Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc805f4c644150141e4ae326fa753ecc3334bd36c796de7f99be63ef86831986.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
150 seconds
General
-
Target
cc805f4c644150141e4ae326fa753ecc3334bd36c796de7f99be63ef86831986.exe
-
Size
454KB
-
MD5
4034b385004094cd16f35b32388b6b45
-
SHA1
e5b5fbf5d22e8a9b03140742e51dcb2276d2c67d
-
SHA256
cc805f4c644150141e4ae326fa753ecc3334bd36c796de7f99be63ef86831986
-
SHA512
07cde2254f8f24ec238456384c6200cf98e87b2108670691b05f98a23e0e953b4ad36e988a67b90065863e23e345050c0f85eb90ff9484e927c2178e5db4972c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4076-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-918-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-958-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-1020-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-1145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-1214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-1252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-1369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2176 htbbtb.exe 4672 vpdvp.exe 3360 rfxrlff.exe 732 jpvdv.exe 1524 rfrllrl.exe 5092 bntthb.exe 1484 jddvp.exe 4620 vpjpp.exe 4792 vpdvv.exe 4912 lllxffr.exe 1392 hbttnh.exe 1704 tbbnnn.exe 1972 jddpv.exe 1832 pppjp.exe 2292 bbtnbh.exe 4808 pvddd.exe 1540 dvpjd.exe 2268 tttnhh.exe 1852 ppvvp.exe 1444 jvvpd.exe 3744 lfxrfff.exe 1368 djddv.exe 976 9thtnn.exe 2892 nbhbbt.exe 2596 vppjd.exe 1492 dvvpj.exe 3000 ttntht.exe 1064 vvvvd.exe 1116 vdpdv.exe 4324 ffxrllf.exe 1716 xlxrflx.exe 4780 hbnhtt.exe 2592 1vpjv.exe 2400 hbbbbb.exe 1452 djpjd.exe 1404 llllxxr.exe 4996 hnnhbt.exe 4168 jjdvp.exe 4484 vvvpd.exe 1684 rflfxxr.exe 4540 tnhhbt.exe 1388 1ppdv.exe 3136 rxxrllf.exe 3140 1ffrllf.exe 1680 dpjdv.exe 1268 xllffxx.exe 2512 nbbtnh.exe 4340 jjjpj.exe 4748 xrrrlff.exe 4076 bttntt.exe 4672 ppddv.exe 3524 lxxrlfx.exe 2132 bntnnh.exe 4932 dpdvp.exe 3576 fxxrlll.exe 4220 htbnhb.exe 1524 thtnhb.exe 3240 lrlffff.exe 1736 tthbhh.exe 3632 dvddd.exe 3624 rrxrrrl.exe 928 bbttbb.exe 3928 jjppp.exe 1916 vvvvp.exe -
resource yara_rule behavioral2/memory/4076-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-865-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-869-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fffllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4076 wrote to memory of 2176 4076 cc805f4c644150141e4ae326fa753ecc3334bd36c796de7f99be63ef86831986.exe 83 PID 4076 wrote to memory of 2176 4076 cc805f4c644150141e4ae326fa753ecc3334bd36c796de7f99be63ef86831986.exe 83 PID 4076 wrote to memory of 2176 4076 cc805f4c644150141e4ae326fa753ecc3334bd36c796de7f99be63ef86831986.exe 83 PID 2176 wrote to memory of 4672 2176 htbbtb.exe 84 PID 2176 wrote to memory of 4672 2176 htbbtb.exe 84 PID 2176 wrote to memory of 4672 2176 htbbtb.exe 84 PID 4672 wrote to memory of 3360 4672 vpdvp.exe 85 PID 4672 wrote to memory of 3360 4672 vpdvp.exe 85 PID 4672 wrote to memory of 3360 4672 vpdvp.exe 85 PID 3360 wrote to memory of 732 3360 rfxrlff.exe 86 PID 3360 wrote to memory of 732 3360 rfxrlff.exe 86 PID 3360 wrote to memory of 732 3360 rfxrlff.exe 86 PID 732 wrote to memory of 1524 732 jpvdv.exe 87 PID 732 wrote to memory of 1524 732 jpvdv.exe 87 PID 732 wrote to memory of 1524 732 jpvdv.exe 87 PID 1524 wrote to memory of 5092 1524 rfrllrl.exe 88 PID 1524 wrote to memory of 5092 1524 rfrllrl.exe 88 PID 1524 wrote to memory of 5092 1524 rfrllrl.exe 88 PID 5092 wrote to memory of 1484 5092 bntthb.exe 89 PID 5092 wrote to memory of 1484 5092 bntthb.exe 89 PID 5092 wrote to memory of 1484 5092 bntthb.exe 89 PID 1484 wrote to memory of 4620 1484 jddvp.exe 90 PID 1484 wrote to memory of 4620 1484 jddvp.exe 90 PID 1484 wrote to memory of 4620 1484 jddvp.exe 90 PID 4620 wrote to memory of 4792 4620 vpjpp.exe 91 PID 4620 wrote to memory of 4792 4620 vpjpp.exe 91 PID 4620 wrote to memory of 4792 4620 vpjpp.exe 91 PID 4792 wrote to memory of 4912 4792 vpdvv.exe 92 PID 4792 wrote to memory of 4912 4792 vpdvv.exe 92 PID 4792 wrote to memory of 4912 4792 vpdvv.exe 92 PID 4912 wrote to memory of 1392 4912 lllxffr.exe 93 PID 4912 wrote to memory of 1392 4912 lllxffr.exe 93 PID 4912 wrote to memory of 1392 4912 lllxffr.exe 93 PID 1392 wrote to memory of 1704 1392 hbttnh.exe 94 PID 1392 wrote to memory of 1704 1392 hbttnh.exe 94 PID 1392 wrote to memory of 1704 1392 hbttnh.exe 94 PID 1704 wrote to memory of 1972 1704 tbbnnn.exe 95 PID 1704 wrote to memory of 1972 1704 tbbnnn.exe 95 PID 1704 wrote to memory of 1972 1704 tbbnnn.exe 95 PID 1972 wrote to memory of 1832 1972 jddpv.exe 96 PID 1972 wrote to memory of 1832 1972 jddpv.exe 96 PID 1972 wrote to memory of 1832 1972 jddpv.exe 96 PID 1832 wrote to memory of 2292 1832 pppjp.exe 97 PID 1832 wrote to memory of 2292 1832 pppjp.exe 97 PID 1832 wrote to memory of 2292 1832 pppjp.exe 97 PID 2292 wrote to memory of 4808 2292 bbtnbh.exe 98 PID 2292 wrote to memory of 4808 2292 bbtnbh.exe 98 PID 2292 wrote to memory of 4808 2292 bbtnbh.exe 98 PID 4808 wrote to memory of 1540 4808 pvddd.exe 99 PID 4808 wrote to memory of 1540 4808 pvddd.exe 99 PID 4808 wrote to memory of 1540 4808 pvddd.exe 99 PID 1540 wrote to memory of 2268 1540 dvpjd.exe 100 PID 1540 wrote to memory of 2268 1540 dvpjd.exe 100 PID 1540 wrote to memory of 2268 1540 dvpjd.exe 100 PID 2268 wrote to memory of 1852 2268 tttnhh.exe 101 PID 2268 wrote to memory of 1852 2268 tttnhh.exe 101 PID 2268 wrote to memory of 1852 2268 tttnhh.exe 101 PID 1852 wrote to memory of 1444 1852 ppvvp.exe 102 PID 1852 wrote to memory of 1444 1852 ppvvp.exe 102 PID 1852 wrote to memory of 1444 1852 ppvvp.exe 102 PID 1444 wrote to memory of 3744 1444 jvvpd.exe 103 PID 1444 wrote to memory of 3744 1444 jvvpd.exe 103 PID 1444 wrote to memory of 3744 1444 jvvpd.exe 103 PID 3744 wrote to memory of 1368 3744 lfxrfff.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc805f4c644150141e4ae326fa753ecc3334bd36c796de7f99be63ef86831986.exe"C:\Users\Admin\AppData\Local\Temp\cc805f4c644150141e4ae326fa753ecc3334bd36c796de7f99be63ef86831986.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\htbbtb.exec:\htbbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\vpdvp.exec:\vpdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\rfxrlff.exec:\rfxrlff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\jpvdv.exec:\jpvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\rfrllrl.exec:\rfrllrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\bntthb.exec:\bntthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\jddvp.exec:\jddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\vpjpp.exec:\vpjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\vpdvv.exec:\vpdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\lllxffr.exec:\lllxffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\hbttnh.exec:\hbttnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\tbbnnn.exec:\tbbnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\jddpv.exec:\jddpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\pppjp.exec:\pppjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\bbtnbh.exec:\bbtnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pvddd.exec:\pvddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\dvpjd.exec:\dvpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\tttnhh.exec:\tttnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\ppvvp.exec:\ppvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\jvvpd.exec:\jvvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\lfxrfff.exec:\lfxrfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\djddv.exec:\djddv.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\9thtnn.exec:\9thtnn.exe24⤵
- Executes dropped EXE
PID:976 -
\??\c:\nbhbbt.exec:\nbhbbt.exe25⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vppjd.exec:\vppjd.exe26⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dvvpj.exec:\dvvpj.exe27⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ttntht.exec:\ttntht.exe28⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vvvvd.exec:\vvvvd.exe29⤵
- Executes dropped EXE
PID:1064 -
\??\c:\vdpdv.exec:\vdpdv.exe30⤵
- Executes dropped EXE
PID:1116 -
\??\c:\ffxrllf.exec:\ffxrllf.exe31⤵
- Executes dropped EXE
PID:4324 -
\??\c:\xlxrflx.exec:\xlxrflx.exe32⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hbnhtt.exec:\hbnhtt.exe33⤵
- Executes dropped EXE
PID:4780 -
\??\c:\1vpjv.exec:\1vpjv.exe34⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbbbbb.exec:\hbbbbb.exe35⤵
- Executes dropped EXE
PID:2400 -
\??\c:\djpjd.exec:\djpjd.exe36⤵
- Executes dropped EXE
PID:1452 -
\??\c:\llllxxr.exec:\llllxxr.exe37⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hnnhbt.exec:\hnnhbt.exe38⤵
- Executes dropped EXE
PID:4996 -
\??\c:\jjdvp.exec:\jjdvp.exe39⤵
- Executes dropped EXE
PID:4168 -
\??\c:\vvvpd.exec:\vvvpd.exe40⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rflfxxr.exec:\rflfxxr.exe41⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tnhhbt.exec:\tnhhbt.exe42⤵
- Executes dropped EXE
PID:4540 -
\??\c:\1ppdv.exec:\1ppdv.exe43⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rxxrllf.exec:\rxxrllf.exe44⤵
- Executes dropped EXE
PID:3136 -
\??\c:\1ffrllf.exec:\1ffrllf.exe45⤵
- Executes dropped EXE
PID:3140 -
\??\c:\dpjdv.exec:\dpjdv.exe46⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xllffxx.exec:\xllffxx.exe47⤵
- Executes dropped EXE
PID:1268 -
\??\c:\nbbtnh.exec:\nbbtnh.exe48⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jjjpj.exec:\jjjpj.exe49⤵
- Executes dropped EXE
PID:4340 -
\??\c:\xrrrlff.exec:\xrrrlff.exe50⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bttntt.exec:\bttntt.exe51⤵
- Executes dropped EXE
PID:4076 -
\??\c:\ppddv.exec:\ppddv.exe52⤵
- Executes dropped EXE
PID:4672 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe53⤵
- Executes dropped EXE
PID:3524 -
\??\c:\bntnnh.exec:\bntnnh.exe54⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dpdvp.exec:\dpdvp.exe55⤵
- Executes dropped EXE
PID:4932 -
\??\c:\fxxrlll.exec:\fxxrlll.exe56⤵
- Executes dropped EXE
PID:3576 -
\??\c:\htbnhb.exec:\htbnhb.exe57⤵
- Executes dropped EXE
PID:4220 -
\??\c:\thtnhb.exec:\thtnhb.exe58⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lrlffff.exec:\lrlffff.exe59⤵
- Executes dropped EXE
PID:3240 -
\??\c:\tthbhh.exec:\tthbhh.exe60⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvddd.exec:\dvddd.exe61⤵
- Executes dropped EXE
PID:3632 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe62⤵
- Executes dropped EXE
PID:3624 -
\??\c:\bbttbb.exec:\bbttbb.exe63⤵
- Executes dropped EXE
PID:928 -
\??\c:\jjppp.exec:\jjppp.exe64⤵
- Executes dropped EXE
PID:3928 -
\??\c:\vvvvp.exec:\vvvvp.exe65⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rrxrrfr.exec:\rrxrrfr.exe66⤵PID:4464
-
\??\c:\btbbtb.exec:\btbbtb.exe67⤵PID:3304
-
\??\c:\vpvpd.exec:\vpvpd.exe68⤵PID:1704
-
\??\c:\xflrllr.exec:\xflrllr.exe69⤵PID:3296
-
\??\c:\hnttbh.exec:\hnttbh.exe70⤵PID:1980
-
\??\c:\3vdvv.exec:\3vdvv.exe71⤵PID:3276
-
\??\c:\fxfxxrl.exec:\fxfxxrl.exe72⤵PID:2220
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe73⤵PID:2068
-
\??\c:\hhtnnn.exec:\hhtnnn.exe74⤵PID:4928
-
\??\c:\vddvv.exec:\vddvv.exe75⤵PID:3784
-
\??\c:\7lxrxxf.exec:\7lxrxxf.exe76⤵PID:4716
-
\??\c:\ttnhbt.exec:\ttnhbt.exe77⤵PID:1096
-
\??\c:\pdppj.exec:\pdppj.exe78⤵PID:4116
-
\??\c:\5xfxffl.exec:\5xfxffl.exe79⤵PID:4988
-
\??\c:\nhthnh.exec:\nhthnh.exe80⤵PID:3744
-
\??\c:\dpdvp.exec:\dpdvp.exe81⤵PID:4248
-
\??\c:\vvvjd.exec:\vvvjd.exe82⤵PID:4820
-
\??\c:\llllllr.exec:\llllllr.exe83⤵PID:4400
-
\??\c:\tbnnnn.exec:\tbnnnn.exe84⤵PID:4644
-
\??\c:\pvvvd.exec:\pvvvd.exe85⤵PID:4392
-
\??\c:\1fxrrrr.exec:\1fxrrrr.exe86⤵PID:228
-
\??\c:\5llxflf.exec:\5llxflf.exe87⤵PID:2280
-
\??\c:\7bbbhn.exec:\7bbbhn.exe88⤵PID:1860
-
\??\c:\3dpjv.exec:\3dpjv.exe89⤵PID:2844
-
\??\c:\fxrfxrl.exec:\fxrfxrl.exe90⤵PID:4296
-
\??\c:\frxrlll.exec:\frxrlll.exe91⤵PID:2768
-
\??\c:\htnhhb.exec:\htnhhb.exe92⤵PID:2928
-
\??\c:\jjddv.exec:\jjddv.exe93⤵PID:5100
-
\??\c:\jdjpj.exec:\jdjpj.exe94⤵PID:2968
-
\??\c:\fxfflll.exec:\fxfflll.exe95⤵PID:4320
-
\??\c:\bthhhn.exec:\bthhhn.exe96⤵PID:2828
-
\??\c:\vjvpj.exec:\vjvpj.exe97⤵PID:2252
-
\??\c:\frfxrfr.exec:\frfxrfr.exe98⤵PID:1452
-
\??\c:\tttnhb.exec:\tttnhb.exe99⤵PID:4276
-
\??\c:\jdpjd.exec:\jdpjd.exe100⤵PID:812
-
\??\c:\rfrllrl.exec:\rfrllrl.exe101⤵PID:2012
-
\??\c:\xlrxlxr.exec:\xlrxlxr.exe102⤵PID:2716
-
\??\c:\pvjvp.exec:\pvjvp.exe103⤵PID:2024
-
\??\c:\lxffxrr.exec:\lxffxrr.exe104⤵PID:2032
-
\??\c:\lllfxxr.exec:\lllfxxr.exe105⤵PID:4664
-
\??\c:\bhnnhh.exec:\bhnnhh.exe106⤵PID:936
-
\??\c:\pjpjd.exec:\pjpjd.exe107⤵PID:2588
-
\??\c:\xffxrlf.exec:\xffxrlf.exe108⤵PID:3292
-
\??\c:\bnbhbb.exec:\bnbhbb.exe109⤵PID:1252
-
\??\c:\jvvpp.exec:\jvvpp.exe110⤵PID:1268
-
\??\c:\1lfxxxx.exec:\1lfxxxx.exe111⤵PID:4308
-
\??\c:\hbhntb.exec:\hbhntb.exe112⤵PID:1952
-
\??\c:\nntntt.exec:\nntntt.exe113⤵PID:2072
-
\??\c:\pddpp.exec:\pddpp.exe114⤵PID:3968
-
\??\c:\xrxrlrr.exec:\xrxrlrr.exe115⤵PID:2960
-
\??\c:\5thnnn.exec:\5thnnn.exe116⤵PID:5044
-
\??\c:\djpjv.exec:\djpjv.exe117⤵PID:844
-
\??\c:\vdjdv.exec:\vdjdv.exe118⤵PID:3804
-
\??\c:\rxrlxxl.exec:\rxrlxxl.exe119⤵PID:2304
-
\??\c:\1hhtnn.exec:\1hhtnn.exe120⤵PID:2680
-
\??\c:\vjjvp.exec:\vjjvp.exe121⤵PID:4800
-
\??\c:\dpvpv.exec:\dpvpv.exe122⤵PID:3604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-