Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2024, 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe
-
Size
349KB
-
MD5
c127df286098c6e50dcc0f98b10238be
-
SHA1
01493860a0e40fa19b8e9787316dc79f9db6d558
-
SHA256
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606
-
SHA512
d005189b32569ca993f161e097f60762db154c053fdd432f1c2dd3c853ffdb8399acfec88e77cef27048b4c7ddbde2e08c2cbcbf7162eda1e5c4615db3f473d1
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA4K:l7TcbWXZshJX2VGd4K
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1080-4-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2932-12-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2884-11-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3580-23-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1672-28-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4844-35-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3216-40-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3444-45-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3900-52-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2080-57-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2948-63-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4576-68-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4460-74-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1780-80-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1224-91-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4004-97-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1288-102-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3424-109-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1468-120-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3064-140-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3416-135-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4440-147-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1000-153-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/376-165-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1996-176-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1564-189-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2960-196-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4976-206-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1980-210-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/224-217-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4284-236-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2932-249-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3620-256-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2588-266-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1664-282-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3376-289-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3092-299-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3588-312-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1364-316-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4712-338-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4776-345-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3248-364-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1332-380-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4748-387-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1724-406-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2664-410-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2284-531-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2276-535-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1980-577-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4312-602-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1468-690-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1192-709-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1092-713-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3908-774-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3348-778-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2784-831-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4968-835-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1172-899-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1932-954-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4436-1093-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/536-1211-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1620-1375-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3908-1708-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2184-1953-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2884 ppjdv.exe 2932 7lxrxll.exe 3580 pdppj.exe 1672 7xfxxff.exe 4844 9bhnnb.exe 3216 lflllff.exe 3444 bhtnbt.exe 3900 vvdvp.exe 2080 thhhbb.exe 2948 xfrlrxf.exe 4576 bnhhtt.exe 4460 lfrlxxx.exe 1780 bhnnht.exe 2668 rxxrllf.exe 1224 bbbnhn.exe 4004 rrrfrlf.exe 1288 tbthtn.exe 3424 jpdvd.exe 4468 xlrrrxx.exe 1468 9ntnhh.exe 2008 xxxrfxr.exe 1620 1htnhh.exe 3416 jjvpj.exe 3064 3xlxlfr.exe 4440 btbtnt.exe 1000 xxlfxrf.exe 1480 ntttnn.exe 376 rxrrrff.exe 4564 dppjd.exe 1996 1lffxff.exe 1332 tttnhh.exe 2852 llrlfxr.exe 1564 rlxlxlx.exe 1772 bbbhhb.exe 2960 dvvpj.exe 4064 lxxrffl.exe 2956 xxxfxfx.exe 4976 1tbttb.exe 1980 vppjd.exe 1856 ffxllff.exe 224 ttnhbb.exe 3400 fxfxrll.exe 1800 thhtnn.exe 1036 7vppj.exe 2112 vvvjj.exe 4864 lxffxrr.exe 4284 nhtnnh.exe 2912 pvdvv.exe 4216 fxfxflf.exe 3908 bbhhhh.exe 2932 tntnhh.exe 1420 5jjdd.exe 3620 jpvpj.exe 2036 rxrlfff.exe 3200 ttntnb.exe 2588 httnnn.exe 764 dvvpj.exe 3444 rlfxrrr.exe 5000 ffffxff.exe 1736 5nnhhh.exe 1664 dvdvp.exe 948 rflrlfx.exe 3376 1ntnnt.exe 3288 tbhbtn.exe -
resource yara_rule behavioral2/memory/1080-4-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2932-12-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2884-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1672-24-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3580-23-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1672-28-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4844-35-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3216-40-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3444-45-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3900-52-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2080-57-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2948-63-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4576-68-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4460-74-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1780-80-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1224-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4004-97-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1288-102-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3424-109-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1468-120-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3064-140-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3416-135-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4440-147-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1000-153-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/376-165-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1996-176-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1564-189-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2960-196-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4976-206-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1980-210-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/224-217-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4284-236-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2932-249-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3620-256-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2588-266-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1664-282-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3376-289-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3092-299-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3588-312-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1364-316-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4712-338-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4776-345-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3248-364-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1332-380-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4748-387-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1724-406-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2664-410-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2284-531-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2276-535-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2068-554-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1956-564-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1980-577-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4312-602-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1468-690-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1192-709-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1092-713-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3908-774-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3348-778-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1984-788-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2784-831-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4968-835-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1172-899-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1932-954-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4436-1093-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 2884 1080 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 82 PID 1080 wrote to memory of 2884 1080 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 82 PID 1080 wrote to memory of 2884 1080 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 82 PID 2884 wrote to memory of 2932 2884 ppjdv.exe 83 PID 2884 wrote to memory of 2932 2884 ppjdv.exe 83 PID 2884 wrote to memory of 2932 2884 ppjdv.exe 83 PID 2932 wrote to memory of 3580 2932 7lxrxll.exe 84 PID 2932 wrote to memory of 3580 2932 7lxrxll.exe 84 PID 2932 wrote to memory of 3580 2932 7lxrxll.exe 84 PID 3580 wrote to memory of 1672 3580 pdppj.exe 85 PID 3580 wrote to memory of 1672 3580 pdppj.exe 85 PID 3580 wrote to memory of 1672 3580 pdppj.exe 85 PID 1672 wrote to memory of 4844 1672 7xfxxff.exe 86 PID 1672 wrote to memory of 4844 1672 7xfxxff.exe 86 PID 1672 wrote to memory of 4844 1672 7xfxxff.exe 86 PID 4844 wrote to memory of 3216 4844 9bhnnb.exe 87 PID 4844 wrote to memory of 3216 4844 9bhnnb.exe 87 PID 4844 wrote to memory of 3216 4844 9bhnnb.exe 87 PID 3216 wrote to memory of 3444 3216 lflllff.exe 88 PID 3216 wrote to memory of 3444 3216 lflllff.exe 88 PID 3216 wrote to memory of 3444 3216 lflllff.exe 88 PID 3444 wrote to memory of 3900 3444 bhtnbt.exe 89 PID 3444 wrote to memory of 3900 3444 bhtnbt.exe 89 PID 3444 wrote to memory of 3900 3444 bhtnbt.exe 89 PID 3900 wrote to memory of 2080 3900 vvdvp.exe 90 PID 3900 wrote to memory of 2080 3900 vvdvp.exe 90 PID 3900 wrote to memory of 2080 3900 vvdvp.exe 90 PID 2080 wrote to memory of 2948 2080 thhhbb.exe 91 PID 2080 wrote to memory of 2948 2080 thhhbb.exe 91 PID 2080 wrote to memory of 2948 2080 thhhbb.exe 91 PID 2948 wrote to memory of 4576 2948 xfrlrxf.exe 92 PID 2948 wrote to memory of 4576 2948 xfrlrxf.exe 92 PID 2948 wrote to memory of 4576 2948 xfrlrxf.exe 92 PID 4576 wrote to memory of 4460 4576 bnhhtt.exe 93 PID 4576 wrote to memory of 4460 4576 bnhhtt.exe 93 PID 4576 wrote to memory of 4460 4576 bnhhtt.exe 93 PID 4460 wrote to memory of 1780 4460 lfrlxxx.exe 94 PID 4460 wrote to memory of 1780 4460 lfrlxxx.exe 94 PID 4460 wrote to memory of 1780 4460 lfrlxxx.exe 94 PID 1780 wrote to memory of 2668 1780 bhnnht.exe 95 PID 1780 wrote to memory of 2668 1780 bhnnht.exe 95 PID 1780 wrote to memory of 2668 1780 bhnnht.exe 95 PID 2668 wrote to memory of 1224 2668 rxxrllf.exe 96 PID 2668 wrote to memory of 1224 2668 rxxrllf.exe 96 PID 2668 wrote to memory of 1224 2668 rxxrllf.exe 96 PID 1224 wrote to memory of 4004 1224 bbbnhn.exe 97 PID 1224 wrote to memory of 4004 1224 bbbnhn.exe 97 PID 1224 wrote to memory of 4004 1224 bbbnhn.exe 97 PID 4004 wrote to memory of 1288 4004 rrrfrlf.exe 98 PID 4004 wrote to memory of 1288 4004 rrrfrlf.exe 98 PID 4004 wrote to memory of 1288 4004 rrrfrlf.exe 98 PID 1288 wrote to memory of 3424 1288 tbthtn.exe 99 PID 1288 wrote to memory of 3424 1288 tbthtn.exe 99 PID 1288 wrote to memory of 3424 1288 tbthtn.exe 99 PID 3424 wrote to memory of 4468 3424 jpdvd.exe 100 PID 3424 wrote to memory of 4468 3424 jpdvd.exe 100 PID 3424 wrote to memory of 4468 3424 jpdvd.exe 100 PID 4468 wrote to memory of 1468 4468 xlrrrxx.exe 101 PID 4468 wrote to memory of 1468 4468 xlrrrxx.exe 101 PID 4468 wrote to memory of 1468 4468 xlrrrxx.exe 101 PID 1468 wrote to memory of 2008 1468 9ntnhh.exe 102 PID 1468 wrote to memory of 2008 1468 9ntnhh.exe 102 PID 1468 wrote to memory of 2008 1468 9ntnhh.exe 102 PID 2008 wrote to memory of 1620 2008 xxxrfxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe"C:\Users\Admin\AppData\Local\Temp\d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\ppjdv.exec:\ppjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\7lxrxll.exec:\7lxrxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pdppj.exec:\pdppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\7xfxxff.exec:\7xfxxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\9bhnnb.exec:\9bhnnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lflllff.exec:\lflllff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\bhtnbt.exec:\bhtnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\vvdvp.exec:\vvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\thhhbb.exec:\thhhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\xfrlrxf.exec:\xfrlrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\bnhhtt.exec:\bnhhtt.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\lfrlxxx.exec:\lfrlxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\bhnnht.exec:\bhnnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\rxxrllf.exec:\rxxrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bbbnhn.exec:\bbbnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\rrrfrlf.exec:\rrrfrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\tbthtn.exec:\tbthtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\jpdvd.exec:\jpdvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\9ntnhh.exec:\9ntnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\xxxrfxr.exec:\xxxrfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\1htnhh.exec:\1htnhh.exe23⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jjvpj.exec:\jjvpj.exe24⤵
- Executes dropped EXE
PID:3416 -
\??\c:\3xlxlfr.exec:\3xlxlfr.exe25⤵
- Executes dropped EXE
PID:3064 -
\??\c:\btbtnt.exec:\btbtnt.exe26⤵
- Executes dropped EXE
PID:4440 -
\??\c:\xxlfxrf.exec:\xxlfxrf.exe27⤵
- Executes dropped EXE
PID:1000 -
\??\c:\ntttnn.exec:\ntttnn.exe28⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rxrrrff.exec:\rxrrrff.exe29⤵
- Executes dropped EXE
PID:376 -
\??\c:\dppjd.exec:\dppjd.exe30⤵
- Executes dropped EXE
PID:4564 -
\??\c:\1lffxff.exec:\1lffxff.exe31⤵
- Executes dropped EXE
PID:1996 -
\??\c:\tttnhh.exec:\tttnhh.exe32⤵
- Executes dropped EXE
PID:1332 -
\??\c:\llrlfxr.exec:\llrlfxr.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2852 -
\??\c:\rlxlxlx.exec:\rlxlxlx.exe34⤵
- Executes dropped EXE
PID:1564 -
\??\c:\bbbhhb.exec:\bbbhhb.exe35⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dvvpj.exec:\dvvpj.exe36⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lxxrffl.exec:\lxxrffl.exe37⤵
- Executes dropped EXE
PID:4064 -
\??\c:\xxxfxfx.exec:\xxxfxfx.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1tbttb.exec:\1tbttb.exe39⤵
- Executes dropped EXE
PID:4976 -
\??\c:\vppjd.exec:\vppjd.exe40⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ffxllff.exec:\ffxllff.exe41⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ttnhbb.exec:\ttnhbb.exe42⤵
- Executes dropped EXE
PID:224 -
\??\c:\fxfxrll.exec:\fxfxrll.exe43⤵
- Executes dropped EXE
PID:3400 -
\??\c:\thhtnn.exec:\thhtnn.exe44⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7vppj.exec:\7vppj.exe45⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vvvjj.exec:\vvvjj.exe46⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lxffxrr.exec:\lxffxrr.exe47⤵
- Executes dropped EXE
PID:4864 -
\??\c:\nhtnnh.exec:\nhtnnh.exe48⤵
- Executes dropped EXE
PID:4284 -
\??\c:\pvdvv.exec:\pvdvv.exe49⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fxfxflf.exec:\fxfxflf.exe50⤵
- Executes dropped EXE
PID:4216 -
\??\c:\bbhhhh.exec:\bbhhhh.exe51⤵
- Executes dropped EXE
PID:3908 -
\??\c:\tntnhh.exec:\tntnhh.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5jjdd.exec:\5jjdd.exe53⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jpvpj.exec:\jpvpj.exe54⤵
- Executes dropped EXE
PID:3620 -
\??\c:\rxrlfff.exec:\rxrlfff.exe55⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ttntnb.exec:\ttntnb.exe56⤵
- Executes dropped EXE
PID:3200 -
\??\c:\httnnn.exec:\httnnn.exe57⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dvvpj.exec:\dvvpj.exe58⤵
- Executes dropped EXE
PID:764 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe59⤵
- Executes dropped EXE
PID:3444 -
\??\c:\ffffxff.exec:\ffffxff.exe60⤵
- Executes dropped EXE
PID:5000 -
\??\c:\5nnhhh.exec:\5nnhhh.exe61⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvdvp.exec:\dvdvp.exe62⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rflrlfx.exec:\rflrlfx.exe63⤵
- Executes dropped EXE
PID:948 -
\??\c:\1ntnnt.exec:\1ntnnt.exe64⤵
- Executes dropped EXE
PID:3376 -
\??\c:\tbhbtn.exec:\tbhbtn.exe65⤵
- Executes dropped EXE
PID:3288 -
\??\c:\9ppjj.exec:\9ppjj.exe66⤵PID:552
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe67⤵PID:3092
-
\??\c:\tnhhbb.exec:\tnhhbb.exe68⤵PID:3520
-
\??\c:\1jjjd.exec:\1jjjd.exe69⤵PID:1320
-
\??\c:\pppvv.exec:\pppvv.exe70⤵PID:2640
-
\??\c:\rllfxxr.exec:\rllfxxr.exe71⤵PID:3588
-
\??\c:\xlrlfff.exec:\xlrlfff.exe72⤵PID:1364
-
\??\c:\nhbtbh.exec:\nhbtbh.exe73⤵PID:3132
-
\??\c:\pvppj.exec:\pvppj.exe74⤵PID:4048
-
\??\c:\5ffxlff.exec:\5ffxlff.exe75⤵PID:4092
-
\??\c:\rflfflf.exec:\rflfflf.exe76⤵PID:4964
-
\??\c:\5nnnhh.exec:\5nnnhh.exe77⤵PID:3876
-
\??\c:\httnbb.exec:\httnbb.exe78⤵PID:1732
-
\??\c:\vpvvj.exec:\vpvvj.exe79⤵PID:4712
-
\??\c:\rxrrllf.exec:\rxrrllf.exe80⤵PID:1620
-
\??\c:\ttbtnn.exec:\ttbtnn.exe81⤵PID:4776
-
\??\c:\5tnbth.exec:\5tnbth.exe82⤵PID:3064
-
\??\c:\ddpjv.exec:\ddpjv.exe83⤵PID:4252
-
\??\c:\5rrlxxr.exec:\5rrlxxr.exe84⤵PID:1312
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe85⤵PID:1424
-
\??\c:\btnbnb.exec:\btnbnb.exe86⤵PID:2228
-
\??\c:\vdjdp.exec:\vdjdp.exe87⤵PID:3248
-
\??\c:\xffrffr.exec:\xffrffr.exe88⤵PID:376
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe89⤵PID:3840
-
\??\c:\nhhbtt.exec:\nhhbtt.exe90⤵PID:4372
-
\??\c:\1bbbnn.exec:\1bbbnn.exe91⤵PID:1996
-
\??\c:\jjvpd.exec:\jjvpd.exe92⤵PID:1332
-
\??\c:\xxrlffx.exec:\xxrlffx.exe93⤵PID:3860
-
\??\c:\bnttnn.exec:\bnttnn.exe94⤵PID:4748
-
\??\c:\dvdvj.exec:\dvdvj.exe95⤵PID:2180
-
\??\c:\7rfrlfl.exec:\7rfrlfl.exe96⤵PID:2720
-
\??\c:\bbhhbh.exec:\bbhhbh.exe97⤵PID:1272
-
\??\c:\hhnhnt.exec:\hhnhnt.exe98⤵PID:2272
-
\??\c:\dvdvj.exec:\dvdvj.exe99⤵PID:1788
-
\??\c:\djjjv.exec:\djjjv.exe100⤵PID:1724
-
\??\c:\fxflllr.exec:\fxflllr.exe101⤵PID:2664
-
\??\c:\3nbtnn.exec:\3nbtnn.exe102⤵PID:3080
-
\??\c:\htnhhh.exec:\htnhhh.exe103⤵PID:3992
-
\??\c:\ddvjd.exec:\ddvjd.exe104⤵PID:3116
-
\??\c:\frxrfxx.exec:\frxrfxx.exe105⤵PID:4588
-
\??\c:\rlllxlf.exec:\rlllxlf.exe106⤵PID:4720
-
\??\c:\nbthnt.exec:\nbthnt.exe107⤵PID:4296
-
\??\c:\dvpjj.exec:\dvpjj.exe108⤵PID:4312
-
\??\c:\jddvv.exec:\jddvv.exe109⤵PID:4264
-
\??\c:\fxfxflr.exec:\fxfxflr.exe110⤵PID:4760
-
\??\c:\ffrrlrr.exec:\ffrrlrr.exe111⤵PID:752
-
\??\c:\bbbhbb.exec:\bbbhbb.exe112⤵PID:1580
-
\??\c:\vdjdv.exec:\vdjdv.exe113⤵PID:4332
-
\??\c:\xlrrlll.exec:\xlrrlll.exe114⤵PID:4868
-
\??\c:\nbhhhh.exec:\nbhhhh.exe115⤵PID:2464
-
\??\c:\pjpjd.exec:\pjpjd.exe116⤵PID:3216
-
\??\c:\3dpvv.exec:\3dpvv.exe117⤵PID:944
-
\??\c:\rflfxxf.exec:\rflfxxf.exe118⤵PID:3536
-
\??\c:\nbnnhh.exec:\nbnnhh.exe119⤵PID:1704
-
\??\c:\5ntnbb.exec:\5ntnbb.exe120⤵PID:792
-
\??\c:\dvddv.exec:\dvddv.exe121⤵PID:1736
-
\??\c:\flfrllf.exec:\flfrllf.exe122⤵PID:228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-