Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 23:07
Behavioral task
behavioral1
Sample
677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe
-
Size
333KB
-
MD5
9b4eed62a5625d53da749c7a6cd54d81
-
SHA1
85bef3b9fbb59257e3645cde5f26becd134d16e8
-
SHA256
677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507
-
SHA512
ba4bf4255460f7f5154c28c0b60b9f79457304ebb632e993fbbf3f1737948810ce7838afd331295244bd72dc675012fc85a7628771b2f01cf4d54de5b2d54624
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbel:R4wFHoSHYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3252-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1076-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2744-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2656-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2072-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/688-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-740-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-803-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-928-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-989-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-1249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3252 bhnnhh.exe 2572 jjdvp.exe 4548 9pvpj.exe 4432 5rxxxxx.exe 2948 nbbtnn.exe 4608 ddpdd.exe 2140 1rlxffr.exe 3336 tbbtnn.exe 3872 dvjjd.exe 4484 jdpjp.exe 1048 rfrlxlf.exe 940 vjjpp.exe 1076 fffrxrf.exe 1528 nthhnb.exe 1204 fxrxxlr.exe 2308 lffxxxr.exe 3544 9bntbt.exe 2204 htbnhb.exe 4856 xlfflrx.exe 4840 bbtnnt.exe 4740 ffrfrlf.exe 1820 vvvpp.exe 2368 hhnhnn.exe 1804 pjpvp.exe 1840 rfffrff.exe 2744 hnhnbb.exe 2088 xrlfrlf.exe 3324 htnbth.exe 4428 ppdpj.exe 452 tbhnnb.exe 1788 dpvvp.exe 3276 7rxrlrl.exe 3120 9vpdp.exe 4396 ddpdv.exe 3680 rrxlrlr.exe 1476 vddvd.exe 4060 xlxlxfx.exe 3064 bbbtht.exe 3516 jjdvp.exe 3780 jpjvv.exe 3820 fflrrfl.exe 3444 jdpjd.exe 2776 lxrrllf.exe 1696 hnnbnn.exe 4392 thbbbb.exe 1380 pjdjv.exe 696 lffflxx.exe 2816 7hhbth.exe 2964 hbnbnh.exe 2356 dvdvv.exe 2476 vpjdv.exe 1536 ffffrfx.exe 1228 bnbbtn.exe 1572 jvjjv.exe 3288 pdvjd.exe 4816 lrrfxrl.exe 4548 nthbnh.exe 5036 pddvj.exe 4432 fxfffff.exe 5060 hnthnh.exe 1692 vdvpp.exe 4608 jppdj.exe 1168 rxfxrlf.exe 4264 nhhbtb.exe -
resource yara_rule behavioral2/memory/4028-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3252-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4028-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023b79-4.dat upx behavioral2/files/0x000b000000023b89-9.dat upx behavioral2/files/0x000a000000023b8d-11.dat upx behavioral2/memory/4548-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8e-20.dat upx behavioral2/files/0x000a000000023b8f-23.dat upx behavioral2/memory/2948-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2572-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-29.dat upx behavioral2/memory/4608-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-34.dat upx behavioral2/memory/4432-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2140-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b93-40.dat upx behavioral2/files/0x000a000000023b94-44.dat upx behavioral2/memory/3872-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3336-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b95-50.dat upx behavioral2/memory/3872-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b96-54.dat upx behavioral2/memory/4484-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-59.dat upx behavioral2/memory/1048-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-64.dat upx behavioral2/memory/1076-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b99-68.dat upx behavioral2/files/0x000a000000023b9a-73.dat upx behavioral2/memory/1204-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9b-77.dat upx behavioral2/files/0x000a000000023b9c-82.dat upx behavioral2/memory/2308-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b8a-87.dat upx behavioral2/memory/3544-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b9d-92.dat upx behavioral2/files/0x000b000000023b9e-97.dat upx behavioral2/memory/4856-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b9f-101.dat upx behavioral2/memory/4840-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba7-106.dat upx behavioral2/files/0x000e000000023bae-110.dat upx behavioral2/files/0x0008000000023bb7-114.dat upx behavioral2/memory/1804-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1528-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2368-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bbc-121.dat upx behavioral2/files/0x0009000000023bbd-125.dat upx behavioral2/files/0x0009000000023bbe-129.dat upx behavioral2/memory/2744-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bc2-134.dat upx behavioral2/memory/2088-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bc4-140.dat upx behavioral2/memory/3324-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bc8-144.dat upx behavioral2/memory/452-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bca-153.dat upx behavioral2/files/0x0008000000023bc9-150.dat upx behavioral2/memory/3276-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3680-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1476-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4060-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3064-173-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4028 wrote to memory of 3252 4028 677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe 82 PID 4028 wrote to memory of 3252 4028 677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe 82 PID 4028 wrote to memory of 3252 4028 677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe 82 PID 3252 wrote to memory of 2572 3252 bhnnhh.exe 83 PID 3252 wrote to memory of 2572 3252 bhnnhh.exe 83 PID 3252 wrote to memory of 2572 3252 bhnnhh.exe 83 PID 2572 wrote to memory of 4548 2572 jjdvp.exe 84 PID 2572 wrote to memory of 4548 2572 jjdvp.exe 84 PID 2572 wrote to memory of 4548 2572 jjdvp.exe 84 PID 4548 wrote to memory of 4432 4548 9pvpj.exe 85 PID 4548 wrote to memory of 4432 4548 9pvpj.exe 85 PID 4548 wrote to memory of 4432 4548 9pvpj.exe 85 PID 4432 wrote to memory of 2948 4432 5rxxxxx.exe 86 PID 4432 wrote to memory of 2948 4432 5rxxxxx.exe 86 PID 4432 wrote to memory of 2948 4432 5rxxxxx.exe 86 PID 2948 wrote to memory of 4608 2948 nbbtnn.exe 87 PID 2948 wrote to memory of 4608 2948 nbbtnn.exe 87 PID 2948 wrote to memory of 4608 2948 nbbtnn.exe 87 PID 4608 wrote to memory of 2140 4608 ddpdd.exe 88 PID 4608 wrote to memory of 2140 4608 ddpdd.exe 88 PID 4608 wrote to memory of 2140 4608 ddpdd.exe 88 PID 2140 wrote to memory of 3336 2140 1rlxffr.exe 89 PID 2140 wrote to memory of 3336 2140 1rlxffr.exe 89 PID 2140 wrote to memory of 3336 2140 1rlxffr.exe 89 PID 3336 wrote to memory of 3872 3336 tbbtnn.exe 90 PID 3336 wrote to memory of 3872 3336 tbbtnn.exe 90 PID 3336 wrote to memory of 3872 3336 tbbtnn.exe 90 PID 3872 wrote to memory of 4484 3872 dvjjd.exe 91 PID 3872 wrote to memory of 4484 3872 dvjjd.exe 91 PID 3872 wrote to memory of 4484 3872 dvjjd.exe 91 PID 4484 wrote to memory of 1048 4484 jdpjp.exe 92 PID 4484 wrote to memory of 1048 4484 jdpjp.exe 92 PID 4484 wrote to memory of 1048 4484 jdpjp.exe 92 PID 1048 wrote to memory of 940 1048 rfrlxlf.exe 93 PID 1048 wrote to memory of 940 1048 rfrlxlf.exe 93 PID 1048 wrote to memory of 940 1048 rfrlxlf.exe 93 PID 940 wrote to memory of 1076 940 vjjpp.exe 94 PID 940 wrote to memory of 1076 940 vjjpp.exe 94 PID 940 wrote to memory of 1076 940 vjjpp.exe 94 PID 1076 wrote to memory of 1528 1076 fffrxrf.exe 95 PID 1076 wrote to memory of 1528 1076 fffrxrf.exe 95 PID 1076 wrote to memory of 1528 1076 fffrxrf.exe 95 PID 1528 wrote to memory of 1204 1528 nthhnb.exe 96 PID 1528 wrote to memory of 1204 1528 nthhnb.exe 96 PID 1528 wrote to memory of 1204 1528 nthhnb.exe 96 PID 1204 wrote to memory of 2308 1204 fxrxxlr.exe 97 PID 1204 wrote to memory of 2308 1204 fxrxxlr.exe 97 PID 1204 wrote to memory of 2308 1204 fxrxxlr.exe 97 PID 2308 wrote to memory of 3544 2308 lffxxxr.exe 98 PID 2308 wrote to memory of 3544 2308 lffxxxr.exe 98 PID 2308 wrote to memory of 3544 2308 lffxxxr.exe 98 PID 3544 wrote to memory of 2204 3544 9bntbt.exe 99 PID 3544 wrote to memory of 2204 3544 9bntbt.exe 99 PID 3544 wrote to memory of 2204 3544 9bntbt.exe 99 PID 2204 wrote to memory of 4856 2204 htbnhb.exe 100 PID 2204 wrote to memory of 4856 2204 htbnhb.exe 100 PID 2204 wrote to memory of 4856 2204 htbnhb.exe 100 PID 4856 wrote to memory of 4840 4856 xlfflrx.exe 101 PID 4856 wrote to memory of 4840 4856 xlfflrx.exe 101 PID 4856 wrote to memory of 4840 4856 xlfflrx.exe 101 PID 4840 wrote to memory of 4740 4840 bbtnnt.exe 102 PID 4840 wrote to memory of 4740 4840 bbtnnt.exe 102 PID 4840 wrote to memory of 4740 4840 bbtnnt.exe 102 PID 4740 wrote to memory of 1820 4740 ffrfrlf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe"C:\Users\Admin\AppData\Local\Temp\677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\bhnnhh.exec:\bhnnhh.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\jjdvp.exec:\jjdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\9pvpj.exec:\9pvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\5rxxxxx.exec:\5rxxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\nbbtnn.exec:\nbbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ddpdd.exec:\ddpdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\1rlxffr.exec:\1rlxffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\tbbtnn.exec:\tbbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\dvjjd.exec:\dvjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\jdpjp.exec:\jdpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\rfrlxlf.exec:\rfrlxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\vjjpp.exec:\vjjpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\fffrxrf.exec:\fffrxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\nthhnb.exec:\nthhnb.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\fxrxxlr.exec:\fxrxxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\lffxxxr.exec:\lffxxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\9bntbt.exec:\9bntbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\htbnhb.exec:\htbnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\xlfflrx.exec:\xlfflrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\bbtnnt.exec:\bbtnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\ffrfrlf.exec:\ffrfrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\vvvpp.exec:\vvvpp.exe23⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hhnhnn.exec:\hhnhnn.exe24⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pjpvp.exec:\pjpvp.exe25⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rfffrff.exec:\rfffrff.exe26⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hnhnbb.exec:\hnhnbb.exe27⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe28⤵
- Executes dropped EXE
PID:2088 -
\??\c:\htnbth.exec:\htnbth.exe29⤵
- Executes dropped EXE
PID:3324 -
\??\c:\ppdpj.exec:\ppdpj.exe30⤵
- Executes dropped EXE
PID:4428 -
\??\c:\tbhnnb.exec:\tbhnnb.exe31⤵
- Executes dropped EXE
PID:452 -
\??\c:\dpvvp.exec:\dpvvp.exe32⤵
- Executes dropped EXE
PID:1788 -
\??\c:\7rxrlrl.exec:\7rxrlrl.exe33⤵
- Executes dropped EXE
PID:3276 -
\??\c:\9vpdp.exec:\9vpdp.exe34⤵
- Executes dropped EXE
PID:3120 -
\??\c:\ddpdv.exec:\ddpdv.exe35⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rrxlrlr.exec:\rrxlrlr.exe36⤵
- Executes dropped EXE
PID:3680 -
\??\c:\vddvd.exec:\vddvd.exe37⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xlxlxfx.exec:\xlxlxfx.exe38⤵
- Executes dropped EXE
PID:4060 -
\??\c:\bbbtht.exec:\bbbtht.exe39⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jjdvp.exec:\jjdvp.exe40⤵
- Executes dropped EXE
PID:3516 -
\??\c:\jpjvv.exec:\jpjvv.exe41⤵
- Executes dropped EXE
PID:3780 -
\??\c:\fflrrfl.exec:\fflrrfl.exe42⤵
- Executes dropped EXE
PID:3820 -
\??\c:\jdpjd.exec:\jdpjd.exe43⤵
- Executes dropped EXE
PID:3444 -
\??\c:\lxrrllf.exec:\lxrrllf.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hnnbnn.exec:\hnnbnn.exe45⤵
- Executes dropped EXE
PID:1696 -
\??\c:\thbbbb.exec:\thbbbb.exe46⤵
- Executes dropped EXE
PID:4392 -
\??\c:\pjdjv.exec:\pjdjv.exe47⤵
- Executes dropped EXE
PID:1380 -
\??\c:\lffflxx.exec:\lffflxx.exe48⤵
- Executes dropped EXE
PID:696 -
\??\c:\7hhbth.exec:\7hhbth.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hbnbnh.exec:\hbnbnh.exe50⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dvdvv.exec:\dvdvv.exe51⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vpjdv.exec:\vpjdv.exe52⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ffffrfx.exec:\ffffrfx.exe53⤵
- Executes dropped EXE
PID:1536 -
\??\c:\bnbbtn.exec:\bnbbtn.exe54⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jvjjv.exec:\jvjjv.exe55⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pdvjd.exec:\pdvjd.exe56⤵
- Executes dropped EXE
PID:3288 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe57⤵
- Executes dropped EXE
PID:4816 -
\??\c:\nthbnh.exec:\nthbnh.exe58⤵
- Executes dropped EXE
PID:4548 -
\??\c:\pddvj.exec:\pddvj.exe59⤵
- Executes dropped EXE
PID:5036 -
\??\c:\fxfffff.exec:\fxfffff.exe60⤵
- Executes dropped EXE
PID:4432 -
\??\c:\hnthnh.exec:\hnthnh.exe61⤵
- Executes dropped EXE
PID:5060 -
\??\c:\vdvpp.exec:\vdvpp.exe62⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jppdj.exec:\jppdj.exe63⤵
- Executes dropped EXE
PID:4608 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe64⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nhhbtb.exec:\nhhbtb.exe65⤵
- Executes dropped EXE
PID:4264 -
\??\c:\bhbnbb.exec:\bhbnbb.exe66⤵PID:3496
-
\??\c:\pjpjd.exec:\pjpjd.exe67⤵PID:1972
-
\??\c:\7rrrlxr.exec:\7rrrlxr.exe68⤵PID:4716
-
\??\c:\xxxfxrl.exec:\xxxfxrl.exe69⤵PID:184
-
\??\c:\nnbnhn.exec:\nnbnhn.exe70⤵PID:1340
-
\??\c:\vvpjj.exec:\vvpjj.exe71⤵PID:1064
-
\??\c:\djvpv.exec:\djvpv.exe72⤵PID:2656
-
\??\c:\rxffxxx.exec:\rxffxxx.exe73⤵PID:3356
-
\??\c:\bbhhnb.exec:\bbhhnb.exe74⤵PID:1488
-
\??\c:\jvpjd.exec:\jvpjd.exe75⤵PID:996
-
\??\c:\lxllfff.exec:\lxllfff.exe76⤵PID:2280
-
\??\c:\hbhbtt.exec:\hbhbtt.exe77⤵PID:2688
-
\??\c:\3hntnn.exec:\3hntnn.exe78⤵PID:804
-
\??\c:\vjjvj.exec:\vjjvj.exe79⤵PID:3256
-
\??\c:\rrxxrlf.exec:\rrxxrlf.exe80⤵PID:4928
-
\??\c:\tnbbbh.exec:\tnbbbh.exe81⤵PID:4924
-
\??\c:\xxrffxx.exec:\xxrffxx.exe82⤵PID:3176
-
\??\c:\lxllxfr.exec:\lxllxfr.exe83⤵PID:392
-
\??\c:\hnnttb.exec:\hnnttb.exe84⤵PID:4840
-
\??\c:\vjdvv.exec:\vjdvv.exe85⤵PID:3364
-
\??\c:\rxrrrrr.exec:\rxrrrrr.exe86⤵PID:2568
-
\??\c:\thbhth.exec:\thbhth.exe87⤵PID:1820
-
\??\c:\btnbhb.exec:\btnbhb.exe88⤵PID:2192
-
\??\c:\ppvjd.exec:\ppvjd.exe89⤵PID:1768
-
\??\c:\fxflrrx.exec:\fxflrrx.exe90⤵PID:4584
-
\??\c:\hbthnt.exec:\hbthnt.exe91⤵PID:5040
-
\??\c:\bbhnnt.exec:\bbhnnt.exe92⤵PID:4800
-
\??\c:\9vddv.exec:\9vddv.exe93⤵PID:4956
-
\??\c:\vvjjj.exec:\vvjjj.exe94⤵PID:5076
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe95⤵PID:3324
-
\??\c:\frllfll.exec:\frllfll.exe96⤵PID:1940
-
\??\c:\hbttnn.exec:\hbttnn.exe97⤵PID:3240
-
\??\c:\djvpj.exec:\djvpj.exe98⤵PID:1172
-
\??\c:\lxrrffr.exec:\lxrrffr.exe99⤵PID:3392
-
\??\c:\bhbhth.exec:\bhbhth.exe100⤵PID:2408
-
\??\c:\ppjvd.exec:\ppjvd.exe101⤵PID:1292
-
\??\c:\pjpvv.exec:\pjpvv.exe102⤵PID:684
-
\??\c:\llfllfl.exec:\llfllfl.exe103⤵PID:4396
-
\??\c:\ttnnnb.exec:\ttnnnb.exe104⤵PID:4912
-
\??\c:\jvvjp.exec:\jvvjp.exe105⤵PID:3728
-
\??\c:\xxfllxx.exec:\xxfllxx.exe106⤵PID:3964
-
\??\c:\fxlllrx.exec:\fxlllrx.exe107⤵PID:2924
-
\??\c:\tntttt.exec:\tntttt.exe108⤵PID:3600
-
\??\c:\jdpjj.exec:\jdpjj.exe109⤵PID:4436
-
\??\c:\rlrfrfr.exec:\rlrfrfr.exe110⤵PID:4280
-
\??\c:\9rrrlrr.exec:\9rrrlrr.exe111⤵PID:1300
-
\??\c:\bbbbnh.exec:\bbbbnh.exe112⤵PID:3824
-
\??\c:\pdddp.exec:\pdddp.exe113⤵PID:4752
-
\??\c:\frxflrr.exec:\frxflrr.exe114⤵PID:5056
-
\??\c:\bhntnb.exec:\bhntnb.exe115⤵PID:448
-
\??\c:\hnbbbb.exec:\hnbbbb.exe116⤵PID:1780
-
\??\c:\9rrrlrl.exec:\9rrrlrl.exe117⤵PID:3232
-
\??\c:\xfxrrff.exec:\xfxrrff.exe118⤵PID:4236
-
\??\c:\tnnhbb.exec:\tnnhbb.exe119⤵PID:4504
-
\??\c:\ddjdv.exec:\ddjdv.exe120⤵PID:1068
-
\??\c:\jpjvv.exec:\jpjvv.exe121⤵PID:4360
-
\??\c:\9xfxxfx.exec:\9xfxxfx.exe122⤵PID:4488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-