Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 07:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe
-
Size
453KB
-
MD5
142798714da101a030f0e3d0d44bc62d
-
SHA1
3a84dd84be087ae132e3cad9fc337ae7f17db3e9
-
SHA256
feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b
-
SHA512
16fbfbfb73266e4c2b569c9190870405c2fde5ad41eeed68f11472f39755e6e54157e3d8bcd84c2bc8123fa4c6a71253f5d7a9927bd6a8aa14eb5e7404a988a8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2568-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-835-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-894-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-1078-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-1206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-1396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2500 vpddd.exe 4812 llfflrr.exe 4804 ppvvv.exe 1172 dddpj.exe 2364 xfllrxx.exe 4228 nbhhnt.exe 3500 dvdpp.exe 4292 rrxfflx.exe 1728 tbntbn.exe 2692 jpjjp.exe 3408 xrfllxx.exe 1528 nntbbh.exe 1744 dvvdd.exe 3780 xfrrrrx.exe 948 hbbbhn.exe 2420 bbhbtt.exe 4916 vvvpj.exe 4912 5nnbbh.exe 2800 htbtnn.exe 1032 hhttbn.exe 4384 vpjpv.exe 2820 rxflrxf.exe 1972 hnbtbn.exe 4764 pdvdd.exe 3456 xrlxxll.exe 2340 3nbttb.exe 1764 xffrllx.exe 4516 btnhbh.exe 4136 rlrxrrr.exe 1920 flffxlr.exe 1092 htttnn.exe 1504 jdpjd.exe 2300 tntnhh.exe 3280 djjvv.exe 4952 jvvvv.exe 4752 hbbhnn.exe 3580 nntnnn.exe 3992 pjdvp.exe 4724 rrrrlll.exe 4512 bththt.exe 4060 nhhbtn.exe 3068 jjpjd.exe 3756 lxfxfxf.exe 1516 ttttnh.exe 2404 nbtnhh.exe 3732 vpddj.exe 3360 rrxrffx.exe 3128 nnhhhb.exe 2752 jpdvp.exe 2688 vpvpv.exe 4400 frxrlrl.exe 848 nbnntb.exe 2500 xflxrrl.exe 2764 bthhbh.exe 1124 jddvp.exe 4704 rlrfflf.exe 3460 1ntnnt.exe 2224 jpdjv.exe 2928 xrfllxf.exe 3388 bbntth.exe 316 7hhhhn.exe 3824 pddvd.exe 908 nnnttt.exe 408 dpvvj.exe -
resource yara_rule behavioral2/memory/2568-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2500 2568 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 82 PID 2568 wrote to memory of 2500 2568 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 82 PID 2568 wrote to memory of 2500 2568 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 82 PID 2500 wrote to memory of 4812 2500 vpddd.exe 83 PID 2500 wrote to memory of 4812 2500 vpddd.exe 83 PID 2500 wrote to memory of 4812 2500 vpddd.exe 83 PID 4812 wrote to memory of 4804 4812 llfflrr.exe 84 PID 4812 wrote to memory of 4804 4812 llfflrr.exe 84 PID 4812 wrote to memory of 4804 4812 llfflrr.exe 84 PID 4804 wrote to memory of 1172 4804 ppvvv.exe 85 PID 4804 wrote to memory of 1172 4804 ppvvv.exe 85 PID 4804 wrote to memory of 1172 4804 ppvvv.exe 85 PID 1172 wrote to memory of 2364 1172 dddpj.exe 86 PID 1172 wrote to memory of 2364 1172 dddpj.exe 86 PID 1172 wrote to memory of 2364 1172 dddpj.exe 86 PID 2364 wrote to memory of 4228 2364 xfllrxx.exe 87 PID 2364 wrote to memory of 4228 2364 xfllrxx.exe 87 PID 2364 wrote to memory of 4228 2364 xfllrxx.exe 87 PID 4228 wrote to memory of 3500 4228 nbhhnt.exe 88 PID 4228 wrote to memory of 3500 4228 nbhhnt.exe 88 PID 4228 wrote to memory of 3500 4228 nbhhnt.exe 88 PID 3500 wrote to memory of 4292 3500 dvdpp.exe 89 PID 3500 wrote to memory of 4292 3500 dvdpp.exe 89 PID 3500 wrote to memory of 4292 3500 dvdpp.exe 89 PID 4292 wrote to memory of 1728 4292 rrxfflx.exe 90 PID 4292 wrote to memory of 1728 4292 rrxfflx.exe 90 PID 4292 wrote to memory of 1728 4292 rrxfflx.exe 90 PID 1728 wrote to memory of 2692 1728 tbntbn.exe 91 PID 1728 wrote to memory of 2692 1728 tbntbn.exe 91 PID 1728 wrote to memory of 2692 1728 tbntbn.exe 91 PID 2692 wrote to memory of 3408 2692 jpjjp.exe 92 PID 2692 wrote to memory of 3408 2692 jpjjp.exe 92 PID 2692 wrote to memory of 3408 2692 jpjjp.exe 92 PID 3408 wrote to memory of 1528 3408 xrfllxx.exe 93 PID 3408 wrote to memory of 1528 3408 xrfllxx.exe 93 PID 3408 wrote to memory of 1528 3408 xrfllxx.exe 93 PID 1528 wrote to memory of 1744 1528 nntbbh.exe 94 PID 1528 wrote to memory of 1744 1528 nntbbh.exe 94 PID 1528 wrote to memory of 1744 1528 nntbbh.exe 94 PID 1744 wrote to memory of 3780 1744 dvvdd.exe 95 PID 1744 wrote to memory of 3780 1744 dvvdd.exe 95 PID 1744 wrote to memory of 3780 1744 dvvdd.exe 95 PID 3780 wrote to memory of 948 3780 xfrrrrx.exe 96 PID 3780 wrote to memory of 948 3780 xfrrrrx.exe 96 PID 3780 wrote to memory of 948 3780 xfrrrrx.exe 96 PID 948 wrote to memory of 2420 948 hbbbhn.exe 97 PID 948 wrote to memory of 2420 948 hbbbhn.exe 97 PID 948 wrote to memory of 2420 948 hbbbhn.exe 97 PID 2420 wrote to memory of 4916 2420 bbhbtt.exe 98 PID 2420 wrote to memory of 4916 2420 bbhbtt.exe 98 PID 2420 wrote to memory of 4916 2420 bbhbtt.exe 98 PID 4916 wrote to memory of 4912 4916 vvvpj.exe 99 PID 4916 wrote to memory of 4912 4916 vvvpj.exe 99 PID 4916 wrote to memory of 4912 4916 vvvpj.exe 99 PID 4912 wrote to memory of 2800 4912 5nnbbh.exe 100 PID 4912 wrote to memory of 2800 4912 5nnbbh.exe 100 PID 4912 wrote to memory of 2800 4912 5nnbbh.exe 100 PID 2800 wrote to memory of 1032 2800 htbtnn.exe 101 PID 2800 wrote to memory of 1032 2800 htbtnn.exe 101 PID 2800 wrote to memory of 1032 2800 htbtnn.exe 101 PID 1032 wrote to memory of 4384 1032 hhttbn.exe 102 PID 1032 wrote to memory of 4384 1032 hhttbn.exe 102 PID 1032 wrote to memory of 4384 1032 hhttbn.exe 102 PID 4384 wrote to memory of 2820 4384 vpjpv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe"C:\Users\Admin\AppData\Local\Temp\feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vpddd.exec:\vpddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\llfflrr.exec:\llfflrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\ppvvv.exec:\ppvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\dddpj.exec:\dddpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\xfllrxx.exec:\xfllrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\nbhhnt.exec:\nbhhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\dvdpp.exec:\dvdpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\rrxfflx.exec:\rrxfflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\tbntbn.exec:\tbntbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\jpjjp.exec:\jpjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xrfllxx.exec:\xrfllxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\nntbbh.exec:\nntbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\dvvdd.exec:\dvvdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\xfrrrrx.exec:\xfrrrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\hbbbhn.exec:\hbbbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\bbhbtt.exec:\bbhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\vvvpj.exec:\vvvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\5nnbbh.exec:\5nnbbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\htbtnn.exec:\htbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\hhttbn.exec:\hhttbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\vpjpv.exec:\vpjpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\rxflrxf.exec:\rxflrxf.exe23⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hnbtbn.exec:\hnbtbn.exe24⤵
- Executes dropped EXE
PID:1972 -
\??\c:\pdvdd.exec:\pdvdd.exe25⤵
- Executes dropped EXE
PID:4764 -
\??\c:\xrlxxll.exec:\xrlxxll.exe26⤵
- Executes dropped EXE
PID:3456 -
\??\c:\3nbttb.exec:\3nbttb.exe27⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xffrllx.exec:\xffrllx.exe28⤵
- Executes dropped EXE
PID:1764 -
\??\c:\btnhbh.exec:\btnhbh.exe29⤵
- Executes dropped EXE
PID:4516 -
\??\c:\rlrxrrr.exec:\rlrxrrr.exe30⤵
- Executes dropped EXE
PID:4136 -
\??\c:\flffxlr.exec:\flffxlr.exe31⤵
- Executes dropped EXE
PID:1920 -
\??\c:\htttnn.exec:\htttnn.exe32⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jdpjd.exec:\jdpjd.exe33⤵
- Executes dropped EXE
PID:1504 -
\??\c:\tntnhh.exec:\tntnhh.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\djjvv.exec:\djjvv.exe35⤵
- Executes dropped EXE
PID:3280 -
\??\c:\jvvvv.exec:\jvvvv.exe36⤵
- Executes dropped EXE
PID:4952 -
\??\c:\hbbhnn.exec:\hbbhnn.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4752 -
\??\c:\nntnnn.exec:\nntnnn.exe38⤵
- Executes dropped EXE
PID:3580 -
\??\c:\pjdvp.exec:\pjdvp.exe39⤵
- Executes dropped EXE
PID:3992 -
\??\c:\rrrrlll.exec:\rrrrlll.exe40⤵
- Executes dropped EXE
PID:4724 -
\??\c:\bththt.exec:\bththt.exe41⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nhhbtn.exec:\nhhbtn.exe42⤵
- Executes dropped EXE
PID:4060 -
\??\c:\jjpjd.exec:\jjpjd.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lxfxfxf.exec:\lxfxfxf.exe44⤵
- Executes dropped EXE
PID:3756 -
\??\c:\ttttnh.exec:\ttttnh.exe45⤵
- Executes dropped EXE
PID:1516 -
\??\c:\nbtnhh.exec:\nbtnhh.exe46⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vpddj.exec:\vpddj.exe47⤵
- Executes dropped EXE
PID:3732 -
\??\c:\rrxrffx.exec:\rrxrffx.exe48⤵
- Executes dropped EXE
PID:3360 -
\??\c:\nnhhhb.exec:\nnhhhb.exe49⤵
- Executes dropped EXE
PID:3128 -
\??\c:\jpdvp.exec:\jpdvp.exe50⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vpvpv.exec:\vpvpv.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\frxrlrl.exec:\frxrlrl.exe52⤵
- Executes dropped EXE
PID:4400 -
\??\c:\nbnntb.exec:\nbnntb.exe53⤵
- Executes dropped EXE
PID:848 -
\??\c:\xflxrrl.exec:\xflxrrl.exe54⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bthhbh.exec:\bthhbh.exe55⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jddvp.exec:\jddvp.exe56⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rlrfflf.exec:\rlrfflf.exe57⤵
- Executes dropped EXE
PID:4704 -
\??\c:\1ntnnt.exec:\1ntnnt.exe58⤵
- Executes dropped EXE
PID:3460 -
\??\c:\jpdjv.exec:\jpdjv.exe59⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrfllxf.exec:\xrfllxf.exe60⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bbntth.exec:\bbntth.exe61⤵
- Executes dropped EXE
PID:3388 -
\??\c:\7hhhhn.exec:\7hhhhn.exe62⤵
- Executes dropped EXE
PID:316 -
\??\c:\pddvd.exec:\pddvd.exe63⤵
- Executes dropped EXE
PID:3824 -
\??\c:\nnnttt.exec:\nnnttt.exe64⤵
- Executes dropped EXE
PID:908 -
\??\c:\dpvvj.exec:\dpvvj.exe65⤵
- Executes dropped EXE
PID:408 -
\??\c:\rxffxrx.exec:\rxffxrx.exe66⤵PID:2692
-
\??\c:\hbbbhh.exec:\hbbbhh.exe67⤵PID:32
-
\??\c:\frxxffx.exec:\frxxffx.exe68⤵PID:4556
-
\??\c:\dvjjd.exec:\dvjjd.exe69⤵PID:4956
-
\??\c:\dpjdp.exec:\dpjdp.exe70⤵PID:1404
-
\??\c:\bbbnbt.exec:\bbbnbt.exe71⤵PID:3780
-
\??\c:\pvpjj.exec:\pvpjj.exe72⤵PID:1328
-
\??\c:\xlrrrxf.exec:\xlrrrxf.exe73⤵PID:3720
-
\??\c:\bnhbhh.exec:\bnhbhh.exe74⤵PID:4916
-
\??\c:\pjjdp.exec:\pjjdp.exe75⤵PID:4912
-
\??\c:\fxrfrrl.exec:\fxrfrrl.exe76⤵PID:4080
-
\??\c:\nnnhhh.exec:\nnnhhh.exe77⤵PID:2396
-
\??\c:\hbtbnn.exec:\hbtbnn.exe78⤵PID:4372
-
\??\c:\dvdpd.exec:\dvdpd.exe79⤵PID:3168
-
\??\c:\llrxlxr.exec:\llrxlxr.exe80⤵PID:3792
-
\??\c:\tbbtnh.exec:\tbbtnh.exe81⤵PID:1400
-
\??\c:\nntttn.exec:\nntttn.exe82⤵PID:4072
-
\??\c:\djvpj.exec:\djvpj.exe83⤵PID:2972
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe84⤵PID:3820
-
\??\c:\hnbbbb.exec:\hnbbbb.exe85⤵PID:672
-
\??\c:\dvvjv.exec:\dvvjv.exe86⤵PID:1524
-
\??\c:\jpvvp.exec:\jpvvp.exe87⤵PID:2340
-
\??\c:\llfrlll.exec:\llfrlll.exe88⤵PID:2212
-
\??\c:\nthbbt.exec:\nthbbt.exe89⤵PID:4768
-
\??\c:\vdppv.exec:\vdppv.exe90⤵PID:2156
-
\??\c:\xfxxrxf.exec:\xfxxrxf.exe91⤵PID:3772
-
\??\c:\bnbnnh.exec:\bnbnnh.exe92⤵PID:1340
-
\??\c:\ppdvv.exec:\ppdvv.exe93⤵PID:4144
-
\??\c:\fflfrlr.exec:\fflfrlr.exe94⤵PID:2368
-
\??\c:\tttnhh.exec:\tttnhh.exe95⤵PID:2440
-
\??\c:\djvvv.exec:\djvvv.exe96⤵PID:4532
-
\??\c:\xlrlxxf.exec:\xlrlxxf.exe97⤵PID:2176
-
\??\c:\nbnhhn.exec:\nbnhhn.exe98⤵PID:2424
-
\??\c:\pppjj.exec:\pppjj.exe99⤵PID:3336
-
\??\c:\lxxlffr.exec:\lxxlffr.exe100⤵PID:4952
-
\??\c:\nbhhhh.exec:\nbhhhh.exe101⤵PID:4596
-
\??\c:\jvppd.exec:\jvppd.exe102⤵PID:1036
-
\??\c:\frxrrlf.exec:\frxrrlf.exe103⤵PID:3116
-
\??\c:\htbnhn.exec:\htbnhn.exe104⤵PID:3992
-
\??\c:\jdjdp.exec:\jdjdp.exe105⤵PID:4776
-
\??\c:\fxfxfff.exec:\fxfxfff.exe106⤵PID:884
-
\??\c:\hhnntn.exec:\hhnntn.exe107⤵PID:324
-
\??\c:\djjjj.exec:\djjjj.exe108⤵PID:1264
-
\??\c:\xrrrlll.exec:\xrrrlll.exe109⤵PID:4840
-
\??\c:\nhtttt.exec:\nhtttt.exe110⤵PID:744
-
\??\c:\jjppj.exec:\jjppj.exe111⤵PID:3144
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe112⤵PID:4448
-
\??\c:\bnhntb.exec:\bnhntb.exe113⤵PID:3220
-
\??\c:\vpdvj.exec:\vpdvj.exe114⤵PID:3940
-
\??\c:\xlrxrfx.exec:\xlrxrfx.exe115⤵PID:3180
-
\??\c:\bhbtnb.exec:\bhbtnb.exe116⤵PID:3000
-
\??\c:\vvvjj.exec:\vvvjj.exe117⤵PID:4348
-
\??\c:\frffllr.exec:\frffllr.exe118⤵PID:4400
-
\??\c:\bhnntb.exec:\bhnntb.exe119⤵PID:848
-
\??\c:\lrxlrxf.exec:\lrxlrxf.exe120⤵PID:2500
-
\??\c:\tntnhb.exec:\tntnhb.exe121⤵PID:3464
-
\??\c:\pdvvv.exec:\pdvvv.exe122⤵PID:4948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-