Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 03:17
Behavioral task
behavioral1
Sample
9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe
-
Size
333KB
-
MD5
b1eaf5db7e7eb52285d559606b0eb4ee
-
SHA1
87a979a408c4c8431d9393071f105cf1a01d6937
-
SHA256
9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f
-
SHA512
7f902a6dfe676a3a268fb73e87ecab81da312872ace10ce1c8259049ffe28e647d44f5395b33542337de85ad9edea9309980da881983d64c68f065612408f40e
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeTb:R4wFHoSHYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/772-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/508-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/620-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3804-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/700-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2804-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-553-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-761-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-766-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/708-937-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3388 vpdpj.exe 1516 lrxxxff.exe 5048 xffrrrr.exe 4600 ttbbbn.exe 756 rlrrrrr.exe 3308 vjvdd.exe 4832 lrrrrff.exe 460 djdpp.exe 4968 btttnt.exe 1672 vvjjd.exe 3244 hbnntb.exe 1944 ntbbbh.exe 4932 ttntbb.exe 2296 hbbbhh.exe 4900 xxllxfr.exe 4920 bnbbbh.exe 3956 rlrrrxx.exe 220 xxxlrff.exe 508 thhbbt.exe 4924 5rffffr.exe 4952 bhbhbt.exe 3432 vvdvp.exe 2088 jjvpp.exe 2164 fxfxrrr.exe 3792 btbbbh.exe 2392 ttnnnn.exe 3936 vpjjd.exe 4620 9rxxrrl.exe 620 pdjpd.exe 2772 llxlfrl.exe 544 tnttbb.exe 1400 llrlfll.exe 2292 lxlllll.exe 3484 dvjjj.exe 4068 9rfffll.exe 2912 bbtntt.exe 3212 xfrlllx.exe 1332 vvddj.exe 1480 vpjjj.exe 1964 jddjj.exe 444 fxxxflr.exe 4484 pjppv.exe 1272 llffxxx.exe 2860 nnhhhh.exe 3404 btnbtt.exe 2408 dpvvd.exe 4184 flxxrrr.exe 4368 btbbtt.exe 3804 nthhbb.exe 4536 dvdpp.exe 3692 xfrffxx.exe 2920 nthttt.exe 4860 jvddd.exe 876 ffrxxff.exe 4656 nbtbbb.exe 2872 bbtttb.exe 1804 ddpdp.exe 4052 xxllffx.exe 756 rlrlllf.exe 3880 hbttbh.exe 1520 jppvj.exe 264 xxffxxx.exe 4160 1xflrxr.exe 4816 nnnhht.exe -
resource yara_rule behavioral2/memory/772-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b35-4.dat upx behavioral2/memory/3388-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/772-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023b8e-9.dat upx behavioral2/memory/3388-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1516-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-16.dat upx behavioral2/memory/1516-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-21.dat upx behavioral2/memory/5048-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4600-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b99-27.dat upx behavioral2/files/0x000a000000023b9a-31.dat upx behavioral2/memory/756-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3308-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9b-36.dat upx behavioral2/files/0x000a000000023b9c-40.dat upx behavioral2/memory/4832-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-47.dat upx behavioral2/memory/460-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9e-50.dat upx behavioral2/files/0x000a000000023b9f-54.dat upx behavioral2/memory/1672-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba0-59.dat upx behavioral2/memory/3244-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba2-64.dat upx behavioral2/memory/1944-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba3-69.dat upx behavioral2/files/0x000b000000023b93-73.dat upx behavioral2/memory/2296-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba4-79.dat upx behavioral2/memory/4900-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba5-85.dat upx behavioral2/files/0x000a000000023ba6-89.dat upx behavioral2/memory/3956-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4920-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba7-94.dat upx behavioral2/memory/220-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba8-99.dat upx behavioral2/files/0x000a000000023ba9-104.dat upx behavioral2/memory/508-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023baa-107.dat upx behavioral2/memory/3432-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bab-113.dat upx behavioral2/memory/2088-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bac-118.dat upx behavioral2/memory/2088-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bad-123.dat upx behavioral2/memory/3792-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3792-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bae-128.dat upx behavioral2/files/0x000a000000023baf-132.dat upx behavioral2/files/0x000a000000023bb0-136.dat upx behavioral2/memory/3936-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4620-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb1-143.dat upx behavioral2/memory/620-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023bb2-147.dat upx behavioral2/files/0x000b000000023bb3-151.dat upx behavioral2/memory/544-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023bb4-155.dat upx behavioral2/memory/1400-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2292-163-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 772 wrote to memory of 3388 772 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 82 PID 772 wrote to memory of 3388 772 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 82 PID 772 wrote to memory of 3388 772 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 82 PID 3388 wrote to memory of 1516 3388 vpdpj.exe 83 PID 3388 wrote to memory of 1516 3388 vpdpj.exe 83 PID 3388 wrote to memory of 1516 3388 vpdpj.exe 83 PID 1516 wrote to memory of 5048 1516 lrxxxff.exe 84 PID 1516 wrote to memory of 5048 1516 lrxxxff.exe 84 PID 1516 wrote to memory of 5048 1516 lrxxxff.exe 84 PID 5048 wrote to memory of 4600 5048 xffrrrr.exe 85 PID 5048 wrote to memory of 4600 5048 xffrrrr.exe 85 PID 5048 wrote to memory of 4600 5048 xffrrrr.exe 85 PID 4600 wrote to memory of 756 4600 ttbbbn.exe 86 PID 4600 wrote to memory of 756 4600 ttbbbn.exe 86 PID 4600 wrote to memory of 756 4600 ttbbbn.exe 86 PID 756 wrote to memory of 3308 756 rlrrrrr.exe 87 PID 756 wrote to memory of 3308 756 rlrrrrr.exe 87 PID 756 wrote to memory of 3308 756 rlrrrrr.exe 87 PID 3308 wrote to memory of 4832 3308 vjvdd.exe 88 PID 3308 wrote to memory of 4832 3308 vjvdd.exe 88 PID 3308 wrote to memory of 4832 3308 vjvdd.exe 88 PID 4832 wrote to memory of 460 4832 lrrrrff.exe 89 PID 4832 wrote to memory of 460 4832 lrrrrff.exe 89 PID 4832 wrote to memory of 460 4832 lrrrrff.exe 89 PID 460 wrote to memory of 4968 460 djdpp.exe 90 PID 460 wrote to memory of 4968 460 djdpp.exe 90 PID 460 wrote to memory of 4968 460 djdpp.exe 90 PID 4968 wrote to memory of 1672 4968 btttnt.exe 91 PID 4968 wrote to memory of 1672 4968 btttnt.exe 91 PID 4968 wrote to memory of 1672 4968 btttnt.exe 91 PID 1672 wrote to memory of 3244 1672 vvjjd.exe 92 PID 1672 wrote to memory of 3244 1672 vvjjd.exe 92 PID 1672 wrote to memory of 3244 1672 vvjjd.exe 92 PID 3244 wrote to memory of 1944 3244 hbnntb.exe 93 PID 3244 wrote to memory of 1944 3244 hbnntb.exe 93 PID 3244 wrote to memory of 1944 3244 hbnntb.exe 93 PID 1944 wrote to memory of 4932 1944 ntbbbh.exe 94 PID 1944 wrote to memory of 4932 1944 ntbbbh.exe 94 PID 1944 wrote to memory of 4932 1944 ntbbbh.exe 94 PID 4932 wrote to memory of 2296 4932 ttntbb.exe 95 PID 4932 wrote to memory of 2296 4932 ttntbb.exe 95 PID 4932 wrote to memory of 2296 4932 ttntbb.exe 95 PID 2296 wrote to memory of 4900 2296 hbbbhh.exe 96 PID 2296 wrote to memory of 4900 2296 hbbbhh.exe 96 PID 2296 wrote to memory of 4900 2296 hbbbhh.exe 96 PID 4900 wrote to memory of 4920 4900 xxllxfr.exe 97 PID 4900 wrote to memory of 4920 4900 xxllxfr.exe 97 PID 4900 wrote to memory of 4920 4900 xxllxfr.exe 97 PID 4920 wrote to memory of 3956 4920 bnbbbh.exe 98 PID 4920 wrote to memory of 3956 4920 bnbbbh.exe 98 PID 4920 wrote to memory of 3956 4920 bnbbbh.exe 98 PID 3956 wrote to memory of 220 3956 rlrrrxx.exe 99 PID 3956 wrote to memory of 220 3956 rlrrrxx.exe 99 PID 3956 wrote to memory of 220 3956 rlrrrxx.exe 99 PID 220 wrote to memory of 508 220 xxxlrff.exe 100 PID 220 wrote to memory of 508 220 xxxlrff.exe 100 PID 220 wrote to memory of 508 220 xxxlrff.exe 100 PID 508 wrote to memory of 4924 508 thhbbt.exe 101 PID 508 wrote to memory of 4924 508 thhbbt.exe 101 PID 508 wrote to memory of 4924 508 thhbbt.exe 101 PID 4924 wrote to memory of 4952 4924 5rffffr.exe 102 PID 4924 wrote to memory of 4952 4924 5rffffr.exe 102 PID 4924 wrote to memory of 4952 4924 5rffffr.exe 102 PID 4952 wrote to memory of 3432 4952 bhbhbt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe"C:\Users\Admin\AppData\Local\Temp\9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\vpdpj.exec:\vpdpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\lrxxxff.exec:\lrxxxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\xffrrrr.exec:\xffrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\ttbbbn.exec:\ttbbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\vjvdd.exec:\vjvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\lrrrrff.exec:\lrrrrff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\djdpp.exec:\djdpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\btttnt.exec:\btttnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\vvjjd.exec:\vvjjd.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\hbnntb.exec:\hbnntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\ntbbbh.exec:\ntbbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\ttntbb.exec:\ttntbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\hbbbhh.exec:\hbbbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\xxllxfr.exec:\xxllxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\bnbbbh.exec:\bnbbbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\xxxlrff.exec:\xxxlrff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\thhbbt.exec:\thhbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\5rffffr.exec:\5rffffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\bhbhbt.exec:\bhbhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\vvdvp.exec:\vvdvp.exe23⤵
- Executes dropped EXE
PID:3432 -
\??\c:\jjvpp.exec:\jjvpp.exe24⤵
- Executes dropped EXE
PID:2088 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe25⤵
- Executes dropped EXE
PID:2164 -
\??\c:\btbbbh.exec:\btbbbh.exe26⤵
- Executes dropped EXE
PID:3792 -
\??\c:\ttnnnn.exec:\ttnnnn.exe27⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vpjjd.exec:\vpjjd.exe28⤵
- Executes dropped EXE
PID:3936 -
\??\c:\9rxxrrl.exec:\9rxxrrl.exe29⤵
- Executes dropped EXE
PID:4620 -
\??\c:\pdjpd.exec:\pdjpd.exe30⤵
- Executes dropped EXE
PID:620 -
\??\c:\llxlfrl.exec:\llxlfrl.exe31⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tnttbb.exec:\tnttbb.exe32⤵
- Executes dropped EXE
PID:544 -
\??\c:\llrlfll.exec:\llrlfll.exe33⤵
- Executes dropped EXE
PID:1400 -
\??\c:\lxlllll.exec:\lxlllll.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dvjjj.exec:\dvjjj.exe35⤵
- Executes dropped EXE
PID:3484 -
\??\c:\9rfffll.exec:\9rfffll.exe36⤵
- Executes dropped EXE
PID:4068 -
\??\c:\bbtntt.exec:\bbtntt.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xfrlllx.exec:\xfrlllx.exe38⤵
- Executes dropped EXE
PID:3212 -
\??\c:\vvddj.exec:\vvddj.exe39⤵
- Executes dropped EXE
PID:1332 -
\??\c:\vpjjj.exec:\vpjjj.exe40⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jddjj.exec:\jddjj.exe41⤵
- Executes dropped EXE
PID:1964 -
\??\c:\fxxxflr.exec:\fxxxflr.exe42⤵
- Executes dropped EXE
PID:444 -
\??\c:\pjppv.exec:\pjppv.exe43⤵
- Executes dropped EXE
PID:4484 -
\??\c:\llffxxx.exec:\llffxxx.exe44⤵
- Executes dropped EXE
PID:1272 -
\??\c:\nnhhhh.exec:\nnhhhh.exe45⤵
- Executes dropped EXE
PID:2860 -
\??\c:\btnbtt.exec:\btnbtt.exe46⤵
- Executes dropped EXE
PID:3404 -
\??\c:\dpvvd.exec:\dpvvd.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\flxxrrr.exec:\flxxrrr.exe48⤵
- Executes dropped EXE
PID:4184 -
\??\c:\btbbtt.exec:\btbbtt.exe49⤵
- Executes dropped EXE
PID:4368 -
\??\c:\nthhbb.exec:\nthhbb.exe50⤵
- Executes dropped EXE
PID:3804 -
\??\c:\dvdpp.exec:\dvdpp.exe51⤵
- Executes dropped EXE
PID:4536 -
\??\c:\llffxfr.exec:\llffxfr.exe52⤵PID:4384
-
\??\c:\xfrffxx.exec:\xfrffxx.exe53⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nthttt.exec:\nthttt.exe54⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jvddd.exec:\jvddd.exe55⤵
- Executes dropped EXE
PID:4860 -
\??\c:\ffrxxff.exec:\ffrxxff.exe56⤵
- Executes dropped EXE
PID:876 -
\??\c:\nbtbbb.exec:\nbtbbb.exe57⤵
- Executes dropped EXE
PID:4656 -
\??\c:\bbtttb.exec:\bbtttb.exe58⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ddpdp.exec:\ddpdp.exe59⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xxllffx.exec:\xxllffx.exe60⤵
- Executes dropped EXE
PID:4052 -
\??\c:\rlrlllf.exec:\rlrlllf.exe61⤵
- Executes dropped EXE
PID:756 -
\??\c:\hbttbh.exec:\hbttbh.exe62⤵
- Executes dropped EXE
PID:3880 -
\??\c:\jppvj.exec:\jppvj.exe63⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xxffxxx.exec:\xxffxxx.exe64⤵
- Executes dropped EXE
PID:264 -
\??\c:\1xflrxr.exec:\1xflrxr.exe65⤵
- Executes dropped EXE
PID:4160 -
\??\c:\nnnhht.exec:\nnnhht.exe66⤵
- Executes dropped EXE
PID:4816 -
\??\c:\ppvdd.exec:\ppvdd.exe67⤵PID:4856
-
\??\c:\rrxxrxf.exec:\rrxxrxf.exe68⤵PID:2968
-
\??\c:\flllxfl.exec:\flllxfl.exe69⤵PID:1284
-
\??\c:\hhnnnt.exec:\hhnnnt.exe70⤵PID:3252
-
\??\c:\3vpjp.exec:\3vpjp.exe71⤵PID:3556
-
\??\c:\jjpdv.exec:\jjpdv.exe72⤵PID:3372
-
\??\c:\xlffxxx.exec:\xlffxxx.exe73⤵PID:2188
-
\??\c:\btthhh.exec:\btthhh.exe74⤵PID:4464
-
\??\c:\jjvvp.exec:\jjvvp.exe75⤵PID:1468
-
\??\c:\lfxrlrx.exec:\lfxrlrx.exe76⤵PID:2236
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe77⤵PID:4104
-
\??\c:\hntnhb.exec:\hntnhb.exe78⤵PID:232
-
\??\c:\jdjvp.exec:\jdjvp.exe79⤵PID:4220
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe80⤵PID:4040
-
\??\c:\nbbnnb.exec:\nbbnnb.exe81⤵PID:2436
-
\??\c:\7nthnn.exec:\7nthnn.exe82⤵PID:1152
-
\??\c:\jpdpj.exec:\jpdpj.exe83⤵PID:700
-
\??\c:\lrxrxfl.exec:\lrxrxfl.exe84⤵PID:4952
-
\??\c:\tthnnn.exec:\tthnnn.exe85⤵PID:3272
-
\??\c:\jdjpp.exec:\jdjpp.exe86⤵PID:960
-
\??\c:\jdjdd.exec:\jdjdd.exe87⤵PID:540
-
\??\c:\7lrrrfx.exec:\7lrrrfx.exe88⤵PID:1792
-
\??\c:\fffffrr.exec:\fffffrr.exe89⤵PID:2192
-
\??\c:\5bhnhb.exec:\5bhnhb.exe90⤵PID:3792
-
\??\c:\jdpvp.exec:\jdpvp.exe91⤵PID:1036
-
\??\c:\ppvvp.exec:\ppvvp.exe92⤵PID:4784
-
\??\c:\frrffxf.exec:\frrffxf.exe93⤵PID:4364
-
\??\c:\hthbbb.exec:\hthbbb.exe94⤵PID:3600
-
\??\c:\vvjvp.exec:\vvjvp.exe95⤵PID:4676
-
\??\c:\dddjv.exec:\dddjv.exe96⤵PID:4352
-
\??\c:\rlrrlrx.exec:\rlrrlrx.exe97⤵PID:4616
-
\??\c:\nnnnnt.exec:\nnnnnt.exe98⤵PID:4872
-
\??\c:\bbtnhh.exec:\bbtnhh.exe99⤵PID:1600
-
\??\c:\jvjpp.exec:\jvjpp.exe100⤵PID:5060
-
\??\c:\3ffxllr.exec:\3ffxllr.exe101⤵PID:2292
-
\??\c:\tnhnnn.exec:\tnhnnn.exe102⤵PID:760
-
\??\c:\tthhhh.exec:\tthhhh.exe103⤵PID:2428
-
\??\c:\3jddv.exec:\3jddv.exe104⤵PID:3376
-
\??\c:\rlxfrfr.exec:\rlxfrfr.exe105⤵PID:2804
-
\??\c:\5bnbbt.exec:\5bnbbt.exe106⤵PID:4628
-
\??\c:\pjvpj.exec:\pjvpj.exe107⤵PID:1888
-
\??\c:\vppvd.exec:\vppvd.exe108⤵PID:1784
-
\??\c:\frfffxx.exec:\frfffxx.exe109⤵PID:2680
-
\??\c:\bhhhhn.exec:\bhhhhn.exe110⤵PID:3312
-
\??\c:\htthbt.exec:\htthbt.exe111⤵PID:5076
-
\??\c:\vpvvv.exec:\vpvvv.exe112⤵PID:1948
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe113⤵PID:3980
-
\??\c:\bntnhh.exec:\bntnhh.exe114⤵PID:1984
-
\??\c:\ppjjp.exec:\ppjjp.exe115⤵PID:2408
-
\??\c:\pjjjd.exec:\pjjjd.exe116⤵PID:1456
-
\??\c:\xflxxrl.exec:\xflxxrl.exe117⤵PID:4368
-
\??\c:\hhbnbh.exec:\hhbnbh.exe118⤵PID:4284
-
\??\c:\jjjpj.exec:\jjjpj.exe119⤵PID:4536
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe120⤵PID:664
-
\??\c:\bnnntb.exec:\bnnntb.exe121⤵PID:740
-
\??\c:\bbhnnn.exec:\bbhnnn.exe122⤵PID:3552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-