Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 20:07
Behavioral task
behavioral1
Sample
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe
Resource
win7-20240903-en
General
-
Target
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe
-
Size
332KB
-
MD5
f66e32ae53325232d1d14d721fbc2f6b
-
SHA1
0686dc81ac94ace7db64d89e7eff3c847f01f036
-
SHA256
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1
-
SHA512
55cff182fdfcd5c58a40fb92fcd91f8a7f91f749c109e4e14a1e0ae39896ff236eb3c386b00acbf520be2ab9970be8c99cfbeaaa1e2c3572358193f4b7177fde
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR:R4wFHoSHYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/976-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3864-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-662-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-711-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-1102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-1123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djpdp.exe9vvpd.exennhbnh.exexrfxlll.exepvvjd.exerfffxrf.exetnnbth.exevjvvp.exevvpdp.exefrxlxrl.exebhntbn.exe7nbtbt.exedppdv.exe7rxlxrr.exehthtbb.exenhhbnh.exedvjdj.exexrrlfrl.exentbnbb.exe7vvjv.exelxrfrlx.exebthnnt.exe1vdvp.exe9xfrlfr.exelrlfrlx.exethhhbh.exe9ppjv.exefflfxfx.exennhbtn.exepvpvp.exepppdv.exexfllxrf.exehbtnbt.exejjvjd.exepppjd.exeffrlxfx.exebhhbhb.exepjjpp.exeppdvv.exefxffxxx.exerrffllr.exe5bnhbb.exepdjdd.exeddvjd.exe9pdvp.exexxrxrlf.exehbthth.exe3bhbnn.exeddpjd.exeflxxlll.exehbbttt.exehbhnhn.exevvppj.exe5jddv.exeffxrlfx.exenbhntt.exebhnbnh.exedvpdj.exejppjd.exelrfllxl.exe9flffrx.exetbnhhn.exenhhnnn.exe5pddv.exepid process 2124 djpdp.exe 4472 9vvpd.exe 4512 nnhbnh.exe 4416 xrfxlll.exe 2100 pvvjd.exe 2552 rfffxrf.exe 4132 tnnbth.exe 2380 vjvvp.exe 1340 vvpdp.exe 4444 frxlxrl.exe 1460 bhntbn.exe 2332 7nbtbt.exe 756 dppdv.exe 4120 7rxlxrr.exe 952 hthtbb.exe 3864 nhhbnh.exe 4948 dvjdj.exe 2872 xrrlfrl.exe 4060 ntbnbb.exe 2356 7vvjv.exe 4712 lxrfrlx.exe 3184 bthnnt.exe 3672 1vdvp.exe 4168 9xfrlfr.exe 2088 lrlfrlx.exe 2168 thhhbh.exe 4052 9ppjv.exe 1588 fflfxfx.exe 2232 nnhbtn.exe 2428 pvpvp.exe 2696 pppdv.exe 440 xfllxrf.exe 208 hbtnbt.exe 4364 jjvjd.exe 1724 pppjd.exe 4396 ffrlxfx.exe 2372 bhhbhb.exe 1708 pjjpp.exe 2012 ppdvv.exe 804 fxffxxx.exe 1776 rrffllr.exe 1972 5bnhbb.exe 1320 pdjdd.exe 920 ddvjd.exe 4524 9pdvp.exe 4816 xxrxrlf.exe 1508 hbthth.exe 4320 3bhbnn.exe 4516 ddpjd.exe 1728 flxxlll.exe 2948 hbbttt.exe 692 hbhnhn.exe 3212 vvppj.exe 772 5jddv.exe 1700 ffxrlfx.exe 1380 nbhntt.exe 4144 bhnbnh.exe 3244 dvpdj.exe 4436 jppjd.exe 1672 lrfllxl.exe 1528 9flffrx.exe 2124 tbnhhn.exe 4860 nhhnnn.exe 3620 5pddv.exe -
Processes:
resource yara_rule behavioral2/memory/976-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djpdp.exe upx behavioral2/memory/976-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2124-9-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vvpd.exe upx C:\nnhbnh.exe upx behavioral2/memory/4472-14-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrfxlll.exe upx C:\pvvjd.exe upx behavioral2/memory/4416-23-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfffxrf.exe upx C:\tnnbth.exe upx behavioral2/memory/2100-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4132-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2552-32-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vvpdp.exe upx behavioral2/memory/2380-43-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjvvp.exe upx behavioral2/memory/1340-48-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frxlxrl.exe upx behavioral2/memory/4444-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1460-54-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhntbn.exe upx \??\c:\dppdv.exe upx behavioral2/memory/2332-63-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7nbtbt.exe upx C:\hthtbb.exe upx behavioral2/memory/952-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhhbnh.exe upx behavioral2/memory/3864-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4948-87-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrrlfrl.exe upx \??\c:\ntbnbb.exe upx \??\c:\lxrfrlx.exe upx behavioral2/memory/2356-101-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bthnnt.exe upx \??\c:\9xfrlfr.exe upx \??\c:\lrlfrlx.exe upx \??\c:\9ppjv.exe upx behavioral2/memory/4052-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2168-130-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\thhhbh.exe upx \??\c:\nnhbtn.exe upx behavioral2/memory/2696-150-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xfllxrf.exe upx behavioral2/memory/440-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2088-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1724-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2012-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4816-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4320-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2948-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3212-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4144-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3160-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3576-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/464-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1508-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4524-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1320-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1972-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4396-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4364-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/208-161-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dpppd.exedddpj.exe1jjvp.exexrrfffl.exe5ttnht.exe9lllfff.exelrlflrf.exexflxlfx.exelxfxrlf.exefxfrlxx.exehbbthh.exejppjd.exelfrllfl.exeddvjv.exejvpdp.exedddvj.exebbhhhh.exeddpjd.exentnbtn.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exedjpdp.exe9vvpd.exennhbnh.exexrfxlll.exepvvjd.exerfffxrf.exetnnbth.exevjvvp.exevvpdp.exefrxlxrl.exebhntbn.exe7nbtbt.exedppdv.exe7rxlxrr.exehthtbb.exenhhbnh.exedvjdj.exexrrlfrl.exentbnbb.exe7vvjv.exelxrfrlx.exedescription pid process target process PID 976 wrote to memory of 2124 976 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe djpdp.exe PID 976 wrote to memory of 2124 976 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe djpdp.exe PID 976 wrote to memory of 2124 976 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe djpdp.exe PID 2124 wrote to memory of 4472 2124 djpdp.exe 9vvpd.exe PID 2124 wrote to memory of 4472 2124 djpdp.exe 9vvpd.exe PID 2124 wrote to memory of 4472 2124 djpdp.exe 9vvpd.exe PID 4472 wrote to memory of 4512 4472 9vvpd.exe nnhbnh.exe PID 4472 wrote to memory of 4512 4472 9vvpd.exe nnhbnh.exe PID 4472 wrote to memory of 4512 4472 9vvpd.exe nnhbnh.exe PID 4512 wrote to memory of 4416 4512 nnhbnh.exe xrfxlll.exe PID 4512 wrote to memory of 4416 4512 nnhbnh.exe xrfxlll.exe PID 4512 wrote to memory of 4416 4512 nnhbnh.exe xrfxlll.exe PID 4416 wrote to memory of 2100 4416 xrfxlll.exe pvvjd.exe PID 4416 wrote to memory of 2100 4416 xrfxlll.exe pvvjd.exe PID 4416 wrote to memory of 2100 4416 xrfxlll.exe pvvjd.exe PID 2100 wrote to memory of 2552 2100 pvvjd.exe rfffxrf.exe PID 2100 wrote to memory of 2552 2100 pvvjd.exe rfffxrf.exe PID 2100 wrote to memory of 2552 2100 pvvjd.exe rfffxrf.exe PID 2552 wrote to memory of 4132 2552 rfffxrf.exe 9rlxrlf.exe PID 2552 wrote to memory of 4132 2552 rfffxrf.exe 9rlxrlf.exe PID 2552 wrote to memory of 4132 2552 rfffxrf.exe 9rlxrlf.exe PID 4132 wrote to memory of 2380 4132 tnnbth.exe vjvvp.exe PID 4132 wrote to memory of 2380 4132 tnnbth.exe vjvvp.exe PID 4132 wrote to memory of 2380 4132 tnnbth.exe vjvvp.exe PID 2380 wrote to memory of 1340 2380 vjvvp.exe vvpdp.exe PID 2380 wrote to memory of 1340 2380 vjvvp.exe vvpdp.exe PID 2380 wrote to memory of 1340 2380 vjvvp.exe vvpdp.exe PID 1340 wrote to memory of 4444 1340 vvpdp.exe frxlxrl.exe PID 1340 wrote to memory of 4444 1340 vvpdp.exe frxlxrl.exe PID 1340 wrote to memory of 4444 1340 vvpdp.exe frxlxrl.exe PID 4444 wrote to memory of 1460 4444 frxlxrl.exe bhntbn.exe PID 4444 wrote to memory of 1460 4444 frxlxrl.exe bhntbn.exe PID 4444 wrote to memory of 1460 4444 frxlxrl.exe bhntbn.exe PID 1460 wrote to memory of 2332 1460 bhntbn.exe 7nbtbt.exe PID 1460 wrote to memory of 2332 1460 bhntbn.exe 7nbtbt.exe PID 1460 wrote to memory of 2332 1460 bhntbn.exe 7nbtbt.exe PID 2332 wrote to memory of 756 2332 7nbtbt.exe dppdv.exe PID 2332 wrote to memory of 756 2332 7nbtbt.exe dppdv.exe PID 2332 wrote to memory of 756 2332 7nbtbt.exe dppdv.exe PID 756 wrote to memory of 4120 756 dppdv.exe 7rxlxrr.exe PID 756 wrote to memory of 4120 756 dppdv.exe 7rxlxrr.exe PID 756 wrote to memory of 4120 756 dppdv.exe 7rxlxrr.exe PID 4120 wrote to memory of 952 4120 7rxlxrr.exe hthtbb.exe PID 4120 wrote to memory of 952 4120 7rxlxrr.exe hthtbb.exe PID 4120 wrote to memory of 952 4120 7rxlxrr.exe hthtbb.exe PID 952 wrote to memory of 3864 952 hthtbb.exe nhhbnh.exe PID 952 wrote to memory of 3864 952 hthtbb.exe nhhbnh.exe PID 952 wrote to memory of 3864 952 hthtbb.exe nhhbnh.exe PID 3864 wrote to memory of 4948 3864 nhhbnh.exe dvjdj.exe PID 3864 wrote to memory of 4948 3864 nhhbnh.exe dvjdj.exe PID 3864 wrote to memory of 4948 3864 nhhbnh.exe dvjdj.exe PID 4948 wrote to memory of 2872 4948 dvjdj.exe xrrlfrl.exe PID 4948 wrote to memory of 2872 4948 dvjdj.exe xrrlfrl.exe PID 4948 wrote to memory of 2872 4948 dvjdj.exe xrrlfrl.exe PID 2872 wrote to memory of 4060 2872 xrrlfrl.exe ntbnbb.exe PID 2872 wrote to memory of 4060 2872 xrrlfrl.exe ntbnbb.exe PID 2872 wrote to memory of 4060 2872 xrrlfrl.exe ntbnbb.exe PID 4060 wrote to memory of 2356 4060 ntbnbb.exe 7vvjv.exe PID 4060 wrote to memory of 2356 4060 ntbnbb.exe 7vvjv.exe PID 4060 wrote to memory of 2356 4060 ntbnbb.exe 7vvjv.exe PID 2356 wrote to memory of 4712 2356 7vvjv.exe lxrfrlx.exe PID 2356 wrote to memory of 4712 2356 7vvjv.exe lxrfrlx.exe PID 2356 wrote to memory of 4712 2356 7vvjv.exe lxrfrlx.exe PID 4712 wrote to memory of 3184 4712 lxrfrlx.exe bthnnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe"C:\Users\Admin\AppData\Local\Temp\13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\djpdp.exec:\djpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\9vvpd.exec:\9vvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\nnhbnh.exec:\nnhbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\xrfxlll.exec:\xrfxlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\pvvjd.exec:\pvvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\rfffxrf.exec:\rfffxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\tnnbth.exec:\tnnbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\vjvvp.exec:\vjvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\vvpdp.exec:\vvpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\frxlxrl.exec:\frxlxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\bhntbn.exec:\bhntbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\7nbtbt.exec:\7nbtbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\dppdv.exec:\dppdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\7rxlxrr.exec:\7rxlxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\hthtbb.exec:\hthtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\nhhbnh.exec:\nhhbnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\dvjdj.exec:\dvjdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\xrrlfrl.exec:\xrrlfrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\ntbnbb.exec:\ntbnbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\7vvjv.exec:\7vvjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\bthnnt.exec:\bthnnt.exe23⤵
- Executes dropped EXE
PID:3184 -
\??\c:\1vdvp.exec:\1vdvp.exe24⤵
- Executes dropped EXE
PID:3672 -
\??\c:\9xfrlfr.exec:\9xfrlfr.exe25⤵
- Executes dropped EXE
PID:4168 -
\??\c:\lrlfrlx.exec:\lrlfrlx.exe26⤵
- Executes dropped EXE
PID:2088 -
\??\c:\thhhbh.exec:\thhhbh.exe27⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9ppjv.exec:\9ppjv.exe28⤵
- Executes dropped EXE
PID:4052 -
\??\c:\fflfxfx.exec:\fflfxfx.exe29⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nnhbtn.exec:\nnhbtn.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pvpvp.exec:\pvpvp.exe31⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pppdv.exec:\pppdv.exe32⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xfllxrf.exec:\xfllxrf.exe33⤵
- Executes dropped EXE
PID:440 -
\??\c:\hbtnbt.exec:\hbtnbt.exe34⤵
- Executes dropped EXE
PID:208 -
\??\c:\jjvjd.exec:\jjvjd.exe35⤵
- Executes dropped EXE
PID:4364 -
\??\c:\pppjd.exec:\pppjd.exe36⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ffrlxfx.exec:\ffrlxfx.exe37⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bhhbhb.exec:\bhhbhb.exe38⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pjjpp.exec:\pjjpp.exe39⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ppdvv.exec:\ppdvv.exe40⤵
- Executes dropped EXE
PID:2012 -
\??\c:\fxffxxx.exec:\fxffxxx.exe41⤵
- Executes dropped EXE
PID:804 -
\??\c:\rrffllr.exec:\rrffllr.exe42⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5bnhbb.exec:\5bnhbb.exe43⤵
- Executes dropped EXE
PID:1972 -
\??\c:\pdjdd.exec:\pdjdd.exe44⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ddvjd.exec:\ddvjd.exe45⤵
- Executes dropped EXE
PID:920 -
\??\c:\9pdvp.exec:\9pdvp.exe46⤵
- Executes dropped EXE
PID:4524 -
\??\c:\xxrxrlf.exec:\xxrxrlf.exe47⤵
- Executes dropped EXE
PID:4816 -
\??\c:\hbthth.exec:\hbthth.exe48⤵
- Executes dropped EXE
PID:1508 -
\??\c:\3bhbnn.exec:\3bhbnn.exe49⤵
- Executes dropped EXE
PID:4320 -
\??\c:\ddpjd.exec:\ddpjd.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4516 -
\??\c:\flxxlll.exec:\flxxlll.exe51⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hbbttt.exec:\hbbttt.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hbhnhn.exec:\hbhnhn.exe53⤵
- Executes dropped EXE
PID:692 -
\??\c:\vvppj.exec:\vvppj.exe54⤵
- Executes dropped EXE
PID:3212 -
\??\c:\5jddv.exec:\5jddv.exe55⤵
- Executes dropped EXE
PID:772 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe56⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nbhntt.exec:\nbhntt.exe57⤵
- Executes dropped EXE
PID:1380 -
\??\c:\bhnbnh.exec:\bhnbnh.exe58⤵
- Executes dropped EXE
PID:4144 -
\??\c:\dvpdj.exec:\dvpdj.exe59⤵
- Executes dropped EXE
PID:3244 -
\??\c:\jppjd.exec:\jppjd.exe60⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lrfllxl.exec:\lrfllxl.exe61⤵
- Executes dropped EXE
PID:1672 -
\??\c:\9flffrx.exec:\9flffrx.exe62⤵
- Executes dropped EXE
PID:1528 -
\??\c:\tbnhhn.exec:\tbnhhn.exe63⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nhhnnn.exec:\nhhnnn.exe64⤵
- Executes dropped EXE
PID:4860 -
\??\c:\5pddv.exec:\5pddv.exe65⤵
- Executes dropped EXE
PID:3620 -
\??\c:\llrfrlf.exec:\llrfrlf.exe66⤵PID:4008
-
\??\c:\fffflrx.exec:\fffflrx.exe67⤵PID:2084
-
\??\c:\httnbt.exec:\httnbt.exe68⤵PID:400
-
\??\c:\hbbtnn.exec:\hbbtnn.exe69⤵PID:3580
-
\??\c:\pjppd.exec:\pjppd.exe70⤵PID:3160
-
\??\c:\djvpj.exec:\djvpj.exe71⤵PID:384
-
\??\c:\9rlxrlf.exec:\9rlxrlf.exe72⤵PID:4132
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe73⤵PID:3576
-
\??\c:\tntnnh.exec:\tntnnh.exe74⤵PID:464
-
\??\c:\thnhnn.exec:\thnhnn.exe75⤵PID:4932
-
\??\c:\rxxlfxl.exec:\rxxlfxl.exe76⤵PID:556
-
\??\c:\lrllfxr.exec:\lrllfxr.exe77⤵PID:2320
-
\??\c:\3bhbnn.exec:\3bhbnn.exe78⤵PID:2020
-
\??\c:\vdjdp.exec:\vdjdp.exe79⤵PID:4900
-
\??\c:\fllxrrl.exec:\fllxrrl.exe80⤵PID:1636
-
\??\c:\rlrrlxr.exec:\rlrrlxr.exe81⤵PID:1796
-
\??\c:\nhbttt.exec:\nhbttt.exe82⤵PID:1432
-
\??\c:\3djvd.exec:\3djvd.exe83⤵PID:1564
-
\??\c:\rlxrllr.exec:\rlxrllr.exe84⤵PID:968
-
\??\c:\lfrllfl.exec:\lfrllfl.exe85⤵
- System Location Discovery: System Language Discovery
PID:4948 -
\??\c:\jvdvp.exec:\jvdvp.exe86⤵PID:2872
-
\??\c:\pjpjv.exec:\pjpjv.exe87⤵PID:3152
-
\??\c:\lxfrxxl.exec:\lxfrxxl.exe88⤵PID:4984
-
\??\c:\hnthbt.exec:\hnthbt.exe89⤵PID:3404
-
\??\c:\vpjvp.exec:\vpjvp.exe90⤵PID:4116
-
\??\c:\xlxxfxx.exec:\xlxxfxx.exe91⤵PID:4776
-
\??\c:\xffxrlf.exec:\xffxrlf.exe92⤵PID:3184
-
\??\c:\nbhbnt.exec:\nbhbnt.exe93⤵PID:2880
-
\??\c:\hbbnnh.exec:\hbbnnh.exe94⤵PID:1200
-
\??\c:\jvvjd.exec:\jvvjd.exe95⤵PID:3628
-
\??\c:\xrrfrll.exec:\xrrfrll.exe96⤵PID:2168
-
\??\c:\3xxxrrr.exec:\3xxxrrr.exe97⤵PID:4928
-
\??\c:\thhhbt.exec:\thhhbt.exe98⤵PID:1744
-
\??\c:\dppjv.exec:\dppjv.exe99⤵PID:3476
-
\??\c:\xxlfrrr.exec:\xxlfrrr.exe100⤵PID:5048
-
\??\c:\lxrxrxr.exec:\lxrxrxr.exe101⤵PID:3544
-
\??\c:\nbbbtt.exec:\nbbbtt.exe102⤵PID:3188
-
\??\c:\pdpjv.exec:\pdpjv.exe103⤵PID:3708
-
\??\c:\dvvjp.exec:\dvvjp.exe104⤵PID:440
-
\??\c:\5xffrfx.exec:\5xffrfx.exe105⤵PID:208
-
\??\c:\hbbnhb.exec:\hbbnhb.exe106⤵PID:4528
-
\??\c:\dvvvv.exec:\dvvvv.exe107⤵PID:1152
-
\??\c:\jjvpp.exec:\jjvpp.exe108⤵PID:1272
-
\??\c:\xrffrll.exec:\xrffrll.exe109⤵PID:2504
-
\??\c:\rxllffx.exec:\rxllffx.exe110⤵PID:2372
-
\??\c:\tbhbth.exec:\tbhbth.exe111⤵PID:2028
-
\??\c:\djppp.exec:\djppp.exe112⤵PID:1600
-
\??\c:\dvvpj.exec:\dvvpj.exe113⤵PID:1696
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe114⤵PID:804
-
\??\c:\5btnhb.exec:\5btnhb.exe115⤵PID:1704
-
\??\c:\9ttbnn.exec:\9ttbnn.exe116⤵PID:4696
-
\??\c:\pvddp.exec:\pvddp.exe117⤵PID:4500
-
\??\c:\flxlffx.exec:\flxlffx.exe118⤵PID:2856
-
\??\c:\nnttnh.exec:\nnttnh.exe119⤵PID:2812
-
\??\c:\vdvpv.exec:\vdvpv.exe120⤵PID:3616
-
\??\c:\5vvpd.exec:\5vvpd.exe121⤵PID:3176
-
\??\c:\xllfxxr.exec:\xllfxxr.exe122⤵PID:4904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-