Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 08:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20c050df03743fe6f8841a7819e33a3b5a7d766f7c330c4d3e3b06584c00898d.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
20c050df03743fe6f8841a7819e33a3b5a7d766f7c330c4d3e3b06584c00898d.exe
-
Size
454KB
-
MD5
d979acfd01299acc4cedbe53d2b0d8f4
-
SHA1
ea080a4f0a7745e8876ed623ec9caa876595e744
-
SHA256
20c050df03743fe6f8841a7819e33a3b5a7d766f7c330c4d3e3b06584c00898d
-
SHA512
574301038f44efcee1429c13f4f3b222104aa378059021dc86c3e4e03a9407792b59b617891c74ea11b4c0a463743d96e8b90de4539ea7c91bcdb2c24caea4ae
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetn:q7Tc2NYHUrAwfMp3CDtn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4852-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1316-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4788 bthhbb.exe 4816 dddvj.exe 1548 bbnthb.exe 4084 rrxrfxr.exe 396 nbbhnb.exe 2960 jjdjj.exe 3200 thttbt.exe 4160 vpvpv.exe 5048 9vvvv.exe 3132 dppdj.exe 3748 vdddd.exe 4240 lfrrxxx.exe 1316 jvjvv.exe 2616 frrrxfl.exe 4920 ddppd.exe 2196 5xfllrl.exe 1708 djvvd.exe 852 7frrrxf.exe 220 bhbbhn.exe 3536 5pvdd.exe 2732 1llrxxf.exe 1244 vvpvd.exe 3416 xffllrf.exe 1332 pvvvd.exe 1864 frxxfll.exe 1084 dddjj.exe 1668 dvpvd.exe 2328 vdjjd.exe 620 rxrxfll.exe 3336 jjdvj.exe 2744 tttnhh.exe 876 xlxlllx.exe 224 pjjdd.exe 4684 lxxrxxx.exe 3020 xrfflff.exe 1880 1jvvd.exe 4864 7fllllf.exe 4680 btbbbn.exe 3904 vjjjp.exe 3316 lfxlrrf.exe 3888 hhntbh.exe 4840 pvjpv.exe 4992 flffrxl.exe 4304 llfxflr.exe 1420 ddddj.exe 1128 frlrflx.exe 2176 jdpvd.exe 4556 ppjvd.exe 4436 5fxfxxx.exe 5108 tttttb.exe 4720 llfrxxf.exe 4672 bbhhbb.exe 5080 dpdpd.exe 4448 frrlxrr.exe 4080 hbhhbh.exe 676 vdpdj.exe 3552 ffllrxx.exe 4560 tnhhhh.exe 396 vjvpd.exe 1112 fxxxxff.exe 1280 bnbhhb.exe 64 ddvvd.exe 4824 9lxxxlr.exe 3484 nnbbbb.exe -
resource yara_rule behavioral2/memory/4852-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-679-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 4788 4852 20c050df03743fe6f8841a7819e33a3b5a7d766f7c330c4d3e3b06584c00898d.exe 82 PID 4852 wrote to memory of 4788 4852 20c050df03743fe6f8841a7819e33a3b5a7d766f7c330c4d3e3b06584c00898d.exe 82 PID 4852 wrote to memory of 4788 4852 20c050df03743fe6f8841a7819e33a3b5a7d766f7c330c4d3e3b06584c00898d.exe 82 PID 4788 wrote to memory of 4816 4788 bthhbb.exe 83 PID 4788 wrote to memory of 4816 4788 bthhbb.exe 83 PID 4788 wrote to memory of 4816 4788 bthhbb.exe 83 PID 4816 wrote to memory of 1548 4816 dddvj.exe 84 PID 4816 wrote to memory of 1548 4816 dddvj.exe 84 PID 4816 wrote to memory of 1548 4816 dddvj.exe 84 PID 1548 wrote to memory of 4084 1548 bbnthb.exe 85 PID 1548 wrote to memory of 4084 1548 bbnthb.exe 85 PID 1548 wrote to memory of 4084 1548 bbnthb.exe 85 PID 4084 wrote to memory of 396 4084 rrxrfxr.exe 86 PID 4084 wrote to memory of 396 4084 rrxrfxr.exe 86 PID 4084 wrote to memory of 396 4084 rrxrfxr.exe 86 PID 396 wrote to memory of 2960 396 nbbhnb.exe 87 PID 396 wrote to memory of 2960 396 nbbhnb.exe 87 PID 396 wrote to memory of 2960 396 nbbhnb.exe 87 PID 2960 wrote to memory of 3200 2960 jjdjj.exe 88 PID 2960 wrote to memory of 3200 2960 jjdjj.exe 88 PID 2960 wrote to memory of 3200 2960 jjdjj.exe 88 PID 3200 wrote to memory of 4160 3200 thttbt.exe 89 PID 3200 wrote to memory of 4160 3200 thttbt.exe 89 PID 3200 wrote to memory of 4160 3200 thttbt.exe 89 PID 4160 wrote to memory of 5048 4160 vpvpv.exe 90 PID 4160 wrote to memory of 5048 4160 vpvpv.exe 90 PID 4160 wrote to memory of 5048 4160 vpvpv.exe 90 PID 5048 wrote to memory of 3132 5048 9vvvv.exe 91 PID 5048 wrote to memory of 3132 5048 9vvvv.exe 91 PID 5048 wrote to memory of 3132 5048 9vvvv.exe 91 PID 3132 wrote to memory of 3748 3132 dppdj.exe 92 PID 3132 wrote to memory of 3748 3132 dppdj.exe 92 PID 3132 wrote to memory of 3748 3132 dppdj.exe 92 PID 3748 wrote to memory of 4240 3748 vdddd.exe 93 PID 3748 wrote to memory of 4240 3748 vdddd.exe 93 PID 3748 wrote to memory of 4240 3748 vdddd.exe 93 PID 4240 wrote to memory of 1316 4240 lfrrxxx.exe 94 PID 4240 wrote to memory of 1316 4240 lfrrxxx.exe 94 PID 4240 wrote to memory of 1316 4240 lfrrxxx.exe 94 PID 1316 wrote to memory of 2616 1316 jvjvv.exe 95 PID 1316 wrote to memory of 2616 1316 jvjvv.exe 95 PID 1316 wrote to memory of 2616 1316 jvjvv.exe 95 PID 2616 wrote to memory of 4920 2616 frrrxfl.exe 96 PID 2616 wrote to memory of 4920 2616 frrrxfl.exe 96 PID 2616 wrote to memory of 4920 2616 frrrxfl.exe 96 PID 4920 wrote to memory of 2196 4920 ddppd.exe 97 PID 4920 wrote to memory of 2196 4920 ddppd.exe 97 PID 4920 wrote to memory of 2196 4920 ddppd.exe 97 PID 2196 wrote to memory of 1708 2196 5xfllrl.exe 98 PID 2196 wrote to memory of 1708 2196 5xfllrl.exe 98 PID 2196 wrote to memory of 1708 2196 5xfllrl.exe 98 PID 1708 wrote to memory of 852 1708 djvvd.exe 99 PID 1708 wrote to memory of 852 1708 djvvd.exe 99 PID 1708 wrote to memory of 852 1708 djvvd.exe 99 PID 852 wrote to memory of 220 852 7frrrxf.exe 100 PID 852 wrote to memory of 220 852 7frrrxf.exe 100 PID 852 wrote to memory of 220 852 7frrrxf.exe 100 PID 220 wrote to memory of 3536 220 bhbbhn.exe 101 PID 220 wrote to memory of 3536 220 bhbbhn.exe 101 PID 220 wrote to memory of 3536 220 bhbbhn.exe 101 PID 3536 wrote to memory of 2732 3536 5pvdd.exe 102 PID 3536 wrote to memory of 2732 3536 5pvdd.exe 102 PID 3536 wrote to memory of 2732 3536 5pvdd.exe 102 PID 2732 wrote to memory of 1244 2732 1llrxxf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\20c050df03743fe6f8841a7819e33a3b5a7d766f7c330c4d3e3b06584c00898d.exe"C:\Users\Admin\AppData\Local\Temp\20c050df03743fe6f8841a7819e33a3b5a7d766f7c330c4d3e3b06584c00898d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\bthhbb.exec:\bthhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\dddvj.exec:\dddvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\bbnthb.exec:\bbnthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\rrxrfxr.exec:\rrxrfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\nbbhnb.exec:\nbbhnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\jjdjj.exec:\jjdjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\thttbt.exec:\thttbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\vpvpv.exec:\vpvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\9vvvv.exec:\9vvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\dppdj.exec:\dppdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\vdddd.exec:\vdddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\jvjvv.exec:\jvjvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\frrrxfl.exec:\frrrxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ddppd.exec:\ddppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\5xfllrl.exec:\5xfllrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\djvvd.exec:\djvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\7frrrxf.exec:\7frrrxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\bhbbhn.exec:\bhbbhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\5pvdd.exec:\5pvdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\1llrxxf.exec:\1llrxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\vvpvd.exec:\vvpvd.exe23⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xffllrf.exec:\xffllrf.exe24⤵
- Executes dropped EXE
PID:3416 -
\??\c:\pvvvd.exec:\pvvvd.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1332 -
\??\c:\frxxfll.exec:\frxxfll.exe26⤵
- Executes dropped EXE
PID:1864 -
\??\c:\dddjj.exec:\dddjj.exe27⤵
- Executes dropped EXE
PID:1084 -
\??\c:\dvpvd.exec:\dvpvd.exe28⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vdjjd.exec:\vdjjd.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rxrxfll.exec:\rxrxfll.exe30⤵
- Executes dropped EXE
PID:620 -
\??\c:\jjdvj.exec:\jjdvj.exe31⤵
- Executes dropped EXE
PID:3336 -
\??\c:\tttnhh.exec:\tttnhh.exe32⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xlxlllx.exec:\xlxlllx.exe33⤵
- Executes dropped EXE
PID:876 -
\??\c:\pjjdd.exec:\pjjdd.exe34⤵
- Executes dropped EXE
PID:224 -
\??\c:\lxxrxxx.exec:\lxxrxxx.exe35⤵
- Executes dropped EXE
PID:4684 -
\??\c:\xrfflff.exec:\xrfflff.exe36⤵
- Executes dropped EXE
PID:3020 -
\??\c:\1jvvd.exec:\1jvvd.exe37⤵
- Executes dropped EXE
PID:1880 -
\??\c:\7fllllf.exec:\7fllllf.exe38⤵
- Executes dropped EXE
PID:4864 -
\??\c:\btbbbn.exec:\btbbbn.exe39⤵
- Executes dropped EXE
PID:4680 -
\??\c:\vjjjp.exec:\vjjjp.exe40⤵
- Executes dropped EXE
PID:3904 -
\??\c:\lfxlrrf.exec:\lfxlrrf.exe41⤵
- Executes dropped EXE
PID:3316 -
\??\c:\hhntbh.exec:\hhntbh.exe42⤵
- Executes dropped EXE
PID:3888 -
\??\c:\pvjpv.exec:\pvjpv.exe43⤵
- Executes dropped EXE
PID:4840 -
\??\c:\flffrxl.exec:\flffrxl.exe44⤵
- Executes dropped EXE
PID:4992 -
\??\c:\llfxflr.exec:\llfxflr.exe45⤵
- Executes dropped EXE
PID:4304 -
\??\c:\ddddj.exec:\ddddj.exe46⤵
- Executes dropped EXE
PID:1420 -
\??\c:\frlrflx.exec:\frlrflx.exe47⤵
- Executes dropped EXE
PID:1128 -
\??\c:\jdpvd.exec:\jdpvd.exe48⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ppjvd.exec:\ppjvd.exe49⤵
- Executes dropped EXE
PID:4556 -
\??\c:\5fxfxxx.exec:\5fxfxxx.exe50⤵
- Executes dropped EXE
PID:4436 -
\??\c:\tttttb.exec:\tttttb.exe51⤵
- Executes dropped EXE
PID:5108 -
\??\c:\llfrxxf.exec:\llfrxxf.exe52⤵
- Executes dropped EXE
PID:4720 -
\??\c:\bbhhbb.exec:\bbhhbb.exe53⤵
- Executes dropped EXE
PID:4672 -
\??\c:\dpdpd.exec:\dpdpd.exe54⤵
- Executes dropped EXE
PID:5080 -
\??\c:\frrlxrr.exec:\frrlxrr.exe55⤵
- Executes dropped EXE
PID:4448 -
\??\c:\hbhhbh.exec:\hbhhbh.exe56⤵
- Executes dropped EXE
PID:4080 -
\??\c:\vdpdj.exec:\vdpdj.exe57⤵
- Executes dropped EXE
PID:676 -
\??\c:\ffllrxx.exec:\ffllrxx.exe58⤵
- Executes dropped EXE
PID:3552 -
\??\c:\tnhhhh.exec:\tnhhhh.exe59⤵
- Executes dropped EXE
PID:4560 -
\??\c:\vjvpd.exec:\vjvpd.exe60⤵
- Executes dropped EXE
PID:396 -
\??\c:\fxxxxff.exec:\fxxxxff.exe61⤵
- Executes dropped EXE
PID:1112 -
\??\c:\bnbhhb.exec:\bnbhhb.exe62⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ddvvd.exec:\ddvvd.exe63⤵
- Executes dropped EXE
PID:64 -
\??\c:\9lxxxlr.exec:\9lxxxlr.exe64⤵
- Executes dropped EXE
PID:4824 -
\??\c:\nnbbbb.exec:\nnbbbb.exe65⤵
- Executes dropped EXE
PID:3484 -
\??\c:\1djjj.exec:\1djjj.exe66⤵PID:3332
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe67⤵PID:3264
-
\??\c:\5httbt.exec:\5httbt.exe68⤵PID:3432
-
\??\c:\jjdpp.exec:\jjdpp.exe69⤵PID:1224
-
\??\c:\dvdvd.exec:\dvdvd.exe70⤵PID:5064
-
\??\c:\lflllll.exec:\lflllll.exe71⤵PID:1316
-
\??\c:\tbntbn.exec:\tbntbn.exe72⤵PID:2020
-
\??\c:\jjjjp.exec:\jjjjp.exe73⤵PID:4524
-
\??\c:\xxffxxx.exec:\xxffxxx.exe74⤵PID:4744
-
\??\c:\hbntth.exec:\hbntth.exe75⤵PID:532
-
\??\c:\rrrrrlf.exec:\rrrrrlf.exe76⤵PID:2244
-
\??\c:\9tbthb.exec:\9tbthb.exe77⤵PID:1708
-
\??\c:\vvjdj.exec:\vvjdj.exe78⤵PID:852
-
\??\c:\rxfllrr.exec:\rxfllrr.exe79⤵PID:220
-
\??\c:\hbbbhn.exec:\hbbbhn.exe80⤵PID:2324
-
\??\c:\vvvvj.exec:\vvvvj.exe81⤵PID:3536
-
\??\c:\frlxlxl.exec:\frlxlxl.exe82⤵PID:2732
-
\??\c:\htbhhn.exec:\htbhhn.exe83⤵PID:1560
-
\??\c:\pjvdj.exec:\pjvdj.exe84⤵PID:1472
-
\??\c:\ppdjp.exec:\ppdjp.exe85⤵PID:3416
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe86⤵PID:2724
-
\??\c:\hntntn.exec:\hntntn.exe87⤵PID:4480
-
\??\c:\7ppdj.exec:\7ppdj.exe88⤵PID:1984
-
\??\c:\vdjvp.exec:\vdjvp.exe89⤵PID:4804
-
\??\c:\fflrxfl.exec:\fflrxfl.exe90⤵PID:1140
-
\??\c:\1ttbbn.exec:\1ttbbn.exe91⤵PID:4728
-
\??\c:\9jpvv.exec:\9jpvv.exe92⤵PID:2328
-
\??\c:\5xlrxrx.exec:\5xlrxrx.exe93⤵PID:2468
-
\??\c:\tntbtb.exec:\tntbtb.exe94⤵PID:1536
-
\??\c:\dpvvd.exec:\dpvvd.exe95⤵PID:3796
-
\??\c:\llrllfx.exec:\llrllfx.exe96⤵PID:2448
-
\??\c:\thttbh.exec:\thttbh.exe97⤵PID:1584
-
\??\c:\dvdjp.exec:\dvdjp.exe98⤵PID:1664
-
\??\c:\rfxfrxf.exec:\rfxfrxf.exe99⤵PID:4796
-
\??\c:\nnbhhn.exec:\nnbhhn.exe100⤵PID:752
-
\??\c:\vdpvv.exec:\vdpvv.exe101⤵PID:4424
-
\??\c:\3ffrlrf.exec:\3ffrlrf.exe102⤵PID:1108
-
\??\c:\hbhntt.exec:\hbhntt.exe103⤵PID:3944
-
\??\c:\1frxfrr.exec:\1frxfrr.exe104⤵PID:3728
-
\??\c:\xrrxxfl.exec:\xrrxxfl.exe105⤵PID:1504
-
\??\c:\hbhhbb.exec:\hbhhbb.exe106⤵
- System Location Discovery: System Language Discovery
PID:5020 -
\??\c:\pvjjp.exec:\pvjjp.exe107⤵PID:4832
-
\??\c:\llflrfr.exec:\llflrfr.exe108⤵PID:4840
-
\??\c:\jdjdv.exec:\jdjdv.exe109⤵PID:364
-
\??\c:\djpvv.exec:\djpvv.exe110⤵PID:4304
-
\??\c:\xfrrxfl.exec:\xfrrxfl.exe111⤵PID:1420
-
\??\c:\ttthnh.exec:\ttthnh.exe112⤵PID:1128
-
\??\c:\3pvvp.exec:\3pvvp.exe113⤵PID:4396
-
\??\c:\xxfffrr.exec:\xxfffrr.exe114⤵PID:1372
-
\??\c:\1hnnnt.exec:\1hnnnt.exe115⤵PID:1528
-
\??\c:\vvjdd.exec:\vvjdd.exe116⤵PID:2068
-
\??\c:\xfflrrr.exec:\xfflrrr.exe117⤵PID:4788
-
\??\c:\vppdp.exec:\vppdp.exe118⤵PID:4360
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe119⤵PID:4816
-
\??\c:\hhthtn.exec:\hhthtn.exe120⤵PID:2088
-
\??\c:\pvdjp.exec:\pvdjp.exe121⤵PID:3376
-
\??\c:\vjvpp.exec:\vjvpp.exe122⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-