Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 04:22
Static task
static1
Behavioral task
behavioral1
Sample
d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe
Resource
win7-20240903-en
General
-
Target
d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe
-
Size
453KB
-
MD5
db07ed8d02f858f5f721d1ea0774a028
-
SHA1
79c6c903a1734561eb6a23870fe9654d7a1c6651
-
SHA256
d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0
-
SHA512
4f1ec169d9db50e5db9d948b4cc6b427e8c929e4eed13b2ca7d1940d73d72087c11f43a72f44804136a82a0819dbd2471db921335c722728d27b8b73e6101309
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeK:q7Tc2NYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/4384-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-856-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-989-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-1134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-1174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-1352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bhhnnn.exenttnhh.exejpddp.exepdpvj.exehnbbnn.exennhtbt.exefflrrlf.exebtthbh.exedjppp.exettntbh.exepjjdp.exedvvpj.exenhnnhh.exe9dddj.exepjpjj.exe1xffxll.exe3btbbn.exevdddv.exexllxrxx.exefllxxrl.exepvdvp.exettthht.exedjdpd.exerxllfxr.exehtnnnn.exe9bbtnb.exevvjvp.exefrfxrrl.exelllxlxf.exerlffxll.exebthhht.exeffrlfxr.exexfxfxxx.exe3pvpp.exefffxxxx.exe7ttnhn.exepvdvv.exexxxxxxx.exennnnnn.exerflxlll.exetthbtb.exe1nttth.exefllxrxx.exelfrxlll.exehhbtnn.exevjddd.exe5ffxxff.exejppvv.exexrrllfx.exettbnhn.exeppddj.exellrxfxl.exe3ttbhh.exenhhhbn.exejpdpj.exe9flfllf.exehnbbhh.exedppjj.exe9nnnnt.exe7djdp.exelflfxrl.exerrlfllr.exe3vddj.exe1jppj.exepid Process 452 bhhnnn.exe 220 nttnhh.exe 3488 jpddp.exe 5112 pdpvj.exe 4748 hnbbnn.exe 4936 nnhtbt.exe 3108 fflrrlf.exe 1060 btthbh.exe 4680 djppp.exe 3948 ttntbh.exe 5100 pjjdp.exe 3540 dvvpj.exe 4688 nhnnhh.exe 436 9dddj.exe 1056 pjpjj.exe 4880 1xffxll.exe 4184 3btbbn.exe 864 vdddv.exe 3608 xllxrxx.exe 4716 fllxxrl.exe 1352 pvdvp.exe 1448 ttthht.exe 2416 djdpd.exe 4612 rxllfxr.exe 3888 htnnnn.exe 2872 9bbtnb.exe 4596 vvjvp.exe 4916 frfxrrl.exe 4204 lllxlxf.exe 1316 rlffxll.exe 2272 bthhht.exe 2148 ffrlfxr.exe 4584 xfxfxxx.exe 3536 3pvpp.exe 3416 fffxxxx.exe 3940 7ttnhn.exe 468 pvdvv.exe 3376 xxxxxxx.exe 5084 nnnnnn.exe 1748 rflxlll.exe 3452 tthbtb.exe 4116 1nttth.exe 3552 fllxrxx.exe 5024 lfrxlll.exe 3504 hhbtnn.exe 1368 vjddd.exe 2128 5ffxxff.exe 224 jppvv.exe 1236 xrrllfx.exe 4300 ttbnhn.exe 1504 ppddj.exe 1964 llrxfxl.exe 3692 3ttbhh.exe 1196 nhhhbn.exe 2784 jpdpj.exe 2276 9flfllf.exe 3092 hnbbhh.exe 5100 dppjj.exe 4616 9nnnnt.exe 4524 7djdp.exe 3388 lflfxrl.exe 1416 rrlfllr.exe 2480 3vddj.exe 8 1jppj.exe -
Processes:
resource yara_rule behavioral2/memory/4384-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-989-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pvdvv.exefxffxff.exebttbnb.exe5pvdv.exelxrlfxx.exelflfxxr.exerxfxxxx.exefrflfff.exejvvdp.exefxxllff.exe3xrfrlf.exejpdpp.exexllllxx.exethhhbt.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exebhhnnn.exenttnhh.exejpddp.exepdpvj.exehnbbnn.exennhtbt.exefflrrlf.exebtthbh.exedjppp.exettntbh.exepjjdp.exedvvpj.exenhnnhh.exe9dddj.exepjpjj.exe1xffxll.exe3btbbn.exevdddv.exexllxrxx.exefllxxrl.exepvdvp.exedescription pid Process procid_target PID 4384 wrote to memory of 452 4384 d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe 83 PID 4384 wrote to memory of 452 4384 d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe 83 PID 4384 wrote to memory of 452 4384 d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe 83 PID 452 wrote to memory of 220 452 bhhnnn.exe 84 PID 452 wrote to memory of 220 452 bhhnnn.exe 84 PID 452 wrote to memory of 220 452 bhhnnn.exe 84 PID 220 wrote to memory of 3488 220 nttnhh.exe 85 PID 220 wrote to memory of 3488 220 nttnhh.exe 85 PID 220 wrote to memory of 3488 220 nttnhh.exe 85 PID 3488 wrote to memory of 5112 3488 jpddp.exe 86 PID 3488 wrote to memory of 5112 3488 jpddp.exe 86 PID 3488 wrote to memory of 5112 3488 jpddp.exe 86 PID 5112 wrote to memory of 4748 5112 pdpvj.exe 87 PID 5112 wrote to memory of 4748 5112 pdpvj.exe 87 PID 5112 wrote to memory of 4748 5112 pdpvj.exe 87 PID 4748 wrote to memory of 4936 4748 hnbbnn.exe 88 PID 4748 wrote to memory of 4936 4748 hnbbnn.exe 88 PID 4748 wrote to memory of 4936 4748 hnbbnn.exe 88 PID 4936 wrote to memory of 3108 4936 nnhtbt.exe 89 PID 4936 wrote to memory of 3108 4936 nnhtbt.exe 89 PID 4936 wrote to memory of 3108 4936 nnhtbt.exe 89 PID 3108 wrote to memory of 1060 3108 fflrrlf.exe 90 PID 3108 wrote to memory of 1060 3108 fflrrlf.exe 90 PID 3108 wrote to memory of 1060 3108 fflrrlf.exe 90 PID 1060 wrote to memory of 4680 1060 btthbh.exe 91 PID 1060 wrote to memory of 4680 1060 btthbh.exe 91 PID 1060 wrote to memory of 4680 1060 btthbh.exe 91 PID 4680 wrote to memory of 3948 4680 djppp.exe 92 PID 4680 wrote to memory of 3948 4680 djppp.exe 92 PID 4680 wrote to memory of 3948 4680 djppp.exe 92 PID 3948 wrote to memory of 5100 3948 ttntbh.exe 93 PID 3948 wrote to memory of 5100 3948 ttntbh.exe 93 PID 3948 wrote to memory of 5100 3948 ttntbh.exe 93 PID 5100 wrote to memory of 3540 5100 pjjdp.exe 94 PID 5100 wrote to memory of 3540 5100 pjjdp.exe 94 PID 5100 wrote to memory of 3540 5100 pjjdp.exe 94 PID 3540 wrote to memory of 4688 3540 dvvpj.exe 95 PID 3540 wrote to memory of 4688 3540 dvvpj.exe 95 PID 3540 wrote to memory of 4688 3540 dvvpj.exe 95 PID 4688 wrote to memory of 436 4688 nhnnhh.exe 96 PID 4688 wrote to memory of 436 4688 nhnnhh.exe 96 PID 4688 wrote to memory of 436 4688 nhnnhh.exe 96 PID 436 wrote to memory of 1056 436 9dddj.exe 97 PID 436 wrote to memory of 1056 436 9dddj.exe 97 PID 436 wrote to memory of 1056 436 9dddj.exe 97 PID 1056 wrote to memory of 4880 1056 pjpjj.exe 98 PID 1056 wrote to memory of 4880 1056 pjpjj.exe 98 PID 1056 wrote to memory of 4880 1056 pjpjj.exe 98 PID 4880 wrote to memory of 4184 4880 1xffxll.exe 99 PID 4880 wrote to memory of 4184 4880 1xffxll.exe 99 PID 4880 wrote to memory of 4184 4880 1xffxll.exe 99 PID 4184 wrote to memory of 864 4184 3btbbn.exe 100 PID 4184 wrote to memory of 864 4184 3btbbn.exe 100 PID 4184 wrote to memory of 864 4184 3btbbn.exe 100 PID 864 wrote to memory of 3608 864 vdddv.exe 101 PID 864 wrote to memory of 3608 864 vdddv.exe 101 PID 864 wrote to memory of 3608 864 vdddv.exe 101 PID 3608 wrote to memory of 4716 3608 xllxrxx.exe 102 PID 3608 wrote to memory of 4716 3608 xllxrxx.exe 102 PID 3608 wrote to memory of 4716 3608 xllxrxx.exe 102 PID 4716 wrote to memory of 1352 4716 fllxxrl.exe 103 PID 4716 wrote to memory of 1352 4716 fllxxrl.exe 103 PID 4716 wrote to memory of 1352 4716 fllxxrl.exe 103 PID 1352 wrote to memory of 1448 1352 pvdvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe"C:\Users\Admin\AppData\Local\Temp\d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\bhhnnn.exec:\bhhnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\nttnhh.exec:\nttnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\jpddp.exec:\jpddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\pdpvj.exec:\pdpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\hnbbnn.exec:\hnbbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\nnhtbt.exec:\nnhtbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\fflrrlf.exec:\fflrrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\btthbh.exec:\btthbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\djppp.exec:\djppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\ttntbh.exec:\ttntbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\pjjdp.exec:\pjjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\dvvpj.exec:\dvvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\nhnnhh.exec:\nhnnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\9dddj.exec:\9dddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\pjpjj.exec:\pjpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\1xffxll.exec:\1xffxll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\3btbbn.exec:\3btbbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\vdddv.exec:\vdddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\xllxrxx.exec:\xllxrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\fllxxrl.exec:\fllxxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\pvdvp.exec:\pvdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\ttthht.exec:\ttthht.exe23⤵
- Executes dropped EXE
PID:1448 -
\??\c:\djdpd.exec:\djdpd.exe24⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rxllfxr.exec:\rxllfxr.exe25⤵
- Executes dropped EXE
PID:4612 -
\??\c:\htnnnn.exec:\htnnnn.exe26⤵
- Executes dropped EXE
PID:3888 -
\??\c:\9bbtnb.exec:\9bbtnb.exe27⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vvjvp.exec:\vvjvp.exe28⤵
- Executes dropped EXE
PID:4596 -
\??\c:\frfxrrl.exec:\frfxrrl.exe29⤵
- Executes dropped EXE
PID:4916 -
\??\c:\lllxlxf.exec:\lllxlxf.exe30⤵
- Executes dropped EXE
PID:4204 -
\??\c:\rlffxll.exec:\rlffxll.exe31⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bthhht.exec:\bthhht.exe32⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ffrlfxr.exec:\ffrlfxr.exe33⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xfxfxxx.exec:\xfxfxxx.exe34⤵
- Executes dropped EXE
PID:4584 -
\??\c:\3pvpp.exec:\3pvpp.exe35⤵
- Executes dropped EXE
PID:3536 -
\??\c:\fffxxxx.exec:\fffxxxx.exe36⤵
- Executes dropped EXE
PID:3416 -
\??\c:\7ttnhn.exec:\7ttnhn.exe37⤵
- Executes dropped EXE
PID:3940 -
\??\c:\pvdvv.exec:\pvdvv.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:468 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe39⤵
- Executes dropped EXE
PID:3376 -
\??\c:\nnnnnn.exec:\nnnnnn.exe40⤵
- Executes dropped EXE
PID:5084 -
\??\c:\rflxlll.exec:\rflxlll.exe41⤵
- Executes dropped EXE
PID:1748 -
\??\c:\tthbtb.exec:\tthbtb.exe42⤵
- Executes dropped EXE
PID:3452 -
\??\c:\1nttth.exec:\1nttth.exe43⤵
- Executes dropped EXE
PID:4116 -
\??\c:\fllxrxx.exec:\fllxrxx.exe44⤵
- Executes dropped EXE
PID:3552 -
\??\c:\lfrxlll.exec:\lfrxlll.exe45⤵
- Executes dropped EXE
PID:5024 -
\??\c:\hhbtnn.exec:\hhbtnn.exe46⤵
- Executes dropped EXE
PID:3504 -
\??\c:\vjddd.exec:\vjddd.exe47⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5ffxxff.exec:\5ffxxff.exe48⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jppvv.exec:\jppvv.exe49⤵
- Executes dropped EXE
PID:224 -
\??\c:\xrrllfx.exec:\xrrllfx.exe50⤵
- Executes dropped EXE
PID:1236 -
\??\c:\ttbnhn.exec:\ttbnhn.exe51⤵
- Executes dropped EXE
PID:4300 -
\??\c:\ppddj.exec:\ppddj.exe52⤵
- Executes dropped EXE
PID:1504 -
\??\c:\llrxfxl.exec:\llrxfxl.exe53⤵
- Executes dropped EXE
PID:1964 -
\??\c:\3ttbhh.exec:\3ttbhh.exe54⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nhhhbn.exec:\nhhhbn.exe55⤵
- Executes dropped EXE
PID:1196 -
\??\c:\jpdpj.exec:\jpdpj.exe56⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9flfllf.exec:\9flfllf.exe57⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hnbbhh.exec:\hnbbhh.exe58⤵
- Executes dropped EXE
PID:3092 -
\??\c:\dppjj.exec:\dppjj.exe59⤵
- Executes dropped EXE
PID:5100 -
\??\c:\9nnnnt.exec:\9nnnnt.exe60⤵
- Executes dropped EXE
PID:4616 -
\??\c:\7djdp.exec:\7djdp.exe61⤵
- Executes dropped EXE
PID:4524 -
\??\c:\lflfxrl.exec:\lflfxrl.exe62⤵
- Executes dropped EXE
PID:3388 -
\??\c:\rrlfllr.exec:\rrlfllr.exe63⤵
- Executes dropped EXE
PID:1416 -
\??\c:\3vddj.exec:\3vddj.exe64⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1jppj.exec:\1jppj.exe65⤵
- Executes dropped EXE
PID:8 -
\??\c:\tbbbbt.exec:\tbbbbt.exe66⤵PID:4196
-
\??\c:\5llxxxr.exec:\5llxxxr.exe67⤵PID:5080
-
\??\c:\hbhhnn.exec:\hbhhnn.exe68⤵PID:4484
-
\??\c:\pjpvp.exec:\pjpvp.exe69⤵PID:264
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe70⤵PID:4720
-
\??\c:\tttnnh.exec:\tttnnh.exe71⤵PID:2956
-
\??\c:\ddddd.exec:\ddddd.exe72⤵PID:4452
-
\??\c:\lffrffx.exec:\lffrffx.exe73⤵PID:4044
-
\??\c:\ttnhht.exec:\ttnhht.exe74⤵PID:3064
-
\??\c:\jjddj.exec:\jjddj.exe75⤵PID:1332
-
\??\c:\5xffffx.exec:\5xffffx.exe76⤵PID:4516
-
\??\c:\lxlffxx.exec:\lxlffxx.exe77⤵PID:4040
-
\??\c:\dppjd.exec:\dppjd.exe78⤵PID:3976
-
\??\c:\9vvpp.exec:\9vvpp.exe79⤵PID:4700
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe80⤵PID:1080
-
\??\c:\nhnnnb.exec:\nhnnnb.exe81⤵PID:5044
-
\??\c:\9jjjj.exec:\9jjjj.exe82⤵PID:4588
-
\??\c:\5rxxflr.exec:\5rxxflr.exe83⤵PID:4596
-
\??\c:\rrrrrfl.exec:\rrrrrfl.exe84⤵PID:4312
-
\??\c:\vdjjd.exec:\vdjjd.exe85⤵PID:1168
-
\??\c:\9vvpj.exec:\9vvpj.exe86⤵PID:2096
-
\??\c:\3xrrrxx.exec:\3xrrrxx.exe87⤵PID:3184
-
\??\c:\tnnhhb.exec:\tnnhhb.exe88⤵PID:1912
-
\??\c:\9jvpj.exec:\9jvpj.exe89⤵PID:3528
-
\??\c:\vdpjj.exec:\vdpjj.exe90⤵PID:4544
-
\??\c:\rxxrltt.exec:\rxxrltt.exe91⤵PID:3004
-
\??\c:\7nnnhh.exec:\7nnnhh.exe92⤵PID:1764
-
\??\c:\jpjjj.exec:\jpjjj.exe93⤵PID:1052
-
\??\c:\rxffxrr.exec:\rxffxrr.exe94⤵PID:4404
-
\??\c:\htbbnt.exec:\htbbnt.exe95⤵PID:3456
-
\??\c:\bttbbh.exec:\bttbbh.exe96⤵PID:3208
-
\??\c:\3rxfxfx.exec:\3rxfxfx.exe97⤵PID:372
-
\??\c:\9ntttb.exec:\9ntttb.exe98⤵PID:1432
-
\??\c:\hnhhbb.exec:\hnhhbb.exe99⤵PID:1008
-
\??\c:\pdjjd.exec:\pdjjd.exe100⤵PID:844
-
\??\c:\lrrrllx.exec:\lrrrllx.exe101⤵PID:2528
-
\??\c:\nhtbhn.exec:\nhtbhn.exe102⤵PID:4376
-
\??\c:\ppvvv.exec:\ppvvv.exe103⤵PID:2204
-
\??\c:\lrrxxrr.exec:\lrrxxrr.exe104⤵PID:1068
-
\??\c:\1xlllxx.exec:\1xlllxx.exe105⤵PID:220
-
\??\c:\btbttt.exec:\btbttt.exe106⤵PID:5112
-
\??\c:\5vjpj.exec:\5vjpj.exe107⤵PID:1844
-
\??\c:\rxrrllf.exec:\rxrrllf.exe108⤵PID:4300
-
\??\c:\hnbttn.exec:\hnbttn.exe109⤵PID:1676
-
\??\c:\7hnhhn.exec:\7hnhhn.exe110⤵PID:3704
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe111⤵PID:3692
-
\??\c:\9rrrlll.exec:\9rrrlll.exe112⤵PID:1480
-
\??\c:\htbtnt.exec:\htbtnt.exe113⤵PID:4740
-
\??\c:\jddvv.exec:\jddvv.exe114⤵PID:2276
-
\??\c:\rxxllfl.exec:\rxxllfl.exe115⤵PID:2924
-
\??\c:\1rlrxff.exec:\1rlrxff.exe116⤵PID:232
-
\??\c:\nnnnht.exec:\nnnnht.exe117⤵PID:4616
-
\??\c:\pdjjd.exec:\pdjjd.exe118⤵PID:4524
-
\??\c:\djdvp.exec:\djdvp.exe119⤵PID:4164
-
\??\c:\xrxllfx.exec:\xrxllfx.exe120⤵PID:1384
-
\??\c:\bbhbtt.exec:\bbhbtt.exe121⤵PID:4168
-
\??\c:\flfxrrr.exec:\flfxrrr.exe122⤵PID:4296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-