Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 10:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18092830742bb1ad4cb10e8a711b545d10c3736790c2548d5f8625c02b6984e5.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
18092830742bb1ad4cb10e8a711b545d10c3736790c2548d5f8625c02b6984e5.exe
-
Size
456KB
-
MD5
918d744d88bbe0f870f02a270f9a45aa
-
SHA1
e8a0a79d9ecaa01e56032fb1b827108cd6a0b32d
-
SHA256
18092830742bb1ad4cb10e8a711b545d10c3736790c2548d5f8625c02b6984e5
-
SHA512
f6bec7fd3459d6bee304cf16b1c9cc6bae5de1733a5c033e4276f845a79adb75926beac5b12e9ab1bd4f909303c6426c27ccafcf6c054ec33bbdaa1555981c39
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRS:q7Tc2NYHUrAwfMp3CDRS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3392-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-915-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-1033-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-1402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 880 7dvdv.exe 3280 rrllrrl.exe 3592 bnbbbb.exe 4856 ppvdd.exe 4468 1rxffrr.exe 2832 fxrxxfx.exe 1660 bbnntt.exe 916 dpddv.exe 3364 lrlxrrr.exe 1216 9tbbtn.exe 3164 dddvv.exe 4380 dpddd.exe 748 3rfxrff.exe 1052 jddjd.exe 3608 tbnhhh.exe 3556 tnbbhn.exe 4232 djddp.exe 5100 tthhhn.exe 3484 nbhntt.exe 2272 tnbbbh.exe 1712 9vjjj.exe 2692 5htnhh.exe 3708 pjvjp.exe 1364 btnttb.exe 4928 pvjpd.exe 2248 ffrfrxx.exe 5088 xrfllrr.exe 3284 djddd.exe 3028 ppdpv.exe 3932 pdjpd.exe 2776 hhnhhb.exe 1540 ttbhhh.exe 4160 lfrlrrx.exe 4900 bhhbth.exe 4944 dvjdd.exe 1648 fffffxl.exe 912 hhttnt.exe 2524 xxxrfll.exe 3272 hhnhhh.exe 1456 nhtthn.exe 4248 rfrrlll.exe 2116 hbhbtt.exe 4964 dddpj.exe 4108 hnbtbt.exe 5076 dpvpj.exe 2752 flxlffr.exe 64 5fllllr.exe 3080 tntttt.exe 812 jdppv.exe 4104 9pvvv.exe 3616 rrrxxfl.exe 4352 thnhtn.exe 4356 ppjpj.exe 4832 xxrxflf.exe 3780 7bbnhh.exe 4904 djdpd.exe 3312 fxlfxxx.exe 4856 nhnbtn.exe 1496 3pjdd.exe 4680 xffxrfx.exe 2684 nbtnnn.exe 1660 9pdpv.exe 2480 xxxfrxr.exe 3740 htbbbh.exe -
resource yara_rule behavioral2/memory/3392-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-788-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3392 wrote to memory of 880 3392 18092830742bb1ad4cb10e8a711b545d10c3736790c2548d5f8625c02b6984e5.exe 82 PID 3392 wrote to memory of 880 3392 18092830742bb1ad4cb10e8a711b545d10c3736790c2548d5f8625c02b6984e5.exe 82 PID 3392 wrote to memory of 880 3392 18092830742bb1ad4cb10e8a711b545d10c3736790c2548d5f8625c02b6984e5.exe 82 PID 880 wrote to memory of 3280 880 7dvdv.exe 83 PID 880 wrote to memory of 3280 880 7dvdv.exe 83 PID 880 wrote to memory of 3280 880 7dvdv.exe 83 PID 3280 wrote to memory of 3592 3280 rrllrrl.exe 84 PID 3280 wrote to memory of 3592 3280 rrllrrl.exe 84 PID 3280 wrote to memory of 3592 3280 rrllrrl.exe 84 PID 3592 wrote to memory of 4856 3592 bnbbbb.exe 85 PID 3592 wrote to memory of 4856 3592 bnbbbb.exe 85 PID 3592 wrote to memory of 4856 3592 bnbbbb.exe 85 PID 4856 wrote to memory of 4468 4856 ppvdd.exe 86 PID 4856 wrote to memory of 4468 4856 ppvdd.exe 86 PID 4856 wrote to memory of 4468 4856 ppvdd.exe 86 PID 4468 wrote to memory of 2832 4468 1rxffrr.exe 87 PID 4468 wrote to memory of 2832 4468 1rxffrr.exe 87 PID 4468 wrote to memory of 2832 4468 1rxffrr.exe 87 PID 2832 wrote to memory of 1660 2832 fxrxxfx.exe 88 PID 2832 wrote to memory of 1660 2832 fxrxxfx.exe 88 PID 2832 wrote to memory of 1660 2832 fxrxxfx.exe 88 PID 1660 wrote to memory of 916 1660 bbnntt.exe 89 PID 1660 wrote to memory of 916 1660 bbnntt.exe 89 PID 1660 wrote to memory of 916 1660 bbnntt.exe 89 PID 916 wrote to memory of 3364 916 dpddv.exe 90 PID 916 wrote to memory of 3364 916 dpddv.exe 90 PID 916 wrote to memory of 3364 916 dpddv.exe 90 PID 3364 wrote to memory of 1216 3364 lrlxrrr.exe 91 PID 3364 wrote to memory of 1216 3364 lrlxrrr.exe 91 PID 3364 wrote to memory of 1216 3364 lrlxrrr.exe 91 PID 1216 wrote to memory of 3164 1216 9tbbtn.exe 92 PID 1216 wrote to memory of 3164 1216 9tbbtn.exe 92 PID 1216 wrote to memory of 3164 1216 9tbbtn.exe 92 PID 3164 wrote to memory of 4380 3164 dddvv.exe 93 PID 3164 wrote to memory of 4380 3164 dddvv.exe 93 PID 3164 wrote to memory of 4380 3164 dddvv.exe 93 PID 4380 wrote to memory of 748 4380 dpddd.exe 94 PID 4380 wrote to memory of 748 4380 dpddd.exe 94 PID 4380 wrote to memory of 748 4380 dpddd.exe 94 PID 748 wrote to memory of 1052 748 3rfxrff.exe 95 PID 748 wrote to memory of 1052 748 3rfxrff.exe 95 PID 748 wrote to memory of 1052 748 3rfxrff.exe 95 PID 1052 wrote to memory of 3608 1052 jddjd.exe 96 PID 1052 wrote to memory of 3608 1052 jddjd.exe 96 PID 1052 wrote to memory of 3608 1052 jddjd.exe 96 PID 3608 wrote to memory of 3556 3608 tbnhhh.exe 97 PID 3608 wrote to memory of 3556 3608 tbnhhh.exe 97 PID 3608 wrote to memory of 3556 3608 tbnhhh.exe 97 PID 3556 wrote to memory of 4232 3556 tnbbhn.exe 98 PID 3556 wrote to memory of 4232 3556 tnbbhn.exe 98 PID 3556 wrote to memory of 4232 3556 tnbbhn.exe 98 PID 4232 wrote to memory of 5100 4232 djddp.exe 99 PID 4232 wrote to memory of 5100 4232 djddp.exe 99 PID 4232 wrote to memory of 5100 4232 djddp.exe 99 PID 5100 wrote to memory of 3484 5100 tthhhn.exe 100 PID 5100 wrote to memory of 3484 5100 tthhhn.exe 100 PID 5100 wrote to memory of 3484 5100 tthhhn.exe 100 PID 3484 wrote to memory of 2272 3484 nbhntt.exe 101 PID 3484 wrote to memory of 2272 3484 nbhntt.exe 101 PID 3484 wrote to memory of 2272 3484 nbhntt.exe 101 PID 2272 wrote to memory of 1712 2272 tnbbbh.exe 102 PID 2272 wrote to memory of 1712 2272 tnbbbh.exe 102 PID 2272 wrote to memory of 1712 2272 tnbbbh.exe 102 PID 1712 wrote to memory of 2692 1712 9vjjj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\18092830742bb1ad4cb10e8a711b545d10c3736790c2548d5f8625c02b6984e5.exe"C:\Users\Admin\AppData\Local\Temp\18092830742bb1ad4cb10e8a711b545d10c3736790c2548d5f8625c02b6984e5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\7dvdv.exec:\7dvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\rrllrrl.exec:\rrllrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\bnbbbb.exec:\bnbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\ppvdd.exec:\ppvdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\1rxffrr.exec:\1rxffrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\fxrxxfx.exec:\fxrxxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\bbnntt.exec:\bbnntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\dpddv.exec:\dpddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\lrlxrrr.exec:\lrlxrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\9tbbtn.exec:\9tbbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\dddvv.exec:\dddvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\dpddd.exec:\dpddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\3rfxrff.exec:\3rfxrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\jddjd.exec:\jddjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\tbnhhh.exec:\tbnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\tnbbhn.exec:\tnbbhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\djddp.exec:\djddp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\tthhhn.exec:\tthhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\nbhntt.exec:\nbhntt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\tnbbbh.exec:\tnbbbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\9vjjj.exec:\9vjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\5htnhh.exec:\5htnhh.exe23⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pjvjp.exec:\pjvjp.exe24⤵
- Executes dropped EXE
PID:3708 -
\??\c:\btnttb.exec:\btnttb.exe25⤵
- Executes dropped EXE
PID:1364 -
\??\c:\pvjpd.exec:\pvjpd.exe26⤵
- Executes dropped EXE
PID:4928 -
\??\c:\ffrfrxx.exec:\ffrfrxx.exe27⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xrfllrr.exec:\xrfllrr.exe28⤵
- Executes dropped EXE
PID:5088 -
\??\c:\djddd.exec:\djddd.exe29⤵
- Executes dropped EXE
PID:3284 -
\??\c:\ppdpv.exec:\ppdpv.exe30⤵
- Executes dropped EXE
PID:3028 -
\??\c:\pdjpd.exec:\pdjpd.exe31⤵
- Executes dropped EXE
PID:3932 -
\??\c:\hhnhhb.exec:\hhnhhb.exe32⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ttbhhh.exec:\ttbhhh.exe33⤵
- Executes dropped EXE
PID:1540 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe34⤵
- Executes dropped EXE
PID:4160 -
\??\c:\bhhbth.exec:\bhhbth.exe35⤵
- Executes dropped EXE
PID:4900 -
\??\c:\dvjdd.exec:\dvjdd.exe36⤵
- Executes dropped EXE
PID:4944 -
\??\c:\fffffxl.exec:\fffffxl.exe37⤵
- Executes dropped EXE
PID:1648 -
\??\c:\hhttnt.exec:\hhttnt.exe38⤵
- Executes dropped EXE
PID:912 -
\??\c:\xxxrfll.exec:\xxxrfll.exe39⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hhnhhh.exec:\hhnhhh.exe40⤵
- Executes dropped EXE
PID:3272 -
\??\c:\nhtthn.exec:\nhtthn.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1456 -
\??\c:\rfrrlll.exec:\rfrrlll.exe42⤵
- Executes dropped EXE
PID:4248 -
\??\c:\hbhbtt.exec:\hbhbtt.exe43⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dddpj.exec:\dddpj.exe44⤵
- Executes dropped EXE
PID:4964 -
\??\c:\hnbtbt.exec:\hnbtbt.exe45⤵
- Executes dropped EXE
PID:4108 -
\??\c:\dpvpj.exec:\dpvpj.exe46⤵
- Executes dropped EXE
PID:5076 -
\??\c:\flxlffr.exec:\flxlffr.exe47⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5fllllr.exec:\5fllllr.exe48⤵
- Executes dropped EXE
PID:64 -
\??\c:\tntttt.exec:\tntttt.exe49⤵
- Executes dropped EXE
PID:3080 -
\??\c:\jdppv.exec:\jdppv.exe50⤵
- Executes dropped EXE
PID:812 -
\??\c:\9pvvv.exec:\9pvvv.exe51⤵
- Executes dropped EXE
PID:4104 -
\??\c:\rrrxxfl.exec:\rrrxxfl.exe52⤵
- Executes dropped EXE
PID:3616 -
\??\c:\thnhtn.exec:\thnhtn.exe53⤵
- Executes dropped EXE
PID:4352 -
\??\c:\ppjpj.exec:\ppjpj.exe54⤵
- Executes dropped EXE
PID:4356 -
\??\c:\xxrxflf.exec:\xxrxflf.exe55⤵
- Executes dropped EXE
PID:4832 -
\??\c:\7bbnhh.exec:\7bbnhh.exe56⤵
- Executes dropped EXE
PID:3780 -
\??\c:\djdpd.exec:\djdpd.exe57⤵
- Executes dropped EXE
PID:4904 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe58⤵
- Executes dropped EXE
PID:3312 -
\??\c:\nhnbtn.exec:\nhnbtn.exe59⤵
- Executes dropped EXE
PID:4856 -
\??\c:\3pjdd.exec:\3pjdd.exe60⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xffxrfx.exec:\xffxrfx.exe61⤵
- Executes dropped EXE
PID:4680 -
\??\c:\nbtnnn.exec:\nbtnnn.exe62⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9pdpv.exec:\9pdpv.exe63⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xxxfrxr.exec:\xxxfrxr.exe64⤵
- Executes dropped EXE
PID:2480 -
\??\c:\htbbbh.exec:\htbbbh.exe65⤵
- Executes dropped EXE
PID:3740 -
\??\c:\pvddd.exec:\pvddd.exe66⤵PID:2544
-
\??\c:\dvvvp.exec:\dvvvp.exe67⤵PID:4524
-
\??\c:\lrfxrxr.exec:\lrfxrxr.exe68⤵PID:3228
-
\??\c:\hhhhbt.exec:\hhhhbt.exe69⤵PID:1264
-
\??\c:\dpppp.exec:\dpppp.exe70⤵PID:736
-
\??\c:\lrlffff.exec:\lrlffff.exe71⤵PID:5060
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe72⤵PID:4380
-
\??\c:\tthhnn.exec:\tthhnn.exe73⤵PID:748
-
\??\c:\jvvvv.exec:\jvvvv.exe74⤵PID:2408
-
\??\c:\rrrxffl.exec:\rrrxffl.exe75⤵PID:2520
-
\??\c:\nthhnn.exec:\nthhnn.exe76⤵PID:4784
-
\??\c:\vdpjj.exec:\vdpjj.exe77⤵PID:4420
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe78⤵PID:2620
-
\??\c:\tnbbbb.exec:\tnbbbb.exe79⤵PID:2320
-
\??\c:\nnnhnb.exec:\nnnhnb.exe80⤵PID:3260
-
\??\c:\vvpjd.exec:\vvpjd.exe81⤵PID:452
-
\??\c:\3rxxflr.exec:\3rxxflr.exe82⤵PID:1012
-
\??\c:\hnnnhn.exec:\hnnnhn.exe83⤵PID:3492
-
\??\c:\pdjdv.exec:\pdjdv.exe84⤵PID:1336
-
\??\c:\rlfffrr.exec:\rlfffrr.exe85⤵PID:1640
-
\??\c:\7xlfrrl.exec:\7xlfrrl.exe86⤵PID:1696
-
\??\c:\djppp.exec:\djppp.exe87⤵PID:2692
-
\??\c:\jdjjj.exec:\jdjjj.exe88⤵PID:1372
-
\??\c:\tttttt.exec:\tttttt.exe89⤵PID:1596
-
\??\c:\bbbthh.exec:\bbbthh.exe90⤵PID:4412
-
\??\c:\vpjdd.exec:\vpjdd.exe91⤵PID:2748
-
\??\c:\xrfflll.exec:\xrfflll.exe92⤵PID:2248
-
\??\c:\ttbnhn.exec:\ttbnhn.exe93⤵PID:4752
-
\??\c:\1vdpj.exec:\1vdpj.exe94⤵PID:1300
-
\??\c:\vpjjj.exec:\vpjjj.exe95⤵PID:2108
-
\??\c:\xrfffll.exec:\xrfffll.exe96⤵PID:4336
-
\??\c:\hbtnnn.exec:\hbtnnn.exe97⤵PID:1932
-
\??\c:\pdjjd.exec:\pdjjd.exe98⤵PID:3932
-
\??\c:\1xxxxxx.exec:\1xxxxxx.exe99⤵PID:2776
-
\??\c:\flxfrxr.exec:\flxfrxr.exe100⤵PID:4612
-
\??\c:\thtttt.exec:\thtttt.exe101⤵PID:4160
-
\??\c:\vdjdv.exec:\vdjdv.exe102⤵PID:4852
-
\??\c:\xlrrllf.exec:\xlrrllf.exe103⤵PID:1852
-
\??\c:\tnhhbb.exec:\tnhhbb.exe104⤵PID:4176
-
\??\c:\bbttht.exec:\bbttht.exe105⤵PID:3112
-
\??\c:\xxrrlll.exec:\xxrrlll.exe106⤵PID:4820
-
\??\c:\bbbbbh.exec:\bbbbbh.exe107⤵PID:4756
-
\??\c:\pdppp.exec:\pdppp.exe108⤵PID:1456
-
\??\c:\frlrxxl.exec:\frlrxxl.exe109⤵PID:560
-
\??\c:\bhnnhn.exec:\bhnnhn.exe110⤵PID:3736
-
\??\c:\bbtthn.exec:\bbtthn.exe111⤵PID:2736
-
\??\c:\5vvdd.exec:\5vvdd.exe112⤵PID:4292
-
\??\c:\bhhbtt.exec:\bhhbtt.exe113⤵PID:4020
-
\??\c:\3bbttt.exec:\3bbttt.exe114⤵PID:3692
-
\??\c:\dvvdv.exec:\dvvdv.exe115⤵PID:64
-
\??\c:\llllxfx.exec:\llllxfx.exe116⤵PID:3080
-
\??\c:\xrxxrxl.exec:\xrxxrxl.exe117⤵PID:2564
-
\??\c:\btnnnn.exec:\btnnnn.exe118⤵PID:1060
-
\??\c:\pjpjj.exec:\pjpjj.exe119⤵PID:3964
-
\??\c:\rflllrr.exec:\rflllrr.exe120⤵PID:4312
-
\??\c:\bnhbtt.exec:\bnhbtt.exe121⤵PID:2968
-
\??\c:\dpvjj.exec:\dpvjj.exe122⤵PID:636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-