Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 19:57
Behavioral task
behavioral1
Sample
efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe
Resource
win7-20240708-en
General
-
Target
efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe
-
Size
335KB
-
MD5
3352ae640f8d2019a968527ea34338f0
-
SHA1
0f78bda70a60163b91bae2082e6b9d2f4124cadc
-
SHA256
efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6
-
SHA512
5fdcf2896e3fddc0c102aa88ca2df0b42fa23fe966569efb27a27e38625ccd1dcb2645148fc62fa4e61fbb15535c1b6e3d016b662002331c28807c31865b7505
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRb:R4wFHoSHYHUrAwfMp3CDRb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4720-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3816-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3756-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2804-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-675-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-690-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-699-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-839-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-952-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdvvp.exeffrrrrr.exehtnntt.exevddvv.exerxffrll.exejpddd.exethhhbt.exefxxxxll.exenhnhbb.exevpddv.exepdpjp.exerxffffl.exepvpdv.exehbhttb.exepjppp.exexlllffx.exepppjj.exexxxrrxr.exejjpjj.exerlxlrrr.exe1rfffrr.exe3dvpj.exexrrrxxx.exehnhbbb.exepddjj.exexrrlfff.exebbhtnn.exevjpvv.exepdjdd.exennnnnn.exe5lrxrrx.exebhbbtb.exetbbhbb.exeflffrrf.exehbbbtn.exedpvvv.exelfrfxrl.exebhtthb.exepppjp.exeffrfxrr.exejdpjd.exepdpjj.exelrrllrr.exehnhhhn.exevpvvp.exerlfrrxx.exexrxxxfl.exeppvpp.exe7rxrxfx.exe1bbbbb.exerrlxrrr.exepvvvv.exebnbnbt.exepdddj.exe5rxrllx.exehhhbbh.exe9vdvv.exexxrlffx.exebhbbtb.exehttttt.exetbnhhb.exe7vvvv.exerfflffr.exerlllffx.exepid process 5096 pdvvp.exe 2196 ffrrrrr.exe 1204 htnntt.exe 3264 vddvv.exe 216 rxffrll.exe 2788 jpddd.exe 3048 thhhbt.exe 1928 fxxxxll.exe 2348 nhnhbb.exe 832 vpddv.exe 4044 pdpjp.exe 4504 rxffffl.exe 2028 pvpdv.exe 1816 hbhttb.exe 4012 pjppp.exe 3480 xlllffx.exe 3128 pppjj.exe 4828 xxxrrxr.exe 3180 jjpjj.exe 3584 rlxlrrr.exe 1408 1rfffrr.exe 1164 3dvpj.exe 3076 xrrrxxx.exe 3216 hnhbbb.exe 1212 pddjj.exe 1240 xrrlfff.exe 552 bbhtnn.exe 5000 vjpvv.exe 1572 pdjdd.exe 4780 nnnnnn.exe 2628 5lrxrrx.exe 1756 bhbbtb.exe 516 tbbhbb.exe 3420 flffrrf.exe 4776 hbbbtn.exe 2224 dpvvv.exe 3816 lfrfxrl.exe 3548 bhtthb.exe 1232 pppjp.exe 4784 ffrfxrr.exe 384 jdpjd.exe 4724 pdpjj.exe 3356 lrrllrr.exe 3312 hnhhhn.exe 4268 vpvvp.exe 4804 rlfrrxx.exe 3756 xrxxxfl.exe 1440 ppvpp.exe 4248 7rxrxfx.exe 452 1bbbbb.exe 4468 rrlxrrr.exe 4868 pvvvv.exe 2788 bnbnbt.exe 3984 pdddj.exe 3652 5rxrllx.exe 2856 hhhbbh.exe 2140 9vdvv.exe 4264 xxrlffx.exe 1200 bhbbtb.exe 2748 httttt.exe 4960 tbnhhb.exe 3096 7vvvv.exe 4112 rfflffr.exe 976 rlllffx.exe -
Processes:
resource yara_rule behavioral2/memory/4720-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvvp.exe upx behavioral2/memory/4720-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrrrrr.exe upx behavioral2/memory/5096-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2196-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htnntt.exe upx behavioral2/memory/1204-18-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vddvv.exe upx behavioral2/memory/3264-21-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxffrll.exe upx behavioral2/memory/3264-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpddd.exe upx behavioral2/memory/216-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thhhbt.exe upx behavioral2/memory/2788-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxxxll.exe upx behavioral2/memory/1928-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3048-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnhbb.exe upx behavioral2/memory/2348-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpddv.exe upx C:\pdpjp.exe upx behavioral2/memory/832-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxffffl.exe upx behavioral2/memory/4044-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvpdv.exe upx behavioral2/memory/4504-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2028-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhttb.exe upx behavioral2/memory/1816-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjppp.exe upx C:\xlllffx.exe upx behavioral2/memory/4012-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pppjj.exe upx behavioral2/memory/3480-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxrrxr.exe upx behavioral2/memory/4828-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjpjj.exe upx behavioral2/memory/3180-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxlrrr.exe upx behavioral2/memory/3584-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3180-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4828-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1rfffrr.exe upx C:\3dvpj.exe upx \??\c:\xrrrxxx.exe upx \??\c:\hnhbbb.exe upx behavioral2/memory/3216-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddjj.exe upx behavioral2/memory/1212-126-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrrlfff.exe upx C:\bbhtnn.exe upx behavioral2/memory/552-135-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjpvv.exe upx behavioral2/memory/5000-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5000-142-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjdd.exe upx C:\nnnnnn.exe upx behavioral2/memory/1572-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lrxrrx.exe upx C:\bhbbtb.exe upx behavioral2/memory/2224-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3816-171-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
vdddj.exe3hhnnb.exenthhtb.exe7ntbtt.exe9httnt.exe3xllrxr.exevpdjd.exedjdvv.exejvppv.exe5httbt.exedjjjp.exettbbbb.exe1jjjp.exerxlllrr.exerrrllll.exeddjvd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9httnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xllrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5httbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exepdvvp.exeffrrrrr.exehtnntt.exevddvv.exerxffrll.exejpddd.exethhhbt.exefxxxxll.exenhnhbb.exevpddv.exepdpjp.exerxffffl.exepvpdv.exehbhttb.exepjppp.exexlllffx.exepppjj.exexxxrrxr.exejjpjj.exerlxlrrr.exe1rfffrr.exedescription pid process target process PID 4720 wrote to memory of 5096 4720 efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe pdvvp.exe PID 4720 wrote to memory of 5096 4720 efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe pdvvp.exe PID 4720 wrote to memory of 5096 4720 efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe pdvvp.exe PID 5096 wrote to memory of 2196 5096 pdvvp.exe ffrrrrr.exe PID 5096 wrote to memory of 2196 5096 pdvvp.exe ffrrrrr.exe PID 5096 wrote to memory of 2196 5096 pdvvp.exe ffrrrrr.exe PID 2196 wrote to memory of 1204 2196 ffrrrrr.exe htnntt.exe PID 2196 wrote to memory of 1204 2196 ffrrrrr.exe htnntt.exe PID 2196 wrote to memory of 1204 2196 ffrrrrr.exe htnntt.exe PID 1204 wrote to memory of 3264 1204 htnntt.exe vddvv.exe PID 1204 wrote to memory of 3264 1204 htnntt.exe vddvv.exe PID 1204 wrote to memory of 3264 1204 htnntt.exe vddvv.exe PID 3264 wrote to memory of 216 3264 vddvv.exe rxffrll.exe PID 3264 wrote to memory of 216 3264 vddvv.exe rxffrll.exe PID 3264 wrote to memory of 216 3264 vddvv.exe rxffrll.exe PID 216 wrote to memory of 2788 216 rxffrll.exe jpddd.exe PID 216 wrote to memory of 2788 216 rxffrll.exe jpddd.exe PID 216 wrote to memory of 2788 216 rxffrll.exe jpddd.exe PID 2788 wrote to memory of 3048 2788 jpddd.exe thhhbt.exe PID 2788 wrote to memory of 3048 2788 jpddd.exe thhhbt.exe PID 2788 wrote to memory of 3048 2788 jpddd.exe thhhbt.exe PID 3048 wrote to memory of 1928 3048 thhhbt.exe fxxxxll.exe PID 3048 wrote to memory of 1928 3048 thhhbt.exe fxxxxll.exe PID 3048 wrote to memory of 1928 3048 thhhbt.exe fxxxxll.exe PID 1928 wrote to memory of 2348 1928 fxxxxll.exe nhnhbb.exe PID 1928 wrote to memory of 2348 1928 fxxxxll.exe nhnhbb.exe PID 1928 wrote to memory of 2348 1928 fxxxxll.exe nhnhbb.exe PID 2348 wrote to memory of 832 2348 nhnhbb.exe vpddv.exe PID 2348 wrote to memory of 832 2348 nhnhbb.exe vpddv.exe PID 2348 wrote to memory of 832 2348 nhnhbb.exe vpddv.exe PID 832 wrote to memory of 4044 832 vpddv.exe pdpjp.exe PID 832 wrote to memory of 4044 832 vpddv.exe pdpjp.exe PID 832 wrote to memory of 4044 832 vpddv.exe pdpjp.exe PID 4044 wrote to memory of 4504 4044 pdpjp.exe rxffffl.exe PID 4044 wrote to memory of 4504 4044 pdpjp.exe rxffffl.exe PID 4044 wrote to memory of 4504 4044 pdpjp.exe rxffffl.exe PID 4504 wrote to memory of 2028 4504 rxffffl.exe pvpdv.exe PID 4504 wrote to memory of 2028 4504 rxffffl.exe pvpdv.exe PID 4504 wrote to memory of 2028 4504 rxffffl.exe pvpdv.exe PID 2028 wrote to memory of 1816 2028 pvpdv.exe hbhttb.exe PID 2028 wrote to memory of 1816 2028 pvpdv.exe hbhttb.exe PID 2028 wrote to memory of 1816 2028 pvpdv.exe hbhttb.exe PID 1816 wrote to memory of 4012 1816 hbhttb.exe pjppp.exe PID 1816 wrote to memory of 4012 1816 hbhttb.exe pjppp.exe PID 1816 wrote to memory of 4012 1816 hbhttb.exe pjppp.exe PID 4012 wrote to memory of 3480 4012 pjppp.exe xlllffx.exe PID 4012 wrote to memory of 3480 4012 pjppp.exe xlllffx.exe PID 4012 wrote to memory of 3480 4012 pjppp.exe xlllffx.exe PID 3480 wrote to memory of 3128 3480 xlllffx.exe pppjj.exe PID 3480 wrote to memory of 3128 3480 xlllffx.exe pppjj.exe PID 3480 wrote to memory of 3128 3480 xlllffx.exe pppjj.exe PID 3128 wrote to memory of 4828 3128 pppjj.exe xxxrrxr.exe PID 3128 wrote to memory of 4828 3128 pppjj.exe xxxrrxr.exe PID 3128 wrote to memory of 4828 3128 pppjj.exe xxxrrxr.exe PID 4828 wrote to memory of 3180 4828 xxxrrxr.exe jjpjj.exe PID 4828 wrote to memory of 3180 4828 xxxrrxr.exe jjpjj.exe PID 4828 wrote to memory of 3180 4828 xxxrrxr.exe jjpjj.exe PID 3180 wrote to memory of 3584 3180 jjpjj.exe rlxlrrr.exe PID 3180 wrote to memory of 3584 3180 jjpjj.exe rlxlrrr.exe PID 3180 wrote to memory of 3584 3180 jjpjj.exe rlxlrrr.exe PID 3584 wrote to memory of 1408 3584 rlxlrrr.exe 1rfffrr.exe PID 3584 wrote to memory of 1408 3584 rlxlrrr.exe 1rfffrr.exe PID 3584 wrote to memory of 1408 3584 rlxlrrr.exe 1rfffrr.exe PID 1408 wrote to memory of 1164 1408 1rfffrr.exe 3dvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe"C:\Users\Admin\AppData\Local\Temp\efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\pdvvp.exec:\pdvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\htnntt.exec:\htnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\vddvv.exec:\vddvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\rxffrll.exec:\rxffrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\jpddd.exec:\jpddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\thhhbt.exec:\thhhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\fxxxxll.exec:\fxxxxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\nhnhbb.exec:\nhnhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\vpddv.exec:\vpddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\pdpjp.exec:\pdpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\rxffffl.exec:\rxffffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\pvpdv.exec:\pvpdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\hbhttb.exec:\hbhttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\pjppp.exec:\pjppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\xlllffx.exec:\xlllffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\pppjj.exec:\pppjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\xxxrrxr.exec:\xxxrrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\jjpjj.exec:\jjpjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\rlxlrrr.exec:\rlxlrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\1rfffrr.exec:\1rfffrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\3dvpj.exec:\3dvpj.exe23⤵
- Executes dropped EXE
PID:1164 -
\??\c:\xrrrxxx.exec:\xrrrxxx.exe24⤵
- Executes dropped EXE
PID:3076 -
\??\c:\hnhbbb.exec:\hnhbbb.exe25⤵
- Executes dropped EXE
PID:3216 -
\??\c:\pddjj.exec:\pddjj.exe26⤵
- Executes dropped EXE
PID:1212 -
\??\c:\xrrlfff.exec:\xrrlfff.exe27⤵
- Executes dropped EXE
PID:1240 -
\??\c:\bbhtnn.exec:\bbhtnn.exe28⤵
- Executes dropped EXE
PID:552 -
\??\c:\vjpvv.exec:\vjpvv.exe29⤵
- Executes dropped EXE
PID:5000 -
\??\c:\pdjdd.exec:\pdjdd.exe30⤵
- Executes dropped EXE
PID:1572 -
\??\c:\nnnnnn.exec:\nnnnnn.exe31⤵
- Executes dropped EXE
PID:4780 -
\??\c:\5lrxrrx.exec:\5lrxrrx.exe32⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bhbbtb.exec:\bhbbtb.exe33⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tbbhbb.exec:\tbbhbb.exe34⤵
- Executes dropped EXE
PID:516 -
\??\c:\flffrrf.exec:\flffrrf.exe35⤵
- Executes dropped EXE
PID:3420 -
\??\c:\hbbbtn.exec:\hbbbtn.exe36⤵
- Executes dropped EXE
PID:4776 -
\??\c:\dpvvv.exec:\dpvvv.exe37⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lfrfxrl.exec:\lfrfxrl.exe38⤵
- Executes dropped EXE
PID:3816 -
\??\c:\bhtthb.exec:\bhtthb.exe39⤵
- Executes dropped EXE
PID:3548 -
\??\c:\pppjp.exec:\pppjp.exe40⤵
- Executes dropped EXE
PID:1232 -
\??\c:\ffrfxrr.exec:\ffrfxrr.exe41⤵
- Executes dropped EXE
PID:4784 -
\??\c:\jdpjd.exec:\jdpjd.exe42⤵
- Executes dropped EXE
PID:384 -
\??\c:\pdpjj.exec:\pdpjj.exe43⤵
- Executes dropped EXE
PID:4724 -
\??\c:\lrrllrr.exec:\lrrllrr.exe44⤵
- Executes dropped EXE
PID:3356 -
\??\c:\hnhhhn.exec:\hnhhhn.exe45⤵
- Executes dropped EXE
PID:3312 -
\??\c:\vpvvp.exec:\vpvvp.exe46⤵
- Executes dropped EXE
PID:4268 -
\??\c:\rlfrrxx.exec:\rlfrrxx.exe47⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe48⤵
- Executes dropped EXE
PID:3756 -
\??\c:\hhhhhb.exec:\hhhhhb.exe49⤵PID:4364
-
\??\c:\ppvpp.exec:\ppvpp.exe50⤵
- Executes dropped EXE
PID:1440 -
\??\c:\7rxrxfx.exec:\7rxrxfx.exe51⤵
- Executes dropped EXE
PID:4248 -
\??\c:\1bbbbb.exec:\1bbbbb.exe52⤵
- Executes dropped EXE
PID:452 -
\??\c:\rrlxrrr.exec:\rrlxrrr.exe53⤵
- Executes dropped EXE
PID:4468 -
\??\c:\pvvvv.exec:\pvvvv.exe54⤵
- Executes dropped EXE
PID:4868 -
\??\c:\bnbnbt.exec:\bnbnbt.exe55⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pdddj.exec:\pdddj.exe56⤵
- Executes dropped EXE
PID:3984 -
\??\c:\5rxrllx.exec:\5rxrllx.exe57⤵
- Executes dropped EXE
PID:3652 -
\??\c:\hhhbbh.exec:\hhhbbh.exe58⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9vdvv.exec:\9vdvv.exe59⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xxrlffx.exec:\xxrlffx.exe60⤵
- Executes dropped EXE
PID:4264 -
\??\c:\bhbbtb.exec:\bhbbtb.exe61⤵
- Executes dropped EXE
PID:1200 -
\??\c:\httttt.exec:\httttt.exe62⤵
- Executes dropped EXE
PID:2748 -
\??\c:\tbnhhb.exec:\tbnhhb.exe63⤵
- Executes dropped EXE
PID:4960 -
\??\c:\7vvvv.exec:\7vvvv.exe64⤵
- Executes dropped EXE
PID:3096 -
\??\c:\rfflffr.exec:\rfflffr.exe65⤵
- Executes dropped EXE
PID:4112 -
\??\c:\rlllffx.exec:\rlllffx.exe66⤵
- Executes dropped EXE
PID:976 -
\??\c:\thtbbn.exec:\thtbbn.exe67⤵PID:4032
-
\??\c:\vdvvd.exec:\vdvvd.exe68⤵PID:2028
-
\??\c:\ffllxxr.exec:\ffllxxr.exe69⤵PID:868
-
\??\c:\xfrxflf.exec:\xfrxflf.exe70⤵PID:4552
-
\??\c:\bhnhtt.exec:\bhnhtt.exe71⤵PID:2216
-
\??\c:\vjpvd.exec:\vjpvd.exe72⤵PID:4904
-
\??\c:\llrlfrl.exec:\llrlfrl.exe73⤵PID:4512
-
\??\c:\xlllfff.exec:\xlllfff.exe74⤵PID:3308
-
\??\c:\pddjd.exec:\pddjd.exe75⤵PID:3980
-
\??\c:\vvdvd.exec:\vvdvd.exe76⤵PID:4956
-
\??\c:\1lrlxrl.exec:\1lrlxrl.exe77⤵PID:4652
-
\??\c:\hnhhhn.exec:\hnhhhn.exe78⤵PID:956
-
\??\c:\djdvv.exec:\djdvv.exe79⤵
- System Location Discovery: System Language Discovery
PID:3252 -
\??\c:\lfllllf.exec:\lfllllf.exe80⤵PID:2280
-
\??\c:\llrrrrx.exec:\llrrrrx.exe81⤵PID:3956
-
\??\c:\tntttb.exec:\tntttb.exe82⤵PID:4740
-
\??\c:\jpjjp.exec:\jpjjp.exe83⤵PID:1364
-
\??\c:\7rxxrxx.exec:\7rxxrxx.exe84⤵PID:1940
-
\??\c:\ntttbn.exec:\ntttbn.exe85⤵PID:1212
-
\??\c:\vjddd.exec:\vjddd.exe86⤵PID:3132
-
\??\c:\fflfffx.exec:\fflfffx.exe87⤵PID:2252
-
\??\c:\3bttnb.exec:\3bttnb.exe88⤵PID:552
-
\??\c:\1jppv.exec:\1jppv.exe89⤵PID:2324
-
\??\c:\3ffxxxr.exec:\3ffxxxr.exe90⤵PID:4668
-
\??\c:\9ttttt.exec:\9ttttt.exe91⤵PID:4796
-
\??\c:\hthhhh.exec:\hthhhh.exe92⤵PID:1868
-
\??\c:\dpjjj.exec:\dpjjj.exe93⤵PID:1072
-
\??\c:\fffxrxr.exec:\fffxrxr.exe94⤵PID:3668
-
\??\c:\3hhhht.exec:\3hhhht.exe95⤵PID:4756
-
\??\c:\dvdvj.exec:\dvdvj.exe96⤵PID:2192
-
\??\c:\rxrrrxr.exec:\rxrrrxr.exe97⤵PID:4544
-
\??\c:\btnbtn.exec:\btnbtn.exe98⤵PID:432
-
\??\c:\nbhtnh.exec:\nbhtnh.exe99⤵PID:5016
-
\??\c:\vpppp.exec:\vpppp.exe100⤵PID:3724
-
\??\c:\tbbthh.exec:\tbbthh.exe101⤵PID:1104
-
\??\c:\ttbbbb.exec:\ttbbbb.exe102⤵
- System Location Discovery: System Language Discovery
PID:3336 -
\??\c:\vpddp.exec:\vpddp.exe103⤵PID:2760
-
\??\c:\ffrrlrr.exec:\ffrrlrr.exe104⤵PID:4664
-
\??\c:\hnhhhn.exec:\hnhhhn.exe105⤵PID:2560
-
\??\c:\vdjdd.exec:\vdjdd.exe106⤵PID:1888
-
\??\c:\7lxxfff.exec:\7lxxfff.exe107⤵PID:3720
-
\??\c:\ntnnhb.exec:\ntnnhb.exe108⤵PID:2896
-
\??\c:\ddjdd.exec:\ddjdd.exe109⤵PID:3688
-
\??\c:\pppjd.exec:\pppjd.exe110⤵PID:4452
-
\??\c:\lxlrxll.exec:\lxlrxll.exe111⤵PID:1032
-
\??\c:\thhttb.exec:\thhttb.exe112⤵PID:4348
-
\??\c:\vdddj.exec:\vdddj.exe113⤵PID:3248
-
\??\c:\3fxrffr.exec:\3fxrffr.exe114⤵PID:4572
-
\??\c:\nntttn.exec:\nntttn.exe115⤵PID:4248
-
\??\c:\pjdvv.exec:\pjdvv.exe116⤵PID:2968
-
\??\c:\dddvp.exec:\dddvp.exe117⤵PID:3880
-
\??\c:\lxlxrxl.exec:\lxlxrxl.exe118⤵PID:2196
-
\??\c:\tbtnhh.exec:\tbtnhh.exe119⤵PID:3932
-
\??\c:\dvppp.exec:\dvppp.exe120⤵PID:1268
-
\??\c:\lxflxlf.exec:\lxflxlf.exe121⤵PID:1236
-
\??\c:\rfxlxlx.exec:\rfxlxlx.exe122⤵PID:2128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-