Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2024, 05:05
Behavioral task
behavioral1
Sample
86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe
-
Size
90KB
-
MD5
7c91480a9e4740e4be8b02ae03cca360
-
SHA1
c934634f916c44cf4176bb66557e505d0034a0cc
-
SHA256
86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539
-
SHA512
a28ccafa97f2cd484cb8befcc834b121c5e3f431f339b2368466fd5a6a381354d074bc396e65acbe54da5e5d4314f6d4d7c4af329dfeac7bedac693732f43ae6
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOj2YUW+S436CA:9hOmTsF93UYfwC6GIoutyaVszyKd+XY+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4388-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/684-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3756-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-647-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-697-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-845-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-1005-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-1078-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-1112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-1137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-1321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2840 jjpjd.exe 1708 rxffllf.exe 2288 tntnnb.exe 3576 pvvpj.exe 3020 xxlrxll.exe 208 hhntnn.exe 4144 dvdvv.exe 3512 rfrlllf.exe 4952 nhnhnn.exe 3516 dvvjv.exe 3572 vpvvv.exe 1640 flrlfff.exe 3424 9nnhhn.exe 2924 1pjdd.exe 3476 xffxxxx.exe 4692 rfxfxxr.exe 912 hhbntt.exe 1336 pvpdd.exe 2640 xfrffff.exe 4576 lfffxff.exe 3612 jpppp.exe 1012 xrrllll.exe 4668 hhntnt.exe 3908 tbttnt.exe 3188 vpjdj.exe 4932 fxflfff.exe 4240 btbbhh.exe 3604 ntbbbb.exe 4732 7jddd.exe 4232 rfxxxxr.exe 684 rrlrlxl.exe 4088 ttbbbn.exe 1692 bbhhnn.exe 2096 ppjdp.exe 4348 7dddv.exe 4672 xrffrrl.exe 4928 ntthbb.exe 4840 vjjjj.exe 4596 rfxxrff.exe 1968 rfrlxff.exe 1820 nbbbbn.exe 3800 flxxxff.exe 4964 lfrxxlf.exe 4560 btbthh.exe 5044 7bhhhn.exe 1000 jvdvd.exe 3652 5rlffff.exe 3736 rrrrlll.exe 1472 bbhbtn.exe 2148 vjpjp.exe 1944 pjpjv.exe 5068 fxrrlll.exe 1388 5hhhbb.exe 3824 tnttbh.exe 840 dppjj.exe 2788 rxrfflf.exe 4456 rlllrlf.exe 1368 nbttnn.exe 1644 pjdvd.exe 1528 5rxxrrr.exe 1788 xrffllr.exe 3632 5hhhbb.exe 3048 7hthhn.exe 4756 ppvpv.exe -
resource yara_rule behavioral2/memory/4388-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023b6d-3.dat upx behavioral2/memory/4388-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b71-10.dat upx behavioral2/memory/2840-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b72-13.dat upx behavioral2/memory/1708-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b73-21.dat upx behavioral2/memory/2288-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b74-27.dat upx behavioral2/memory/3576-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b75-33.dat upx behavioral2/memory/3020-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/208-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b76-39.dat upx behavioral2/files/0x000a000000023b77-44.dat upx behavioral2/memory/4144-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4952-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b79-57.dat upx behavioral2/memory/3516-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7a-63.dat upx behavioral2/files/0x000a000000023b78-53.dat upx behavioral2/memory/3512-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7b-68.dat upx behavioral2/files/0x000a000000023b7c-73.dat upx behavioral2/files/0x000a000000023b7d-81.dat upx behavioral2/memory/3424-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7e-84.dat upx behavioral2/memory/2924-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3476-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7f-91.dat upx behavioral2/memory/4692-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3476-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b80-99.dat upx behavioral2/memory/4692-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b81-106.dat upx behavioral2/memory/912-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b82-110.dat upx behavioral2/files/0x000a000000023b83-116.dat upx behavioral2/memory/1336-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2640-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b84-123.dat upx behavioral2/files/0x0031000000023b85-127.dat upx behavioral2/memory/3612-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b86-134.dat upx behavioral2/files/0x000a000000023b87-138.dat upx behavioral2/memory/4668-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b88-144.dat upx behavioral2/memory/3908-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b6e-152.dat upx behavioral2/memory/3188-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-157.dat upx behavioral2/files/0x000a000000023b8a-161.dat upx behavioral2/memory/4240-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-168.dat upx behavioral2/files/0x000a000000023b8c-172.dat upx behavioral2/files/0x000a000000023b8d-177.dat upx behavioral2/files/0x000a000000023b8e-181.dat upx behavioral2/memory/684-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2096-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4672-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4928-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4596-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1968-214-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4388 wrote to memory of 2840 4388 86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe 83 PID 4388 wrote to memory of 2840 4388 86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe 83 PID 4388 wrote to memory of 2840 4388 86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe 83 PID 2840 wrote to memory of 1708 2840 jjpjd.exe 84 PID 2840 wrote to memory of 1708 2840 jjpjd.exe 84 PID 2840 wrote to memory of 1708 2840 jjpjd.exe 84 PID 1708 wrote to memory of 2288 1708 rxffllf.exe 85 PID 1708 wrote to memory of 2288 1708 rxffllf.exe 85 PID 1708 wrote to memory of 2288 1708 rxffllf.exe 85 PID 2288 wrote to memory of 3576 2288 tntnnb.exe 86 PID 2288 wrote to memory of 3576 2288 tntnnb.exe 86 PID 2288 wrote to memory of 3576 2288 tntnnb.exe 86 PID 3576 wrote to memory of 3020 3576 pvvpj.exe 87 PID 3576 wrote to memory of 3020 3576 pvvpj.exe 87 PID 3576 wrote to memory of 3020 3576 pvvpj.exe 87 PID 3020 wrote to memory of 208 3020 xxlrxll.exe 88 PID 3020 wrote to memory of 208 3020 xxlrxll.exe 88 PID 3020 wrote to memory of 208 3020 xxlrxll.exe 88 PID 208 wrote to memory of 4144 208 hhntnn.exe 89 PID 208 wrote to memory of 4144 208 hhntnn.exe 89 PID 208 wrote to memory of 4144 208 hhntnn.exe 89 PID 4144 wrote to memory of 3512 4144 dvdvv.exe 90 PID 4144 wrote to memory of 3512 4144 dvdvv.exe 90 PID 4144 wrote to memory of 3512 4144 dvdvv.exe 90 PID 3512 wrote to memory of 4952 3512 rfrlllf.exe 91 PID 3512 wrote to memory of 4952 3512 rfrlllf.exe 91 PID 3512 wrote to memory of 4952 3512 rfrlllf.exe 91 PID 4952 wrote to memory of 3516 4952 nhnhnn.exe 92 PID 4952 wrote to memory of 3516 4952 nhnhnn.exe 92 PID 4952 wrote to memory of 3516 4952 nhnhnn.exe 92 PID 3516 wrote to memory of 3572 3516 dvvjv.exe 93 PID 3516 wrote to memory of 3572 3516 dvvjv.exe 93 PID 3516 wrote to memory of 3572 3516 dvvjv.exe 93 PID 3572 wrote to memory of 1640 3572 vpvvv.exe 94 PID 3572 wrote to memory of 1640 3572 vpvvv.exe 94 PID 3572 wrote to memory of 1640 3572 vpvvv.exe 94 PID 1640 wrote to memory of 3424 1640 flrlfff.exe 95 PID 1640 wrote to memory of 3424 1640 flrlfff.exe 95 PID 1640 wrote to memory of 3424 1640 flrlfff.exe 95 PID 3424 wrote to memory of 2924 3424 9nnhhn.exe 96 PID 3424 wrote to memory of 2924 3424 9nnhhn.exe 96 PID 3424 wrote to memory of 2924 3424 9nnhhn.exe 96 PID 2924 wrote to memory of 3476 2924 1pjdd.exe 97 PID 2924 wrote to memory of 3476 2924 1pjdd.exe 97 PID 2924 wrote to memory of 3476 2924 1pjdd.exe 97 PID 3476 wrote to memory of 4692 3476 xffxxxx.exe 98 PID 3476 wrote to memory of 4692 3476 xffxxxx.exe 98 PID 3476 wrote to memory of 4692 3476 xffxxxx.exe 98 PID 4692 wrote to memory of 912 4692 rfxfxxr.exe 99 PID 4692 wrote to memory of 912 4692 rfxfxxr.exe 99 PID 4692 wrote to memory of 912 4692 rfxfxxr.exe 99 PID 912 wrote to memory of 1336 912 hhbntt.exe 100 PID 912 wrote to memory of 1336 912 hhbntt.exe 100 PID 912 wrote to memory of 1336 912 hhbntt.exe 100 PID 1336 wrote to memory of 2640 1336 pvpdd.exe 101 PID 1336 wrote to memory of 2640 1336 pvpdd.exe 101 PID 1336 wrote to memory of 2640 1336 pvpdd.exe 101 PID 2640 wrote to memory of 4576 2640 xfrffff.exe 102 PID 2640 wrote to memory of 4576 2640 xfrffff.exe 102 PID 2640 wrote to memory of 4576 2640 xfrffff.exe 102 PID 4576 wrote to memory of 3612 4576 lfffxff.exe 103 PID 4576 wrote to memory of 3612 4576 lfffxff.exe 103 PID 4576 wrote to memory of 3612 4576 lfffxff.exe 103 PID 3612 wrote to memory of 1012 3612 jpppp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe"C:\Users\Admin\AppData\Local\Temp\86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\jjpjd.exec:\jjpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rxffllf.exec:\rxffllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\tntnnb.exec:\tntnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\pvvpj.exec:\pvvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\xxlrxll.exec:\xxlrxll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\hhntnn.exec:\hhntnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\dvdvv.exec:\dvdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\rfrlllf.exec:\rfrlllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\nhnhnn.exec:\nhnhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\dvvjv.exec:\dvvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\vpvvv.exec:\vpvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\flrlfff.exec:\flrlfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\9nnhhn.exec:\9nnhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\1pjdd.exec:\1pjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\xffxxxx.exec:\xffxxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\rfxfxxr.exec:\rfxfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\hhbntt.exec:\hhbntt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\pvpdd.exec:\pvpdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\xfrffff.exec:\xfrffff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\lfffxff.exec:\lfffxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\jpppp.exec:\jpppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\xrrllll.exec:\xrrllll.exe23⤵
- Executes dropped EXE
PID:1012 -
\??\c:\hhntnt.exec:\hhntnt.exe24⤵
- Executes dropped EXE
PID:4668 -
\??\c:\tbttnt.exec:\tbttnt.exe25⤵
- Executes dropped EXE
PID:3908 -
\??\c:\vpjdj.exec:\vpjdj.exe26⤵
- Executes dropped EXE
PID:3188 -
\??\c:\fxflfff.exec:\fxflfff.exe27⤵
- Executes dropped EXE
PID:4932 -
\??\c:\btbbhh.exec:\btbbhh.exe28⤵
- Executes dropped EXE
PID:4240 -
\??\c:\ntbbbb.exec:\ntbbbb.exe29⤵
- Executes dropped EXE
PID:3604 -
\??\c:\7jddd.exec:\7jddd.exe30⤵
- Executes dropped EXE
PID:4732 -
\??\c:\rfxxxxr.exec:\rfxxxxr.exe31⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rrlrlxl.exec:\rrlrlxl.exe32⤵
- Executes dropped EXE
PID:684 -
\??\c:\ttbbbn.exec:\ttbbbn.exe33⤵
- Executes dropped EXE
PID:4088 -
\??\c:\bbhhnn.exec:\bbhhnn.exe34⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ppjdp.exec:\ppjdp.exe35⤵
- Executes dropped EXE
PID:2096 -
\??\c:\7dddv.exec:\7dddv.exe36⤵
- Executes dropped EXE
PID:4348 -
\??\c:\xrffrrl.exec:\xrffrrl.exe37⤵
- Executes dropped EXE
PID:4672 -
\??\c:\ntthbb.exec:\ntthbb.exe38⤵
- Executes dropped EXE
PID:4928 -
\??\c:\vjjjj.exec:\vjjjj.exe39⤵
- Executes dropped EXE
PID:4840 -
\??\c:\rfxxrff.exec:\rfxxrff.exe40⤵
- Executes dropped EXE
PID:4596 -
\??\c:\rfrlxff.exec:\rfrlxff.exe41⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nbbbbn.exec:\nbbbbn.exe42⤵
- Executes dropped EXE
PID:1820 -
\??\c:\flxxxff.exec:\flxxxff.exe43⤵
- Executes dropped EXE
PID:3800 -
\??\c:\lfrxxlf.exec:\lfrxxlf.exe44⤵
- Executes dropped EXE
PID:4964 -
\??\c:\btbthh.exec:\btbthh.exe45⤵
- Executes dropped EXE
PID:4560 -
\??\c:\7bhhhn.exec:\7bhhhn.exe46⤵
- Executes dropped EXE
PID:5044 -
\??\c:\jvdvd.exec:\jvdvd.exe47⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5rlffff.exec:\5rlffff.exe48⤵
- Executes dropped EXE
PID:3652 -
\??\c:\rrrrlll.exec:\rrrrlll.exe49⤵
- Executes dropped EXE
PID:3736 -
\??\c:\bbhbtn.exec:\bbhbtn.exe50⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vjpjp.exec:\vjpjp.exe51⤵
- Executes dropped EXE
PID:2148 -
\??\c:\pjpjv.exec:\pjpjv.exe52⤵
- Executes dropped EXE
PID:1944 -
\??\c:\fxrrlll.exec:\fxrrlll.exe53⤵
- Executes dropped EXE
PID:5068 -
\??\c:\5hhhbb.exec:\5hhhbb.exe54⤵
- Executes dropped EXE
PID:1388 -
\??\c:\tnttbh.exec:\tnttbh.exe55⤵
- Executes dropped EXE
PID:3824 -
\??\c:\dppjj.exec:\dppjj.exe56⤵
- Executes dropped EXE
PID:840 -
\??\c:\rxrfflf.exec:\rxrfflf.exe57⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rlllrlf.exec:\rlllrlf.exe58⤵
- Executes dropped EXE
PID:4456 -
\??\c:\nbttnn.exec:\nbttnn.exe59⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pjdvd.exec:\pjdvd.exe60⤵
- Executes dropped EXE
PID:1644 -
\??\c:\5rxxrrr.exec:\5rxxrrr.exe61⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xrffllr.exec:\xrffllr.exe62⤵
- Executes dropped EXE
PID:1788 -
\??\c:\5hhhbb.exec:\5hhhbb.exe63⤵
- Executes dropped EXE
PID:3632 -
\??\c:\7hthhn.exec:\7hthhn.exe64⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ppvpv.exec:\ppvpv.exe65⤵
- Executes dropped EXE
PID:4756 -
\??\c:\thhhhh.exec:\thhhhh.exe66⤵PID:2612
-
\??\c:\ddppj.exec:\ddppj.exe67⤵PID:1724
-
\??\c:\5lrrrxr.exec:\5lrrrxr.exe68⤵PID:4036
-
\??\c:\1rxffff.exec:\1rxffff.exe69⤵PID:3112
-
\??\c:\3dvpj.exec:\3dvpj.exe70⤵PID:5064
-
\??\c:\pvvjj.exec:\pvvjj.exe71⤵PID:2068
-
\??\c:\9fllfff.exec:\9fllfff.exe72⤵PID:5048
-
\??\c:\bhnnbn.exec:\bhnnbn.exe73⤵PID:3612
-
\??\c:\jvvdp.exec:\jvvdp.exe74⤵PID:1680
-
\??\c:\rlrrlff.exec:\rlrrlff.exe75⤵PID:3596
-
\??\c:\7xffflf.exec:\7xffflf.exe76⤵PID:1616
-
\??\c:\nhhbtt.exec:\nhhbtt.exe77⤵PID:5052
-
\??\c:\pjdvp.exec:\pjdvp.exe78⤵PID:3544
-
\??\c:\3rfxrrr.exec:\3rfxrrr.exe79⤵PID:1568
-
\??\c:\5llllxx.exec:\5llllxx.exe80⤵PID:932
-
\??\c:\1nbbbt.exec:\1nbbbt.exe81⤵PID:4240
-
\??\c:\httnnn.exec:\httnnn.exe82⤵PID:3040
-
\??\c:\pjvpv.exec:\pjvpv.exe83⤵PID:3472
-
\??\c:\frxrlll.exec:\frxrlll.exe84⤵PID:3328
-
\??\c:\tnhhtt.exec:\tnhhtt.exe85⤵PID:1208
-
\??\c:\btbbtt.exec:\btbbtt.exe86⤵PID:2936
-
\??\c:\jpppj.exec:\jpppj.exe87⤵PID:2780
-
\??\c:\5pddd.exec:\5pddd.exe88⤵PID:1692
-
\??\c:\7ffxrrl.exec:\7ffxrrl.exe89⤵PID:2696
-
\??\c:\xlllfff.exec:\xlllfff.exe90⤵PID:3756
-
\??\c:\nbbbtt.exec:\nbbbtt.exe91⤵PID:2964
-
\??\c:\nbhhnn.exec:\nbhhnn.exe92⤵PID:4928
-
\??\c:\jpppj.exec:\jpppj.exe93⤵PID:4840
-
\??\c:\rrlrrfx.exec:\rrlrrfx.exe94⤵PID:1376
-
\??\c:\rflrrxx.exec:\rflrrxx.exe95⤵PID:4992
-
\??\c:\vvddp.exec:\vvddp.exe96⤵PID:1544
-
\??\c:\pjpjp.exec:\pjpjp.exe97⤵PID:4964
-
\??\c:\nntntt.exec:\nntntt.exe98⤵PID:2708
-
\??\c:\ttttnn.exec:\ttttnn.exe99⤵PID:5044
-
\??\c:\nbbhbt.exec:\nbbhbt.exe100⤵PID:3652
-
\??\c:\3ppjj.exec:\3ppjj.exe101⤵PID:4056
-
\??\c:\rxrrrrl.exec:\rxrrrrl.exe102⤵PID:992
-
\??\c:\lrrrlll.exec:\lrrrlll.exe103⤵PID:908
-
\??\c:\5bnntt.exec:\5bnntt.exe104⤵
- System Location Discovery: System Language Discovery
PID:312 -
\??\c:\pvjjp.exec:\pvjjp.exe105⤵PID:3512
-
\??\c:\vjjdp.exec:\vjjdp.exe106⤵PID:3560
-
\??\c:\ffxfrfr.exec:\ffxfrfr.exe107⤵PID:4452
-
\??\c:\tthbbb.exec:\tthbbb.exe108⤵PID:1396
-
\??\c:\ntbbbb.exec:\ntbbbb.exe109⤵PID:2916
-
\??\c:\jdppj.exec:\jdppj.exe110⤵PID:1936
-
\??\c:\rllfxff.exec:\rllfxff.exe111⤵PID:4720
-
\??\c:\5xxxrrr.exec:\5xxxrrr.exe112⤵PID:1488
-
\??\c:\nhhbbb.exec:\nhhbbb.exe113⤵PID:3424
-
\??\c:\3vvvp.exec:\3vvvp.exe114⤵PID:4212
-
\??\c:\dvvpv.exec:\dvvpv.exe115⤵PID:3556
-
\??\c:\1xllxfx.exec:\1xllxfx.exe116⤵PID:1720
-
\??\c:\3btnnt.exec:\3btnnt.exe117⤵PID:2808
-
\??\c:\dppvv.exec:\dppvv.exe118⤵PID:4956
-
\??\c:\ppdvp.exec:\ppdvp.exe119⤵PID:2320
-
\??\c:\lfxfllx.exec:\lfxfllx.exe120⤵PID:3784
-
\??\c:\1rlxlfr.exec:\1rlxlfr.exe121⤵PID:3792
-
\??\c:\bbbntt.exec:\bbbntt.exe122⤵PID:4260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-