Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe
-
Size
454KB
-
MD5
c3a2b04188e0793c1cf40867941cd950
-
SHA1
aa47dd587e22ceb03a508bb591e859eee47a2d9a
-
SHA256
840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458
-
SHA512
c6c06beb0e0bee95d202743b7d57778cabad458604be8f7294455adece474550d68da57985903d954f18779625349001503189f04853fd921e6954e096dfe8a7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetP:q7Tc2NYHUrAwfMp3CDtP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2360-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-1342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-1517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1368 3pdvp.exe 1068 rllfxrr.exe 2208 hhnnnn.exe 3496 vjjpj.exe 5112 rlrlffx.exe 2228 jdvpj.exe 2696 rlffrxl.exe 4244 hbtnhh.exe 756 vvpdv.exe 2320 vpvpj.exe 3848 thbtnh.exe 5100 jvvvv.exe 3180 fffxxll.exe 2352 1dpdd.exe 3164 xrrffxr.exe 1384 tnbbbb.exe 3576 dpdvp.exe 2376 1nhbbb.exe 432 dvjdp.exe 4060 dvjdd.exe 2692 dvjjd.exe 2264 3rrfxxx.exe 752 rfffffx.exe 4516 nbhhbb.exe 4912 5jpjd.exe 2588 nnbttt.exe 4700 xrrlfrl.exe 4188 dvvpd.exe 912 jjpjp.exe 3056 rxfxxxr.exe 3580 dddvv.exe 2312 9pjpd.exe 2844 xlfxxxr.exe 1344 bnnhhn.exe 1536 jpdjj.exe 2124 ttbttb.exe 872 vjpjj.exe 1752 xxllxxf.exe 468 vvjdj.exe 3376 3llffff.exe 5084 bttntt.exe 1748 pjvpj.exe 3452 fxflffx.exe 1984 9nbhbt.exe 828 hnbbbb.exe 3188 3jvpv.exe 1576 5ffxxxx.exe 3156 3nnhbb.exe 4360 ntbttn.exe 452 vvddj.exe 2344 1lrxrlf.exe 2464 bbbbbb.exe 3512 hnnhbb.exe 3632 pdvjp.exe 1516 5ffxrrl.exe 2876 7hnhbn.exe 4000 jvjdd.exe 1788 9jvpv.exe 4748 1rflrff.exe 5116 vpppj.exe 1504 xxlllrr.exe 2184 5bbbtb.exe 1876 thhhbb.exe 756 5pppp.exe -
resource yara_rule behavioral2/memory/2360-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-682-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1368 2360 840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe 83 PID 2360 wrote to memory of 1368 2360 840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe 83 PID 2360 wrote to memory of 1368 2360 840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe 83 PID 1368 wrote to memory of 1068 1368 3pdvp.exe 84 PID 1368 wrote to memory of 1068 1368 3pdvp.exe 84 PID 1368 wrote to memory of 1068 1368 3pdvp.exe 84 PID 1068 wrote to memory of 2208 1068 rllfxrr.exe 85 PID 1068 wrote to memory of 2208 1068 rllfxrr.exe 85 PID 1068 wrote to memory of 2208 1068 rllfxrr.exe 85 PID 2208 wrote to memory of 3496 2208 hhnnnn.exe 86 PID 2208 wrote to memory of 3496 2208 hhnnnn.exe 86 PID 2208 wrote to memory of 3496 2208 hhnnnn.exe 86 PID 3496 wrote to memory of 5112 3496 vjjpj.exe 87 PID 3496 wrote to memory of 5112 3496 vjjpj.exe 87 PID 3496 wrote to memory of 5112 3496 vjjpj.exe 87 PID 5112 wrote to memory of 2228 5112 rlrlffx.exe 88 PID 5112 wrote to memory of 2228 5112 rlrlffx.exe 88 PID 5112 wrote to memory of 2228 5112 rlrlffx.exe 88 PID 2228 wrote to memory of 2696 2228 jdvpj.exe 89 PID 2228 wrote to memory of 2696 2228 jdvpj.exe 89 PID 2228 wrote to memory of 2696 2228 jdvpj.exe 89 PID 2696 wrote to memory of 4244 2696 rlffrxl.exe 90 PID 2696 wrote to memory of 4244 2696 rlffrxl.exe 90 PID 2696 wrote to memory of 4244 2696 rlffrxl.exe 90 PID 4244 wrote to memory of 756 4244 hbtnhh.exe 91 PID 4244 wrote to memory of 756 4244 hbtnhh.exe 91 PID 4244 wrote to memory of 756 4244 hbtnhh.exe 91 PID 756 wrote to memory of 2320 756 vvpdv.exe 92 PID 756 wrote to memory of 2320 756 vvpdv.exe 92 PID 756 wrote to memory of 2320 756 vvpdv.exe 92 PID 2320 wrote to memory of 3848 2320 vpvpj.exe 93 PID 2320 wrote to memory of 3848 2320 vpvpj.exe 93 PID 2320 wrote to memory of 3848 2320 vpvpj.exe 93 PID 3848 wrote to memory of 5100 3848 thbtnh.exe 94 PID 3848 wrote to memory of 5100 3848 thbtnh.exe 94 PID 3848 wrote to memory of 5100 3848 thbtnh.exe 94 PID 5100 wrote to memory of 3180 5100 jvvvv.exe 95 PID 5100 wrote to memory of 3180 5100 jvvvv.exe 95 PID 5100 wrote to memory of 3180 5100 jvvvv.exe 95 PID 3180 wrote to memory of 2352 3180 fffxxll.exe 96 PID 3180 wrote to memory of 2352 3180 fffxxll.exe 96 PID 3180 wrote to memory of 2352 3180 fffxxll.exe 96 PID 2352 wrote to memory of 3164 2352 1dpdd.exe 97 PID 2352 wrote to memory of 3164 2352 1dpdd.exe 97 PID 2352 wrote to memory of 3164 2352 1dpdd.exe 97 PID 3164 wrote to memory of 1384 3164 xrrffxr.exe 98 PID 3164 wrote to memory of 1384 3164 xrrffxr.exe 98 PID 3164 wrote to memory of 1384 3164 xrrffxr.exe 98 PID 1384 wrote to memory of 3576 1384 tnbbbb.exe 99 PID 1384 wrote to memory of 3576 1384 tnbbbb.exe 99 PID 1384 wrote to memory of 3576 1384 tnbbbb.exe 99 PID 3576 wrote to memory of 2376 3576 dpdvp.exe 100 PID 3576 wrote to memory of 2376 3576 dpdvp.exe 100 PID 3576 wrote to memory of 2376 3576 dpdvp.exe 100 PID 2376 wrote to memory of 432 2376 1nhbbb.exe 101 PID 2376 wrote to memory of 432 2376 1nhbbb.exe 101 PID 2376 wrote to memory of 432 2376 1nhbbb.exe 101 PID 432 wrote to memory of 4060 432 dvjdp.exe 102 PID 432 wrote to memory of 4060 432 dvjdp.exe 102 PID 432 wrote to memory of 4060 432 dvjdp.exe 102 PID 4060 wrote to memory of 2692 4060 dvjdd.exe 103 PID 4060 wrote to memory of 2692 4060 dvjdd.exe 103 PID 4060 wrote to memory of 2692 4060 dvjdd.exe 103 PID 2692 wrote to memory of 2264 2692 dvjjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe"C:\Users\Admin\AppData\Local\Temp\840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\3pdvp.exec:\3pdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\rllfxrr.exec:\rllfxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\hhnnnn.exec:\hhnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\vjjpj.exec:\vjjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\rlrlffx.exec:\rlrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\jdvpj.exec:\jdvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\rlffrxl.exec:\rlffrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\hbtnhh.exec:\hbtnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\vvpdv.exec:\vvpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\vpvpj.exec:\vpvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\thbtnh.exec:\thbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\jvvvv.exec:\jvvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\fffxxll.exec:\fffxxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\1dpdd.exec:\1dpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\xrrffxr.exec:\xrrffxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\tnbbbb.exec:\tnbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\dpdvp.exec:\dpdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\1nhbbb.exec:\1nhbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\dvjdp.exec:\dvjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\dvjdd.exec:\dvjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\dvjjd.exec:\dvjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\3rrfxxx.exec:\3rrfxxx.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\rfffffx.exec:\rfffffx.exe24⤵
- Executes dropped EXE
PID:752 -
\??\c:\nbhhbb.exec:\nbhhbb.exe25⤵
- Executes dropped EXE
PID:4516 -
\??\c:\5jpjd.exec:\5jpjd.exe26⤵
- Executes dropped EXE
PID:4912 -
\??\c:\nnbttt.exec:\nnbttt.exe27⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrrlfrl.exec:\xrrlfrl.exe28⤵
- Executes dropped EXE
PID:4700 -
\??\c:\dvvpd.exec:\dvvpd.exe29⤵
- Executes dropped EXE
PID:4188 -
\??\c:\jjpjp.exec:\jjpjp.exe30⤵
- Executes dropped EXE
PID:912 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe31⤵
- Executes dropped EXE
PID:3056 -
\??\c:\dddvv.exec:\dddvv.exe32⤵
- Executes dropped EXE
PID:3580 -
\??\c:\9pjpd.exec:\9pjpd.exe33⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe34⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bnnhhn.exec:\bnnhhn.exe35⤵
- Executes dropped EXE
PID:1344 -
\??\c:\jpdjj.exec:\jpdjj.exe36⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ttbttb.exec:\ttbttb.exe37⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vjpjj.exec:\vjpjj.exe38⤵
- Executes dropped EXE
PID:872 -
\??\c:\xxllxxf.exec:\xxllxxf.exe39⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vvjdj.exec:\vvjdj.exe40⤵
- Executes dropped EXE
PID:468 -
\??\c:\3llffff.exec:\3llffff.exe41⤵
- Executes dropped EXE
PID:3376 -
\??\c:\bttntt.exec:\bttntt.exe42⤵
- Executes dropped EXE
PID:5084 -
\??\c:\pjvpj.exec:\pjvpj.exe43⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fxflffx.exec:\fxflffx.exe44⤵
- Executes dropped EXE
PID:3452 -
\??\c:\9nbhbt.exec:\9nbhbt.exe45⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hnbbbb.exec:\hnbbbb.exe46⤵
- Executes dropped EXE
PID:828 -
\??\c:\3jvpv.exec:\3jvpv.exe47⤵
- Executes dropped EXE
PID:3188 -
\??\c:\5ffxxxx.exec:\5ffxxxx.exe48⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3nnhbb.exec:\3nnhbb.exe49⤵
- Executes dropped EXE
PID:3156 -
\??\c:\ntbttn.exec:\ntbttn.exe50⤵
- Executes dropped EXE
PID:4360 -
\??\c:\vvddj.exec:\vvddj.exe51⤵
- Executes dropped EXE
PID:452 -
\??\c:\1lrxrlf.exec:\1lrxrlf.exe52⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bbbbbb.exec:\bbbbbb.exe53⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hnnhbb.exec:\hnnhbb.exe54⤵
- Executes dropped EXE
PID:3512 -
\??\c:\pdvjp.exec:\pdvjp.exe55⤵
- Executes dropped EXE
PID:3632 -
\??\c:\5ffxrrl.exec:\5ffxrrl.exe56⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7hnhbn.exec:\7hnhbn.exe57⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jvjdd.exec:\jvjdd.exe58⤵
- Executes dropped EXE
PID:4000 -
\??\c:\9jvpv.exec:\9jvpv.exe59⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1rflrff.exec:\1rflrff.exe60⤵
- Executes dropped EXE
PID:4748 -
\??\c:\vpppj.exec:\vpppj.exe61⤵
- Executes dropped EXE
PID:5116 -
\??\c:\xxlllrr.exec:\xxlllrr.exe62⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5bbbtb.exec:\5bbbtb.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\thhhbb.exec:\thhhbb.exe64⤵
- Executes dropped EXE
PID:1876 -
\??\c:\5pppp.exec:\5pppp.exe65⤵
- Executes dropped EXE
PID:756 -
\??\c:\fxllrrx.exec:\fxllrrx.exe66⤵PID:4216
-
\??\c:\hntnbb.exec:\hntnbb.exe67⤵PID:2276
-
\??\c:\3vdvp.exec:\3vdvp.exe68⤵PID:3844
-
\??\c:\vpvpj.exec:\vpvpj.exe69⤵PID:1020
-
\??\c:\lfffxff.exec:\lfffxff.exe70⤵PID:4524
-
\??\c:\thnbnt.exec:\thnbnt.exe71⤵PID:2868
-
\??\c:\7fllxrl.exec:\7fllxrl.exe72⤵PID:4648
-
\??\c:\7vvpp.exec:\7vvpp.exe73⤵PID:1360
-
\??\c:\vdppp.exec:\vdppp.exe74⤵PID:1384
-
\??\c:\fxfrllf.exec:\fxfrllf.exe75⤵PID:2804
-
\??\c:\nbnhnn.exec:\nbnhnn.exe76⤵PID:4296
-
\??\c:\pjvvv.exec:\pjvvv.exe77⤵PID:4720
-
\??\c:\jjjdv.exec:\jjjdv.exe78⤵PID:4628
-
\??\c:\5llfxxx.exec:\5llfxxx.exe79⤵PID:748
-
\??\c:\hhhbtt.exec:\hhhbtt.exe80⤵PID:2288
-
\??\c:\9nnhhh.exec:\9nnhhh.exe81⤵PID:2412
-
\??\c:\dpvvp.exec:\dpvvp.exe82⤵PID:384
-
\??\c:\7xxrlfx.exec:\7xxrlfx.exe83⤵PID:1064
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe84⤵PID:2200
-
\??\c:\hnttnn.exec:\hnttnn.exe85⤵PID:3816
-
\??\c:\5jvvv.exec:\5jvvv.exe86⤵PID:3960
-
\??\c:\jvdvp.exec:\jvdvp.exe87⤵PID:4604
-
\??\c:\frfxrlf.exec:\frfxrlf.exe88⤵
- System Location Discovery: System Language Discovery
PID:4700 -
\??\c:\bbbbtt.exec:\bbbbtt.exe89⤵PID:4580
-
\??\c:\vpddj.exec:\vpddj.exe90⤵PID:4336
-
\??\c:\ppdjd.exec:\ppdjd.exe91⤵PID:1372
-
\??\c:\3lxrxxf.exec:\3lxrxxf.exe92⤵PID:968
-
\??\c:\tntnhh.exec:\tntnhh.exe93⤵PID:1316
-
\??\c:\pdjjd.exec:\pdjjd.exe94⤵PID:3316
-
\??\c:\lllfxxx.exec:\lllfxxx.exe95⤵PID:5016
-
\??\c:\llrllll.exec:\llrllll.exe96⤵PID:1708
-
\??\c:\nhhtnt.exec:\nhhtnt.exe97⤵PID:1412
-
\??\c:\1vpjp.exec:\1vpjp.exe98⤵PID:4976
-
\??\c:\vpppp.exec:\vpppp.exe99⤵PID:3536
-
\??\c:\frrlfxx.exec:\frrlfxx.exe100⤵PID:3416
-
\??\c:\nbhbnb.exec:\nbhbnb.exe101⤵PID:3940
-
\??\c:\9jpjd.exec:\9jpjd.exe102⤵PID:4488
-
\??\c:\7jppj.exec:\7jppj.exe103⤵PID:2424
-
\??\c:\rrrxllf.exec:\rrrxllf.exe104⤵PID:3516
-
\??\c:\nttbtn.exec:\nttbtn.exe105⤵PID:5084
-
\??\c:\djvjd.exec:\djvjd.exe106⤵PID:2492
-
\??\c:\fxxrfff.exec:\fxxrfff.exe107⤵PID:3452
-
\??\c:\hnnnnb.exec:\hnnnnb.exe108⤵PID:1984
-
\??\c:\thnhtt.exec:\thnhtt.exe109⤵PID:640
-
\??\c:\pdjvp.exec:\pdjvp.exe110⤵PID:2520
-
\??\c:\lfrlllr.exec:\lfrlllr.exe111⤵PID:800
-
\??\c:\9ntnbb.exec:\9ntnbb.exe112⤵PID:3504
-
\??\c:\tbnbtt.exec:\tbnbtt.exe113⤵PID:4372
-
\??\c:\vppjj.exec:\vppjj.exe114⤵PID:4384
-
\??\c:\3xfffrl.exec:\3xfffrl.exe115⤵PID:3920
-
\??\c:\hnbttn.exec:\hnbttn.exe116⤵PID:1068
-
\??\c:\hntnnn.exec:\hntnnn.exe117⤵PID:1812
-
\??\c:\jdpjd.exec:\jdpjd.exe118⤵PID:3936
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe119⤵PID:4968
-
\??\c:\nthnhh.exec:\nthnhh.exe120⤵PID:3396
-
\??\c:\thnhhb.exec:\thnhhb.exe121⤵PID:4812
-
\??\c:\1djpp.exec:\1djpp.exe122⤵PID:1788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-