Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 01:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1ec02d60a0342e4dc1644fea4f97b446bba8ab484a7066b6be4879a8e08d872.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a1ec02d60a0342e4dc1644fea4f97b446bba8ab484a7066b6be4879a8e08d872.exe
-
Size
455KB
-
MD5
e2d639b94d4eca4b92ccfb33a613e3e2
-
SHA1
5b2aa2fb3a2224c72542c4ff6f977feed787df22
-
SHA256
a1ec02d60a0342e4dc1644fea4f97b446bba8ab484a7066b6be4879a8e08d872
-
SHA512
08898acbf7c49195dca37e68eabb1c72cb4b54d4e2c943035c39dbcea30f63911db4be67caefa661e7246b37507b0c889efa1b1d7851b356396fa9640884019c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTP:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3400-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-1061-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5024 hhbbtb.exe 4928 pvjjd.exe 3532 llrlfxr.exe 3980 pvdpd.exe 4832 ntnbbh.exe 1120 hbbnnn.exe 4280 fxfrrff.exe 1428 1nhhtb.exe 1948 hbbbnn.exe 2312 lxrxrrf.exe 820 vpdvv.exe 3148 frrffff.exe 544 nhthhn.exe 3656 jjvjj.exe 208 nbntnn.exe 4492 dpjdd.exe 2400 tbhbtt.exe 1956 nnnbtn.exe 3448 xrxrlll.exe 3872 ffllllr.exe 4500 vdddd.exe 4016 nbttht.exe 648 fffxxxr.exe 3364 bbhbbb.exe 2464 bttnnh.exe 3588 jjdjp.exe 4508 ntnbnh.exe 4268 fxfxrrr.exe 2740 xxlrrfl.exe 1628 pjjdv.exe 1996 llfrrlx.exe 1468 dppjp.exe 1388 ppvpv.exe 4360 xlrxfll.exe 3740 nhnnnh.exe 1540 jvpvj.exe 3372 vpvjj.exe 1752 xflrrxx.exe 1968 tnbbbb.exe 1288 ppvvv.exe 2292 lllrrfl.exe 2076 ntthhh.exe 1836 jpdjj.exe 540 fflffff.exe 1768 nnbhnt.exe 4580 pppvd.exe 3792 llxxxff.exe 3700 nhbbnt.exe 1988 vpppv.exe 4620 jvvdd.exe 536 fflxlrx.exe 4080 djvdv.exe 4404 jjjpj.exe 3404 5nnbhb.exe 3640 jpjpp.exe 4876 vddjv.exe 1636 bnttnt.exe 3968 ttbtnt.exe 3532 dpvvv.exe 5052 fxfxrrf.exe 1756 bhhbhb.exe 1460 vddvj.exe 3864 xxfllrf.exe 1120 bbnhhb.exe -
resource yara_rule behavioral2/memory/3400-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-547-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3400 wrote to memory of 5024 3400 a1ec02d60a0342e4dc1644fea4f97b446bba8ab484a7066b6be4879a8e08d872.exe 83 PID 3400 wrote to memory of 5024 3400 a1ec02d60a0342e4dc1644fea4f97b446bba8ab484a7066b6be4879a8e08d872.exe 83 PID 3400 wrote to memory of 5024 3400 a1ec02d60a0342e4dc1644fea4f97b446bba8ab484a7066b6be4879a8e08d872.exe 83 PID 5024 wrote to memory of 4928 5024 hhbbtb.exe 84 PID 5024 wrote to memory of 4928 5024 hhbbtb.exe 84 PID 5024 wrote to memory of 4928 5024 hhbbtb.exe 84 PID 4928 wrote to memory of 3532 4928 pvjjd.exe 85 PID 4928 wrote to memory of 3532 4928 pvjjd.exe 85 PID 4928 wrote to memory of 3532 4928 pvjjd.exe 85 PID 3532 wrote to memory of 3980 3532 llrlfxr.exe 86 PID 3532 wrote to memory of 3980 3532 llrlfxr.exe 86 PID 3532 wrote to memory of 3980 3532 llrlfxr.exe 86 PID 3980 wrote to memory of 4832 3980 pvdpd.exe 87 PID 3980 wrote to memory of 4832 3980 pvdpd.exe 87 PID 3980 wrote to memory of 4832 3980 pvdpd.exe 87 PID 4832 wrote to memory of 1120 4832 ntnbbh.exe 88 PID 4832 wrote to memory of 1120 4832 ntnbbh.exe 88 PID 4832 wrote to memory of 1120 4832 ntnbbh.exe 88 PID 1120 wrote to memory of 4280 1120 hbbnnn.exe 89 PID 1120 wrote to memory of 4280 1120 hbbnnn.exe 89 PID 1120 wrote to memory of 4280 1120 hbbnnn.exe 89 PID 4280 wrote to memory of 1428 4280 fxfrrff.exe 90 PID 4280 wrote to memory of 1428 4280 fxfrrff.exe 90 PID 4280 wrote to memory of 1428 4280 fxfrrff.exe 90 PID 1428 wrote to memory of 1948 1428 1nhhtb.exe 91 PID 1428 wrote to memory of 1948 1428 1nhhtb.exe 91 PID 1428 wrote to memory of 1948 1428 1nhhtb.exe 91 PID 1948 wrote to memory of 2312 1948 hbbbnn.exe 92 PID 1948 wrote to memory of 2312 1948 hbbbnn.exe 92 PID 1948 wrote to memory of 2312 1948 hbbbnn.exe 92 PID 2312 wrote to memory of 820 2312 lxrxrrf.exe 93 PID 2312 wrote to memory of 820 2312 lxrxrrf.exe 93 PID 2312 wrote to memory of 820 2312 lxrxrrf.exe 93 PID 820 wrote to memory of 3148 820 vpdvv.exe 94 PID 820 wrote to memory of 3148 820 vpdvv.exe 94 PID 820 wrote to memory of 3148 820 vpdvv.exe 94 PID 3148 wrote to memory of 544 3148 frrffff.exe 95 PID 3148 wrote to memory of 544 3148 frrffff.exe 95 PID 3148 wrote to memory of 544 3148 frrffff.exe 95 PID 544 wrote to memory of 3656 544 nhthhn.exe 96 PID 544 wrote to memory of 3656 544 nhthhn.exe 96 PID 544 wrote to memory of 3656 544 nhthhn.exe 96 PID 3656 wrote to memory of 208 3656 jjvjj.exe 97 PID 3656 wrote to memory of 208 3656 jjvjj.exe 97 PID 3656 wrote to memory of 208 3656 jjvjj.exe 97 PID 208 wrote to memory of 4492 208 nbntnn.exe 98 PID 208 wrote to memory of 4492 208 nbntnn.exe 98 PID 208 wrote to memory of 4492 208 nbntnn.exe 98 PID 4492 wrote to memory of 2400 4492 dpjdd.exe 99 PID 4492 wrote to memory of 2400 4492 dpjdd.exe 99 PID 4492 wrote to memory of 2400 4492 dpjdd.exe 99 PID 2400 wrote to memory of 1956 2400 tbhbtt.exe 100 PID 2400 wrote to memory of 1956 2400 tbhbtt.exe 100 PID 2400 wrote to memory of 1956 2400 tbhbtt.exe 100 PID 1956 wrote to memory of 3448 1956 nnnbtn.exe 101 PID 1956 wrote to memory of 3448 1956 nnnbtn.exe 101 PID 1956 wrote to memory of 3448 1956 nnnbtn.exe 101 PID 3448 wrote to memory of 3872 3448 xrxrlll.exe 102 PID 3448 wrote to memory of 3872 3448 xrxrlll.exe 102 PID 3448 wrote to memory of 3872 3448 xrxrlll.exe 102 PID 3872 wrote to memory of 4500 3872 ffllllr.exe 103 PID 3872 wrote to memory of 4500 3872 ffllllr.exe 103 PID 3872 wrote to memory of 4500 3872 ffllllr.exe 103 PID 4500 wrote to memory of 4016 4500 vdddd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1ec02d60a0342e4dc1644fea4f97b446bba8ab484a7066b6be4879a8e08d872.exe"C:\Users\Admin\AppData\Local\Temp\a1ec02d60a0342e4dc1644fea4f97b446bba8ab484a7066b6be4879a8e08d872.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\hhbbtb.exec:\hhbbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\pvjjd.exec:\pvjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\llrlfxr.exec:\llrlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\pvdpd.exec:\pvdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\ntnbbh.exec:\ntnbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\hbbnnn.exec:\hbbnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\fxfrrff.exec:\fxfrrff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\1nhhtb.exec:\1nhhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\hbbbnn.exec:\hbbbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\lxrxrrf.exec:\lxrxrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\vpdvv.exec:\vpdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\frrffff.exec:\frrffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\nhthhn.exec:\nhthhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\jjvjj.exec:\jjvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\nbntnn.exec:\nbntnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\dpjdd.exec:\dpjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\tbhbtt.exec:\tbhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\nnnbtn.exec:\nnnbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\xrxrlll.exec:\xrxrlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\ffllllr.exec:\ffllllr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\vdddd.exec:\vdddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\nbttht.exec:\nbttht.exe23⤵
- Executes dropped EXE
PID:4016 -
\??\c:\fffxxxr.exec:\fffxxxr.exe24⤵
- Executes dropped EXE
PID:648 -
\??\c:\bbhbbb.exec:\bbhbbb.exe25⤵
- Executes dropped EXE
PID:3364 -
\??\c:\bttnnh.exec:\bttnnh.exe26⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jjdjp.exec:\jjdjp.exe27⤵
- Executes dropped EXE
PID:3588 -
\??\c:\ntnbnh.exec:\ntnbnh.exe28⤵
- Executes dropped EXE
PID:4508 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe29⤵
- Executes dropped EXE
PID:4268 -
\??\c:\xxlrrfl.exec:\xxlrrfl.exe30⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pjjdv.exec:\pjjdv.exe31⤵
- Executes dropped EXE
PID:1628 -
\??\c:\llfrrlx.exec:\llfrrlx.exe32⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dppjp.exec:\dppjp.exe33⤵
- Executes dropped EXE
PID:1468 -
\??\c:\ppvpv.exec:\ppvpv.exe34⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xlrxfll.exec:\xlrxfll.exe35⤵
- Executes dropped EXE
PID:4360 -
\??\c:\nhnnnh.exec:\nhnnnh.exe36⤵
- Executes dropped EXE
PID:3740 -
\??\c:\jvpvj.exec:\jvpvj.exe37⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vpvjj.exec:\vpvjj.exe38⤵
- Executes dropped EXE
PID:3372 -
\??\c:\xflrrxx.exec:\xflrrxx.exe39⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tnbbbb.exec:\tnbbbb.exe40⤵
- Executes dropped EXE
PID:1968 -
\??\c:\ppvvv.exec:\ppvvv.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1288 -
\??\c:\lllrrfl.exec:\lllrrfl.exe42⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ntthhh.exec:\ntthhh.exe43⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jpdjj.exec:\jpdjj.exe44⤵
- Executes dropped EXE
PID:1836 -
\??\c:\fflffff.exec:\fflffff.exe45⤵
- Executes dropped EXE
PID:540 -
\??\c:\nnbhnt.exec:\nnbhnt.exe46⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pppvd.exec:\pppvd.exe47⤵
- Executes dropped EXE
PID:4580 -
\??\c:\llxxxff.exec:\llxxxff.exe48⤵
- Executes dropped EXE
PID:3792 -
\??\c:\nhbbnt.exec:\nhbbnt.exe49⤵
- Executes dropped EXE
PID:3700 -
\??\c:\vpppv.exec:\vpppv.exe50⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jvvdd.exec:\jvvdd.exe51⤵
- Executes dropped EXE
PID:4620 -
\??\c:\fflxlrx.exec:\fflxlrx.exe52⤵
- Executes dropped EXE
PID:536 -
\??\c:\djvdv.exec:\djvdv.exe53⤵
- Executes dropped EXE
PID:4080 -
\??\c:\jjjpj.exec:\jjjpj.exe54⤵
- Executes dropped EXE
PID:4404 -
\??\c:\5nnbhb.exec:\5nnbhb.exe55⤵
- Executes dropped EXE
PID:3404 -
\??\c:\jpjpp.exec:\jpjpp.exe56⤵
- Executes dropped EXE
PID:3640 -
\??\c:\vddjv.exec:\vddjv.exe57⤵
- Executes dropped EXE
PID:4876 -
\??\c:\bnttnt.exec:\bnttnt.exe58⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ttbtnt.exec:\ttbtnt.exe59⤵
- Executes dropped EXE
PID:3968 -
\??\c:\dpvvv.exec:\dpvvv.exe60⤵
- Executes dropped EXE
PID:3532 -
\??\c:\fxfxrrf.exec:\fxfxrrf.exe61⤵
- Executes dropped EXE
PID:5052 -
\??\c:\bhhbhb.exec:\bhhbhb.exe62⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vddvj.exec:\vddvj.exe63⤵
- Executes dropped EXE
PID:1460 -
\??\c:\xxfllrf.exec:\xxfllrf.exe64⤵
- Executes dropped EXE
PID:3864 -
\??\c:\bbnhhb.exec:\bbnhhb.exe65⤵
- Executes dropped EXE
PID:1120 -
\??\c:\5jvpd.exec:\5jvpd.exe66⤵PID:1304
-
\??\c:\xxlllrx.exec:\xxlllrx.exe67⤵PID:2512
-
\??\c:\hbhbhh.exec:\hbhbhh.exe68⤵PID:620
-
\??\c:\jjjpd.exec:\jjjpd.exe69⤵PID:2440
-
\??\c:\lfllffx.exec:\lfllffx.exe70⤵PID:2948
-
\??\c:\hnthnb.exec:\hnthnb.exe71⤵PID:4160
-
\??\c:\ddddj.exec:\ddddj.exe72⤵PID:2888
-
\??\c:\rrlrffr.exec:\rrlrffr.exe73⤵PID:468
-
\??\c:\hhnhhb.exec:\hhnhhb.exe74⤵PID:2212
-
\??\c:\dppvd.exec:\dppvd.exe75⤵
- System Location Discovery: System Language Discovery
PID:216 -
\??\c:\tbhhhb.exec:\tbhhhb.exe76⤵PID:312
-
\??\c:\ddjjj.exec:\ddjjj.exe77⤵PID:4188
-
\??\c:\xfrxlrl.exec:\xfrxlrl.exe78⤵PID:2284
-
\??\c:\ttbbhn.exec:\ttbbhn.exe79⤵PID:4372
-
\??\c:\vvvjv.exec:\vvvjv.exe80⤵PID:1824
-
\??\c:\fllxlfr.exec:\fllxlfr.exe81⤵PID:4444
-
\??\c:\rllrrrx.exec:\rllrrrx.exe82⤵PID:3448
-
\??\c:\9jppp.exec:\9jppp.exe83⤵PID:1924
-
\??\c:\pjdvp.exec:\pjdvp.exe84⤵PID:4548
-
\??\c:\fllfffx.exec:\fllfffx.exe85⤵PID:2172
-
\??\c:\bhthnn.exec:\bhthnn.exe86⤵PID:2072
-
\??\c:\ppppp.exec:\ppppp.exe87⤵PID:4692
-
\??\c:\xlxlllr.exec:\xlxlllr.exe88⤵PID:3044
-
\??\c:\jdjjj.exec:\jdjjj.exe89⤵PID:1356
-
\??\c:\lxlfllx.exec:\lxlfllx.exe90⤵PID:2928
-
\??\c:\htnttb.exec:\htnttb.exe91⤵PID:4092
-
\??\c:\djjjv.exec:\djjjv.exe92⤵PID:976
-
\??\c:\jdjjd.exec:\jdjjd.exe93⤵PID:3940
-
\??\c:\rflfrrl.exec:\rflfrrl.exe94⤵PID:3500
-
\??\c:\bnhnbn.exec:\bnhnbn.exe95⤵PID:3484
-
\??\c:\dpvvj.exec:\dpvvj.exe96⤵PID:4184
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe97⤵PID:3184
-
\??\c:\ttthth.exec:\ttthth.exe98⤵PID:1264
-
\??\c:\ppdvv.exec:\ppdvv.exe99⤵PID:1904
-
\??\c:\rlllfff.exec:\rlllfff.exe100⤵PID:116
-
\??\c:\hbhbhb.exec:\hbhbhb.exe101⤵PID:4360
-
\??\c:\pdvpp.exec:\pdvpp.exe102⤵PID:3740
-
\??\c:\7lllxff.exec:\7lllxff.exe103⤵PID:1540
-
\??\c:\7hnbtt.exec:\7hnbtt.exe104⤵PID:2636
-
\??\c:\thnnnh.exec:\thnnnh.exe105⤵PID:3556
-
\??\c:\jdjjd.exec:\jdjjd.exe106⤵PID:4420
-
\??\c:\rxllfll.exec:\rxllfll.exe107⤵PID:1772
-
\??\c:\7btttn.exec:\7btttn.exe108⤵PID:2628
-
\??\c:\jjdjd.exec:\jjdjd.exe109⤵PID:2336
-
\??\c:\tnhhtt.exec:\tnhhtt.exe110⤵PID:2972
-
\??\c:\bhtnnn.exec:\bhtnnn.exe111⤵PID:3432
-
\??\c:\jppjp.exec:\jppjp.exe112⤵PID:228
-
\??\c:\xxlllxx.exec:\xxlllxx.exe113⤵PID:4512
-
\??\c:\tbhbhh.exec:\tbhbhh.exe114⤵PID:1600
-
\??\c:\jdddv.exec:\jdddv.exe115⤵PID:2296
-
\??\c:\llflxxr.exec:\llflxxr.exe116⤵PID:3756
-
\??\c:\nbtnhh.exec:\nbtnhh.exe117⤵PID:3760
-
\??\c:\vdvpj.exec:\vdvpj.exe118⤵PID:888
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe119⤵PID:2444
-
\??\c:\hbnnnn.exec:\hbnnnn.exe120⤵PID:3476
-
\??\c:\jjjjd.exec:\jjjjd.exe121⤵PID:4656
-
\??\c:\xfxrllf.exec:\xfxrllf.exe122⤵PID:4600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-