Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 06:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
559e27b4cc8d42d3bf76a99a2227820cb14a733f7d8d9e1d5cc66cc85ecceb35N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
559e27b4cc8d42d3bf76a99a2227820cb14a733f7d8d9e1d5cc66cc85ecceb35N.exe
-
Size
455KB
-
MD5
d099cc506a6e2406b63365cd1e55c540
-
SHA1
bf2c93d3fe2ad485ad35b922aee8c422f80102f9
-
SHA256
559e27b4cc8d42d3bf76a99a2227820cb14a733f7d8d9e1d5cc66cc85ecceb35
-
SHA512
8fe2b5b17523ebfc295b84dd14e62836409d0b0c20a9ad99e13e9b5d8a1cd1b39bb3b22de2146165fd5dac284adf687d2dd1434e82a64105953e3fba6b4a2ca6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRwI:q7Tc2NYHUrAwfMp3CDRwI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4340-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-914-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-1009-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-1097-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-1301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-1774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4800 9jvpj.exe 536 ffffflr.exe 1492 hntttt.exe 3888 vvppp.exe 1772 ffxrxxf.exe 924 tbtttt.exe 2328 pppjd.exe 1404 rxxrlll.exe 2468 5rxxxxx.exe 1644 tnhbhh.exe 1808 5ntnnn.exe 4840 xlffxfr.exe 2560 pvpjd.exe 1200 hthhhn.exe 396 dpvvv.exe 1696 btbbtt.exe 2932 rxrrrrr.exe 540 5bnnhh.exe 4636 9jjdv.exe 2260 xrlllrr.exe 3036 jvjjd.exe 3636 lrflxxl.exe 4260 7vddv.exe 2940 pvvjv.exe 1580 lrfxlfx.exe 2928 9ntbbn.exe 3052 vpdvj.exe 4808 hntnnn.exe 1592 rlxrrff.exe 4640 tbbnnh.exe 4548 jddvp.exe 2664 pvdjv.exe 5072 rllrffx.exe 1452 hbnhnh.exe 2660 pjpjd.exe 3796 lfxrrrr.exe 4124 hntbbt.exe 4008 pdppj.exe 4504 xffffrf.exe 632 flxlllx.exe 4512 tnnbnh.exe 5044 ddjjp.exe 64 rxfrfxr.exe 4328 rfflrfx.exe 3356 bbtbhb.exe 2520 jjjpd.exe 4004 lxfxrxx.exe 1732 htbttt.exe 2272 jdpdv.exe 5048 frrfxlr.exe 1868 ffrrxff.exe 2192 5vddd.exe 948 pdjdp.exe 2252 lxfxxrl.exe 2328 lxfxflx.exe 1788 tttbtb.exe 628 pjjpj.exe 1920 lxrfxrl.exe 3280 htbnnt.exe 1192 ttnbbh.exe 1944 ppppv.exe 4668 rffrrxx.exe 4472 hhbbtb.exe 1100 5jjdv.exe -
resource yara_rule behavioral2/memory/4340-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-479-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrlxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4340 wrote to memory of 4800 4340 559e27b4cc8d42d3bf76a99a2227820cb14a733f7d8d9e1d5cc66cc85ecceb35N.exe 84 PID 4340 wrote to memory of 4800 4340 559e27b4cc8d42d3bf76a99a2227820cb14a733f7d8d9e1d5cc66cc85ecceb35N.exe 84 PID 4340 wrote to memory of 4800 4340 559e27b4cc8d42d3bf76a99a2227820cb14a733f7d8d9e1d5cc66cc85ecceb35N.exe 84 PID 4800 wrote to memory of 536 4800 9jvpj.exe 85 PID 4800 wrote to memory of 536 4800 9jvpj.exe 85 PID 4800 wrote to memory of 536 4800 9jvpj.exe 85 PID 536 wrote to memory of 1492 536 ffffflr.exe 86 PID 536 wrote to memory of 1492 536 ffffflr.exe 86 PID 536 wrote to memory of 1492 536 ffffflr.exe 86 PID 1492 wrote to memory of 3888 1492 hntttt.exe 87 PID 1492 wrote to memory of 3888 1492 hntttt.exe 87 PID 1492 wrote to memory of 3888 1492 hntttt.exe 87 PID 3888 wrote to memory of 1772 3888 vvppp.exe 88 PID 3888 wrote to memory of 1772 3888 vvppp.exe 88 PID 3888 wrote to memory of 1772 3888 vvppp.exe 88 PID 1772 wrote to memory of 924 1772 ffxrxxf.exe 89 PID 1772 wrote to memory of 924 1772 ffxrxxf.exe 89 PID 1772 wrote to memory of 924 1772 ffxrxxf.exe 89 PID 924 wrote to memory of 2328 924 tbtttt.exe 90 PID 924 wrote to memory of 2328 924 tbtttt.exe 90 PID 924 wrote to memory of 2328 924 tbtttt.exe 90 PID 2328 wrote to memory of 1404 2328 pppjd.exe 91 PID 2328 wrote to memory of 1404 2328 pppjd.exe 91 PID 2328 wrote to memory of 1404 2328 pppjd.exe 91 PID 1404 wrote to memory of 2468 1404 rxxrlll.exe 92 PID 1404 wrote to memory of 2468 1404 rxxrlll.exe 92 PID 1404 wrote to memory of 2468 1404 rxxrlll.exe 92 PID 2468 wrote to memory of 1644 2468 5rxxxxx.exe 93 PID 2468 wrote to memory of 1644 2468 5rxxxxx.exe 93 PID 2468 wrote to memory of 1644 2468 5rxxxxx.exe 93 PID 1644 wrote to memory of 1808 1644 tnhbhh.exe 94 PID 1644 wrote to memory of 1808 1644 tnhbhh.exe 94 PID 1644 wrote to memory of 1808 1644 tnhbhh.exe 94 PID 1808 wrote to memory of 4840 1808 5ntnnn.exe 95 PID 1808 wrote to memory of 4840 1808 5ntnnn.exe 95 PID 1808 wrote to memory of 4840 1808 5ntnnn.exe 95 PID 4840 wrote to memory of 2560 4840 xlffxfr.exe 96 PID 4840 wrote to memory of 2560 4840 xlffxfr.exe 96 PID 4840 wrote to memory of 2560 4840 xlffxfr.exe 96 PID 2560 wrote to memory of 1200 2560 pvpjd.exe 97 PID 2560 wrote to memory of 1200 2560 pvpjd.exe 97 PID 2560 wrote to memory of 1200 2560 pvpjd.exe 97 PID 1200 wrote to memory of 396 1200 hthhhn.exe 98 PID 1200 wrote to memory of 396 1200 hthhhn.exe 98 PID 1200 wrote to memory of 396 1200 hthhhn.exe 98 PID 396 wrote to memory of 1696 396 dpvvv.exe 99 PID 396 wrote to memory of 1696 396 dpvvv.exe 99 PID 396 wrote to memory of 1696 396 dpvvv.exe 99 PID 1696 wrote to memory of 2932 1696 btbbtt.exe 100 PID 1696 wrote to memory of 2932 1696 btbbtt.exe 100 PID 1696 wrote to memory of 2932 1696 btbbtt.exe 100 PID 2932 wrote to memory of 540 2932 rxrrrrr.exe 101 PID 2932 wrote to memory of 540 2932 rxrrrrr.exe 101 PID 2932 wrote to memory of 540 2932 rxrrrrr.exe 101 PID 540 wrote to memory of 4636 540 5bnnhh.exe 102 PID 540 wrote to memory of 4636 540 5bnnhh.exe 102 PID 540 wrote to memory of 4636 540 5bnnhh.exe 102 PID 4636 wrote to memory of 2260 4636 9jjdv.exe 103 PID 4636 wrote to memory of 2260 4636 9jjdv.exe 103 PID 4636 wrote to memory of 2260 4636 9jjdv.exe 103 PID 2260 wrote to memory of 3036 2260 xrlllrr.exe 104 PID 2260 wrote to memory of 3036 2260 xrlllrr.exe 104 PID 2260 wrote to memory of 3036 2260 xrlllrr.exe 104 PID 3036 wrote to memory of 3636 3036 jvjjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\559e27b4cc8d42d3bf76a99a2227820cb14a733f7d8d9e1d5cc66cc85ecceb35N.exe"C:\Users\Admin\AppData\Local\Temp\559e27b4cc8d42d3bf76a99a2227820cb14a733f7d8d9e1d5cc66cc85ecceb35N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\9jvpj.exec:\9jvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\ffffflr.exec:\ffffflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\hntttt.exec:\hntttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\vvppp.exec:\vvppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\ffxrxxf.exec:\ffxrxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\tbtttt.exec:\tbtttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\pppjd.exec:\pppjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\rxxrlll.exec:\rxxrlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\5rxxxxx.exec:\5rxxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\tnhbhh.exec:\tnhbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\5ntnnn.exec:\5ntnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\xlffxfr.exec:\xlffxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\pvpjd.exec:\pvpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\hthhhn.exec:\hthhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\dpvvv.exec:\dpvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\btbbtt.exec:\btbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\rxrrrrr.exec:\rxrrrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\5bnnhh.exec:\5bnnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\9jjdv.exec:\9jjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\xrlllrr.exec:\xrlllrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\jvjjd.exec:\jvjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lrflxxl.exec:\lrflxxl.exe23⤵
- Executes dropped EXE
PID:3636 -
\??\c:\7vddv.exec:\7vddv.exe24⤵
- Executes dropped EXE
PID:4260 -
\??\c:\pvvjv.exec:\pvvjv.exe25⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lrfxlfx.exec:\lrfxlfx.exe26⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9ntbbn.exec:\9ntbbn.exe27⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vpdvj.exec:\vpdvj.exe28⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hntnnn.exec:\hntnnn.exe29⤵
- Executes dropped EXE
PID:4808 -
\??\c:\rlxrrff.exec:\rlxrrff.exe30⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tbbnnh.exec:\tbbnnh.exe31⤵
- Executes dropped EXE
PID:4640 -
\??\c:\jddvp.exec:\jddvp.exe32⤵
- Executes dropped EXE
PID:4548 -
\??\c:\pvdjv.exec:\pvdjv.exe33⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rllrffx.exec:\rllrffx.exe34⤵
- Executes dropped EXE
PID:5072 -
\??\c:\hbnhnh.exec:\hbnhnh.exe35⤵
- Executes dropped EXE
PID:1452 -
\??\c:\pjpjd.exec:\pjpjd.exe36⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lfxrrrr.exec:\lfxrrrr.exe37⤵
- Executes dropped EXE
PID:3796 -
\??\c:\hntbbt.exec:\hntbbt.exe38⤵
- Executes dropped EXE
PID:4124 -
\??\c:\pdppj.exec:\pdppj.exe39⤵
- Executes dropped EXE
PID:4008 -
\??\c:\xffffrf.exec:\xffffrf.exe40⤵
- Executes dropped EXE
PID:4504 -
\??\c:\flxlllx.exec:\flxlllx.exe41⤵
- Executes dropped EXE
PID:632 -
\??\c:\tnnbnh.exec:\tnnbnh.exe42⤵
- Executes dropped EXE
PID:4512 -
\??\c:\ddjjp.exec:\ddjjp.exe43⤵
- Executes dropped EXE
PID:5044 -
\??\c:\rxfrfxr.exec:\rxfrfxr.exe44⤵
- Executes dropped EXE
PID:64 -
\??\c:\rfflrfx.exec:\rfflrfx.exe45⤵
- Executes dropped EXE
PID:4328 -
\??\c:\bbtbhb.exec:\bbtbhb.exe46⤵
- Executes dropped EXE
PID:3356 -
\??\c:\jvjvd.exec:\jvjvd.exe47⤵PID:2612
-
\??\c:\jjjpd.exec:\jjjpd.exe48⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe49⤵
- Executes dropped EXE
PID:4004 -
\??\c:\htbttt.exec:\htbttt.exe50⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jdpdv.exec:\jdpdv.exe51⤵
- Executes dropped EXE
PID:2272 -
\??\c:\frrfxlr.exec:\frrfxlr.exe52⤵
- Executes dropped EXE
PID:5048 -
\??\c:\ffrrxff.exec:\ffrrxff.exe53⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5vddd.exec:\5vddd.exe54⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pdjdp.exec:\pdjdp.exe55⤵
- Executes dropped EXE
PID:948 -
\??\c:\lxfxxrl.exec:\lxfxxrl.exe56⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lxfxflx.exec:\lxfxflx.exe57⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tttbtb.exec:\tttbtb.exe58⤵
- Executes dropped EXE
PID:1788 -
\??\c:\pjjpj.exec:\pjjpj.exe59⤵
- Executes dropped EXE
PID:628 -
\??\c:\lxrfxrl.exec:\lxrfxrl.exe60⤵
- Executes dropped EXE
PID:1920 -
\??\c:\htbnnt.exec:\htbnnt.exe61⤵
- Executes dropped EXE
PID:3280 -
\??\c:\ttnbbh.exec:\ttnbbh.exe62⤵
- Executes dropped EXE
PID:1192 -
\??\c:\ppppv.exec:\ppppv.exe63⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rffrrxx.exec:\rffrrxx.exe64⤵
- Executes dropped EXE
PID:4668 -
\??\c:\hhbbtb.exec:\hhbbtb.exe65⤵
- Executes dropped EXE
PID:4472 -
\??\c:\5jjdv.exec:\5jjdv.exe66⤵
- Executes dropped EXE
PID:1100 -
\??\c:\fllxrxr.exec:\fllxrxr.exe67⤵PID:2896
-
\??\c:\tbhbbh.exec:\tbhbbh.exe68⤵PID:5112
-
\??\c:\btbbbh.exec:\btbbbh.exe69⤵PID:1224
-
\??\c:\dvdvp.exec:\dvdvp.exe70⤵PID:2900
-
\??\c:\7fllfff.exec:\7fllfff.exe71⤵PID:4832
-
\??\c:\bnthth.exec:\bnthth.exe72⤵PID:4904
-
\??\c:\vjppp.exec:\vjppp.exe73⤵PID:4876
-
\??\c:\lrlrllf.exec:\lrlrllf.exe74⤵PID:456
-
\??\c:\nhnnbn.exec:\nhnnbn.exe75⤵PID:2608
-
\??\c:\vpjjv.exec:\vpjjv.exe76⤵PID:412
-
\??\c:\rrxfrfl.exec:\rrxfrfl.exe77⤵PID:3636
-
\??\c:\1nbtnb.exec:\1nbtnb.exe78⤵PID:464
-
\??\c:\ddddv.exec:\ddddv.exe79⤵PID:876
-
\??\c:\1rxfxrl.exec:\1rxfxrl.exe80⤵PID:2940
-
\??\c:\flxlfxr.exec:\flxlfxr.exe81⤵PID:644
-
\??\c:\nhbnnh.exec:\nhbnnh.exe82⤵PID:1608
-
\??\c:\dppdv.exec:\dppdv.exe83⤵PID:2304
-
\??\c:\9xxrlfr.exec:\9xxrlfr.exe84⤵PID:1448
-
\??\c:\3nbbtt.exec:\3nbbtt.exe85⤵PID:1620
-
\??\c:\dpdvp.exec:\dpdvp.exe86⤵PID:3556
-
\??\c:\pjjdp.exec:\pjjdp.exe87⤵PID:4676
-
\??\c:\rrrlxrl.exec:\rrrlxrl.exe88⤵PID:4208
-
\??\c:\nhnhhh.exec:\nhnhhh.exe89⤵PID:3984
-
\??\c:\5ppjp.exec:\5ppjp.exe90⤵PID:1824
-
\??\c:\1dvjj.exec:\1dvjj.exe91⤵PID:3320
-
\??\c:\rflfxxx.exec:\rflfxxx.exe92⤵PID:2652
-
\??\c:\bbnhtn.exec:\bbnhtn.exe93⤵PID:4088
-
\??\c:\pjpvv.exec:\pjpvv.exe94⤵PID:2416
-
\??\c:\vdpdv.exec:\vdpdv.exe95⤵PID:3504
-
\??\c:\rxfxrll.exec:\rxfxrll.exe96⤵PID:4264
-
\??\c:\httnnh.exec:\httnnh.exe97⤵PID:4804
-
\??\c:\3jpvj.exec:\3jpvj.exe98⤵PID:1568
-
\??\c:\fxlfffx.exec:\fxlfffx.exe99⤵PID:4504
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe100⤵PID:3324
-
\??\c:\nnnnhn.exec:\nnnnhn.exe101⤵PID:4916
-
\??\c:\7rffllf.exec:\7rffllf.exe102⤵PID:4360
-
\??\c:\nnnbbn.exec:\nnnbbn.exe103⤵PID:4328
-
\??\c:\vvjpv.exec:\vvjpv.exe104⤵PID:4340
-
\??\c:\jjvpj.exec:\jjvpj.exe105⤵PID:536
-
\??\c:\fffrlfr.exec:\fffrlfr.exe106⤵PID:5020
-
\??\c:\nnbbtt.exec:\nnbbtt.exe107⤵PID:2084
-
\??\c:\pvvjv.exec:\pvvjv.exe108⤵
- System Location Discovery: System Language Discovery
PID:3812 -
\??\c:\pvvvv.exec:\pvvvv.exe109⤵PID:1328
-
\??\c:\xxrlxrf.exec:\xxrlxrf.exe110⤵PID:4528
-
\??\c:\5xxrxxf.exec:\5xxrxxf.exe111⤵PID:3904
-
\??\c:\dvvpp.exec:\dvvpp.exe112⤵PID:2844
-
\??\c:\flrfxrl.exec:\flrfxrl.exe113⤵PID:1920
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe114⤵PID:4972
-
\??\c:\bthtnn.exec:\bthtnn.exe115⤵PID:2848
-
\??\c:\dpddd.exec:\dpddd.exe116⤵PID:1808
-
\??\c:\rrfxlrl.exec:\rrfxlrl.exe117⤵PID:1536
-
\??\c:\bnnhbb.exec:\bnnhbb.exe118⤵PID:4880
-
\??\c:\dvvdp.exec:\dvvdp.exe119⤵PID:2560
-
\??\c:\pddvp.exec:\pddvp.exe120⤵PID:3928
-
\??\c:\rlllffx.exec:\rlllffx.exe121⤵PID:396
-
\??\c:\nhbhtt.exec:\nhbhtt.exe122⤵PID:1704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-