Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3bcd7621510d392368c8e4d1137dda83e13d2eb39b735a8e70cc132ca6b4c7e.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
d3bcd7621510d392368c8e4d1137dda83e13d2eb39b735a8e70cc132ca6b4c7e.exe
-
Size
453KB
-
MD5
31653f8e0aa45af32f56aa6eb7768bca
-
SHA1
a37ac8630d3b6a90c1cb9c64917fa50c0e3f1aa1
-
SHA256
d3bcd7621510d392368c8e4d1137dda83e13d2eb39b735a8e70cc132ca6b4c7e
-
SHA512
fc4d6cf445841d79447cddfc0e027604bb22dba846462fa930904a8093fecb509461e075a5e596ded2c813b00bef2cd092c6a5d6070f80b893a902e81e925c04
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3956-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-826-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-913-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-981-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-1346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3776 hbbbbb.exe 4412 ppdvd.exe 1584 jjvvd.exe 3280 xxfxlfr.exe 748 llxrrrx.exe 3376 nhbtnh.exe 3728 3ppjv.exe 1364 1btnhh.exe 1172 rllxrlf.exe 2076 3djdv.exe 2444 fllfxlf.exe 2324 ttnhtt.exe 2636 jvpjj.exe 5028 hhhbtt.exe 3632 vvjdj.exe 3552 7hhbbt.exe 1476 pdjdp.exe 2812 lfxxfxr.exe 1208 lllxrrr.exe 4724 3ddpp.exe 4580 bthbtt.exe 2344 pppdj.exe 3532 5tttnh.exe 436 fxrrfxl.exe 2264 ntbbbb.exe 4640 tnhbhb.exe 3088 vjvvp.exe 1804 lffxrlf.exe 4424 ppddj.exe 2780 nhhtnb.exe 1896 xllffxr.exe 1188 tbhbbt.exe 3588 lxlfffx.exe 1076 thnnnn.exe 3784 vdpdv.exe 4716 xxxxfff.exe 3056 bnbttt.exe 1416 ddjjj.exe 3544 jddvv.exe 2296 flxrlff.exe 2844 tbhbbb.exe 1968 vpddd.exe 1752 5flxrfx.exe 1220 flxfxxx.exe 2112 hbbtnh.exe 624 vdpjd.exe 1760 llxrlxr.exe 4352 nnnhhh.exe 4492 tnhntn.exe 3956 ddjjv.exe 2736 lrfxrrf.exe 4040 9nhnnh.exe 3948 5dvpj.exe 2160 xrrlfxx.exe 2260 frllfff.exe 1924 tntnnn.exe 2512 pdppj.exe 4964 fffxxxx.exe 4512 bhnnhh.exe 1268 1jjjj.exe 3376 rfxrlrl.exe 4204 vjppp.exe 4456 xxrfrlf.exe 1392 nttnhb.exe -
resource yara_rule behavioral2/memory/3956-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-913-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3956 wrote to memory of 3776 3956 d3bcd7621510d392368c8e4d1137dda83e13d2eb39b735a8e70cc132ca6b4c7e.exe 82 PID 3956 wrote to memory of 3776 3956 d3bcd7621510d392368c8e4d1137dda83e13d2eb39b735a8e70cc132ca6b4c7e.exe 82 PID 3956 wrote to memory of 3776 3956 d3bcd7621510d392368c8e4d1137dda83e13d2eb39b735a8e70cc132ca6b4c7e.exe 82 PID 3776 wrote to memory of 4412 3776 hbbbbb.exe 83 PID 3776 wrote to memory of 4412 3776 hbbbbb.exe 83 PID 3776 wrote to memory of 4412 3776 hbbbbb.exe 83 PID 4412 wrote to memory of 1584 4412 ppdvd.exe 84 PID 4412 wrote to memory of 1584 4412 ppdvd.exe 84 PID 4412 wrote to memory of 1584 4412 ppdvd.exe 84 PID 1584 wrote to memory of 3280 1584 jjvvd.exe 85 PID 1584 wrote to memory of 3280 1584 jjvvd.exe 85 PID 1584 wrote to memory of 3280 1584 jjvvd.exe 85 PID 3280 wrote to memory of 748 3280 xxfxlfr.exe 86 PID 3280 wrote to memory of 748 3280 xxfxlfr.exe 86 PID 3280 wrote to memory of 748 3280 xxfxlfr.exe 86 PID 748 wrote to memory of 3376 748 llxrrrx.exe 87 PID 748 wrote to memory of 3376 748 llxrrrx.exe 87 PID 748 wrote to memory of 3376 748 llxrrrx.exe 87 PID 3376 wrote to memory of 3728 3376 nhbtnh.exe 88 PID 3376 wrote to memory of 3728 3376 nhbtnh.exe 88 PID 3376 wrote to memory of 3728 3376 nhbtnh.exe 88 PID 3728 wrote to memory of 1364 3728 3ppjv.exe 89 PID 3728 wrote to memory of 1364 3728 3ppjv.exe 89 PID 3728 wrote to memory of 1364 3728 3ppjv.exe 89 PID 1364 wrote to memory of 1172 1364 1btnhh.exe 90 PID 1364 wrote to memory of 1172 1364 1btnhh.exe 90 PID 1364 wrote to memory of 1172 1364 1btnhh.exe 90 PID 1172 wrote to memory of 2076 1172 rllxrlf.exe 91 PID 1172 wrote to memory of 2076 1172 rllxrlf.exe 91 PID 1172 wrote to memory of 2076 1172 rllxrlf.exe 91 PID 2076 wrote to memory of 2444 2076 3djdv.exe 92 PID 2076 wrote to memory of 2444 2076 3djdv.exe 92 PID 2076 wrote to memory of 2444 2076 3djdv.exe 92 PID 2444 wrote to memory of 2324 2444 fllfxlf.exe 93 PID 2444 wrote to memory of 2324 2444 fllfxlf.exe 93 PID 2444 wrote to memory of 2324 2444 fllfxlf.exe 93 PID 2324 wrote to memory of 2636 2324 ttnhtt.exe 94 PID 2324 wrote to memory of 2636 2324 ttnhtt.exe 94 PID 2324 wrote to memory of 2636 2324 ttnhtt.exe 94 PID 2636 wrote to memory of 5028 2636 jvpjj.exe 95 PID 2636 wrote to memory of 5028 2636 jvpjj.exe 95 PID 2636 wrote to memory of 5028 2636 jvpjj.exe 95 PID 5028 wrote to memory of 3632 5028 hhhbtt.exe 96 PID 5028 wrote to memory of 3632 5028 hhhbtt.exe 96 PID 5028 wrote to memory of 3632 5028 hhhbtt.exe 96 PID 3632 wrote to memory of 3552 3632 vvjdj.exe 97 PID 3632 wrote to memory of 3552 3632 vvjdj.exe 97 PID 3632 wrote to memory of 3552 3632 vvjdj.exe 97 PID 3552 wrote to memory of 1476 3552 7hhbbt.exe 98 PID 3552 wrote to memory of 1476 3552 7hhbbt.exe 98 PID 3552 wrote to memory of 1476 3552 7hhbbt.exe 98 PID 1476 wrote to memory of 2812 1476 pdjdp.exe 99 PID 1476 wrote to memory of 2812 1476 pdjdp.exe 99 PID 1476 wrote to memory of 2812 1476 pdjdp.exe 99 PID 2812 wrote to memory of 1208 2812 lfxxfxr.exe 100 PID 2812 wrote to memory of 1208 2812 lfxxfxr.exe 100 PID 2812 wrote to memory of 1208 2812 lfxxfxr.exe 100 PID 1208 wrote to memory of 4724 1208 lllxrrr.exe 101 PID 1208 wrote to memory of 4724 1208 lllxrrr.exe 101 PID 1208 wrote to memory of 4724 1208 lllxrrr.exe 101 PID 4724 wrote to memory of 4580 4724 3ddpp.exe 102 PID 4724 wrote to memory of 4580 4724 3ddpp.exe 102 PID 4724 wrote to memory of 4580 4724 3ddpp.exe 102 PID 4580 wrote to memory of 2344 4580 bthbtt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3bcd7621510d392368c8e4d1137dda83e13d2eb39b735a8e70cc132ca6b4c7e.exe"C:\Users\Admin\AppData\Local\Temp\d3bcd7621510d392368c8e4d1137dda83e13d2eb39b735a8e70cc132ca6b4c7e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\hbbbbb.exec:\hbbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\ppdvd.exec:\ppdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\jjvvd.exec:\jjvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\xxfxlfr.exec:\xxfxlfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\llxrrrx.exec:\llxrrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\nhbtnh.exec:\nhbtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\3ppjv.exec:\3ppjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\1btnhh.exec:\1btnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\rllxrlf.exec:\rllxrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\3djdv.exec:\3djdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\fllfxlf.exec:\fllfxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\ttnhtt.exec:\ttnhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jvpjj.exec:\jvpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\hhhbtt.exec:\hhhbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\vvjdj.exec:\vvjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\7hhbbt.exec:\7hhbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\pdjdp.exec:\pdjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\lfxxfxr.exec:\lfxxfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lllxrrr.exec:\lllxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\3ddpp.exec:\3ddpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\bthbtt.exec:\bthbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\pppdj.exec:\pppdj.exe23⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5tttnh.exec:\5tttnh.exe24⤵
- Executes dropped EXE
PID:3532 -
\??\c:\fxrrfxl.exec:\fxrrfxl.exe25⤵
- Executes dropped EXE
PID:436 -
\??\c:\ntbbbb.exec:\ntbbbb.exe26⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tnhbhb.exec:\tnhbhb.exe27⤵
- Executes dropped EXE
PID:4640 -
\??\c:\vjvvp.exec:\vjvvp.exe28⤵
- Executes dropped EXE
PID:3088 -
\??\c:\lffxrlf.exec:\lffxrlf.exe29⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ppddj.exec:\ppddj.exe30⤵
- Executes dropped EXE
PID:4424 -
\??\c:\nhhtnb.exec:\nhhtnb.exe31⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xllffxr.exec:\xllffxr.exe32⤵
- Executes dropped EXE
PID:1896 -
\??\c:\tbhbbt.exec:\tbhbbt.exe33⤵
- Executes dropped EXE
PID:1188 -
\??\c:\lxlfffx.exec:\lxlfffx.exe34⤵
- Executes dropped EXE
PID:3588 -
\??\c:\thnnnn.exec:\thnnnn.exe35⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vdpdv.exec:\vdpdv.exe36⤵
- Executes dropped EXE
PID:3784 -
\??\c:\xxxxfff.exec:\xxxxfff.exe37⤵
- Executes dropped EXE
PID:4716 -
\??\c:\bnbttt.exec:\bnbttt.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ddjjj.exec:\ddjjj.exe39⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jddvv.exec:\jddvv.exe40⤵
- Executes dropped EXE
PID:3544 -
\??\c:\flxrlff.exec:\flxrlff.exe41⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tbhbbb.exec:\tbhbbb.exe42⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vpddd.exec:\vpddd.exe43⤵
- Executes dropped EXE
PID:1968 -
\??\c:\5flxrfx.exec:\5flxrfx.exe44⤵
- Executes dropped EXE
PID:1752 -
\??\c:\flxfxxx.exec:\flxfxxx.exe45⤵
- Executes dropped EXE
PID:1220 -
\??\c:\hbbtnh.exec:\hbbtnh.exe46⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vdpjd.exec:\vdpjd.exe47⤵
- Executes dropped EXE
PID:624 -
\??\c:\llxrlxr.exec:\llxrlxr.exe48⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nnnhhh.exec:\nnnhhh.exe49⤵
- Executes dropped EXE
PID:4352 -
\??\c:\tnhntn.exec:\tnhntn.exe50⤵
- Executes dropped EXE
PID:4492 -
\??\c:\ddjjv.exec:\ddjjv.exe51⤵
- Executes dropped EXE
PID:3956 -
\??\c:\lrfxrrf.exec:\lrfxrrf.exe52⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9nhnnh.exec:\9nhnnh.exe53⤵
- Executes dropped EXE
PID:4040 -
\??\c:\5dvpj.exec:\5dvpj.exe54⤵
- Executes dropped EXE
PID:3948 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe55⤵
- Executes dropped EXE
PID:2160 -
\??\c:\frllfff.exec:\frllfff.exe56⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tntnnn.exec:\tntnnn.exe57⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pdppj.exec:\pdppj.exe58⤵
- Executes dropped EXE
PID:2512 -
\??\c:\fffxxxx.exec:\fffxxxx.exe59⤵
- Executes dropped EXE
PID:4964 -
\??\c:\bhnnhh.exec:\bhnnhh.exe60⤵
- Executes dropped EXE
PID:4512 -
\??\c:\1jjjj.exec:\1jjjj.exe61⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rfxrlrl.exec:\rfxrlrl.exe62⤵
- Executes dropped EXE
PID:3376 -
\??\c:\vjppp.exec:\vjppp.exe63⤵
- Executes dropped EXE
PID:4204 -
\??\c:\xxrfrlf.exec:\xxrfrlf.exe64⤵
- Executes dropped EXE
PID:4456 -
\??\c:\nttnhb.exec:\nttnhb.exe65⤵
- Executes dropped EXE
PID:1392 -
\??\c:\vjpjv.exec:\vjpjv.exe66⤵PID:948
-
\??\c:\5dpdd.exec:\5dpdd.exe67⤵PID:3060
-
\??\c:\rflfllf.exec:\rflfllf.exe68⤵PID:32
-
\??\c:\1tbtnn.exec:\1tbtnn.exe69⤵PID:4956
-
\??\c:\pddpd.exec:\pddpd.exe70⤵PID:116
-
\??\c:\flxlfxr.exec:\flxlfxr.exe71⤵PID:3136
-
\??\c:\bntbtt.exec:\bntbtt.exe72⤵PID:1276
-
\??\c:\vpppv.exec:\vpppv.exe73⤵PID:4776
-
\??\c:\xllfrrl.exec:\xllfrrl.exe74⤵PID:4856
-
\??\c:\fxrlffx.exec:\fxrlffx.exe75⤵PID:1732
-
\??\c:\tnnhnn.exec:\tnnhnn.exe76⤵PID:3632
-
\??\c:\vvjpv.exec:\vvjpv.exe77⤵PID:3736
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe78⤵PID:4912
-
\??\c:\hhbnnt.exec:\hhbnnt.exe79⤵PID:2124
-
\??\c:\5dddp.exec:\5dddp.exe80⤵PID:2436
-
\??\c:\xfxrfff.exec:\xfxrfff.exe81⤵PID:4380
-
\??\c:\llxfxxr.exec:\llxfxxr.exe82⤵PID:5004
-
\??\c:\ntnhbb.exec:\ntnhbb.exe83⤵PID:2148
-
\??\c:\jdjjd.exec:\jdjjd.exe84⤵PID:4732
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe85⤵PID:2340
-
\??\c:\ffxxrll.exec:\ffxxrll.exe86⤵PID:2344
-
\??\c:\5bthbb.exec:\5bthbb.exe87⤵PID:2900
-
\??\c:\pjjpj.exec:\pjjpj.exe88⤵PID:4752
-
\??\c:\vddvj.exec:\vddvj.exe89⤵PID:436
-
\??\c:\lrlxllr.exec:\lrlxllr.exe90⤵PID:3308
-
\??\c:\hbbtnh.exec:\hbbtnh.exe91⤵PID:3996
-
\??\c:\jjjdv.exec:\jjjdv.exe92⤵PID:3112
-
\??\c:\xlxrllf.exec:\xlxrllf.exe93⤵PID:368
-
\??\c:\xrrlfxf.exec:\xrrlfxf.exe94⤵PID:1336
-
\??\c:\dddjp.exec:\dddjp.exe95⤵PID:4872
-
\??\c:\rrrfxlr.exec:\rrrfxlr.exe96⤵PID:2056
-
\??\c:\ttbbhh.exec:\ttbbhh.exe97⤵PID:964
-
\??\c:\9jpdj.exec:\9jpdj.exe98⤵PID:1896
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe99⤵PID:4148
-
\??\c:\tnbhhh.exec:\tnbhhh.exe100⤵PID:3992
-
\??\c:\7dpjd.exec:\7dpjd.exe101⤵PID:4236
-
\??\c:\xrrllrl.exec:\xrrllrl.exe102⤵PID:2632
-
\??\c:\7lxrlrr.exec:\7lxrlrr.exe103⤵PID:392
-
\??\c:\htnbtn.exec:\htnbtn.exe104⤵PID:3300
-
\??\c:\vdjjp.exec:\vdjjp.exe105⤵PID:1840
-
\??\c:\xrllrrf.exec:\xrllrrf.exe106⤵PID:5092
-
\??\c:\thhnht.exec:\thhnht.exe107⤵PID:3340
-
\??\c:\djpjd.exec:\djpjd.exe108⤵PID:920
-
\??\c:\9vvpj.exec:\9vvpj.exe109⤵PID:4788
-
\??\c:\xrrlxrf.exec:\xrrlxrf.exe110⤵PID:1728
-
\??\c:\ttnhbt.exec:\ttnhbt.exe111⤵PID:4136
-
\??\c:\pjpdv.exec:\pjpdv.exe112⤵PID:4072
-
\??\c:\llrfxxr.exec:\llrfxxr.exe113⤵PID:3968
-
\??\c:\nnbtbb.exec:\nnbtbb.exe114⤵PID:2292
-
\??\c:\nhhbtt.exec:\nhhbtt.exe115⤵PID:2724
-
\??\c:\vpvpv.exec:\vpvpv.exe116⤵PID:1760
-
\??\c:\xrlllrr.exec:\xrlllrr.exe117⤵PID:4352
-
\??\c:\hnbtnn.exec:\hnbtnn.exe118⤵PID:1444
-
\??\c:\djvpj.exec:\djvpj.exe119⤵PID:4700
-
\??\c:\rllllll.exec:\rllllll.exe120⤵PID:5100
-
\??\c:\hbhbtt.exec:\hbhbtt.exe121⤵PID:3776
-
\??\c:\hntbbb.exec:\hntbbb.exe122⤵PID:3224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-