Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 23:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe
-
Size
453KB
-
MD5
d75ae541ae76388d0b22fed138fed1e0
-
SHA1
058745d3300e6b476fe7e79dd7bfe96d95616549
-
SHA256
c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4
-
SHA512
65c50c4bbd205768012ca5f2d6d28aa2c70d6497c19e0d35634b798994e1dc1a929178cdc77a998895d68c9978f503707e1abc21060804470a9fe74279d46c33
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1448-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-847-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-947-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-1265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-1269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-1285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 716 dvvjv.exe 3856 lxlxrlf.exe 3024 flffrlf.exe 4504 nnbtnh.exe 2836 3xrfrlx.exe 1992 nbbttt.exe 2132 flfrlfr.exe 4200 3bnbnh.exe 3628 9jdpp.exe 4808 tnhbbh.exe 2404 1pdpd.exe 3304 bnthnb.exe 1832 3vpdp.exe 2408 htttnn.exe 1556 pvdjj.exe 2080 bnbtnn.exe 3164 jvvjd.exe 1936 5lfrllf.exe 2280 thnnhb.exe 4576 3lxlfxx.exe 3676 bnhthb.exe 1604 lfrllfr.exe 4624 hbhtnh.exe 212 7ppdv.exe 4468 xlrfxlf.exe 2580 hhnbht.exe 4240 frfxrlf.exe 4740 9rrfrlx.exe 4932 jpdjj.exe 1824 bhthtn.exe 3048 vpjvj.exe 1580 hnntnb.exe 2628 dpjvp.exe 3140 lxrfrlx.exe 2500 bnnhbb.exe 924 pjjdv.exe 1272 rlfxrrl.exe 536 bnhttn.exe 2044 jppdp.exe 3328 xfxlrlf.exe 2992 ntbbnn.exe 116 pdvjd.exe 3468 lxxlxrf.exe 2240 tnbhtn.exe 3132 5jvvv.exe 4484 tnnbtt.exe 4336 dpdvp.exe 3896 rrxrrrx.exe 2748 hthbnh.exe 3688 jjjvj.exe 4116 frrlffx.exe 980 hthbnh.exe 4092 9jddj.exe 4816 3llxrrl.exe 2860 htbnbt.exe 404 bbbthh.exe 3956 5djjd.exe 1120 rrxlrlr.exe 4804 1tntht.exe 4948 pdjdd.exe 3628 jpvpj.exe 2488 frrflxr.exe 3756 1hthnb.exe 1964 7bbthb.exe -
resource yara_rule behavioral2/memory/1448-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-847-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1448 wrote to memory of 716 1448 c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe 82 PID 1448 wrote to memory of 716 1448 c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe 82 PID 1448 wrote to memory of 716 1448 c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe 82 PID 716 wrote to memory of 3856 716 dvvjv.exe 83 PID 716 wrote to memory of 3856 716 dvvjv.exe 83 PID 716 wrote to memory of 3856 716 dvvjv.exe 83 PID 3856 wrote to memory of 3024 3856 lxlxrlf.exe 84 PID 3856 wrote to memory of 3024 3856 lxlxrlf.exe 84 PID 3856 wrote to memory of 3024 3856 lxlxrlf.exe 84 PID 3024 wrote to memory of 4504 3024 flffrlf.exe 85 PID 3024 wrote to memory of 4504 3024 flffrlf.exe 85 PID 3024 wrote to memory of 4504 3024 flffrlf.exe 85 PID 4504 wrote to memory of 2836 4504 nnbtnh.exe 86 PID 4504 wrote to memory of 2836 4504 nnbtnh.exe 86 PID 4504 wrote to memory of 2836 4504 nnbtnh.exe 86 PID 2836 wrote to memory of 1992 2836 3xrfrlx.exe 87 PID 2836 wrote to memory of 1992 2836 3xrfrlx.exe 87 PID 2836 wrote to memory of 1992 2836 3xrfrlx.exe 87 PID 1992 wrote to memory of 2132 1992 nbbttt.exe 88 PID 1992 wrote to memory of 2132 1992 nbbttt.exe 88 PID 1992 wrote to memory of 2132 1992 nbbttt.exe 88 PID 2132 wrote to memory of 4200 2132 flfrlfr.exe 89 PID 2132 wrote to memory of 4200 2132 flfrlfr.exe 89 PID 2132 wrote to memory of 4200 2132 flfrlfr.exe 89 PID 4200 wrote to memory of 3628 4200 3bnbnh.exe 90 PID 4200 wrote to memory of 3628 4200 3bnbnh.exe 90 PID 4200 wrote to memory of 3628 4200 3bnbnh.exe 90 PID 3628 wrote to memory of 4808 3628 9jdpp.exe 91 PID 3628 wrote to memory of 4808 3628 9jdpp.exe 91 PID 3628 wrote to memory of 4808 3628 9jdpp.exe 91 PID 4808 wrote to memory of 2404 4808 tnhbbh.exe 92 PID 4808 wrote to memory of 2404 4808 tnhbbh.exe 92 PID 4808 wrote to memory of 2404 4808 tnhbbh.exe 92 PID 2404 wrote to memory of 3304 2404 1pdpd.exe 93 PID 2404 wrote to memory of 3304 2404 1pdpd.exe 93 PID 2404 wrote to memory of 3304 2404 1pdpd.exe 93 PID 3304 wrote to memory of 1832 3304 bnthnb.exe 94 PID 3304 wrote to memory of 1832 3304 bnthnb.exe 94 PID 3304 wrote to memory of 1832 3304 bnthnb.exe 94 PID 1832 wrote to memory of 2408 1832 3vpdp.exe 95 PID 1832 wrote to memory of 2408 1832 3vpdp.exe 95 PID 1832 wrote to memory of 2408 1832 3vpdp.exe 95 PID 2408 wrote to memory of 1556 2408 htttnn.exe 96 PID 2408 wrote to memory of 1556 2408 htttnn.exe 96 PID 2408 wrote to memory of 1556 2408 htttnn.exe 96 PID 1556 wrote to memory of 2080 1556 pvdjj.exe 97 PID 1556 wrote to memory of 2080 1556 pvdjj.exe 97 PID 1556 wrote to memory of 2080 1556 pvdjj.exe 97 PID 2080 wrote to memory of 3164 2080 bnbtnn.exe 98 PID 2080 wrote to memory of 3164 2080 bnbtnn.exe 98 PID 2080 wrote to memory of 3164 2080 bnbtnn.exe 98 PID 3164 wrote to memory of 1936 3164 jvvjd.exe 99 PID 3164 wrote to memory of 1936 3164 jvvjd.exe 99 PID 3164 wrote to memory of 1936 3164 jvvjd.exe 99 PID 1936 wrote to memory of 2280 1936 5lfrllf.exe 100 PID 1936 wrote to memory of 2280 1936 5lfrllf.exe 100 PID 1936 wrote to memory of 2280 1936 5lfrllf.exe 100 PID 2280 wrote to memory of 4576 2280 thnnhb.exe 101 PID 2280 wrote to memory of 4576 2280 thnnhb.exe 101 PID 2280 wrote to memory of 4576 2280 thnnhb.exe 101 PID 4576 wrote to memory of 3676 4576 3lxlfxx.exe 102 PID 4576 wrote to memory of 3676 4576 3lxlfxx.exe 102 PID 4576 wrote to memory of 3676 4576 3lxlfxx.exe 102 PID 3676 wrote to memory of 1604 3676 bnhthb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe"C:\Users\Admin\AppData\Local\Temp\c322cc777dd209f62d0103d12bb991493fb02f1c88a76d77fb6a1ead83e76bb4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\dvvjv.exec:\dvvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\lxlxrlf.exec:\lxlxrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\flffrlf.exec:\flffrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\nnbtnh.exec:\nnbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\3xrfrlx.exec:\3xrfrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\nbbttt.exec:\nbbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\flfrlfr.exec:\flfrlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\3bnbnh.exec:\3bnbnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\9jdpp.exec:\9jdpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\tnhbbh.exec:\tnhbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\1pdpd.exec:\1pdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\bnthnb.exec:\bnthnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\3vpdp.exec:\3vpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\htttnn.exec:\htttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\pvdjj.exec:\pvdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\bnbtnn.exec:\bnbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\jvvjd.exec:\jvvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\5lfrllf.exec:\5lfrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\thnnhb.exec:\thnnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\3lxlfxx.exec:\3lxlfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\bnhthb.exec:\bnhthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\lfrllfr.exec:\lfrllfr.exe23⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hbhtnh.exec:\hbhtnh.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4624 -
\??\c:\7ppdv.exec:\7ppdv.exe25⤵
- Executes dropped EXE
PID:212 -
\??\c:\xlrfxlf.exec:\xlrfxlf.exe26⤵
- Executes dropped EXE
PID:4468 -
\??\c:\hhnbht.exec:\hhnbht.exe27⤵
- Executes dropped EXE
PID:2580 -
\??\c:\frfxrlf.exec:\frfxrlf.exe28⤵
- Executes dropped EXE
PID:4240 -
\??\c:\9rrfrlx.exec:\9rrfrlx.exe29⤵
- Executes dropped EXE
PID:4740 -
\??\c:\jpdjj.exec:\jpdjj.exe30⤵
- Executes dropped EXE
PID:4932 -
\??\c:\bhthtn.exec:\bhthtn.exe31⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vpjvj.exec:\vpjvj.exe32⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hnntnb.exec:\hnntnb.exe33⤵
- Executes dropped EXE
PID:1580 -
\??\c:\dpjvp.exec:\dpjvp.exe34⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe35⤵
- Executes dropped EXE
PID:3140 -
\??\c:\bnnhbb.exec:\bnnhbb.exe36⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pjjdv.exec:\pjjdv.exe37⤵
- Executes dropped EXE
PID:924 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe38⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bnhttn.exec:\bnhttn.exe39⤵
- Executes dropped EXE
PID:536 -
\??\c:\jppdp.exec:\jppdp.exe40⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xfxlrlf.exec:\xfxlrlf.exe41⤵
- Executes dropped EXE
PID:3328 -
\??\c:\ntbbnn.exec:\ntbbnn.exe42⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pdvjd.exec:\pdvjd.exe43⤵
- Executes dropped EXE
PID:116 -
\??\c:\lxxlxrf.exec:\lxxlxrf.exe44⤵
- Executes dropped EXE
PID:3468 -
\??\c:\tnbhtn.exec:\tnbhtn.exe45⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5jvvv.exec:\5jvvv.exe46⤵
- Executes dropped EXE
PID:3132 -
\??\c:\tnnbtt.exec:\tnnbtt.exe47⤵
- Executes dropped EXE
PID:4484 -
\??\c:\dpdvp.exec:\dpdvp.exe48⤵
- Executes dropped EXE
PID:4336 -
\??\c:\rrxrrrx.exec:\rrxrrrx.exe49⤵
- Executes dropped EXE
PID:3896 -
\??\c:\hthbnh.exec:\hthbnh.exe50⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jjjvj.exec:\jjjvj.exe51⤵
- Executes dropped EXE
PID:3688 -
\??\c:\frrlffx.exec:\frrlffx.exe52⤵
- Executes dropped EXE
PID:4116 -
\??\c:\hthbnh.exec:\hthbnh.exe53⤵
- Executes dropped EXE
PID:980 -
\??\c:\9jddj.exec:\9jddj.exe54⤵
- Executes dropped EXE
PID:4092 -
\??\c:\3llxrrl.exec:\3llxrrl.exe55⤵
- Executes dropped EXE
PID:4816 -
\??\c:\htbnbt.exec:\htbnbt.exe56⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bbbthh.exec:\bbbthh.exe57⤵
- Executes dropped EXE
PID:404 -
\??\c:\5djjd.exec:\5djjd.exe58⤵
- Executes dropped EXE
PID:3956 -
\??\c:\rrxlrlr.exec:\rrxlrlr.exe59⤵
- Executes dropped EXE
PID:1120 -
\??\c:\1tntht.exec:\1tntht.exe60⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pdjdd.exec:\pdjdd.exe61⤵
- Executes dropped EXE
PID:4948 -
\??\c:\jpvpj.exec:\jpvpj.exe62⤵
- Executes dropped EXE
PID:3628 -
\??\c:\frrflxr.exec:\frrflxr.exe63⤵
- Executes dropped EXE
PID:2488 -
\??\c:\1hthnb.exec:\1hthnb.exe64⤵
- Executes dropped EXE
PID:3756 -
\??\c:\7bbthb.exec:\7bbthb.exe65⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vvpjj.exec:\vvpjj.exe66⤵PID:2752
-
\??\c:\llllllx.exec:\llllllx.exe67⤵PID:4432
-
\??\c:\btthbb.exec:\btthbb.exe68⤵PID:2388
-
\??\c:\vjvjd.exec:\vjvjd.exe69⤵PID:2556
-
\??\c:\pvdpp.exec:\pvdpp.exe70⤵PID:4836
-
\??\c:\9xrxrlx.exec:\9xrxrlx.exe71⤵PID:4596
-
\??\c:\nbtttt.exec:\nbtttt.exe72⤵PID:4300
-
\??\c:\jddpd.exec:\jddpd.exe73⤵PID:720
-
\??\c:\xlxlxxl.exec:\xlxlxxl.exe74⤵PID:1488
-
\??\c:\fflxxrf.exec:\fflxxrf.exe75⤵PID:4512
-
\??\c:\htthtn.exec:\htthtn.exe76⤵PID:2612
-
\??\c:\htttnt.exec:\htttnt.exe77⤵PID:4576
-
\??\c:\pjvdd.exec:\pjvdd.exe78⤵PID:3332
-
\??\c:\7xfxrfx.exec:\7xfxrfx.exe79⤵PID:4920
-
\??\c:\btnnbb.exec:\btnnbb.exe80⤵PID:4520
-
\??\c:\pdjdj.exec:\pdjdj.exe81⤵PID:1064
-
\??\c:\vjjvj.exec:\vjjvj.exe82⤵PID:212
-
\??\c:\xfxlxrf.exec:\xfxlxrf.exe83⤵PID:1776
-
\??\c:\3nnbtn.exec:\3nnbtn.exe84⤵PID:1652
-
\??\c:\vvvjv.exec:\vvvjv.exe85⤵PID:3000
-
\??\c:\pddpj.exec:\pddpj.exe86⤵PID:3576
-
\??\c:\rfrllll.exec:\rfrllll.exe87⤵PID:2600
-
\??\c:\1bbtnn.exec:\1bbtnn.exe88⤵PID:2880
-
\??\c:\jpjvj.exec:\jpjvj.exe89⤵PID:4932
-
\??\c:\rlfrlfr.exec:\rlfrlfr.exe90⤵PID:2312
-
\??\c:\btbtbb.exec:\btbtbb.exe91⤵PID:5056
-
\??\c:\ddjdj.exec:\ddjdj.exe92⤵PID:2300
-
\??\c:\lflxrrx.exec:\lflxrrx.exe93⤵PID:2876
-
\??\c:\9nttbb.exec:\9nttbb.exe94⤵PID:2628
-
\??\c:\thhttn.exec:\thhttn.exe95⤵PID:3140
-
\??\c:\5pjdv.exec:\5pjdv.exe96⤵PID:392
-
\??\c:\xxxxflx.exec:\xxxxflx.exe97⤵PID:400
-
\??\c:\thtnhb.exec:\thtnhb.exe98⤵PID:1272
-
\??\c:\3hthtt.exec:\3hthtt.exe99⤵PID:536
-
\??\c:\vdpjj.exec:\vdpjj.exe100⤵PID:1420
-
\??\c:\lxxlxrf.exec:\lxxlxrf.exe101⤵PID:4564
-
\??\c:\bbbbtt.exec:\bbbbtt.exe102⤵PID:4272
-
\??\c:\jdpjv.exec:\jdpjv.exe103⤵PID:3708
-
\??\c:\9xffllr.exec:\9xffllr.exe104⤵PID:3692
-
\??\c:\1bntnh.exec:\1bntnh.exe105⤵PID:4376
-
\??\c:\bbnhbb.exec:\bbnhbb.exe106⤵PID:4380
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe107⤵PID:1448
-
\??\c:\xlxrrfx.exec:\xlxrrfx.exe108⤵
- System Location Discovery: System Language Discovery
PID:1016 -
\??\c:\vpppj.exec:\vpppj.exe109⤵PID:2484
-
\??\c:\fflfllx.exec:\fflfllx.exe110⤵PID:588
-
\??\c:\lxrxlfr.exec:\lxrxlfr.exe111⤵PID:4608
-
\??\c:\9bhnnn.exec:\9bhnnn.exe112⤵PID:468
-
\??\c:\vpdvd.exec:\vpdvd.exe113⤵PID:2380
-
\??\c:\flrlllr.exec:\flrlllr.exe114⤵PID:4872
-
\??\c:\tttnbb.exec:\tttnbb.exe115⤵PID:3108
-
\??\c:\7nnhtt.exec:\7nnhtt.exe116⤵PID:2324
-
\??\c:\pvdvp.exec:\pvdvp.exe117⤵PID:3440
-
\??\c:\5rfrlfr.exec:\5rfrlfr.exe118⤵PID:4016
-
\??\c:\nbbttn.exec:\nbbttn.exe119⤵PID:4200
-
\??\c:\9jdvd.exec:\9jdvd.exe120⤵PID:4040
-
\??\c:\ddpjv.exec:\ddpjv.exe121⤵PID:4420
-
\??\c:\lxfxrlr.exec:\lxfxrlr.exe122⤵PID:2220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-