Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 05:33
Behavioral task
behavioral1
Sample
c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe
-
Size
333KB
-
MD5
9c537586841bf88dac510c1ef69ddbe0
-
SHA1
8da4919eeeebb6139d3593b8637c10abefefd86a
-
SHA256
c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9af
-
SHA512
46eeaec80011dcf6a4b0c3bb369e1f70266875b61272562e2b785480af7d39f4d8b512996d5bed444d54e25d7f462d2ad16145bd9a04ac8fb6f96058390ee2d3
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeTZ:R4wFHoSHYHUrAwfMp3CDF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4564-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2940-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1100-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2056-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1252-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3860-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-600-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-1169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2536 vvpjv.exe 4564 7fxlffl.exe 1608 rrxrfll.exe 1472 lffxrlf.exe 964 5dppj.exe 3624 lxxrlff.exe 2940 tbbtnn.exe 2100 vvdvj.exe 4456 hntbnn.exe 2464 5jpjv.exe 1100 5flfllf.exe 220 vpppp.exe 1920 rrffxxr.exe 3400 rxlfxrl.exe 1464 nnthbb.exe 2056 nbnbnn.exe 3220 rrffffx.exe 1388 flrrflr.exe 1952 7httnn.exe 1044 pvddd.exe 2696 vvddp.exe 1216 rlrlffx.exe 4056 9nnnhn.exe 1252 5pppj.exe 2884 flllllf.exe 4316 ddvpj.exe 1584 lrxffrl.exe 3288 pdjpv.exe 1204 xfrrrrr.exe 4880 hhhbhn.exe 1984 fffrxrr.exe 3096 9nnnhh.exe 3240 pddvp.exe 3172 xfxrxrl.exe 3548 nbbbtn.exe 1824 jjvpd.exe 516 1xrrrrr.exe 3664 thhhht.exe 1448 ppvpd.exe 3776 7vvdv.exe 2868 lrllffx.exe 2220 dpvpj.exe 5116 ppjjp.exe 1836 llxrllf.exe 316 frxxrrr.exe 2864 ttbbnh.exe 2988 dppjd.exe 2764 3bbtnh.exe 5008 5pjdv.exe 3580 xlfxfrr.exe 1676 jppjd.exe 1616 llxxffl.exe 4528 fxxxrrf.exe 2608 hhbtnn.exe 2848 jdjpp.exe 4360 xrxrlll.exe 3256 bhttth.exe 64 jjpjd.exe 2536 djdvp.exe 1040 llrlxrf.exe 544 hbttnn.exe 2280 vpdpd.exe 4392 rrxlrlr.exe 4728 fflffxr.exe -
resource yara_rule behavioral2/memory/2036-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b9b-4.dat upx behavioral2/files/0x0009000000023c85-9.dat upx behavioral2/files/0x0008000000023c86-12.dat upx behavioral2/memory/4564-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2536-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2036-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1608-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c87-20.dat upx behavioral2/files/0x0008000000023c89-23.dat upx behavioral2/memory/964-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c8a-28.dat upx behavioral2/memory/3624-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c93-32.dat upx behavioral2/files/0x0007000000023c94-37.dat upx behavioral2/memory/2940-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c95-42.dat upx behavioral2/memory/2100-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c96-48.dat upx behavioral2/memory/4456-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c97-52.dat upx behavioral2/memory/2464-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c98-57.dat upx behavioral2/memory/1100-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c99-62.dat upx behavioral2/files/0x0007000000023c9a-68.dat upx behavioral2/memory/3400-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1920-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9b-72.dat upx behavioral2/memory/1464-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9c-77.dat upx behavioral2/memory/2056-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9d-82.dat upx behavioral2/files/0x0007000000023c9e-87.dat upx behavioral2/files/0x0007000000023c9f-90.dat upx behavioral2/memory/1952-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca1-100.dat upx behavioral2/memory/2696-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1044-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca0-96.dat upx behavioral2/files/0x0009000000023c83-105.dat upx behavioral2/memory/1216-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca2-110.dat upx behavioral2/files/0x0007000000023ca4-115.dat upx behavioral2/memory/1252-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1252-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca5-120.dat upx behavioral2/files/0x0007000000023ca6-124.dat upx behavioral2/memory/2884-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca7-129.dat upx behavioral2/memory/1584-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4316-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca8-135.dat upx behavioral2/files/0x0007000000023ca9-139.dat upx behavioral2/memory/3288-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023caa-144.dat upx behavioral2/memory/1204-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cab-149.dat upx behavioral2/files/0x0007000000023cac-153.dat upx behavioral2/memory/1984-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3096-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3240-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1824-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/516-169-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2536 2036 c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe 82 PID 2036 wrote to memory of 2536 2036 c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe 82 PID 2036 wrote to memory of 2536 2036 c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe 82 PID 2536 wrote to memory of 4564 2536 vvpjv.exe 83 PID 2536 wrote to memory of 4564 2536 vvpjv.exe 83 PID 2536 wrote to memory of 4564 2536 vvpjv.exe 83 PID 4564 wrote to memory of 1608 4564 7fxlffl.exe 84 PID 4564 wrote to memory of 1608 4564 7fxlffl.exe 84 PID 4564 wrote to memory of 1608 4564 7fxlffl.exe 84 PID 1608 wrote to memory of 1472 1608 rrxrfll.exe 85 PID 1608 wrote to memory of 1472 1608 rrxrfll.exe 85 PID 1608 wrote to memory of 1472 1608 rrxrfll.exe 85 PID 1472 wrote to memory of 964 1472 lffxrlf.exe 86 PID 1472 wrote to memory of 964 1472 lffxrlf.exe 86 PID 1472 wrote to memory of 964 1472 lffxrlf.exe 86 PID 964 wrote to memory of 3624 964 5dppj.exe 87 PID 964 wrote to memory of 3624 964 5dppj.exe 87 PID 964 wrote to memory of 3624 964 5dppj.exe 87 PID 3624 wrote to memory of 2940 3624 lxxrlff.exe 88 PID 3624 wrote to memory of 2940 3624 lxxrlff.exe 88 PID 3624 wrote to memory of 2940 3624 lxxrlff.exe 88 PID 2940 wrote to memory of 2100 2940 tbbtnn.exe 89 PID 2940 wrote to memory of 2100 2940 tbbtnn.exe 89 PID 2940 wrote to memory of 2100 2940 tbbtnn.exe 89 PID 2100 wrote to memory of 4456 2100 vvdvj.exe 90 PID 2100 wrote to memory of 4456 2100 vvdvj.exe 90 PID 2100 wrote to memory of 4456 2100 vvdvj.exe 90 PID 4456 wrote to memory of 2464 4456 hntbnn.exe 91 PID 4456 wrote to memory of 2464 4456 hntbnn.exe 91 PID 4456 wrote to memory of 2464 4456 hntbnn.exe 91 PID 2464 wrote to memory of 1100 2464 5jpjv.exe 92 PID 2464 wrote to memory of 1100 2464 5jpjv.exe 92 PID 2464 wrote to memory of 1100 2464 5jpjv.exe 92 PID 1100 wrote to memory of 220 1100 5flfllf.exe 93 PID 1100 wrote to memory of 220 1100 5flfllf.exe 93 PID 1100 wrote to memory of 220 1100 5flfllf.exe 93 PID 220 wrote to memory of 1920 220 vpppp.exe 94 PID 220 wrote to memory of 1920 220 vpppp.exe 94 PID 220 wrote to memory of 1920 220 vpppp.exe 94 PID 1920 wrote to memory of 3400 1920 rrffxxr.exe 95 PID 1920 wrote to memory of 3400 1920 rrffxxr.exe 95 PID 1920 wrote to memory of 3400 1920 rrffxxr.exe 95 PID 3400 wrote to memory of 1464 3400 rxlfxrl.exe 96 PID 3400 wrote to memory of 1464 3400 rxlfxrl.exe 96 PID 3400 wrote to memory of 1464 3400 rxlfxrl.exe 96 PID 1464 wrote to memory of 2056 1464 nnthbb.exe 97 PID 1464 wrote to memory of 2056 1464 nnthbb.exe 97 PID 1464 wrote to memory of 2056 1464 nnthbb.exe 97 PID 2056 wrote to memory of 3220 2056 nbnbnn.exe 98 PID 2056 wrote to memory of 3220 2056 nbnbnn.exe 98 PID 2056 wrote to memory of 3220 2056 nbnbnn.exe 98 PID 3220 wrote to memory of 1388 3220 rrffffx.exe 99 PID 3220 wrote to memory of 1388 3220 rrffffx.exe 99 PID 3220 wrote to memory of 1388 3220 rrffffx.exe 99 PID 1388 wrote to memory of 1952 1388 flrrflr.exe 100 PID 1388 wrote to memory of 1952 1388 flrrflr.exe 100 PID 1388 wrote to memory of 1952 1388 flrrflr.exe 100 PID 1952 wrote to memory of 1044 1952 7httnn.exe 101 PID 1952 wrote to memory of 1044 1952 7httnn.exe 101 PID 1952 wrote to memory of 1044 1952 7httnn.exe 101 PID 1044 wrote to memory of 2696 1044 pvddd.exe 102 PID 1044 wrote to memory of 2696 1044 pvddd.exe 102 PID 1044 wrote to memory of 2696 1044 pvddd.exe 102 PID 2696 wrote to memory of 1216 2696 vvddp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe"C:\Users\Admin\AppData\Local\Temp\c4d3576a430bfdb7075584e4e7f2b2b26d04a29fe6a3d46f0f3ec24979fad9afN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\vvpjv.exec:\vvpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\7fxlffl.exec:\7fxlffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\rrxrfll.exec:\rrxrfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\lffxrlf.exec:\lffxrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\5dppj.exec:\5dppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\lxxrlff.exec:\lxxrlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\tbbtnn.exec:\tbbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\vvdvj.exec:\vvdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hntbnn.exec:\hntbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\5jpjv.exec:\5jpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\5flfllf.exec:\5flfllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\vpppp.exec:\vpppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\rrffxxr.exec:\rrffxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\nnthbb.exec:\nnthbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\nbnbnn.exec:\nbnbnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\rrffffx.exec:\rrffffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\flrrflr.exec:\flrrflr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\7httnn.exec:\7httnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\pvddd.exec:\pvddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\vvddp.exec:\vvddp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\rlrlffx.exec:\rlrlffx.exe23⤵
- Executes dropped EXE
PID:1216 -
\??\c:\9nnnhn.exec:\9nnnhn.exe24⤵
- Executes dropped EXE
PID:4056 -
\??\c:\5pppj.exec:\5pppj.exe25⤵
- Executes dropped EXE
PID:1252 -
\??\c:\flllllf.exec:\flllllf.exe26⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ddvpj.exec:\ddvpj.exe27⤵
- Executes dropped EXE
PID:4316 -
\??\c:\lrxffrl.exec:\lrxffrl.exe28⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pdjpv.exec:\pdjpv.exe29⤵
- Executes dropped EXE
PID:3288 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1204 -
\??\c:\hhhbhn.exec:\hhhbhn.exe31⤵
- Executes dropped EXE
PID:4880 -
\??\c:\fffrxrr.exec:\fffrxrr.exe32⤵
- Executes dropped EXE
PID:1984 -
\??\c:\9nnnhh.exec:\9nnnhh.exe33⤵
- Executes dropped EXE
PID:3096 -
\??\c:\pddvp.exec:\pddvp.exe34⤵
- Executes dropped EXE
PID:3240 -
\??\c:\xfxrxrl.exec:\xfxrxrl.exe35⤵
- Executes dropped EXE
PID:3172 -
\??\c:\nbbbtn.exec:\nbbbtn.exe36⤵
- Executes dropped EXE
PID:3548 -
\??\c:\jjvpd.exec:\jjvpd.exe37⤵
- Executes dropped EXE
PID:1824 -
\??\c:\1xrrrrr.exec:\1xrrrrr.exe38⤵
- Executes dropped EXE
PID:516 -
\??\c:\thhhht.exec:\thhhht.exe39⤵
- Executes dropped EXE
PID:3664 -
\??\c:\ppvpd.exec:\ppvpd.exe40⤵
- Executes dropped EXE
PID:1448 -
\??\c:\7vvdv.exec:\7vvdv.exe41⤵
- Executes dropped EXE
PID:3776 -
\??\c:\lrllffx.exec:\lrllffx.exe42⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dpvpj.exec:\dpvpj.exe43⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ppjjp.exec:\ppjjp.exe44⤵
- Executes dropped EXE
PID:5116 -
\??\c:\llxrllf.exec:\llxrllf.exe45⤵
- Executes dropped EXE
PID:1836 -
\??\c:\frxxrrr.exec:\frxxrrr.exe46⤵
- Executes dropped EXE
PID:316 -
\??\c:\ttbbnh.exec:\ttbbnh.exe47⤵
- Executes dropped EXE
PID:2864 -
\??\c:\dppjd.exec:\dppjd.exe48⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3bbtnh.exec:\3bbtnh.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5pjdv.exec:\5pjdv.exe50⤵
- Executes dropped EXE
PID:5008 -
\??\c:\xlfxfrr.exec:\xlfxfrr.exe51⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jppjd.exec:\jppjd.exe52⤵
- Executes dropped EXE
PID:1676 -
\??\c:\llxxffl.exec:\llxxffl.exe53⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fxxxrrf.exec:\fxxxrrf.exe54⤵
- Executes dropped EXE
PID:4528 -
\??\c:\hhbtnn.exec:\hhbtnn.exe55⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jdjpp.exec:\jdjpp.exe56⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrxrlll.exec:\xrxrlll.exe57⤵
- Executes dropped EXE
PID:4360 -
\??\c:\bhttth.exec:\bhttth.exe58⤵
- Executes dropped EXE
PID:3256 -
\??\c:\jjpjd.exec:\jjpjd.exe59⤵
- Executes dropped EXE
PID:64 -
\??\c:\djdvp.exec:\djdvp.exe60⤵
- Executes dropped EXE
PID:2536 -
\??\c:\llrlxrf.exec:\llrlxrf.exe61⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hbttnn.exec:\hbttnn.exe62⤵
- Executes dropped EXE
PID:544 -
\??\c:\vpdpd.exec:\vpdpd.exe63⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rrxlrlr.exec:\rrxlrlr.exe64⤵
- Executes dropped EXE
PID:4392 -
\??\c:\fflffxr.exec:\fflffxr.exe65⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nthbnn.exec:\nthbnn.exe66⤵PID:1548
-
\??\c:\pjjdd.exec:\pjjdd.exe67⤵PID:3508
-
\??\c:\pdjvp.exec:\pdjvp.exe68⤵PID:4276
-
\??\c:\3fffffx.exec:\3fffffx.exe69⤵PID:1148
-
\??\c:\jjpjp.exec:\jjpjp.exe70⤵PID:4028
-
\??\c:\jvvpj.exec:\jvvpj.exe71⤵PID:2924
-
\??\c:\rxlllfr.exec:\rxlllfr.exe72⤵PID:1196
-
\??\c:\bthbhh.exec:\bthbhh.exe73⤵PID:3940
-
\??\c:\hhhbth.exec:\hhhbth.exe74⤵PID:4944
-
\??\c:\jjvpp.exec:\jjvpp.exe75⤵PID:2500
-
\??\c:\lrxxlfx.exec:\lrxxlfx.exe76⤵PID:1336
-
\??\c:\7xxrffl.exec:\7xxrffl.exe77⤵PID:3044
-
\??\c:\ttnntb.exec:\ttnntb.exe78⤵PID:4580
-
\??\c:\ppjdp.exec:\ppjdp.exe79⤵PID:2380
-
\??\c:\7rrfrrl.exec:\7rrfrrl.exe80⤵PID:224
-
\??\c:\7xfxfrl.exec:\7xfxfrl.exe81⤵PID:3492
-
\??\c:\hbnnhh.exec:\hbnnhh.exe82⤵PID:3860
-
\??\c:\ddddv.exec:\ddddv.exe83⤵PID:3900
-
\??\c:\jjddp.exec:\jjddp.exe84⤵PID:3944
-
\??\c:\rlfxrlr.exec:\rlfxrlr.exe85⤵PID:1468
-
\??\c:\ttnhbb.exec:\ttnhbb.exe86⤵PID:2528
-
\??\c:\tbnntb.exec:\tbnntb.exe87⤵PID:2860
-
\??\c:\vjjjd.exec:\vjjjd.exe88⤵PID:2140
-
\??\c:\xlffrfl.exec:\xlffrfl.exe89⤵PID:3952
-
\??\c:\rrfxrrf.exec:\rrfxrrf.exe90⤵PID:1952
-
\??\c:\ttbbhh.exec:\ttbbhh.exe91⤵PID:1964
-
\??\c:\vpdvp.exec:\vpdvp.exe92⤵PID:1592
-
\??\c:\pvjdv.exec:\pvjdv.exe93⤵PID:4932
-
\??\c:\llrllfl.exec:\llrllfl.exe94⤵PID:2156
-
\??\c:\tnnhtt.exec:\tnnhtt.exe95⤵PID:3312
-
\??\c:\bthbbn.exec:\bthbbn.exe96⤵PID:1736
-
\??\c:\dvvvv.exec:\dvvvv.exe97⤵PID:3964
-
\??\c:\5llfxxf.exec:\5llfxxf.exe98⤵PID:3832
-
\??\c:\nhhnnn.exec:\nhhnnn.exe99⤵
- System Location Discovery: System Language Discovery
PID:4764 -
\??\c:\dvjjd.exec:\dvjjd.exe100⤵PID:3976
-
\??\c:\jvdvj.exec:\jvdvj.exe101⤵PID:2640
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe102⤵PID:2368
-
\??\c:\9bnnnt.exec:\9bnnnt.exe103⤵PID:1912
-
\??\c:\ntnhbb.exec:\ntnhbb.exe104⤵PID:4832
-
\??\c:\ddjdj.exec:\ddjdj.exe105⤵PID:3996
-
\??\c:\lllllll.exec:\lllllll.exe106⤵PID:1992
-
\??\c:\3llfxfx.exec:\3llfxfx.exe107⤵PID:216
-
\??\c:\tbttnh.exec:\tbttnh.exe108⤵PID:2780
-
\??\c:\bnttnt.exec:\bnttnt.exe109⤵PID:2268
-
\??\c:\dvpjj.exec:\dvpjj.exe110⤵PID:1236
-
\??\c:\5llfxxr.exec:\5llfxxr.exe111⤵PID:2508
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe112⤵PID:516
-
\??\c:\bhhhhn.exec:\bhhhhn.exe113⤵PID:1648
-
\??\c:\pjjjd.exec:\pjjjd.exe114⤵PID:756
-
\??\c:\pjpjd.exec:\pjpjd.exe115⤵PID:2088
-
\??\c:\lrffxxx.exec:\lrffxxx.exe116⤵PID:2200
-
\??\c:\7tnhbt.exec:\7tnhbt.exe117⤵PID:4224
-
\??\c:\tntttb.exec:\tntttb.exe118⤵PID:3080
-
\??\c:\jpjpd.exec:\jpjpd.exe119⤵PID:4740
-
\??\c:\5xrlfxr.exec:\5xrlfxr.exe120⤵PID:1052
-
\??\c:\9tbttt.exec:\9tbttt.exe121⤵PID:1188
-
\??\c:\7dddv.exec:\7dddv.exe122⤵PID:3888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-