Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 20:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fed7038153472a430620c9ec5339988eaf8493153b48a6272b468e363fd85a7fN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
fed7038153472a430620c9ec5339988eaf8493153b48a6272b468e363fd85a7fN.exe
-
Size
200KB
-
MD5
c5b678a06eeaed38a35478094826a930
-
SHA1
2654c63c507c162466ec225f2fa63dbb7416c404
-
SHA256
fed7038153472a430620c9ec5339988eaf8493153b48a6272b468e363fd85a7f
-
SHA512
eb467063cc3252c28e6a164789df045a78c521091f61a3327867ed36fa0ab2f771ffad7675cadce966338d344e98dc6617342bb0baa1a348317e12dc57257987
-
SSDEEP
1536:1vQBeOGtrYSSsrc93UBIfdC67m6AJiqpfg3Cn/uiYs9oV:1hOm2sI93UufdC67ciyfmCnmiYNV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3284-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/896-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/820-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-1053-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-1147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-1322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-1707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-1900-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3480 ddpdp.exe 3340 jvddv.exe 2420 824404.exe 4712 dppvv.exe 1296 246866.exe 3788 4806066.exe 4660 pvjjd.exe 3128 606666.exe 4376 60086.exe 4520 044264.exe 2060 22482.exe 220 64260.exe 2840 864860.exe 5004 5xxfxrx.exe 896 3ntntt.exe 2692 68448.exe 1444 m2820.exe 2412 tbhbtn.exe 2068 7flxlfx.exe 3548 1ddvp.exe 1056 680866.exe 1012 a4682.exe 3524 62264.exe 1468 1nbttt.exe 3028 btthtt.exe 4728 2660402.exe 4332 600488.exe 3428 40826.exe 2528 86220.exe 5032 5xxrlll.exe 2824 vjjvj.exe 1044 nhbbnb.exe 756 q84268.exe 2632 62480.exe 460 g0668.exe 1708 46826.exe 3024 642200.exe 4312 bnbnbt.exe 3488 jjjpd.exe 1548 26826.exe 2312 228648.exe 4052 llfrlfr.exe 2248 nthbhb.exe 3804 2026042.exe 4652 462082.exe 1504 a6808.exe 2576 k46080.exe 5076 xlllfxl.exe 3004 bnhbnt.exe 376 q84226.exe 4552 nhtnhh.exe 2592 m4044.exe 3340 jdppj.exe 1160 82888.exe 8 06608.exe 3860 xfxlrfr.exe 3732 tnnnnn.exe 4188 jpjvp.exe 1376 0606462.exe 848 628206.exe 4664 lrrfrlx.exe 2832 3bhtnh.exe 516 5vpjv.exe 2820 hthbtn.exe -
resource yara_rule behavioral2/memory/3284-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/896-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/820-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06206.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88486.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0226660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 406660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3284 wrote to memory of 3480 3284 fed7038153472a430620c9ec5339988eaf8493153b48a6272b468e363fd85a7fN.exe 83 PID 3284 wrote to memory of 3480 3284 fed7038153472a430620c9ec5339988eaf8493153b48a6272b468e363fd85a7fN.exe 83 PID 3284 wrote to memory of 3480 3284 fed7038153472a430620c9ec5339988eaf8493153b48a6272b468e363fd85a7fN.exe 83 PID 3480 wrote to memory of 3340 3480 ddpdp.exe 84 PID 3480 wrote to memory of 3340 3480 ddpdp.exe 84 PID 3480 wrote to memory of 3340 3480 ddpdp.exe 84 PID 3340 wrote to memory of 2420 3340 jvddv.exe 85 PID 3340 wrote to memory of 2420 3340 jvddv.exe 85 PID 3340 wrote to memory of 2420 3340 jvddv.exe 85 PID 2420 wrote to memory of 4712 2420 824404.exe 86 PID 2420 wrote to memory of 4712 2420 824404.exe 86 PID 2420 wrote to memory of 4712 2420 824404.exe 86 PID 4712 wrote to memory of 1296 4712 dppvv.exe 87 PID 4712 wrote to memory of 1296 4712 dppvv.exe 87 PID 4712 wrote to memory of 1296 4712 dppvv.exe 87 PID 1296 wrote to memory of 3788 1296 246866.exe 88 PID 1296 wrote to memory of 3788 1296 246866.exe 88 PID 1296 wrote to memory of 3788 1296 246866.exe 88 PID 3788 wrote to memory of 4660 3788 4806066.exe 89 PID 3788 wrote to memory of 4660 3788 4806066.exe 89 PID 3788 wrote to memory of 4660 3788 4806066.exe 89 PID 4660 wrote to memory of 3128 4660 pvjjd.exe 90 PID 4660 wrote to memory of 3128 4660 pvjjd.exe 90 PID 4660 wrote to memory of 3128 4660 pvjjd.exe 90 PID 3128 wrote to memory of 4376 3128 606666.exe 91 PID 3128 wrote to memory of 4376 3128 606666.exe 91 PID 3128 wrote to memory of 4376 3128 606666.exe 91 PID 4376 wrote to memory of 4520 4376 60086.exe 92 PID 4376 wrote to memory of 4520 4376 60086.exe 92 PID 4376 wrote to memory of 4520 4376 60086.exe 92 PID 4520 wrote to memory of 2060 4520 044264.exe 93 PID 4520 wrote to memory of 2060 4520 044264.exe 93 PID 4520 wrote to memory of 2060 4520 044264.exe 93 PID 2060 wrote to memory of 220 2060 22482.exe 94 PID 2060 wrote to memory of 220 2060 22482.exe 94 PID 2060 wrote to memory of 220 2060 22482.exe 94 PID 220 wrote to memory of 2840 220 64260.exe 95 PID 220 wrote to memory of 2840 220 64260.exe 95 PID 220 wrote to memory of 2840 220 64260.exe 95 PID 2840 wrote to memory of 5004 2840 864860.exe 96 PID 2840 wrote to memory of 5004 2840 864860.exe 96 PID 2840 wrote to memory of 5004 2840 864860.exe 96 PID 5004 wrote to memory of 896 5004 5xxfxrx.exe 97 PID 5004 wrote to memory of 896 5004 5xxfxrx.exe 97 PID 5004 wrote to memory of 896 5004 5xxfxrx.exe 97 PID 896 wrote to memory of 2692 896 3ntntt.exe 98 PID 896 wrote to memory of 2692 896 3ntntt.exe 98 PID 896 wrote to memory of 2692 896 3ntntt.exe 98 PID 2692 wrote to memory of 1444 2692 68448.exe 99 PID 2692 wrote to memory of 1444 2692 68448.exe 99 PID 2692 wrote to memory of 1444 2692 68448.exe 99 PID 1444 wrote to memory of 2412 1444 m2820.exe 100 PID 1444 wrote to memory of 2412 1444 m2820.exe 100 PID 1444 wrote to memory of 2412 1444 m2820.exe 100 PID 2412 wrote to memory of 2068 2412 tbhbtn.exe 101 PID 2412 wrote to memory of 2068 2412 tbhbtn.exe 101 PID 2412 wrote to memory of 2068 2412 tbhbtn.exe 101 PID 2068 wrote to memory of 3548 2068 7flxlfx.exe 102 PID 2068 wrote to memory of 3548 2068 7flxlfx.exe 102 PID 2068 wrote to memory of 3548 2068 7flxlfx.exe 102 PID 3548 wrote to memory of 1056 3548 1ddvp.exe 103 PID 3548 wrote to memory of 1056 3548 1ddvp.exe 103 PID 3548 wrote to memory of 1056 3548 1ddvp.exe 103 PID 1056 wrote to memory of 1012 1056 680866.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\fed7038153472a430620c9ec5339988eaf8493153b48a6272b468e363fd85a7fN.exe"C:\Users\Admin\AppData\Local\Temp\fed7038153472a430620c9ec5339988eaf8493153b48a6272b468e363fd85a7fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\ddpdp.exec:\ddpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\jvddv.exec:\jvddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\824404.exec:\824404.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\dppvv.exec:\dppvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\246866.exec:\246866.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\4806066.exec:\4806066.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\pvjjd.exec:\pvjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\606666.exec:\606666.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\60086.exec:\60086.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\044264.exec:\044264.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\22482.exec:\22482.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\64260.exec:\64260.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\864860.exec:\864860.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\5xxfxrx.exec:\5xxfxrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\3ntntt.exec:\3ntntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\68448.exec:\68448.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\m2820.exec:\m2820.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\tbhbtn.exec:\tbhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\7flxlfx.exec:\7flxlfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\1ddvp.exec:\1ddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\680866.exec:\680866.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\a4682.exec:\a4682.exe23⤵
- Executes dropped EXE
PID:1012 -
\??\c:\62264.exec:\62264.exe24⤵
- Executes dropped EXE
PID:3524 -
\??\c:\1nbttt.exec:\1nbttt.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\btthtt.exec:\btthtt.exe26⤵
- Executes dropped EXE
PID:3028 -
\??\c:\2660402.exec:\2660402.exe27⤵
- Executes dropped EXE
PID:4728 -
\??\c:\600488.exec:\600488.exe28⤵
- Executes dropped EXE
PID:4332 -
\??\c:\40826.exec:\40826.exe29⤵
- Executes dropped EXE
PID:3428 -
\??\c:\86220.exec:\86220.exe30⤵
- Executes dropped EXE
PID:2528 -
\??\c:\5xxrlll.exec:\5xxrlll.exe31⤵
- Executes dropped EXE
PID:5032 -
\??\c:\vjjvj.exec:\vjjvj.exe32⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nhbbnb.exec:\nhbbnb.exe33⤵
- Executes dropped EXE
PID:1044 -
\??\c:\q84268.exec:\q84268.exe34⤵
- Executes dropped EXE
PID:756 -
\??\c:\62480.exec:\62480.exe35⤵
- Executes dropped EXE
PID:2632 -
\??\c:\g0668.exec:\g0668.exe36⤵
- Executes dropped EXE
PID:460 -
\??\c:\46826.exec:\46826.exe37⤵
- Executes dropped EXE
PID:1708 -
\??\c:\642200.exec:\642200.exe38⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bnbnbt.exec:\bnbnbt.exe39⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jjjpd.exec:\jjjpd.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3488 -
\??\c:\26826.exec:\26826.exe41⤵
- Executes dropped EXE
PID:1548 -
\??\c:\228648.exec:\228648.exe42⤵
- Executes dropped EXE
PID:2312 -
\??\c:\llfrlfr.exec:\llfrlfr.exe43⤵
- Executes dropped EXE
PID:4052 -
\??\c:\nthbhb.exec:\nthbhb.exe44⤵
- Executes dropped EXE
PID:2248 -
\??\c:\2026042.exec:\2026042.exe45⤵
- Executes dropped EXE
PID:3804 -
\??\c:\462082.exec:\462082.exe46⤵
- Executes dropped EXE
PID:4652 -
\??\c:\a6808.exec:\a6808.exe47⤵
- Executes dropped EXE
PID:1504 -
\??\c:\k46080.exec:\k46080.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xlllfxl.exec:\xlllfxl.exe49⤵
- Executes dropped EXE
PID:5076 -
\??\c:\bnhbnt.exec:\bnhbnt.exe50⤵
- Executes dropped EXE
PID:3004 -
\??\c:\q84226.exec:\q84226.exe51⤵
- Executes dropped EXE
PID:376 -
\??\c:\nhtnhh.exec:\nhtnhh.exe52⤵
- Executes dropped EXE
PID:4552 -
\??\c:\m4044.exec:\m4044.exe53⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jdppj.exec:\jdppj.exe54⤵
- Executes dropped EXE
PID:3340 -
\??\c:\82888.exec:\82888.exe55⤵
- Executes dropped EXE
PID:1160 -
\??\c:\06608.exec:\06608.exe56⤵
- Executes dropped EXE
PID:8 -
\??\c:\xfxlrfr.exec:\xfxlrfr.exe57⤵
- Executes dropped EXE
PID:3860 -
\??\c:\tnnnnn.exec:\tnnnnn.exe58⤵
- Executes dropped EXE
PID:3732 -
\??\c:\jpjvp.exec:\jpjvp.exe59⤵
- Executes dropped EXE
PID:4188 -
\??\c:\0606462.exec:\0606462.exe60⤵
- Executes dropped EXE
PID:1376 -
\??\c:\628206.exec:\628206.exe61⤵
- Executes dropped EXE
PID:848 -
\??\c:\lrrfrlx.exec:\lrrfrlx.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664 -
\??\c:\3bhtnh.exec:\3bhtnh.exe63⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5vpjv.exec:\5vpjv.exe64⤵
- Executes dropped EXE
PID:516 -
\??\c:\hthbtn.exec:\hthbtn.exe65⤵
- Executes dropped EXE
PID:2820 -
\??\c:\tnntnh.exec:\tnntnh.exe66⤵PID:4984
-
\??\c:\440426.exec:\440426.exe67⤵PID:4968
-
\??\c:\2466448.exec:\2466448.exe68⤵PID:1472
-
\??\c:\7jpjd.exec:\7jpjd.exe69⤵PID:1920
-
\??\c:\260426.exec:\260426.exe70⤵PID:3728
-
\??\c:\424226.exec:\424226.exe71⤵PID:2840
-
\??\c:\nhtbhh.exec:\nhtbhh.exe72⤵PID:3208
-
\??\c:\nbbnhb.exec:\nbbnhb.exe73⤵PID:3376
-
\??\c:\nbbtnh.exec:\nbbtnh.exe74⤵PID:3300
-
\??\c:\866482.exec:\866482.exe75⤵PID:556
-
\??\c:\vvjvj.exec:\vvjvj.exe76⤵PID:676
-
\??\c:\26666.exec:\26666.exe77⤵PID:2380
-
\??\c:\rllxrfx.exec:\rllxrfx.exe78⤵PID:2148
-
\??\c:\680486.exec:\680486.exe79⤵PID:820
-
\??\c:\04826.exec:\04826.exe80⤵PID:2068
-
\??\c:\8622264.exec:\8622264.exe81⤵PID:3240
-
\??\c:\dpvpd.exec:\dpvpd.exe82⤵PID:3248
-
\??\c:\82826.exec:\82826.exe83⤵PID:4080
-
\??\c:\846660.exec:\846660.exe84⤵PID:3552
-
\??\c:\nnthbt.exec:\nnthbt.exe85⤵PID:3524
-
\??\c:\o682220.exec:\o682220.exe86⤵PID:4456
-
\??\c:\0882604.exec:\0882604.exe87⤵PID:3028
-
\??\c:\060608.exec:\060608.exe88⤵PID:4256
-
\??\c:\ppdvp.exec:\ppdvp.exe89⤵PID:1328
-
\??\c:\1rxlfxr.exec:\1rxlfxr.exe90⤵PID:3180
-
\??\c:\6826042.exec:\6826042.exe91⤵PID:1936
-
\??\c:\pvvjv.exec:\pvvjv.exe92⤵PID:5060
-
\??\c:\828204.exec:\828204.exe93⤵PID:424
-
\??\c:\frrrfrr.exec:\frrrfrr.exe94⤵PID:3328
-
\??\c:\884266.exec:\884266.exe95⤵PID:3088
-
\??\c:\0882042.exec:\0882042.exe96⤵PID:4864
-
\??\c:\6448422.exec:\6448422.exe97⤵PID:1236
-
\??\c:\e40448.exec:\e40448.exe98⤵PID:2408
-
\??\c:\a2682.exec:\a2682.exe99⤵PID:3496
-
\??\c:\684226.exec:\684226.exe100⤵PID:1736
-
\??\c:\e88262.exec:\e88262.exe101⤵PID:2028
-
\??\c:\24242.exec:\24242.exe102⤵PID:2052
-
\??\c:\fxxlxrl.exec:\fxxlxrl.exe103⤵PID:1520
-
\??\c:\5ntnbt.exec:\5ntnbt.exe104⤵PID:1264
-
\??\c:\4286482.exec:\4286482.exe105⤵PID:4320
-
\??\c:\2442260.exec:\2442260.exe106⤵PID:2236
-
\??\c:\jpvpj.exec:\jpvpj.exe107⤵PID:4068
-
\??\c:\q46086.exec:\q46086.exe108⤵PID:2248
-
\??\c:\9ttnht.exec:\9ttnht.exe109⤵PID:3768
-
\??\c:\86820.exec:\86820.exe110⤵PID:4652
-
\??\c:\00086.exec:\00086.exe111⤵PID:1504
-
\??\c:\flllxlf.exec:\flllxlf.exe112⤵PID:1212
-
\??\c:\6282648.exec:\6282648.exe113⤵PID:3752
-
\??\c:\2686266.exec:\2686266.exe114⤵PID:4500
-
\??\c:\04666.exec:\04666.exe115⤵PID:2696
-
\??\c:\2282028.exec:\2282028.exe116⤵PID:3480
-
\??\c:\2260404.exec:\2260404.exe117⤵PID:4740
-
\??\c:\jppdj.exec:\jppdj.exe118⤵PID:1600
-
\??\c:\llrfrxx.exec:\llrfrxx.exe119⤵PID:2372
-
\??\c:\fxfrffr.exec:\fxfrffr.exe120⤵PID:2420
-
\??\c:\s4482.exec:\s4482.exe121⤵PID:396
-
\??\c:\jddvp.exec:\jddvp.exe122⤵PID:2044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-