Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 06:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe
-
Size
454KB
-
MD5
29b01c8130e6df2fd85ee6d16c613881
-
SHA1
dd7c78fd43b691ffc4e584c769b0f5e441ce25cc
-
SHA256
f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a
-
SHA512
eff9e4061b0c8acc037abe58927022de28a6cf5798cd2eaf0d924e8ebd278ce98913a6786218529363ccb1e4ba7c81d3ee3d6b88237a17837dd3837545e22eac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3064-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-940-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-1061-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-1276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2296 dvjvv.exe 1116 lxrrxff.exe 1488 tnhhtt.exe 1984 pvjjv.exe 536 ffxrlrl.exe 2160 rrxxflr.exe 4564 tthhnn.exe 3984 dvjjp.exe 912 jvppp.exe 2840 xxfffrr.exe 2568 7hnnnb.exe 4100 hhnnhn.exe 1500 vdppd.exe 4444 ffxxrxr.exe 4368 lxfflll.exe 980 5bthht.exe 3884 nbnnnt.exe 4964 1vpvv.exe 2880 xrffxxx.exe 5004 llxxrrx.exe 3176 1hbbtb.exe 844 jvjjp.exe 1520 3ddvd.exe 4580 lfrrrxf.exe 3952 nnbbhb.exe 4272 3hbtbh.exe 1244 dpjjj.exe 3856 jjddp.exe 1492 xrllxfl.exe 3208 3hhhhh.exe 2956 3bttht.exe 4548 pjppp.exe 1376 vpdjj.exe 4860 llrrrxx.exe 1364 bthhhb.exe 1616 btnbtb.exe 4244 vpddd.exe 1312 llrffrx.exe 4292 lllxlrf.exe 5016 ttnnnt.exe 4808 nntnhn.exe 512 ddvvj.exe 3752 xrrllrr.exe 4104 rrxxlrx.exe 2360 1nnnnn.exe 4540 nnbnnt.exe 4164 vvjjj.exe 396 frxrrrr.exe 4536 rrxxxxf.exe 4908 bbhhhh.exe 2336 nthhhn.exe 2248 vpdvv.exe 4752 lxlrrrx.exe 4636 nbntnn.exe 3852 1nhhbh.exe 920 ppvvj.exe 1268 vpdpp.exe 4648 xxrrrxf.exe 1796 hhbhtt.exe 1468 tbbbtb.exe 2400 7dppv.exe 3364 rrrxxff.exe 4400 rrfxxxx.exe 1668 nnhhbh.exe -
resource yara_rule behavioral2/memory/3064-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-940-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnnt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2296 3064 f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe 82 PID 3064 wrote to memory of 2296 3064 f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe 82 PID 3064 wrote to memory of 2296 3064 f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe 82 PID 2296 wrote to memory of 1116 2296 dvjvv.exe 83 PID 2296 wrote to memory of 1116 2296 dvjvv.exe 83 PID 2296 wrote to memory of 1116 2296 dvjvv.exe 83 PID 1116 wrote to memory of 1488 1116 lxrrxff.exe 152 PID 1116 wrote to memory of 1488 1116 lxrrxff.exe 152 PID 1116 wrote to memory of 1488 1116 lxrrxff.exe 152 PID 1488 wrote to memory of 1984 1488 tnhhtt.exe 85 PID 1488 wrote to memory of 1984 1488 tnhhtt.exe 85 PID 1488 wrote to memory of 1984 1488 tnhhtt.exe 85 PID 1984 wrote to memory of 536 1984 pvjjv.exe 86 PID 1984 wrote to memory of 536 1984 pvjjv.exe 86 PID 1984 wrote to memory of 536 1984 pvjjv.exe 86 PID 536 wrote to memory of 2160 536 ffxrlrl.exe 87 PID 536 wrote to memory of 2160 536 ffxrlrl.exe 87 PID 536 wrote to memory of 2160 536 ffxrlrl.exe 87 PID 2160 wrote to memory of 4564 2160 rrxxflr.exe 88 PID 2160 wrote to memory of 4564 2160 rrxxflr.exe 88 PID 2160 wrote to memory of 4564 2160 rrxxflr.exe 88 PID 4564 wrote to memory of 3984 4564 tthhnn.exe 89 PID 4564 wrote to memory of 3984 4564 tthhnn.exe 89 PID 4564 wrote to memory of 3984 4564 tthhnn.exe 89 PID 3984 wrote to memory of 912 3984 dvjjp.exe 90 PID 3984 wrote to memory of 912 3984 dvjjp.exe 90 PID 3984 wrote to memory of 912 3984 dvjjp.exe 90 PID 912 wrote to memory of 2840 912 jvppp.exe 91 PID 912 wrote to memory of 2840 912 jvppp.exe 91 PID 912 wrote to memory of 2840 912 jvppp.exe 91 PID 2840 wrote to memory of 2568 2840 xxfffrr.exe 92 PID 2840 wrote to memory of 2568 2840 xxfffrr.exe 92 PID 2840 wrote to memory of 2568 2840 xxfffrr.exe 92 PID 2568 wrote to memory of 4100 2568 7hnnnb.exe 93 PID 2568 wrote to memory of 4100 2568 7hnnnb.exe 93 PID 2568 wrote to memory of 4100 2568 7hnnnb.exe 93 PID 4100 wrote to memory of 1500 4100 hhnnhn.exe 94 PID 4100 wrote to memory of 1500 4100 hhnnhn.exe 94 PID 4100 wrote to memory of 1500 4100 hhnnhn.exe 94 PID 1500 wrote to memory of 4444 1500 vdppd.exe 163 PID 1500 wrote to memory of 4444 1500 vdppd.exe 163 PID 1500 wrote to memory of 4444 1500 vdppd.exe 163 PID 4444 wrote to memory of 4368 4444 ffxxrxr.exe 96 PID 4444 wrote to memory of 4368 4444 ffxxrxr.exe 96 PID 4444 wrote to memory of 4368 4444 ffxxrxr.exe 96 PID 4368 wrote to memory of 980 4368 lxfflll.exe 97 PID 4368 wrote to memory of 980 4368 lxfflll.exe 97 PID 4368 wrote to memory of 980 4368 lxfflll.exe 97 PID 980 wrote to memory of 3884 980 5bthht.exe 98 PID 980 wrote to memory of 3884 980 5bthht.exe 98 PID 980 wrote to memory of 3884 980 5bthht.exe 98 PID 3884 wrote to memory of 4964 3884 nbnnnt.exe 99 PID 3884 wrote to memory of 4964 3884 nbnnnt.exe 99 PID 3884 wrote to memory of 4964 3884 nbnnnt.exe 99 PID 4964 wrote to memory of 2880 4964 1vpvv.exe 100 PID 4964 wrote to memory of 2880 4964 1vpvv.exe 100 PID 4964 wrote to memory of 2880 4964 1vpvv.exe 100 PID 2880 wrote to memory of 5004 2880 xrffxxx.exe 101 PID 2880 wrote to memory of 5004 2880 xrffxxx.exe 101 PID 2880 wrote to memory of 5004 2880 xrffxxx.exe 101 PID 5004 wrote to memory of 3176 5004 llxxrrx.exe 102 PID 5004 wrote to memory of 3176 5004 llxxrrx.exe 102 PID 5004 wrote to memory of 3176 5004 llxxrrx.exe 102 PID 3176 wrote to memory of 844 3176 1hbbtb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe"C:\Users\Admin\AppData\Local\Temp\f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\dvjvv.exec:\dvjvv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\lxrrxff.exec:\lxrrxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\tnhhtt.exec:\tnhhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\pvjjv.exec:\pvjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\ffxrlrl.exec:\ffxrlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\rrxxflr.exec:\rrxxflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\tthhnn.exec:\tthhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\dvjjp.exec:\dvjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\jvppp.exec:\jvppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\xxfffrr.exec:\xxfffrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\7hnnnb.exec:\7hnnnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hhnnhn.exec:\hhnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\vdppd.exec:\vdppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\lxfflll.exec:\lxfflll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\5bthht.exec:\5bthht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\nbnnnt.exec:\nbnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\1vpvv.exec:\1vpvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\xrffxxx.exec:\xrffxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\llxxrrx.exec:\llxxrrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\1hbbtb.exec:\1hbbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\jvjjp.exec:\jvjjp.exe23⤵
- Executes dropped EXE
PID:844 -
\??\c:\3ddvd.exec:\3ddvd.exe24⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe25⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nnbbhb.exec:\nnbbhb.exe26⤵
- Executes dropped EXE
PID:3952 -
\??\c:\3hbtbh.exec:\3hbtbh.exe27⤵
- Executes dropped EXE
PID:4272 -
\??\c:\dpjjj.exec:\dpjjj.exe28⤵
- Executes dropped EXE
PID:1244 -
\??\c:\jjddp.exec:\jjddp.exe29⤵
- Executes dropped EXE
PID:3856 -
\??\c:\xrllxfl.exec:\xrllxfl.exe30⤵
- Executes dropped EXE
PID:1492 -
\??\c:\3hhhhh.exec:\3hhhhh.exe31⤵
- Executes dropped EXE
PID:3208 -
\??\c:\3bttht.exec:\3bttht.exe32⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pjppp.exec:\pjppp.exe33⤵
- Executes dropped EXE
PID:4548 -
\??\c:\vpdjj.exec:\vpdjj.exe34⤵
- Executes dropped EXE
PID:1376 -
\??\c:\llrrrxx.exec:\llrrrxx.exe35⤵
- Executes dropped EXE
PID:4860 -
\??\c:\bthhhb.exec:\bthhhb.exe36⤵
- Executes dropped EXE
PID:1364 -
\??\c:\btnbtb.exec:\btnbtb.exe37⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vpddd.exec:\vpddd.exe38⤵
- Executes dropped EXE
PID:4244 -
\??\c:\llrffrx.exec:\llrffrx.exe39⤵
- Executes dropped EXE
PID:1312 -
\??\c:\lllxlrf.exec:\lllxlrf.exe40⤵
- Executes dropped EXE
PID:4292 -
\??\c:\ttnnnt.exec:\ttnnnt.exe41⤵
- Executes dropped EXE
PID:5016 -
\??\c:\nntnhn.exec:\nntnhn.exe42⤵
- Executes dropped EXE
PID:4808 -
\??\c:\ddvvj.exec:\ddvvj.exe43⤵
- Executes dropped EXE
PID:512 -
\??\c:\xrrllrr.exec:\xrrllrr.exe44⤵
- Executes dropped EXE
PID:3752 -
\??\c:\rrxxlrx.exec:\rrxxlrx.exe45⤵
- Executes dropped EXE
PID:4104 -
\??\c:\1nnnnn.exec:\1nnnnn.exe46⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nnbnnt.exec:\nnbnnt.exe47⤵
- Executes dropped EXE
PID:4540 -
\??\c:\vvjjj.exec:\vvjjj.exe48⤵
- Executes dropped EXE
PID:4164 -
\??\c:\frxrrrr.exec:\frxrrrr.exe49⤵
- Executes dropped EXE
PID:396 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe50⤵
- Executes dropped EXE
PID:4536 -
\??\c:\bbhhhh.exec:\bbhhhh.exe51⤵
- Executes dropped EXE
PID:4908 -
\??\c:\nthhhn.exec:\nthhhn.exe52⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vpdvv.exec:\vpdvv.exe53⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe54⤵
- Executes dropped EXE
PID:4752 -
\??\c:\nbntnn.exec:\nbntnn.exe55⤵
- Executes dropped EXE
PID:4636 -
\??\c:\1nhhbh.exec:\1nhhbh.exe56⤵
- Executes dropped EXE
PID:3852 -
\??\c:\ppvvj.exec:\ppvvj.exe57⤵
- Executes dropped EXE
PID:920 -
\??\c:\vpdpp.exec:\vpdpp.exe58⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xxrrrxf.exec:\xxrrrxf.exe59⤵
- Executes dropped EXE
PID:4648 -
\??\c:\hhbhtt.exec:\hhbhtt.exe60⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tbbbtb.exec:\tbbbtb.exe61⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7dppv.exec:\7dppv.exe62⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rrrxxff.exec:\rrrxxff.exe63⤵
- Executes dropped EXE
PID:3364 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe64⤵
- Executes dropped EXE
PID:4400 -
\??\c:\nnhhbh.exec:\nnhhbh.exe65⤵
- Executes dropped EXE
PID:1668 -
\??\c:\dpddd.exec:\dpddd.exe66⤵PID:3520
-
\??\c:\vvpdp.exec:\vvpdp.exe67⤵PID:4392
-
\??\c:\xxllrrx.exec:\xxllrrx.exe68⤵PID:3596
-
\??\c:\9xlllff.exec:\9xlllff.exe69⤵PID:1600
-
\??\c:\hnhhtb.exec:\hnhhtb.exe70⤵PID:4112
-
\??\c:\7ppjv.exec:\7ppjv.exe71⤵PID:3840
-
\??\c:\dpddp.exec:\dpddp.exe72⤵PID:1488
-
\??\c:\lffxxrf.exec:\lffxxrf.exe73⤵PID:4032
-
\??\c:\bbhhhn.exec:\bbhhhn.exe74⤵PID:2300
-
\??\c:\nnhhtb.exec:\nnhhtb.exe75⤵PID:3492
-
\??\c:\jjpvv.exec:\jjpvv.exe76⤵PID:3708
-
\??\c:\xrfffxx.exec:\xrfffxx.exe77⤵PID:2588
-
\??\c:\flrxfll.exec:\flrxfll.exe78⤵PID:1960
-
\??\c:\tnbbbh.exec:\tnbbbh.exe79⤵PID:556
-
\??\c:\nthhtb.exec:\nthhtb.exe80⤵PID:2968
-
\??\c:\7dvdd.exec:\7dvdd.exe81⤵PID:1340
-
\??\c:\rlxfflf.exec:\rlxfflf.exe82⤵PID:2108
-
\??\c:\frlfflf.exec:\frlfflf.exe83⤵PID:4444
-
\??\c:\tbhntb.exec:\tbhntb.exe84⤵PID:1504
-
\??\c:\bbhnnt.exec:\bbhnnt.exe85⤵PID:2836
-
\??\c:\9pddd.exec:\9pddd.exe86⤵PID:2352
-
\??\c:\fxffxxx.exec:\fxffxxx.exe87⤵PID:2036
-
\??\c:\xxffxff.exec:\xxffxff.exe88⤵PID:4528
-
\??\c:\nhthhn.exec:\nhthhn.exe89⤵PID:3240
-
\??\c:\djvvv.exec:\djvvv.exe90⤵PID:4656
-
\??\c:\9jpjd.exec:\9jpjd.exe91⤵PID:4796
-
\??\c:\nhbhhn.exec:\nhbhhn.exe92⤵PID:1700
-
\??\c:\jpjjj.exec:\jpjjj.exe93⤵
- System Location Discovery: System Language Discovery
PID:1492 -
\??\c:\1flrrxf.exec:\1flrrxf.exe94⤵PID:4856
-
\??\c:\bhntnb.exec:\bhntnb.exe95⤵PID:1748
-
\??\c:\5jjpp.exec:\5jjpp.exe96⤵PID:872
-
\??\c:\ffxxxlx.exec:\ffxxxlx.exe97⤵PID:1252
-
\??\c:\frxxxxx.exec:\frxxxxx.exe98⤵PID:2260
-
\??\c:\hnbbbh.exec:\hnbbbh.exe99⤵PID:1236
-
\??\c:\pvvvj.exec:\pvvvj.exe100⤵PID:4296
-
\??\c:\llrlllr.exec:\llrlllr.exe101⤵PID:4544
-
\??\c:\bhthnt.exec:\bhthnt.exe102⤵PID:4012
-
\??\c:\vjvvd.exec:\vjvvd.exe103⤵PID:880
-
\??\c:\llrfrrr.exec:\llrfrrr.exe104⤵PID:1768
-
\??\c:\bnhhhh.exec:\bnhhhh.exe105⤵PID:3136
-
\??\c:\ppjpd.exec:\ppjpd.exe106⤵PID:5032
-
\??\c:\bbbbbb.exec:\bbbbbb.exe107⤵PID:4276
-
\??\c:\pvjjd.exec:\pvjjd.exe108⤵PID:3424
-
\??\c:\lrlrrxl.exec:\lrlrrxl.exe109⤵PID:708
-
\??\c:\tnbbbb.exec:\tnbbbb.exe110⤵PID:3940
-
\??\c:\nhttnt.exec:\nhttnt.exe111⤵PID:2492
-
\??\c:\jdppv.exec:\jdppv.exe112⤵PID:2324
-
\??\c:\9htttb.exec:\9htttb.exe113⤵PID:3964
-
\??\c:\pvvvd.exec:\pvvvd.exe114⤵PID:3852
-
\??\c:\tnhhnt.exec:\tnhhnt.exe115⤵PID:4844
-
\??\c:\pvjjp.exec:\pvjjp.exe116⤵PID:1832
-
\??\c:\flxxrrl.exec:\flxxrrl.exe117⤵PID:996
-
\??\c:\dddjv.exec:\dddjv.exe118⤵PID:1796
-
\??\c:\hnhnbh.exec:\hnhnbh.exe119⤵PID:1088
-
\??\c:\jdjvp.exec:\jdjvp.exe120⤵PID:3140
-
\??\c:\nhhnbn.exec:\nhhnbn.exe121⤵PID:3012
-
\??\c:\vvvvd.exec:\vvvvd.exe122⤵PID:4876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-