Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 11:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6901b86fb721321b96919f312944c780d87e42ff1ecf57b35ee27d1e658e75eN.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
f6901b86fb721321b96919f312944c780d87e42ff1ecf57b35ee27d1e658e75eN.exe
-
Size
454KB
-
MD5
4199fd9b20f9a67d12e118bb6b64ef40
-
SHA1
dca17d18d9691bcdb5f81003c3e74e65bb3922a3
-
SHA256
f6901b86fb721321b96919f312944c780d87e42ff1ecf57b35ee27d1e658e75e
-
SHA512
b5728d9ba239d4cab5a6c8eb2ecbc8e5b2903af9decbb5523bf5f34835d3dbcffd1d06a0d245f640ad1922649f6fe5a9fdb630784c3f224987b5d2ced6498577
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1F:q7Tc2NYHUrAwfMp3CD1F
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1656-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/904-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/900-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-939-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-1316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-1905-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1600 ppddv.exe 4960 fxxrllf.exe 4912 7hhhnt.exe 3356 jdjjp.exe 3952 ffrxrxl.exe 3552 nnhhhn.exe 1168 lxxrllr.exe 4584 xlrrllf.exe 2884 rrlxrfr.exe 1920 jjpjj.exe 1092 tnnnhh.exe 1136 vvvpp.exe 1328 xfffxxr.exe 3020 dpvjp.exe 220 xlfxrxr.exe 4852 vvpjj.exe 2796 xfrxxxx.exe 904 bhnhbb.exe 408 xxxrlfr.exe 2020 tthhhh.exe 708 vpjvp.exe 876 xxflfrr.exe 2736 dpvpp.exe 4132 lxffxxl.exe 4076 bbhhnt.exe 548 pvddj.exe 1284 bbnthn.exe 5016 rfxxfrl.exe 3864 pdppv.exe 3340 dvdjd.exe 4708 bbhbtb.exe 532 bbhbtt.exe 3472 flfflrx.exe 1596 ttttnn.exe 1480 dpddj.exe 2496 rflrlrr.exe 1748 vdvjd.exe 5068 xfxlrlx.exe 3828 ttttnn.exe 452 bhnbtt.exe 3836 9jpjj.exe 2212 hhhnbt.exe 4964 5hbbbb.exe 312 dvvvj.exe 1988 1pdvv.exe 3388 lrlrrxf.exe 1404 ttntth.exe 5004 vpppj.exe 2192 fxlfrlr.exe 3860 nnnhhb.exe 380 9jppv.exe 4476 rlrlffx.exe 900 nbhnbb.exe 4776 pjvpv.exe 2216 fffxrxr.exe 4620 nbhhhh.exe 4292 vdjjj.exe 4896 7llxllr.exe 3500 bhnhhb.exe 3868 vvvdv.exe 3612 9xxrfxf.exe 3552 nhhbtn.exe 3592 7bbbhh.exe 3092 vvvjd.exe -
resource yara_rule behavioral2/memory/1656-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/904-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-772-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1600 1656 f6901b86fb721321b96919f312944c780d87e42ff1ecf57b35ee27d1e658e75eN.exe 81 PID 1656 wrote to memory of 1600 1656 f6901b86fb721321b96919f312944c780d87e42ff1ecf57b35ee27d1e658e75eN.exe 81 PID 1656 wrote to memory of 1600 1656 f6901b86fb721321b96919f312944c780d87e42ff1ecf57b35ee27d1e658e75eN.exe 81 PID 1600 wrote to memory of 4960 1600 ppddv.exe 82 PID 1600 wrote to memory of 4960 1600 ppddv.exe 82 PID 1600 wrote to memory of 4960 1600 ppddv.exe 82 PID 4960 wrote to memory of 4912 4960 fxxrllf.exe 83 PID 4960 wrote to memory of 4912 4960 fxxrllf.exe 83 PID 4960 wrote to memory of 4912 4960 fxxrllf.exe 83 PID 4912 wrote to memory of 3356 4912 7hhhnt.exe 84 PID 4912 wrote to memory of 3356 4912 7hhhnt.exe 84 PID 4912 wrote to memory of 3356 4912 7hhhnt.exe 84 PID 3356 wrote to memory of 3952 3356 jdjjp.exe 85 PID 3356 wrote to memory of 3952 3356 jdjjp.exe 85 PID 3356 wrote to memory of 3952 3356 jdjjp.exe 85 PID 3952 wrote to memory of 3552 3952 ffrxrxl.exe 86 PID 3952 wrote to memory of 3552 3952 ffrxrxl.exe 86 PID 3952 wrote to memory of 3552 3952 ffrxrxl.exe 86 PID 3552 wrote to memory of 1168 3552 nnhhhn.exe 87 PID 3552 wrote to memory of 1168 3552 nnhhhn.exe 87 PID 3552 wrote to memory of 1168 3552 nnhhhn.exe 87 PID 1168 wrote to memory of 4584 1168 lxxrllr.exe 88 PID 1168 wrote to memory of 4584 1168 lxxrllr.exe 88 PID 1168 wrote to memory of 4584 1168 lxxrllr.exe 88 PID 4584 wrote to memory of 2884 4584 xlrrllf.exe 89 PID 4584 wrote to memory of 2884 4584 xlrrllf.exe 89 PID 4584 wrote to memory of 2884 4584 xlrrllf.exe 89 PID 2884 wrote to memory of 1920 2884 rrlxrfr.exe 90 PID 2884 wrote to memory of 1920 2884 rrlxrfr.exe 90 PID 2884 wrote to memory of 1920 2884 rrlxrfr.exe 90 PID 1920 wrote to memory of 1092 1920 jjpjj.exe 91 PID 1920 wrote to memory of 1092 1920 jjpjj.exe 91 PID 1920 wrote to memory of 1092 1920 jjpjj.exe 91 PID 1092 wrote to memory of 1136 1092 tnnnhh.exe 92 PID 1092 wrote to memory of 1136 1092 tnnnhh.exe 92 PID 1092 wrote to memory of 1136 1092 tnnnhh.exe 92 PID 1136 wrote to memory of 1328 1136 vvvpp.exe 93 PID 1136 wrote to memory of 1328 1136 vvvpp.exe 93 PID 1136 wrote to memory of 1328 1136 vvvpp.exe 93 PID 1328 wrote to memory of 3020 1328 xfffxxr.exe 94 PID 1328 wrote to memory of 3020 1328 xfffxxr.exe 94 PID 1328 wrote to memory of 3020 1328 xfffxxr.exe 94 PID 3020 wrote to memory of 220 3020 dpvjp.exe 95 PID 3020 wrote to memory of 220 3020 dpvjp.exe 95 PID 3020 wrote to memory of 220 3020 dpvjp.exe 95 PID 220 wrote to memory of 4852 220 xlfxrxr.exe 96 PID 220 wrote to memory of 4852 220 xlfxrxr.exe 96 PID 220 wrote to memory of 4852 220 xlfxrxr.exe 96 PID 4852 wrote to memory of 2796 4852 vvpjj.exe 97 PID 4852 wrote to memory of 2796 4852 vvpjj.exe 97 PID 4852 wrote to memory of 2796 4852 vvpjj.exe 97 PID 2796 wrote to memory of 904 2796 xfrxxxx.exe 98 PID 2796 wrote to memory of 904 2796 xfrxxxx.exe 98 PID 2796 wrote to memory of 904 2796 xfrxxxx.exe 98 PID 904 wrote to memory of 408 904 bhnhbb.exe 99 PID 904 wrote to memory of 408 904 bhnhbb.exe 99 PID 904 wrote to memory of 408 904 bhnhbb.exe 99 PID 408 wrote to memory of 2020 408 xxxrlfr.exe 100 PID 408 wrote to memory of 2020 408 xxxrlfr.exe 100 PID 408 wrote to memory of 2020 408 xxxrlfr.exe 100 PID 2020 wrote to memory of 708 2020 tthhhh.exe 101 PID 2020 wrote to memory of 708 2020 tthhhh.exe 101 PID 2020 wrote to memory of 708 2020 tthhhh.exe 101 PID 708 wrote to memory of 876 708 vpjvp.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6901b86fb721321b96919f312944c780d87e42ff1ecf57b35ee27d1e658e75eN.exe"C:\Users\Admin\AppData\Local\Temp\f6901b86fb721321b96919f312944c780d87e42ff1ecf57b35ee27d1e658e75eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\ppddv.exec:\ppddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\fxxrllf.exec:\fxxrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\7hhhnt.exec:\7hhhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\jdjjp.exec:\jdjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\ffrxrxl.exec:\ffrxrxl.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\nnhhhn.exec:\nnhhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\lxxrllr.exec:\lxxrllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\xlrrllf.exec:\xlrrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\rrlxrfr.exec:\rrlxrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\jjpjj.exec:\jjpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\tnnnhh.exec:\tnnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\vvvpp.exec:\vvvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\xfffxxr.exec:\xfffxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\dpvjp.exec:\dpvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xlfxrxr.exec:\xlfxrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\vvpjj.exec:\vvpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\xfrxxxx.exec:\xfrxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bhnhbb.exec:\bhnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\xxxrlfr.exec:\xxxrlfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\tthhhh.exec:\tthhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\vpjvp.exec:\vpjvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\xxflfrr.exec:\xxflfrr.exe23⤵
- Executes dropped EXE
PID:876 -
\??\c:\dpvpp.exec:\dpvpp.exe24⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lxffxxl.exec:\lxffxxl.exe25⤵
- Executes dropped EXE
PID:4132 -
\??\c:\bbhhnt.exec:\bbhhnt.exe26⤵
- Executes dropped EXE
PID:4076 -
\??\c:\pvddj.exec:\pvddj.exe27⤵
- Executes dropped EXE
PID:548 -
\??\c:\bbnthn.exec:\bbnthn.exe28⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rfxxfrl.exec:\rfxxfrl.exe29⤵
- Executes dropped EXE
PID:5016 -
\??\c:\pdppv.exec:\pdppv.exe30⤵
- Executes dropped EXE
PID:3864 -
\??\c:\dvdjd.exec:\dvdjd.exe31⤵
- Executes dropped EXE
PID:3340 -
\??\c:\bbhbtb.exec:\bbhbtb.exe32⤵
- Executes dropped EXE
PID:4708 -
\??\c:\bbhbtt.exec:\bbhbtt.exe33⤵
- Executes dropped EXE
PID:532 -
\??\c:\flfflrx.exec:\flfflrx.exe34⤵
- Executes dropped EXE
PID:3472 -
\??\c:\ttttnn.exec:\ttttnn.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dpddj.exec:\dpddj.exe36⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rflrlrr.exec:\rflrlrr.exe37⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vdvjd.exec:\vdvjd.exe38⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xfxlrlx.exec:\xfxlrlx.exe39⤵
- Executes dropped EXE
PID:5068 -
\??\c:\ttttnn.exec:\ttttnn.exe40⤵
- Executes dropped EXE
PID:3828 -
\??\c:\bhnbtt.exec:\bhnbtt.exe41⤵
- Executes dropped EXE
PID:452 -
\??\c:\9jpjj.exec:\9jpjj.exe42⤵
- Executes dropped EXE
PID:3836 -
\??\c:\hhhnbt.exec:\hhhnbt.exe43⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5hbbbb.exec:\5hbbbb.exe44⤵
- Executes dropped EXE
PID:4964 -
\??\c:\dvvvj.exec:\dvvvj.exe45⤵
- Executes dropped EXE
PID:312 -
\??\c:\1pdvv.exec:\1pdvv.exe46⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lrlrrxf.exec:\lrlrrxf.exe47⤵
- Executes dropped EXE
PID:3388 -
\??\c:\ttntth.exec:\ttntth.exe48⤵
- Executes dropped EXE
PID:1404 -
\??\c:\vpppj.exec:\vpppj.exe49⤵
- Executes dropped EXE
PID:5004 -
\??\c:\fxlfrlr.exec:\fxlfrlr.exe50⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nnnhhb.exec:\nnnhhb.exe51⤵
- Executes dropped EXE
PID:3860 -
\??\c:\9jppv.exec:\9jppv.exe52⤵
- Executes dropped EXE
PID:380 -
\??\c:\rlrlffx.exec:\rlrlffx.exe53⤵
- Executes dropped EXE
PID:4476 -
\??\c:\nbhnbb.exec:\nbhnbb.exe54⤵
- Executes dropped EXE
PID:900 -
\??\c:\pjvpv.exec:\pjvpv.exe55⤵
- Executes dropped EXE
PID:4776 -
\??\c:\fffxrxr.exec:\fffxrxr.exe56⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nbhhhh.exec:\nbhhhh.exe57⤵
- Executes dropped EXE
PID:4620 -
\??\c:\vdjjj.exec:\vdjjj.exe58⤵
- Executes dropped EXE
PID:4292 -
\??\c:\7llxllr.exec:\7llxllr.exe59⤵
- Executes dropped EXE
PID:4896 -
\??\c:\bhnhhb.exec:\bhnhhb.exe60⤵
- Executes dropped EXE
PID:3500 -
\??\c:\vvvdv.exec:\vvvdv.exe61⤵
- Executes dropped EXE
PID:3868 -
\??\c:\9xxrfxf.exec:\9xxrfxf.exe62⤵
- Executes dropped EXE
PID:3612 -
\??\c:\nhhbtn.exec:\nhhbtn.exe63⤵
- Executes dropped EXE
PID:3552 -
\??\c:\7bbbhh.exec:\7bbbhh.exe64⤵
- Executes dropped EXE
PID:3592 -
\??\c:\vvvjd.exec:\vvvjd.exe65⤵
- Executes dropped EXE
PID:3092 -
\??\c:\rffffff.exec:\rffffff.exe66⤵PID:4584
-
\??\c:\ttbthh.exec:\ttbthh.exe67⤵PID:3812
-
\??\c:\pddjv.exec:\pddjv.exe68⤵PID:4276
-
\??\c:\rlrrrll.exec:\rlrrrll.exe69⤵PID:1856
-
\??\c:\tnntbn.exec:\tnntbn.exe70⤵PID:444
-
\??\c:\tnhnht.exec:\tnhnht.exe71⤵PID:2544
-
\??\c:\3dvpj.exec:\3dvpj.exe72⤵PID:1136
-
\??\c:\frrlfrl.exec:\frrlfrl.exe73⤵PID:512
-
\??\c:\hhntht.exec:\hhntht.exe74⤵PID:3768
-
\??\c:\vvvjd.exec:\vvvjd.exe75⤵PID:3020
-
\??\c:\fxfrrfl.exec:\fxfrrfl.exe76⤵PID:2900
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe77⤵
- System Location Discovery: System Language Discovery
PID:2560 -
\??\c:\nbthtn.exec:\nbthtn.exe78⤵PID:1184
-
\??\c:\ppvpv.exec:\ppvpv.exe79⤵PID:3732
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe80⤵PID:796
-
\??\c:\btnhbn.exec:\btnhbn.exe81⤵PID:4168
-
\??\c:\9dppj.exec:\9dppj.exe82⤵PID:408
-
\??\c:\xfxlfrl.exec:\xfxlfrl.exe83⤵PID:2664
-
\??\c:\rlxffrr.exec:\rlxffrr.exe84⤵PID:3936
-
\??\c:\7tbttt.exec:\7tbttt.exe85⤵PID:1444
-
\??\c:\dvddd.exec:\dvddd.exe86⤵PID:2548
-
\??\c:\xllflll.exec:\xllflll.exe87⤵PID:2736
-
\??\c:\httttt.exec:\httttt.exe88⤵PID:5064
-
\??\c:\7pjjv.exec:\7pjjv.exe89⤵PID:3628
-
\??\c:\5rrrlff.exec:\5rrrlff.exe90⤵PID:4076
-
\??\c:\rllfffr.exec:\rllfffr.exe91⤵PID:368
-
\??\c:\nnbtbb.exec:\nnbtbb.exe92⤵PID:2992
-
\??\c:\ddjdd.exec:\ddjdd.exe93⤵PID:1284
-
\??\c:\lxrrlfr.exec:\lxrrlfr.exe94⤵PID:4568
-
\??\c:\1thbbb.exec:\1thbbb.exe95⤵PID:60
-
\??\c:\jjddj.exec:\jjddj.exe96⤵PID:748
-
\??\c:\vppjp.exec:\vppjp.exe97⤵PID:4988
-
\??\c:\frrlrfl.exec:\frrlrfl.exe98⤵PID:1456
-
\??\c:\hthbbb.exec:\hthbbb.exe99⤵PID:3196
-
\??\c:\1jjdv.exec:\1jjdv.exe100⤵PID:1912
-
\??\c:\flrfxrl.exec:\flrfxrl.exe101⤵PID:1724
-
\??\c:\btthnh.exec:\btthnh.exe102⤵PID:2248
-
\??\c:\jpdvp.exec:\jpdvp.exe103⤵PID:2200
-
\??\c:\lrllfxr.exec:\lrllfxr.exe104⤵
- System Location Discovery: System Language Discovery
PID:4316 -
\??\c:\htbtnh.exec:\htbtnh.exe105⤵PID:3944
-
\??\c:\9tnhtt.exec:\9tnhtt.exe106⤵PID:1032
-
\??\c:\3jjjd.exec:\3jjjd.exe107⤵PID:3032
-
\??\c:\lrrrlrl.exec:\lrrrlrl.exe108⤵
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\bbbbth.exec:\bbbbth.exe109⤵PID:3336
-
\??\c:\3jdvp.exec:\3jdvp.exe110⤵PID:244
-
\??\c:\rrllfll.exec:\rrllfll.exe111⤵PID:2832
-
\??\c:\tbbbtt.exec:\tbbbtt.exe112⤵PID:312
-
\??\c:\vpvvv.exec:\vpvvv.exe113⤵PID:4924
-
\??\c:\ffrflxr.exec:\ffrflxr.exe114⤵PID:3892
-
\??\c:\hbbbbt.exec:\hbbbbt.exe115⤵PID:4032
-
\??\c:\1jvvp.exec:\1jvvp.exe116⤵PID:1812
-
\??\c:\rlffrlf.exec:\rlffrlf.exe117⤵PID:1968
-
\??\c:\httttb.exec:\httttb.exe118⤵PID:912
-
\??\c:\jvddv.exec:\jvddv.exe119⤵PID:5060
-
\??\c:\jjpjv.exec:\jjpjv.exe120⤵PID:3928
-
\??\c:\fllxxrf.exec:\fllxxrf.exe121⤵PID:3024
-
\??\c:\5pvpd.exec:\5pvpd.exe122⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-