Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 08:41
Behavioral task
behavioral1
Sample
bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe
-
Size
254KB
-
MD5
dc22f86afd3fdd13045f2c4d544f2b10
-
SHA1
85c194451491931e5d1b3b33c0efa7a8280b97a6
-
SHA256
bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838
-
SHA512
c53feb6d8b9b5fc212c5bb52de82ab57523e94fb812092e1a3ffd30b8039bfd41e89658fd920494fa702f1b65a2aaef39674c49616f60f5b302b046f5d4ae0a2
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfBP/l:y4wFHoS3eFaKHpKT9XvEhdfBP/l
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4484-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/688-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-557-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-597-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-619-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-683-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-852-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-892-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-977-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-1077-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-1277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2024 vjvjv.exe 4448 fxfxrlf.exe 212 9bntnb.exe 4520 tnnnhh.exe 4004 5vdvd.exe 2364 ddvjv.exe 4428 thhthb.exe 1732 pjjdv.exe 3556 1ffrxrx.exe 2784 vpdpj.exe 4424 bbhhbb.exe 4072 vdvvp.exe 2832 xrrxrrr.exe 1228 btbbtb.exe 772 3ntnhh.exe 4444 vvjpp.exe 3216 dvvjd.exe 1936 fllrlff.exe 4112 nbbnhb.exe 1768 vpdpd.exe 2052 1vjdp.exe 1692 btnhbb.exe 688 nnnttn.exe 4480 lxrlfxr.exe 3392 hnhbnh.exe 3820 9jdvp.exe 3440 vvdpp.exe 2512 5nhtbt.exe 2736 hbhtnb.exe 3884 5ffxllf.exe 2732 hhtnbt.exe 2236 5vvjj.exe 4436 rrrlxrl.exe 4844 7nnhbb.exe 728 pvppj.exe 2028 bbbnnb.exe 2284 nhnbbt.exe 400 lrlfxrl.exe 1816 hbbthh.exe 2244 vpvpj.exe 4920 xxrlxrl.exe 3644 5bnhbt.exe 4524 tnnbtn.exe 2080 xffxxxr.exe 4408 7bthbt.exe 3024 3ddvp.exe 5096 rrlffff.exe 4348 nthbtb.exe 2232 pppvp.exe 4316 rlxrxxr.exe 2024 fllfrrf.exe 232 tnhbth.exe 224 djvpj.exe 3420 jdvpj.exe 4928 llfrrlf.exe 4076 fflllrr.exe 3328 7tbbht.exe 184 9vpjj.exe 1484 jdvpv.exe 4820 frrfxrl.exe 2564 3xfxrrf.exe 1688 bbthtn.exe 2212 pvddp.exe 1556 rrlxrlf.exe -
resource yara_rule behavioral2/memory/4484-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023cce-3.dat upx behavioral2/memory/4484-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cd1-12.dat upx behavioral2/files/0x0007000000023cd5-13.dat upx behavioral2/memory/4448-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4520-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd6-23.dat upx behavioral2/files/0x0007000000023cd7-30.dat upx behavioral2/memory/4004-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/212-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2024-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd8-34.dat upx behavioral2/files/0x0007000000023cda-39.dat upx behavioral2/memory/2364-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdb-45.dat upx behavioral2/memory/4428-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdc-50.dat upx behavioral2/memory/1732-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdd-56.dat upx behavioral2/memory/3556-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cde-62.dat upx behavioral2/memory/2784-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdf-70.dat upx behavioral2/memory/4424-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce0-74.dat upx behavioral2/files/0x0007000000023ce2-85.dat upx behavioral2/files/0x0007000000023ce4-96.dat upx behavioral2/files/0x0007000000023ce3-93.dat upx behavioral2/memory/1228-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce1-82.dat upx behavioral2/memory/4072-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce5-102.dat upx behavioral2/memory/1936-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cd2-108.dat upx behavioral2/files/0x0007000000023ce6-112.dat upx behavioral2/memory/4112-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce7-119.dat upx behavioral2/memory/2052-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1768-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce9-126.dat upx behavioral2/files/0x0007000000023cea-132.dat upx behavioral2/memory/1692-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ceb-138.dat upx behavioral2/memory/688-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cec-144.dat upx behavioral2/files/0x0007000000023ced-149.dat upx behavioral2/files/0x0007000000023cee-153.dat upx behavioral2/memory/3820-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cef-158.dat upx behavioral2/files/0x0007000000023cf0-164.dat upx behavioral2/memory/2512-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cf1-170.dat upx behavioral2/memory/3884-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cf2-174.dat upx behavioral2/memory/2732-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cf3-182.dat upx behavioral2/memory/2236-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4436-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4844-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1816-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2244-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3644-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4524-226-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4484 wrote to memory of 2024 4484 bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe 83 PID 4484 wrote to memory of 2024 4484 bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe 83 PID 4484 wrote to memory of 2024 4484 bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe 83 PID 2024 wrote to memory of 4448 2024 vjvjv.exe 84 PID 2024 wrote to memory of 4448 2024 vjvjv.exe 84 PID 2024 wrote to memory of 4448 2024 vjvjv.exe 84 PID 4448 wrote to memory of 212 4448 fxfxrlf.exe 85 PID 4448 wrote to memory of 212 4448 fxfxrlf.exe 85 PID 4448 wrote to memory of 212 4448 fxfxrlf.exe 85 PID 212 wrote to memory of 4520 212 9bntnb.exe 86 PID 212 wrote to memory of 4520 212 9bntnb.exe 86 PID 212 wrote to memory of 4520 212 9bntnb.exe 86 PID 4520 wrote to memory of 4004 4520 tnnnhh.exe 87 PID 4520 wrote to memory of 4004 4520 tnnnhh.exe 87 PID 4520 wrote to memory of 4004 4520 tnnnhh.exe 87 PID 4004 wrote to memory of 2364 4004 5vdvd.exe 88 PID 4004 wrote to memory of 2364 4004 5vdvd.exe 88 PID 4004 wrote to memory of 2364 4004 5vdvd.exe 88 PID 2364 wrote to memory of 4428 2364 ddvjv.exe 89 PID 2364 wrote to memory of 4428 2364 ddvjv.exe 89 PID 2364 wrote to memory of 4428 2364 ddvjv.exe 89 PID 4428 wrote to memory of 1732 4428 thhthb.exe 90 PID 4428 wrote to memory of 1732 4428 thhthb.exe 90 PID 4428 wrote to memory of 1732 4428 thhthb.exe 90 PID 1732 wrote to memory of 3556 1732 pjjdv.exe 91 PID 1732 wrote to memory of 3556 1732 pjjdv.exe 91 PID 1732 wrote to memory of 3556 1732 pjjdv.exe 91 PID 3556 wrote to memory of 2784 3556 1ffrxrx.exe 92 PID 3556 wrote to memory of 2784 3556 1ffrxrx.exe 92 PID 3556 wrote to memory of 2784 3556 1ffrxrx.exe 92 PID 2784 wrote to memory of 4424 2784 vpdpj.exe 93 PID 2784 wrote to memory of 4424 2784 vpdpj.exe 93 PID 2784 wrote to memory of 4424 2784 vpdpj.exe 93 PID 4424 wrote to memory of 4072 4424 bbhhbb.exe 94 PID 4424 wrote to memory of 4072 4424 bbhhbb.exe 94 PID 4424 wrote to memory of 4072 4424 bbhhbb.exe 94 PID 4072 wrote to memory of 2832 4072 vdvvp.exe 95 PID 4072 wrote to memory of 2832 4072 vdvvp.exe 95 PID 4072 wrote to memory of 2832 4072 vdvvp.exe 95 PID 2832 wrote to memory of 1228 2832 xrrxrrr.exe 96 PID 2832 wrote to memory of 1228 2832 xrrxrrr.exe 96 PID 2832 wrote to memory of 1228 2832 xrrxrrr.exe 96 PID 1228 wrote to memory of 772 1228 btbbtb.exe 97 PID 1228 wrote to memory of 772 1228 btbbtb.exe 97 PID 1228 wrote to memory of 772 1228 btbbtb.exe 97 PID 772 wrote to memory of 4444 772 3ntnhh.exe 98 PID 772 wrote to memory of 4444 772 3ntnhh.exe 98 PID 772 wrote to memory of 4444 772 3ntnhh.exe 98 PID 4444 wrote to memory of 3216 4444 vvjpp.exe 99 PID 4444 wrote to memory of 3216 4444 vvjpp.exe 99 PID 4444 wrote to memory of 3216 4444 vvjpp.exe 99 PID 3216 wrote to memory of 1936 3216 dvvjd.exe 100 PID 3216 wrote to memory of 1936 3216 dvvjd.exe 100 PID 3216 wrote to memory of 1936 3216 dvvjd.exe 100 PID 1936 wrote to memory of 4112 1936 fllrlff.exe 101 PID 1936 wrote to memory of 4112 1936 fllrlff.exe 101 PID 1936 wrote to memory of 4112 1936 fllrlff.exe 101 PID 4112 wrote to memory of 1768 4112 nbbnhb.exe 102 PID 4112 wrote to memory of 1768 4112 nbbnhb.exe 102 PID 4112 wrote to memory of 1768 4112 nbbnhb.exe 102 PID 1768 wrote to memory of 2052 1768 vpdpd.exe 103 PID 1768 wrote to memory of 2052 1768 vpdpd.exe 103 PID 1768 wrote to memory of 2052 1768 vpdpd.exe 103 PID 2052 wrote to memory of 1692 2052 1vjdp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe"C:\Users\Admin\AppData\Local\Temp\bea1819a7ab01312adf264308d5ecabb05d1cbb8c58f6943e78b7a9391c77838N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\vjvjv.exec:\vjvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\9bntnb.exec:\9bntnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\tnnnhh.exec:\tnnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\5vdvd.exec:\5vdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\ddvjv.exec:\ddvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\thhthb.exec:\thhthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\pjjdv.exec:\pjjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\1ffrxrx.exec:\1ffrxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\vpdpj.exec:\vpdpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bbhhbb.exec:\bbhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\vdvvp.exec:\vdvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\xrrxrrr.exec:\xrrxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\btbbtb.exec:\btbbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\3ntnhh.exec:\3ntnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\vvjpp.exec:\vvjpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\dvvjd.exec:\dvvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\fllrlff.exec:\fllrlff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\nbbnhb.exec:\nbbnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\vpdpd.exec:\vpdpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\1vjdp.exec:\1vjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\btnhbb.exec:\btnhbb.exe23⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nnnttn.exec:\nnnttn.exe24⤵
- Executes dropped EXE
PID:688 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe25⤵
- Executes dropped EXE
PID:4480 -
\??\c:\hnhbnh.exec:\hnhbnh.exe26⤵
- Executes dropped EXE
PID:3392 -
\??\c:\9jdvp.exec:\9jdvp.exe27⤵
- Executes dropped EXE
PID:3820 -
\??\c:\vvdpp.exec:\vvdpp.exe28⤵
- Executes dropped EXE
PID:3440 -
\??\c:\5nhtbt.exec:\5nhtbt.exe29⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hbhtnb.exec:\hbhtnb.exe30⤵
- Executes dropped EXE
PID:2736 -
\??\c:\5ffxllf.exec:\5ffxllf.exe31⤵
- Executes dropped EXE
PID:3884 -
\??\c:\hhtnbt.exec:\hhtnbt.exe32⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5vvjj.exec:\5vvjj.exe33⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rrrlxrl.exec:\rrrlxrl.exe34⤵
- Executes dropped EXE
PID:4436 -
\??\c:\7nnhbb.exec:\7nnhbb.exe35⤵
- Executes dropped EXE
PID:4844 -
\??\c:\pvppj.exec:\pvppj.exe36⤵
- Executes dropped EXE
PID:728 -
\??\c:\bbbnnb.exec:\bbbnnb.exe37⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nhnbbt.exec:\nhnbbt.exe38⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lrlfxrl.exec:\lrlfxrl.exe39⤵
- Executes dropped EXE
PID:400 -
\??\c:\hbbthh.exec:\hbbthh.exe40⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vpvpj.exec:\vpvpj.exe41⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe42⤵
- Executes dropped EXE
PID:4920 -
\??\c:\5bnhbt.exec:\5bnhbt.exe43⤵
- Executes dropped EXE
PID:3644 -
\??\c:\tnnbtn.exec:\tnnbtn.exe44⤵
- Executes dropped EXE
PID:4524 -
\??\c:\xffxxxr.exec:\xffxxxr.exe45⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7bthbt.exec:\7bthbt.exe46⤵
- Executes dropped EXE
PID:4408 -
\??\c:\3ddvp.exec:\3ddvp.exe47⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rrlffff.exec:\rrlffff.exe48⤵
- Executes dropped EXE
PID:5096 -
\??\c:\nthbtb.exec:\nthbtb.exe49⤵
- Executes dropped EXE
PID:4348 -
\??\c:\pppvp.exec:\pppvp.exe50⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rlxrxxr.exec:\rlxrxxr.exe51⤵
- Executes dropped EXE
PID:4316 -
\??\c:\fllfrrf.exec:\fllfrrf.exe52⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnhbth.exec:\tnhbth.exe53⤵
- Executes dropped EXE
PID:232 -
\??\c:\djvpj.exec:\djvpj.exe54⤵
- Executes dropped EXE
PID:224 -
\??\c:\jdvpj.exec:\jdvpj.exe55⤵
- Executes dropped EXE
PID:3420 -
\??\c:\llfrrlf.exec:\llfrrlf.exe56⤵
- Executes dropped EXE
PID:4928 -
\??\c:\fflllrr.exec:\fflllrr.exe57⤵
- Executes dropped EXE
PID:4076 -
\??\c:\7tbbht.exec:\7tbbht.exe58⤵
- Executes dropped EXE
PID:3328 -
\??\c:\9vpjj.exec:\9vpjj.exe59⤵
- Executes dropped EXE
PID:184 -
\??\c:\jdvpv.exec:\jdvpv.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\frrfxrl.exec:\frrfxrl.exe61⤵
- Executes dropped EXE
PID:4820 -
\??\c:\3xfxrrf.exec:\3xfxrrf.exe62⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bbthtn.exec:\bbthtn.exe63⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pvddp.exec:\pvddp.exe64⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rrlxrlf.exec:\rrlxrlf.exe65⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ffrrrrl.exec:\ffrrrrl.exe66⤵PID:3992
-
\??\c:\bntnnt.exec:\bntnnt.exe67⤵PID:2300
-
\??\c:\1ddvp.exec:\1ddvp.exe68⤵PID:1848
-
\??\c:\lffxlll.exec:\lffxlll.exe69⤵PID:1104
-
\??\c:\7lxrlfx.exec:\7lxrlfx.exe70⤵PID:2224
-
\??\c:\tnnbtn.exec:\tnnbtn.exe71⤵PID:912
-
\??\c:\ddpjp.exec:\ddpjp.exe72⤵PID:1700
-
\??\c:\9vvpp.exec:\9vvpp.exe73⤵PID:316
-
\??\c:\lllllll.exec:\lllllll.exe74⤵PID:3224
-
\??\c:\3hhbnn.exec:\3hhbnn.exe75⤵PID:4808
-
\??\c:\pjddp.exec:\pjddp.exe76⤵PID:2876
-
\??\c:\ppdvj.exec:\ppdvj.exe77⤵PID:4112
-
\??\c:\lffrlfr.exec:\lffrlfr.exe78⤵PID:1020
-
\??\c:\nnnhbb.exec:\nnnhbb.exe79⤵PID:2160
-
\??\c:\pdpjd.exec:\pdpjd.exe80⤵PID:1628
-
\??\c:\rflrrrr.exec:\rflrrrr.exe81⤵PID:1468
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe82⤵PID:544
-
\??\c:\3btnhb.exec:\3btnhb.exe83⤵PID:2308
-
\??\c:\ppppj.exec:\ppppj.exe84⤵PID:3392
-
\??\c:\dpvdd.exec:\dpvdd.exe85⤵PID:1456
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe86⤵PID:1356
-
\??\c:\nnthbb.exec:\nnthbb.exe87⤵PID:4700
-
\??\c:\pdpjj.exec:\pdpjj.exe88⤵PID:5064
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe89⤵PID:5084
-
\??\c:\rrlflfl.exec:\rrlflfl.exe90⤵PID:4224
-
\??\c:\hhhhnn.exec:\hhhhnn.exe91⤵PID:1300
-
\??\c:\vjjdv.exec:\vjjdv.exe92⤵PID:2616
-
\??\c:\5vdvp.exec:\5vdvp.exe93⤵PID:1756
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe94⤵PID:4036
-
\??\c:\3lffrrl.exec:\3lffrrl.exe95⤵PID:2776
-
\??\c:\nbhhtt.exec:\nbhhtt.exe96⤵PID:3132
-
\??\c:\jjdvj.exec:\jjdvj.exe97⤵PID:1124
-
\??\c:\pddvp.exec:\pddvp.exe98⤵PID:4468
-
\??\c:\xrrlffx.exec:\xrrlffx.exe99⤵PID:2724
-
\??\c:\hhbtnh.exec:\hhbtnh.exe100⤵PID:780
-
\??\c:\bbhbhh.exec:\bbhbhh.exe101⤵PID:2140
-
\??\c:\9vddv.exec:\9vddv.exe102⤵PID:920
-
\??\c:\jdpjd.exec:\jdpjd.exe103⤵PID:1236
-
\??\c:\xflfxrr.exec:\xflfxrr.exe104⤵PID:1892
-
\??\c:\ttbhhh.exec:\ttbhhh.exe105⤵PID:1504
-
\??\c:\hntbbt.exec:\hntbbt.exe106⤵PID:4524
-
\??\c:\5vppd.exec:\5vppd.exe107⤵PID:116
-
\??\c:\llllfll.exec:\llllfll.exe108⤵PID:820
-
\??\c:\lllfxrl.exec:\lllfxrl.exe109⤵PID:3024
-
\??\c:\bnnttt.exec:\bnnttt.exe110⤵PID:4332
-
\??\c:\9vvpj.exec:\9vvpj.exe111⤵PID:3928
-
\??\c:\7xllfff.exec:\7xllfff.exe112⤵PID:4484
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe113⤵PID:2924
-
\??\c:\hbnbtn.exec:\hbnbtn.exe114⤵PID:4448
-
\??\c:\tnnhbb.exec:\tnnhbb.exe115⤵PID:3648
-
\??\c:\1jdvj.exec:\1jdvj.exe116⤵PID:4520
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe117⤵PID:4952
-
\??\c:\llffxxr.exec:\llffxxr.exe118⤵PID:880
-
\??\c:\1hhbbb.exec:\1hhbbb.exe119⤵PID:4004
-
\??\c:\pvvpj.exec:\pvvpj.exe120⤵PID:4692
-
\??\c:\vpjdv.exec:\vpjdv.exe121⤵PID:928
-
\??\c:\1jjdd.exec:\1jjdd.exe122⤵PID:3768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-