Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 05:17
Behavioral task
behavioral1
Sample
113844635d8ba6ae7906014cbe023447de5a269761ceb4949e1d814220693eef.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
113844635d8ba6ae7906014cbe023447de5a269761ceb4949e1d814220693eef.exe
-
Size
378KB
-
MD5
ff6a31485fc178613ce9cd886a6343a6
-
SHA1
66a7fb935a0d73e068e3e630fb208b871e90dca8
-
SHA256
113844635d8ba6ae7906014cbe023447de5a269761ceb4949e1d814220693eef
-
SHA512
4e8cb5c9cb4818a3c79c9774ddc297e163c93d2e31375105f68de60984e780eccc384569fcf74bc368df8ccd95983f2572886888c52714ac1526557c2ef39896
-
SSDEEP
6144:0cm4FmowdHoSHWVs+QEoD/dL/4oSlCIqbKRs4EkfRDaPRrnVkWHQrvD:C4wFHoS2Vs+IdMoSzqkR5RWVVWrL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4816-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/348-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-640-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-1531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-1677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-1718-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4392 rllfrrf.exe 4144 ddvpj.exe 4744 xrllfxl.exe 2196 htnhtn.exe 396 fllfxlf.exe 2084 jdvpp.exe 4820 vpjvp.exe 4460 9hnnbh.exe 2208 nnnbht.exe 4908 3ntnbt.exe 2808 frrfxxr.exe 1716 9hnhhh.exe 4832 xrlfxfx.exe 5076 bbttnt.exe 2356 ddpjp.exe 3728 vvdvp.exe 4188 xlllxrl.exe 224 nnnhbt.exe 3900 pjdvp.exe 2364 pjvpd.exe 456 9ddvj.exe 556 xxxlffx.exe 1412 frrrlff.exe 4872 tnttnn.exe 4356 7xllfll.exe 3912 bnttbb.exe 3192 3pvvp.exe 4048 ddddv.exe 4312 dvvpj.exe 5048 xrffxll.exe 4324 9pdvv.exe 1132 rrfxxxr.exe 4124 bbbttn.exe 4800 jjjjd.exe 1632 lfffxxr.exe 1784 9tnhbt.exe 1600 jvddv.exe 1064 rfxxflf.exe 4676 3tnbbb.exe 5116 rllfxrl.exe 4876 5tttnt.exe 2336 pjddv.exe 4508 xlxxllr.exe 3988 xlrrfff.exe 2848 hnnnnn.exe 1144 jvvdd.exe 4348 rllfrrl.exe 2840 bttnnh.exe 4568 ntttbh.exe 1604 ddpjp.exe 2052 lrrxxxx.exe 2592 fflfxrr.exe 4952 1bttnn.exe 5108 3dvpj.exe 2400 5jpjj.exe 936 rrlfllr.exe 2024 nhhbtt.exe 2128 bhhbtt.exe 4004 jdjdp.exe 4000 lfffxrr.exe 2184 hbttnn.exe 3996 nhhbnn.exe 2932 pjvpd.exe 3276 xxxrrrl.exe -
resource yara_rule behavioral2/memory/4816-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b2e-3.dat upx behavioral2/memory/4816-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-9.dat upx behavioral2/memory/4392-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-13.dat upx behavioral2/memory/4144-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-22.dat upx behavioral2/files/0x000a000000023b8e-26.dat upx behavioral2/memory/2196-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-35.dat upx behavioral2/memory/396-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b90-38.dat upx behavioral2/memory/2084-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-44.dat upx behavioral2/memory/4460-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4820-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-51.dat upx behavioral2/files/0x000a000000023b93-56.dat upx behavioral2/memory/4908-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2208-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b94-63.dat upx behavioral2/memory/4908-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b95-70.dat upx behavioral2/files/0x000a000000023b97-77.dat upx behavioral2/memory/4832-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1716-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-82.dat upx behavioral2/files/0x000a000000023b99-89.dat upx behavioral2/files/0x000a000000023b9a-95.dat upx behavioral2/memory/3728-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b88-99.dat upx behavioral2/files/0x000a000000023b9b-105.dat upx behavioral2/memory/3900-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-119.dat upx behavioral2/memory/2364-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-112.dat upx behavioral2/memory/224-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4188-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2356-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5076-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9e-124.dat upx behavioral2/files/0x000b000000023b9f-130.dat upx behavioral2/memory/456-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023ba0-134.dat upx behavioral2/files/0x000b000000023ba1-139.dat upx behavioral2/memory/1412-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba9-145.dat upx behavioral2/memory/4872-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bb0-151.dat upx behavioral2/memory/3912-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4356-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bb9-157.dat upx behavioral2/files/0x0009000000023bbe-163.dat upx behavioral2/memory/3192-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bbf-169.dat upx behavioral2/memory/4312-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bc0-175.dat upx behavioral2/files/0x000e000000023bc4-182.dat upx behavioral2/files/0x0008000000023bc6-186.dat upx behavioral2/memory/1600-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1064-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4676-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5116-217-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4392 4816 113844635d8ba6ae7906014cbe023447de5a269761ceb4949e1d814220693eef.exe 83 PID 4816 wrote to memory of 4392 4816 113844635d8ba6ae7906014cbe023447de5a269761ceb4949e1d814220693eef.exe 83 PID 4816 wrote to memory of 4392 4816 113844635d8ba6ae7906014cbe023447de5a269761ceb4949e1d814220693eef.exe 83 PID 4392 wrote to memory of 4144 4392 rllfrrf.exe 84 PID 4392 wrote to memory of 4144 4392 rllfrrf.exe 84 PID 4392 wrote to memory of 4144 4392 rllfrrf.exe 84 PID 4144 wrote to memory of 4744 4144 ddvpj.exe 85 PID 4144 wrote to memory of 4744 4144 ddvpj.exe 85 PID 4144 wrote to memory of 4744 4144 ddvpj.exe 85 PID 4744 wrote to memory of 2196 4744 xrllfxl.exe 86 PID 4744 wrote to memory of 2196 4744 xrllfxl.exe 86 PID 4744 wrote to memory of 2196 4744 xrllfxl.exe 86 PID 2196 wrote to memory of 396 2196 htnhtn.exe 87 PID 2196 wrote to memory of 396 2196 htnhtn.exe 87 PID 2196 wrote to memory of 396 2196 htnhtn.exe 87 PID 396 wrote to memory of 2084 396 fllfxlf.exe 88 PID 396 wrote to memory of 2084 396 fllfxlf.exe 88 PID 396 wrote to memory of 2084 396 fllfxlf.exe 88 PID 2084 wrote to memory of 4820 2084 jdvpp.exe 89 PID 2084 wrote to memory of 4820 2084 jdvpp.exe 89 PID 2084 wrote to memory of 4820 2084 jdvpp.exe 89 PID 4820 wrote to memory of 4460 4820 vpjvp.exe 90 PID 4820 wrote to memory of 4460 4820 vpjvp.exe 90 PID 4820 wrote to memory of 4460 4820 vpjvp.exe 90 PID 4460 wrote to memory of 2208 4460 9hnnbh.exe 91 PID 4460 wrote to memory of 2208 4460 9hnnbh.exe 91 PID 4460 wrote to memory of 2208 4460 9hnnbh.exe 91 PID 2208 wrote to memory of 4908 2208 nnnbht.exe 92 PID 2208 wrote to memory of 4908 2208 nnnbht.exe 92 PID 2208 wrote to memory of 4908 2208 nnnbht.exe 92 PID 4908 wrote to memory of 2808 4908 3ntnbt.exe 93 PID 4908 wrote to memory of 2808 4908 3ntnbt.exe 93 PID 4908 wrote to memory of 2808 4908 3ntnbt.exe 93 PID 2808 wrote to memory of 1716 2808 frrfxxr.exe 94 PID 2808 wrote to memory of 1716 2808 frrfxxr.exe 94 PID 2808 wrote to memory of 1716 2808 frrfxxr.exe 94 PID 1716 wrote to memory of 4832 1716 9hnhhh.exe 95 PID 1716 wrote to memory of 4832 1716 9hnhhh.exe 95 PID 1716 wrote to memory of 4832 1716 9hnhhh.exe 95 PID 4832 wrote to memory of 5076 4832 xrlfxfx.exe 96 PID 4832 wrote to memory of 5076 4832 xrlfxfx.exe 96 PID 4832 wrote to memory of 5076 4832 xrlfxfx.exe 96 PID 5076 wrote to memory of 2356 5076 bbttnt.exe 97 PID 5076 wrote to memory of 2356 5076 bbttnt.exe 97 PID 5076 wrote to memory of 2356 5076 bbttnt.exe 97 PID 2356 wrote to memory of 3728 2356 ddpjp.exe 98 PID 2356 wrote to memory of 3728 2356 ddpjp.exe 98 PID 2356 wrote to memory of 3728 2356 ddpjp.exe 98 PID 3728 wrote to memory of 4188 3728 vvdvp.exe 99 PID 3728 wrote to memory of 4188 3728 vvdvp.exe 99 PID 3728 wrote to memory of 4188 3728 vvdvp.exe 99 PID 4188 wrote to memory of 224 4188 xlllxrl.exe 100 PID 4188 wrote to memory of 224 4188 xlllxrl.exe 100 PID 4188 wrote to memory of 224 4188 xlllxrl.exe 100 PID 224 wrote to memory of 3900 224 nnnhbt.exe 101 PID 224 wrote to memory of 3900 224 nnnhbt.exe 101 PID 224 wrote to memory of 3900 224 nnnhbt.exe 101 PID 3900 wrote to memory of 2364 3900 pjdvp.exe 102 PID 3900 wrote to memory of 2364 3900 pjdvp.exe 102 PID 3900 wrote to memory of 2364 3900 pjdvp.exe 102 PID 2364 wrote to memory of 456 2364 pjvpd.exe 103 PID 2364 wrote to memory of 456 2364 pjvpd.exe 103 PID 2364 wrote to memory of 456 2364 pjvpd.exe 103 PID 456 wrote to memory of 556 456 9ddvj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\113844635d8ba6ae7906014cbe023447de5a269761ceb4949e1d814220693eef.exe"C:\Users\Admin\AppData\Local\Temp\113844635d8ba6ae7906014cbe023447de5a269761ceb4949e1d814220693eef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\rllfrrf.exec:\rllfrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\ddvpj.exec:\ddvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\xrllfxl.exec:\xrllfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\htnhtn.exec:\htnhtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\fllfxlf.exec:\fllfxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\jdvpp.exec:\jdvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\vpjvp.exec:\vpjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\9hnnbh.exec:\9hnnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\nnnbht.exec:\nnnbht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\3ntnbt.exec:\3ntnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\frrfxxr.exec:\frrfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\9hnhhh.exec:\9hnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\xrlfxfx.exec:\xrlfxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\bbttnt.exec:\bbttnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\ddpjp.exec:\ddpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\vvdvp.exec:\vvdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\xlllxrl.exec:\xlllxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\nnnhbt.exec:\nnnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\pjdvp.exec:\pjdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\pjvpd.exec:\pjvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\9ddvj.exec:\9ddvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\xxxlffx.exec:\xxxlffx.exe23⤵
- Executes dropped EXE
PID:556 -
\??\c:\frrrlff.exec:\frrrlff.exe24⤵
- Executes dropped EXE
PID:1412 -
\??\c:\tnttnn.exec:\tnttnn.exe25⤵
- Executes dropped EXE
PID:4872 -
\??\c:\7xllfll.exec:\7xllfll.exe26⤵
- Executes dropped EXE
PID:4356 -
\??\c:\bnttbb.exec:\bnttbb.exe27⤵
- Executes dropped EXE
PID:3912 -
\??\c:\3pvvp.exec:\3pvvp.exe28⤵
- Executes dropped EXE
PID:3192 -
\??\c:\ddddv.exec:\ddddv.exe29⤵
- Executes dropped EXE
PID:4048 -
\??\c:\dvvpj.exec:\dvvpj.exe30⤵
- Executes dropped EXE
PID:4312 -
\??\c:\xrffxll.exec:\xrffxll.exe31⤵
- Executes dropped EXE
PID:5048 -
\??\c:\9pdvv.exec:\9pdvv.exe32⤵
- Executes dropped EXE
PID:4324 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe33⤵
- Executes dropped EXE
PID:1132 -
\??\c:\bbbttn.exec:\bbbttn.exe34⤵
- Executes dropped EXE
PID:4124 -
\??\c:\jjjjd.exec:\jjjjd.exe35⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lfffxxr.exec:\lfffxxr.exe36⤵
- Executes dropped EXE
PID:1632 -
\??\c:\9tnhbt.exec:\9tnhbt.exe37⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jvddv.exec:\jvddv.exe38⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rfxxflf.exec:\rfxxflf.exe39⤵
- Executes dropped EXE
PID:1064 -
\??\c:\3tnbbb.exec:\3tnbbb.exe40⤵
- Executes dropped EXE
PID:4676 -
\??\c:\rllfxrl.exec:\rllfxrl.exe41⤵
- Executes dropped EXE
PID:5116 -
\??\c:\5tttnt.exec:\5tttnt.exe42⤵
- Executes dropped EXE
PID:4876 -
\??\c:\pjddv.exec:\pjddv.exe43⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xlxxllr.exec:\xlxxllr.exe44⤵
- Executes dropped EXE
PID:4508 -
\??\c:\xlrrfff.exec:\xlrrfff.exe45⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hnnnnn.exec:\hnnnnn.exe46⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jvvdd.exec:\jvvdd.exe47⤵
- Executes dropped EXE
PID:1144 -
\??\c:\rllfrrl.exec:\rllfrrl.exe48⤵
- Executes dropped EXE
PID:4348 -
\??\c:\bttnnh.exec:\bttnnh.exe49⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ntttbh.exec:\ntttbh.exe50⤵
- Executes dropped EXE
PID:4568 -
\??\c:\ddpjp.exec:\ddpjp.exe51⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lrrxxxx.exec:\lrrxxxx.exe52⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fflfxrr.exec:\fflfxrr.exe53⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1bttnn.exec:\1bttnn.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4952 -
\??\c:\3dvpj.exec:\3dvpj.exe55⤵
- Executes dropped EXE
PID:5108 -
\??\c:\5jpjj.exec:\5jpjj.exe56⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rrlfllr.exec:\rrlfllr.exe57⤵
- Executes dropped EXE
PID:936 -
\??\c:\nhhbtt.exec:\nhhbtt.exe58⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bhhbtt.exec:\bhhbtt.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jdjdp.exec:\jdjdp.exe60⤵
- Executes dropped EXE
PID:4004 -
\??\c:\lfffxrr.exec:\lfffxrr.exe61⤵
- Executes dropped EXE
PID:4000 -
\??\c:\hbttnn.exec:\hbttnn.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nhhbnn.exec:\nhhbnn.exe63⤵
- Executes dropped EXE
PID:3996 -
\??\c:\pjvpd.exec:\pjvpd.exe64⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe65⤵
- Executes dropped EXE
PID:3276 -
\??\c:\xflfxxr.exec:\xflfxxr.exe66⤵PID:3092
-
\??\c:\nhtnnn.exec:\nhtnnn.exe67⤵PID:2556
-
\??\c:\jdjjp.exec:\jdjjp.exe68⤵PID:2808
-
\??\c:\jvvpd.exec:\jvvpd.exe69⤵PID:2780
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe70⤵PID:2316
-
\??\c:\nbhhbb.exec:\nbhhbb.exe71⤵PID:2980
-
\??\c:\1pvpj.exec:\1pvpj.exe72⤵PID:5100
-
\??\c:\djppd.exec:\djppd.exe73⤵PID:1512
-
\??\c:\5rrrrrr.exec:\5rrrrrr.exe74⤵PID:4644
-
\??\c:\nnbttt.exec:\nnbttt.exe75⤵PID:1212
-
\??\c:\nhhbtn.exec:\nhhbtn.exe76⤵PID:4404
-
\??\c:\dvdvp.exec:\dvdvp.exe77⤵PID:2096
-
\??\c:\xlxrllf.exec:\xlxrllf.exe78⤵PID:1528
-
\??\c:\hbbhhh.exec:\hbbhhh.exe79⤵PID:1532
-
\??\c:\pdjjj.exec:\pdjjj.exe80⤵PID:3348
-
\??\c:\1ffxrrr.exec:\1ffxrrr.exe81⤵PID:376
-
\??\c:\1ffxrrr.exec:\1ffxrrr.exe82⤵PID:1372
-
\??\c:\3nbbnn.exec:\3nbbnn.exe83⤵PID:556
-
\??\c:\vvddj.exec:\vvddj.exe84⤵PID:992
-
\??\c:\vjjjj.exec:\vjjjj.exe85⤵PID:2724
-
\??\c:\xffxfff.exec:\xffxfff.exe86⤵
- System Location Discovery: System Language Discovery
PID:1552 -
\??\c:\rlfffrr.exec:\rlfffrr.exe87⤵PID:4536
-
\??\c:\tnhhtt.exec:\tnhhtt.exe88⤵PID:4416
-
\??\c:\dpvpp.exec:\dpvpp.exe89⤵PID:3588
-
\??\c:\vdddp.exec:\vdddp.exe90⤵PID:2296
-
\??\c:\5xxrllr.exec:\5xxrllr.exe91⤵PID:4456
-
\??\c:\btbbbb.exec:\btbbbb.exe92⤵PID:5008
-
\??\c:\jdjjj.exec:\jdjjj.exe93⤵PID:1932
-
\??\c:\pdjjd.exec:\pdjjd.exe94⤵PID:2164
-
\??\c:\fflfxxr.exec:\fflfxxr.exe95⤵PID:2392
-
\??\c:\hbttbb.exec:\hbttbb.exe96⤵PID:1132
-
\??\c:\7ddvj.exec:\7ddvj.exe97⤵PID:4308
-
\??\c:\jjjdv.exec:\jjjdv.exe98⤵PID:1764
-
\??\c:\rlffxxx.exec:\rlffxxx.exe99⤵PID:4264
-
\??\c:\nhhbtn.exec:\nhhbtn.exe100⤵PID:1884
-
\??\c:\vvvvp.exec:\vvvvp.exe101⤵PID:1600
-
\??\c:\dppjj.exec:\dppjj.exe102⤵PID:4024
-
\??\c:\9xfrllf.exec:\9xfrllf.exe103⤵PID:1560
-
\??\c:\hbtntn.exec:\hbtntn.exe104⤵PID:4676
-
\??\c:\nnbthh.exec:\nnbthh.exe105⤵PID:5116
-
\??\c:\pjpdd.exec:\pjpdd.exe106⤵PID:3688
-
\??\c:\3vvvp.exec:\3vvvp.exe107⤵PID:348
-
\??\c:\rrfxffr.exec:\rrfxffr.exe108⤵PID:4496
-
\??\c:\bbbbbt.exec:\bbbbbt.exe109⤵PID:2440
-
\??\c:\pvddd.exec:\pvddd.exe110⤵PID:1092
-
\??\c:\jdddv.exec:\jdddv.exe111⤵PID:4424
-
\??\c:\xxlfxxl.exec:\xxlfxxl.exe112⤵PID:780
-
\??\c:\hhhbbb.exec:\hhhbbb.exe113⤵PID:2640
-
\??\c:\vpvpj.exec:\vpvpj.exe114⤵PID:100
-
\??\c:\vpdvp.exec:\vpdvp.exe115⤵PID:2996
-
\??\c:\tnbbtt.exec:\tnbbtt.exe116⤵PID:1608
-
\??\c:\bhttnn.exec:\bhttnn.exe117⤵PID:4492
-
\??\c:\vppjj.exec:\vppjj.exe118⤵PID:4744
-
\??\c:\xfxlrlx.exec:\xfxlrlx.exe119⤵PID:4708
-
\??\c:\btbttt.exec:\btbttt.exe120⤵PID:3148
-
\??\c:\hhnhhh.exec:\hhnhhh.exe121⤵PID:1808
-
\??\c:\pdppp.exec:\pdppp.exe122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-