Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 06:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fafff662170a64a67d7b5f66f8341bd9bcf4337625bc125188e9b9ee6d82efe3N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
fafff662170a64a67d7b5f66f8341bd9bcf4337625bc125188e9b9ee6d82efe3N.exe
-
Size
453KB
-
MD5
0d5dbd3128661d1fdd52bd54caae0230
-
SHA1
53aa308495331373035b48c45f3a353eebca1fca
-
SHA256
fafff662170a64a67d7b5f66f8341bd9bcf4337625bc125188e9b9ee6d82efe3
-
SHA512
d462d3fbb01d86e0da944600f6ec636755021bea9d31946fc3f83829c7f0eeb6c640965d87539f0bf213e2f1168c1afb260587b5559de091a8f5043bba49e70c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1764-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/904-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-797-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-930-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-1660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3496 bbbbbb.exe 904 dvvvv.exe 5008 tbhnbh.exe 1828 dvjjj.exe 4892 ttbntn.exe 4496 ppvvv.exe 4596 dvppj.exe 2200 dvjjd.exe 1056 xrfffll.exe 1160 rfrrrxx.exe 4444 htnntt.exe 2152 vddpv.exe 208 ppvdd.exe 4332 9rflxlx.exe 2584 nnttnn.exe 184 pvdvd.exe 1288 lfrfxxr.exe 2076 ttttnt.exe 5032 dpvvp.exe 4364 xrfffff.exe 3936 7lrrrrr.exe 2912 lllllrr.exe 748 rrxrlrx.exe 4156 jpppp.exe 4428 rflffxr.exe 64 ppvvv.exe 2296 rfxxflr.exe 3080 ntbtnh.exe 4388 jdjjv.exe 3544 jpddd.exe 2632 5flllxx.exe 1396 tbnntt.exe 4616 pjvvv.exe 1732 rlrlfff.exe 4296 bntthb.exe 1796 dvjdd.exe 4540 5xlfrrx.exe 4756 bhhhhn.exe 4620 pjddp.exe 2500 fxrflfx.exe 4288 1thttt.exe 3548 vpvvp.exe 4984 rrllxxl.exe 3940 ttbbtb.exe 3580 ddjpv.exe 1412 xxlfffr.exe 1356 btnntb.exe 1752 lfrrlll.exe 1740 bntnhn.exe 8 vvvvp.exe 4960 1flffxf.exe 2588 nbttbh.exe 3184 rlrxrrl.exe 2232 tthnbn.exe 4664 jvdvd.exe 4000 9xrlflr.exe 2508 bnthnn.exe 2124 dvdjj.exe 2708 flxrrxx.exe 1176 nnhbnn.exe 2592 jjpdv.exe 716 rlfflfx.exe 1064 bbbhnb.exe 1720 dpvvd.exe -
resource yara_rule behavioral2/memory/1764-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/904-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-716-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1764 wrote to memory of 3496 1764 fafff662170a64a67d7b5f66f8341bd9bcf4337625bc125188e9b9ee6d82efe3N.exe 82 PID 1764 wrote to memory of 3496 1764 fafff662170a64a67d7b5f66f8341bd9bcf4337625bc125188e9b9ee6d82efe3N.exe 82 PID 1764 wrote to memory of 3496 1764 fafff662170a64a67d7b5f66f8341bd9bcf4337625bc125188e9b9ee6d82efe3N.exe 82 PID 3496 wrote to memory of 904 3496 bbbbbb.exe 83 PID 3496 wrote to memory of 904 3496 bbbbbb.exe 83 PID 3496 wrote to memory of 904 3496 bbbbbb.exe 83 PID 904 wrote to memory of 5008 904 dvvvv.exe 84 PID 904 wrote to memory of 5008 904 dvvvv.exe 84 PID 904 wrote to memory of 5008 904 dvvvv.exe 84 PID 5008 wrote to memory of 1828 5008 tbhnbh.exe 85 PID 5008 wrote to memory of 1828 5008 tbhnbh.exe 85 PID 5008 wrote to memory of 1828 5008 tbhnbh.exe 85 PID 1828 wrote to memory of 4892 1828 dvjjj.exe 86 PID 1828 wrote to memory of 4892 1828 dvjjj.exe 86 PID 1828 wrote to memory of 4892 1828 dvjjj.exe 86 PID 4892 wrote to memory of 4496 4892 ttbntn.exe 87 PID 4892 wrote to memory of 4496 4892 ttbntn.exe 87 PID 4892 wrote to memory of 4496 4892 ttbntn.exe 87 PID 4496 wrote to memory of 4596 4496 ppvvv.exe 88 PID 4496 wrote to memory of 4596 4496 ppvvv.exe 88 PID 4496 wrote to memory of 4596 4496 ppvvv.exe 88 PID 4596 wrote to memory of 2200 4596 dvppj.exe 89 PID 4596 wrote to memory of 2200 4596 dvppj.exe 89 PID 4596 wrote to memory of 2200 4596 dvppj.exe 89 PID 2200 wrote to memory of 1056 2200 dvjjd.exe 90 PID 2200 wrote to memory of 1056 2200 dvjjd.exe 90 PID 2200 wrote to memory of 1056 2200 dvjjd.exe 90 PID 1056 wrote to memory of 1160 1056 xrfffll.exe 91 PID 1056 wrote to memory of 1160 1056 xrfffll.exe 91 PID 1056 wrote to memory of 1160 1056 xrfffll.exe 91 PID 1160 wrote to memory of 4444 1160 rfrrrxx.exe 92 PID 1160 wrote to memory of 4444 1160 rfrrrxx.exe 92 PID 1160 wrote to memory of 4444 1160 rfrrrxx.exe 92 PID 4444 wrote to memory of 2152 4444 htnntt.exe 93 PID 4444 wrote to memory of 2152 4444 htnntt.exe 93 PID 4444 wrote to memory of 2152 4444 htnntt.exe 93 PID 2152 wrote to memory of 208 2152 vddpv.exe 94 PID 2152 wrote to memory of 208 2152 vddpv.exe 94 PID 2152 wrote to memory of 208 2152 vddpv.exe 94 PID 208 wrote to memory of 4332 208 ppvdd.exe 95 PID 208 wrote to memory of 4332 208 ppvdd.exe 95 PID 208 wrote to memory of 4332 208 ppvdd.exe 95 PID 4332 wrote to memory of 2584 4332 9rflxlx.exe 96 PID 4332 wrote to memory of 2584 4332 9rflxlx.exe 96 PID 4332 wrote to memory of 2584 4332 9rflxlx.exe 96 PID 2584 wrote to memory of 184 2584 nnttnn.exe 97 PID 2584 wrote to memory of 184 2584 nnttnn.exe 97 PID 2584 wrote to memory of 184 2584 nnttnn.exe 97 PID 184 wrote to memory of 1288 184 pvdvd.exe 98 PID 184 wrote to memory of 1288 184 pvdvd.exe 98 PID 184 wrote to memory of 1288 184 pvdvd.exe 98 PID 1288 wrote to memory of 2076 1288 lfrfxxr.exe 99 PID 1288 wrote to memory of 2076 1288 lfrfxxr.exe 99 PID 1288 wrote to memory of 2076 1288 lfrfxxr.exe 99 PID 2076 wrote to memory of 5032 2076 ttttnt.exe 100 PID 2076 wrote to memory of 5032 2076 ttttnt.exe 100 PID 2076 wrote to memory of 5032 2076 ttttnt.exe 100 PID 5032 wrote to memory of 4364 5032 dpvvp.exe 101 PID 5032 wrote to memory of 4364 5032 dpvvp.exe 101 PID 5032 wrote to memory of 4364 5032 dpvvp.exe 101 PID 4364 wrote to memory of 3936 4364 xrfffff.exe 102 PID 4364 wrote to memory of 3936 4364 xrfffff.exe 102 PID 4364 wrote to memory of 3936 4364 xrfffff.exe 102 PID 3936 wrote to memory of 2912 3936 7lrrrrr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fafff662170a64a67d7b5f66f8341bd9bcf4337625bc125188e9b9ee6d82efe3N.exe"C:\Users\Admin\AppData\Local\Temp\fafff662170a64a67d7b5f66f8341bd9bcf4337625bc125188e9b9ee6d82efe3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\bbbbbb.exec:\bbbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\dvvvv.exec:\dvvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\tbhnbh.exec:\tbhnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\dvjjj.exec:\dvjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\ttbntn.exec:\ttbntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\ppvvv.exec:\ppvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\dvppj.exec:\dvppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\dvjjd.exec:\dvjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\xrfffll.exec:\xrfffll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\rfrrrxx.exec:\rfrrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\htnntt.exec:\htnntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\vddpv.exec:\vddpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ppvdd.exec:\ppvdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\9rflxlx.exec:\9rflxlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\nnttnn.exec:\nnttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\pvdvd.exec:\pvdvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\lfrfxxr.exec:\lfrfxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\ttttnt.exec:\ttttnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\dpvvp.exec:\dpvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\xrfffff.exec:\xrfffff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\7lrrrrr.exec:\7lrrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\lllllrr.exec:\lllllrr.exe23⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrxrlrx.exec:\rrxrlrx.exe24⤵
- Executes dropped EXE
PID:748 -
\??\c:\jpppp.exec:\jpppp.exe25⤵
- Executes dropped EXE
PID:4156 -
\??\c:\rflffxr.exec:\rflffxr.exe26⤵
- Executes dropped EXE
PID:4428 -
\??\c:\ppvvv.exec:\ppvvv.exe27⤵
- Executes dropped EXE
PID:64 -
\??\c:\rfxxflr.exec:\rfxxflr.exe28⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ntbtnh.exec:\ntbtnh.exe29⤵
- Executes dropped EXE
PID:3080 -
\??\c:\jdjjv.exec:\jdjjv.exe30⤵
- Executes dropped EXE
PID:4388 -
\??\c:\jpddd.exec:\jpddd.exe31⤵
- Executes dropped EXE
PID:3544 -
\??\c:\5flllxx.exec:\5flllxx.exe32⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tbnntt.exec:\tbnntt.exe33⤵
- Executes dropped EXE
PID:1396 -
\??\c:\pjvvv.exec:\pjvvv.exe34⤵
- Executes dropped EXE
PID:4616 -
\??\c:\rlrlfff.exec:\rlrlfff.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bntthb.exec:\bntthb.exe36⤵
- Executes dropped EXE
PID:4296 -
\??\c:\dvjdd.exec:\dvjdd.exe37⤵
- Executes dropped EXE
PID:1796 -
\??\c:\5xlfrrx.exec:\5xlfrrx.exe38⤵
- Executes dropped EXE
PID:4540 -
\??\c:\bhhhhn.exec:\bhhhhn.exe39⤵
- Executes dropped EXE
PID:4756 -
\??\c:\pjddp.exec:\pjddp.exe40⤵
- Executes dropped EXE
PID:4620 -
\??\c:\fxrflfx.exec:\fxrflfx.exe41⤵
- Executes dropped EXE
PID:2500 -
\??\c:\1thttt.exec:\1thttt.exe42⤵
- Executes dropped EXE
PID:4288 -
\??\c:\vpvvp.exec:\vpvvp.exe43⤵
- Executes dropped EXE
PID:3548 -
\??\c:\rrllxxl.exec:\rrllxxl.exe44⤵
- Executes dropped EXE
PID:4984 -
\??\c:\ttbbtb.exec:\ttbbtb.exe45⤵
- Executes dropped EXE
PID:3940 -
\??\c:\ddjpv.exec:\ddjpv.exe46⤵
- Executes dropped EXE
PID:3580 -
\??\c:\xxlfffr.exec:\xxlfffr.exe47⤵
- Executes dropped EXE
PID:1412 -
\??\c:\btnntb.exec:\btnntb.exe48⤵
- Executes dropped EXE
PID:1356 -
\??\c:\lfrrlll.exec:\lfrrlll.exe49⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lllllll.exec:\lllllll.exe50⤵PID:4420
-
\??\c:\bntnhn.exec:\bntnhn.exe51⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vvvvp.exec:\vvvvp.exe52⤵
- Executes dropped EXE
PID:8 -
\??\c:\1flffxf.exec:\1flffxf.exe53⤵
- Executes dropped EXE
PID:4960 -
\??\c:\nbttbh.exec:\nbttbh.exe54⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rlrxrrl.exec:\rlrxrrl.exe55⤵
- Executes dropped EXE
PID:3184 -
\??\c:\tthnbn.exec:\tthnbn.exe56⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jvdvd.exec:\jvdvd.exe57⤵
- Executes dropped EXE
PID:4664 -
\??\c:\9xrlflr.exec:\9xrlflr.exe58⤵
- Executes dropped EXE
PID:4000 -
\??\c:\bnthnn.exec:\bnthnn.exe59⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dvdjj.exec:\dvdjj.exe60⤵
- Executes dropped EXE
PID:2124 -
\??\c:\flxrrxx.exec:\flxrrxx.exe61⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nnhbnn.exec:\nnhbnn.exe62⤵
- Executes dropped EXE
PID:1176 -
\??\c:\jjpdv.exec:\jjpdv.exe63⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rlfflfx.exec:\rlfflfx.exe64⤵
- Executes dropped EXE
PID:716 -
\??\c:\bbbhnb.exec:\bbbhnb.exe65⤵
- Executes dropped EXE
PID:1064 -
\??\c:\dpvvd.exec:\dpvvd.exe66⤵
- Executes dropped EXE
PID:1720 -
\??\c:\dpddp.exec:\dpddp.exe67⤵PID:1160
-
\??\c:\frxxxrl.exec:\frxxxrl.exe68⤵PID:4804
-
\??\c:\htnnnn.exec:\htnnnn.exe69⤵PID:2020
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe70⤵
- System Location Discovery: System Language Discovery
PID:3512 -
\??\c:\xlffflf.exec:\xlffflf.exe71⤵PID:3516
-
\??\c:\vdjdv.exec:\vdjdv.exe72⤵PID:4108
-
\??\c:\vpppj.exec:\vpppj.exe73⤵PID:1816
-
\??\c:\rxrrxrf.exec:\rxrrxrf.exe74⤵PID:2524
-
\??\c:\hnttnt.exec:\hnttnt.exe75⤵PID:5100
-
\??\c:\jdjjj.exec:\jdjjj.exe76⤵PID:1288
-
\??\c:\rrllrrx.exec:\rrllrrx.exe77⤵PID:2036
-
\??\c:\hhbbbn.exec:\hhbbbn.exe78⤵PID:1508
-
\??\c:\tbnnbh.exec:\tbnnbh.exe79⤵PID:664
-
\??\c:\ppvvp.exec:\ppvvp.exe80⤵PID:4364
-
\??\c:\rrffllr.exec:\rrffllr.exe81⤵PID:2120
-
\??\c:\nbnnhb.exec:\nbnnhb.exe82⤵PID:536
-
\??\c:\vdddd.exec:\vdddd.exe83⤵PID:2912
-
\??\c:\1flrxll.exec:\1flrxll.exe84⤵PID:748
-
\??\c:\vvjvp.exec:\vvjvp.exe85⤵PID:880
-
\??\c:\fflrrfx.exec:\fflrrfx.exe86⤵PID:1128
-
\??\c:\tttnbb.exec:\tttnbb.exe87⤵PID:4852
-
\??\c:\jdjjj.exec:\jdjjj.exe88⤵PID:64
-
\??\c:\lfxrlrf.exec:\lfxrlrf.exe89⤵PID:3768
-
\??\c:\ttbthn.exec:\ttbthn.exe90⤵PID:3924
-
\??\c:\nthtbb.exec:\nthtbb.exe91⤵PID:1856
-
\??\c:\djvdp.exec:\djvdp.exe92⤵PID:4188
-
\??\c:\fxxxrfx.exec:\fxxxrfx.exe93⤵PID:4700
-
\??\c:\tnttnt.exec:\tnttnt.exe94⤵PID:624
-
\??\c:\9jppv.exec:\9jppv.exe95⤵PID:3028
-
\??\c:\frflflf.exec:\frflflf.exe96⤵PID:1396
-
\??\c:\9htttb.exec:\9htttb.exe97⤵PID:1224
-
\??\c:\jvppp.exec:\jvppp.exe98⤵PID:3280
-
\??\c:\vvjdd.exec:\vvjdd.exe99⤵PID:3036
-
\??\c:\xrxlfxf.exec:\xrxlfxf.exe100⤵PID:1976
-
\??\c:\nnbtnh.exec:\nnbtnh.exe101⤵PID:4092
-
\??\c:\dpppp.exec:\dpppp.exe102⤵PID:4036
-
\??\c:\xflxlrx.exec:\xflxlrx.exe103⤵PID:408
-
\??\c:\hbhhnn.exec:\hbhhnn.exe104⤵PID:1100
-
\??\c:\pvddd.exec:\pvddd.exe105⤵PID:3196
-
\??\c:\5llfrrl.exec:\5llfrrl.exe106⤵PID:4264
-
\??\c:\httnhh.exec:\httnhh.exe107⤵PID:1156
-
\??\c:\vvddd.exec:\vvddd.exe108⤵PID:2628
-
\??\c:\xfflrfl.exec:\xfflrfl.exe109⤵PID:4812
-
\??\c:\btttnn.exec:\btttnn.exe110⤵PID:3580
-
\??\c:\ppddv.exec:\ppddv.exe111⤵PID:1060
-
\??\c:\pdvdv.exec:\pdvdv.exe112⤵PID:2960
-
\??\c:\xxrfxrl.exec:\xxrfxrl.exe113⤵
- System Location Discovery: System Language Discovery
PID:3948 -
\??\c:\nhbtnn.exec:\nhbtnn.exe114⤵PID:4216
-
\??\c:\dpdvd.exec:\dpdvd.exe115⤵PID:4532
-
\??\c:\llfxrrl.exec:\llfxrrl.exe116⤵PID:4728
-
\??\c:\hbhhhn.exec:\hbhhhn.exe117⤵PID:4668
-
\??\c:\jvjjj.exec:\jvjjj.exe118⤵PID:4744
-
\??\c:\fffxlll.exec:\fffxlll.exe119⤵PID:2480
-
\??\c:\bbttbb.exec:\bbttbb.exe120⤵PID:2232
-
\??\c:\dvdjj.exec:\dvdjj.exe121⤵PID:4664
-
\??\c:\lxxfxxf.exec:\lxxfxxf.exe122⤵PID:4000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-