-en
General
-
Target
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe
-
Size
453KB
-
MD5
cc4d46815384798476dfe3a17633726f
-
SHA1
da32d8c42958b8c85cc8f98d8b67743c21ac1caa
-
SHA256
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b
-
SHA512
c8b147afac53acba404e8b00fd1c3a12881e65cbd8f4938b054878429598a7c5631efc758c98dd159728b63dbfd6ed45acd575fd2084324e350206fd08cc4b87
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4060-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/904-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-890-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-957-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-1053-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
84224.exe66204.exe5vddv.exetbbttt.exee28226.exe26048.exelxxxxrx.exe82848.exenhhhbh.exe022666.exevdddp.exe6886866.exedvjjp.exerfllllf.exevvjdv.exedjjvv.exe462020.exenbhbhh.exe0266606.exepjjdp.exe5xxlfrr.exelxrrrff.exe208800.exehhhhht.exe822660.exepjjvv.exe884864.exe68260.exedvpjd.exenhnhhh.exe486202.exe9rxlfxr.exe260060.exek08200.exe824622.exe80264.exe8660666.exehbtnbb.exe46600.exe808442.exe80860.exe1vvvv.exelffxxxf.exe0444448.exe6464804.exe684484.exetbbbbt.exe840000.exe880224.exehhhhnb.exexxflrxf.exevjpjd.exek02604.exe44606.exedppdp.exehtnthn.exerlxflxf.exeg4644.exedvjvp.exeg6222.exe866682.exek46600.exe20604.exew08244.exepid process 4432 84224.exe 3760 66204.exe 2772 5vddv.exe 2992 tbbttt.exe 1492 e28226.exe 4140 26048.exe 1304 lxxxxrx.exe 3600 82848.exe 5084 nhhhbh.exe 2264 022666.exe 3804 vdddp.exe 4504 6886866.exe 3268 dvjjp.exe 5076 rfllllf.exe 4268 vvjdv.exe 4084 djjvv.exe 1416 462020.exe 3588 nbhbhh.exe 3984 0266606.exe 2880 pjjdp.exe 1888 5xxlfrr.exe 4048 lxrrrff.exe 5000 208800.exe 1808 hhhhht.exe 1736 822660.exe 1052 pjjvv.exe 1708 884864.exe 4964 68260.exe 3076 dvpjd.exe 3240 nhnhhh.exe 3540 486202.exe 1060 9rxlfxr.exe 2908 260060.exe 908 k08200.exe 1676 824622.exe 376 80264.exe 2600 8660666.exe 1604 hbtnbb.exe 2808 46600.exe 1720 808442.exe 2088 80860.exe 2912 1vvvv.exe 2804 lffxxxf.exe 3824 0444448.exe 5060 6464804.exe 2388 684484.exe 996 tbbbbt.exe 4940 840000.exe 3252 880224.exe 4344 hhhhnb.exe 4060 xxflrxf.exe 5064 vjpjd.exe 4272 k02604.exe 1376 44606.exe 2768 dppdp.exe 1536 htnthn.exe 2564 rlxflxf.exe 1160 g4644.exe 3656 dvjvp.exe 2012 g6222.exe 4392 866682.exe 916 k46600.exe 2096 20604.exe 4932 w08244.exe -
Processes:
resource yara_rule behavioral2/memory/4060-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/904-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-823-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2064268.exettnhbb.exe4404488.exe9pjdd.exebnnhtb.exethhbtn.exec066028.exe2066004.exek40044.exe3lrlffx.exe5rrlfff.exexxffrrl.exe002044.exew08244.exennnhbh.exe2848888.exe5vdpd.exefflllrr.exevddjv.exejdvpd.exe8802284.exevvvpd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2064268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4404488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c066028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2066004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k40044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 002044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w08244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2848888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8802284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe84224.exe66204.exe5vddv.exetbbttt.exee28226.exe26048.exelxxxxrx.exe82848.exenhhhbh.exe022666.exevdddp.exe6886866.exedvjjp.exerfllllf.exevvjdv.exedjjvv.exe462020.exenbhbhh.exe0266606.exepjjdp.exe5xxlfrr.exedescription pid process target process PID 4060 wrote to memory of 4432 4060 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 84224.exe PID 4060 wrote to memory of 4432 4060 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 84224.exe PID 4060 wrote to memory of 4432 4060 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 84224.exe PID 4432 wrote to memory of 3760 4432 84224.exe 66204.exe PID 4432 wrote to memory of 3760 4432 84224.exe 66204.exe PID 4432 wrote to memory of 3760 4432 84224.exe 66204.exe PID 3760 wrote to memory of 2772 3760 66204.exe 5vddv.exe PID 3760 wrote to memory of 2772 3760 66204.exe 5vddv.exe PID 3760 wrote to memory of 2772 3760 66204.exe 5vddv.exe PID 2772 wrote to memory of 2992 2772 5vddv.exe tbbttt.exe PID 2772 wrote to memory of 2992 2772 5vddv.exe tbbttt.exe PID 2772 wrote to memory of 2992 2772 5vddv.exe tbbttt.exe PID 2992 wrote to memory of 1492 2992 tbbttt.exe e28226.exe PID 2992 wrote to memory of 1492 2992 tbbttt.exe e28226.exe PID 2992 wrote to memory of 1492 2992 tbbttt.exe e28226.exe PID 1492 wrote to memory of 4140 1492 e28226.exe 26048.exe PID 1492 wrote to memory of 4140 1492 e28226.exe 26048.exe PID 1492 wrote to memory of 4140 1492 e28226.exe 26048.exe PID 4140 wrote to memory of 1304 4140 26048.exe lxxxxrx.exe PID 4140 wrote to memory of 1304 4140 26048.exe lxxxxrx.exe PID 4140 wrote to memory of 1304 4140 26048.exe lxxxxrx.exe PID 1304 wrote to memory of 3600 1304 lxxxxrx.exe 82848.exe PID 1304 wrote to memory of 3600 1304 lxxxxrx.exe 82848.exe PID 1304 wrote to memory of 3600 1304 lxxxxrx.exe 82848.exe PID 3600 wrote to memory of 5084 3600 82848.exe nhhhbh.exe PID 3600 wrote to memory of 5084 3600 82848.exe nhhhbh.exe PID 3600 wrote to memory of 5084 3600 82848.exe nhhhbh.exe PID 5084 wrote to memory of 2264 5084 nhhhbh.exe 022666.exe PID 5084 wrote to memory of 2264 5084 nhhhbh.exe 022666.exe PID 5084 wrote to memory of 2264 5084 nhhhbh.exe 022666.exe PID 2264 wrote to memory of 3804 2264 022666.exe vdddp.exe PID 2264 wrote to memory of 3804 2264 022666.exe vdddp.exe PID 2264 wrote to memory of 3804 2264 022666.exe vdddp.exe PID 3804 wrote to memory of 4504 3804 vdddp.exe 6886866.exe PID 3804 wrote to memory of 4504 3804 vdddp.exe 6886866.exe PID 3804 wrote to memory of 4504 3804 vdddp.exe 6886866.exe PID 4504 wrote to memory of 3268 4504 6886866.exe dvjjp.exe PID 4504 wrote to memory of 3268 4504 6886866.exe dvjjp.exe PID 4504 wrote to memory of 3268 4504 6886866.exe dvjjp.exe PID 3268 wrote to memory of 5076 3268 dvjjp.exe rfllllf.exe PID 3268 wrote to memory of 5076 3268 dvjjp.exe rfllllf.exe PID 3268 wrote to memory of 5076 3268 dvjjp.exe rfllllf.exe PID 5076 wrote to memory of 4268 5076 rfllllf.exe vvjdv.exe PID 5076 wrote to memory of 4268 5076 rfllllf.exe vvjdv.exe PID 5076 wrote to memory of 4268 5076 rfllllf.exe vvjdv.exe PID 4268 wrote to memory of 4084 4268 vvjdv.exe djjvv.exe PID 4268 wrote to memory of 4084 4268 vvjdv.exe djjvv.exe PID 4268 wrote to memory of 4084 4268 vvjdv.exe djjvv.exe PID 4084 wrote to memory of 1416 4084 djjvv.exe 462020.exe PID 4084 wrote to memory of 1416 4084 djjvv.exe 462020.exe PID 4084 wrote to memory of 1416 4084 djjvv.exe 462020.exe PID 1416 wrote to memory of 3588 1416 462020.exe nbhbhh.exe PID 1416 wrote to memory of 3588 1416 462020.exe nbhbhh.exe PID 1416 wrote to memory of 3588 1416 462020.exe nbhbhh.exe PID 3588 wrote to memory of 3984 3588 nbhbhh.exe 0266606.exe PID 3588 wrote to memory of 3984 3588 nbhbhh.exe 0266606.exe PID 3588 wrote to memory of 3984 3588 nbhbhh.exe 0266606.exe PID 3984 wrote to memory of 2880 3984 0266606.exe pjjdp.exe PID 3984 wrote to memory of 2880 3984 0266606.exe pjjdp.exe PID 3984 wrote to memory of 2880 3984 0266606.exe pjjdp.exe PID 2880 wrote to memory of 1888 2880 pjjdp.exe 5xxlfrr.exe PID 2880 wrote to memory of 1888 2880 pjjdp.exe 5xxlfrr.exe PID 2880 wrote to memory of 1888 2880 pjjdp.exe 5xxlfrr.exe PID 1888 wrote to memory of 4048 1888 5xxlfrr.exe lxrrrff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe"C:\Users\Admin\AppData\Local\Temp\c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\84224.exec:\84224.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\66204.exec:\66204.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\5vddv.exec:\5vddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\tbbttt.exec:\tbbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\e28226.exec:\e28226.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\26048.exec:\26048.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\lxxxxrx.exec:\lxxxxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\82848.exec:\82848.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\nhhhbh.exec:\nhhhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\022666.exec:\022666.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\vdddp.exec:\vdddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\6886866.exec:\6886866.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\dvjjp.exec:\dvjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\rfllllf.exec:\rfllllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\vvjdv.exec:\vvjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\djjvv.exec:\djjvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\462020.exec:\462020.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\nbhbhh.exec:\nbhbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\0266606.exec:\0266606.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\pjjdp.exec:\pjjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\5xxlfrr.exec:\5xxlfrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\lxrrrff.exec:\lxrrrff.exe23⤵
- Executes dropped EXE
PID:4048 -
\??\c:\208800.exec:\208800.exe24⤵
- Executes dropped EXE
PID:5000 -
\??\c:\hhhhht.exec:\hhhhht.exe25⤵
- Executes dropped EXE
PID:1808 -
\??\c:\822660.exec:\822660.exe26⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pjjvv.exec:\pjjvv.exe27⤵
- Executes dropped EXE
PID:1052 -
\??\c:\884864.exec:\884864.exe28⤵
- Executes dropped EXE
PID:1708 -
\??\c:\68260.exec:\68260.exe29⤵
- Executes dropped EXE
PID:4964 -
\??\c:\dvpjd.exec:\dvpjd.exe30⤵
- Executes dropped EXE
PID:3076 -
\??\c:\nhnhhh.exec:\nhnhhh.exe31⤵
- Executes dropped EXE
PID:3240 -
\??\c:\486202.exec:\486202.exe32⤵
- Executes dropped EXE
PID:3540 -
\??\c:\9rxlfxr.exec:\9rxlfxr.exe33⤵
- Executes dropped EXE
PID:1060 -
\??\c:\260060.exec:\260060.exe34⤵
- Executes dropped EXE
PID:2908 -
\??\c:\k08200.exec:\k08200.exe35⤵
- Executes dropped EXE
PID:908 -
\??\c:\824622.exec:\824622.exe36⤵
- Executes dropped EXE
PID:1676 -
\??\c:\80264.exec:\80264.exe37⤵
- Executes dropped EXE
PID:376 -
\??\c:\8660666.exec:\8660666.exe38⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hbtnbb.exec:\hbtnbb.exe39⤵
- Executes dropped EXE
PID:1604 -
\??\c:\46600.exec:\46600.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\808442.exec:\808442.exe41⤵
- Executes dropped EXE
PID:1720 -
\??\c:\80860.exec:\80860.exe42⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1vvvv.exec:\1vvvv.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lffxxxf.exec:\lffxxxf.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\0444448.exec:\0444448.exe45⤵
- Executes dropped EXE
PID:3824 -
\??\c:\6464804.exec:\6464804.exe46⤵
- Executes dropped EXE
PID:5060 -
\??\c:\684484.exec:\684484.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tbbbbt.exec:\tbbbbt.exe48⤵
- Executes dropped EXE
PID:996 -
\??\c:\840000.exec:\840000.exe49⤵
- Executes dropped EXE
PID:4940 -
\??\c:\880224.exec:\880224.exe50⤵
- Executes dropped EXE
PID:3252 -
\??\c:\hhhhnb.exec:\hhhhnb.exe51⤵
- Executes dropped EXE
PID:4344 -
\??\c:\xxflrxf.exec:\xxflrxf.exe52⤵
- Executes dropped EXE
PID:4060 -
\??\c:\vjpjd.exec:\vjpjd.exe53⤵
- Executes dropped EXE
PID:5064 -
\??\c:\k02604.exec:\k02604.exe54⤵
- Executes dropped EXE
PID:4272 -
\??\c:\44606.exec:\44606.exe55⤵
- Executes dropped EXE
PID:1376 -
\??\c:\dppdp.exec:\dppdp.exe56⤵
- Executes dropped EXE
PID:2768 -
\??\c:\htnthn.exec:\htnthn.exe57⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rlxflxf.exec:\rlxflxf.exe58⤵
- Executes dropped EXE
PID:2564 -
\??\c:\g4644.exec:\g4644.exe59⤵
- Executes dropped EXE
PID:1160 -
\??\c:\dvjvp.exec:\dvjvp.exe60⤵
- Executes dropped EXE
PID:3656 -
\??\c:\g6222.exec:\g6222.exe61⤵
- Executes dropped EXE
PID:2012 -
\??\c:\866682.exec:\866682.exe62⤵
- Executes dropped EXE
PID:4392 -
\??\c:\k46600.exec:\k46600.exe63⤵
- Executes dropped EXE
PID:916 -
\??\c:\20604.exec:\20604.exe64⤵
- Executes dropped EXE
PID:2096 -
\??\c:\w08244.exec:\w08244.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4932 -
\??\c:\vjjdp.exec:\vjjdp.exe66⤵PID:2788
-
\??\c:\jvdjv.exec:\jvdjv.exe67⤵PID:2928
-
\??\c:\6288400.exec:\6288400.exe68⤵PID:4504
-
\??\c:\o626666.exec:\o626666.exe69⤵PID:8
-
\??\c:\08266.exec:\08266.exe70⤵PID:3184
-
\??\c:\bbhbnn.exec:\bbhbnn.exe71⤵PID:4464
-
\??\c:\rfllfll.exec:\rfllfll.exe72⤵PID:4028
-
\??\c:\624882.exec:\624882.exe73⤵PID:1860
-
\??\c:\28822.exec:\28822.exe74⤵PID:3040
-
\??\c:\c060000.exec:\c060000.exe75⤵PID:208
-
\??\c:\nttnhh.exec:\nttnhh.exe76⤵PID:2500
-
\??\c:\k80480.exec:\k80480.exe77⤵PID:1904
-
\??\c:\20604.exec:\20604.exe78⤵PID:1888
-
\??\c:\9xxrfff.exec:\9xxrfff.exe79⤵PID:1184
-
\??\c:\u626000.exec:\u626000.exe80⤵PID:4680
-
\??\c:\862240.exec:\862240.exe81⤵PID:2340
-
\??\c:\m2448.exec:\m2448.exe82⤵PID:4836
-
\??\c:\ttnbtn.exec:\ttnbtn.exe83⤵PID:4596
-
\??\c:\60802.exec:\60802.exe84⤵PID:3720
-
\??\c:\8608604.exec:\8608604.exe85⤵PID:2184
-
\??\c:\8264602.exec:\8264602.exe86⤵PID:1708
-
\??\c:\228260.exec:\228260.exe87⤵PID:348
-
\??\c:\5ddvp.exec:\5ddvp.exe88⤵PID:3452
-
\??\c:\hhhnhb.exec:\hhhnhb.exe89⤵PID:3284
-
\??\c:\28426.exec:\28426.exe90⤵PID:904
-
\??\c:\428862.exec:\428862.exe91⤵PID:1400
-
\??\c:\c628882.exec:\c628882.exe92⤵PID:1952
-
\??\c:\64648.exec:\64648.exe93⤵PID:1532
-
\??\c:\bbbntb.exec:\bbbntb.exe94⤵PID:2908
-
\??\c:\886600.exec:\886600.exe95⤵PID:2028
-
\??\c:\w80040.exec:\w80040.exe96⤵PID:4148
-
\??\c:\nbbnhb.exec:\nbbnhb.exe97⤵PID:3016
-
\??\c:\pjdvj.exec:\pjdvj.exe98⤵PID:1604
-
\??\c:\bbhhbb.exec:\bbhhbb.exe99⤵PID:1360
-
\??\c:\s6042.exec:\s6042.exe100⤵PID:5024
-
\??\c:\e24822.exec:\e24822.exe101⤵PID:4884
-
\??\c:\42204.exec:\42204.exe102⤵PID:1524
-
\??\c:\c000826.exec:\c000826.exe103⤵PID:5096
-
\??\c:\dvvpv.exec:\dvvpv.exe104⤵PID:1212
-
\??\c:\5pjvj.exec:\5pjvj.exe105⤵PID:3716
-
\??\c:\nhbhbt.exec:\nhbhbt.exe106⤵PID:3832
-
\??\c:\rrlffxr.exec:\rrlffxr.exe107⤵PID:3324
-
\??\c:\628260.exec:\628260.exe108⤵PID:2276
-
\??\c:\2048860.exec:\2048860.exe109⤵PID:3864
-
\??\c:\84004.exec:\84004.exe110⤵PID:1376
-
\??\c:\pjdvv.exec:\pjdvv.exe111⤵PID:1836
-
\??\c:\268288.exec:\268288.exe112⤵PID:3760
-
\??\c:\tnnnnn.exec:\tnnnnn.exe113⤵PID:4624
-
\??\c:\rfrxfxf.exec:\rfrxfxf.exe114⤵PID:1320
-
\??\c:\flxrllf.exec:\flxrllf.exe115⤵PID:3504
-
\??\c:\rrfxxxr.exec:\rrfxxxr.exe116⤵PID:1304
-
\??\c:\tbtbtb.exec:\tbtbtb.exe117⤵PID:5044
-
\??\c:\rfrlffx.exec:\rfrlffx.exe118⤵PID:3600
-
\??\c:\2448624.exec:\2448624.exe119⤵PID:4064
-
\??\c:\00420.exec:\00420.exe120⤵PID:2512
-
\??\c:\9lxxxll.exec:\9lxxxll.exe121⤵PID:1756
-
\??\c:\4022844.exec:\4022844.exe122⤵PID:4124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-