Analysis
-
max time kernel
120s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe
-
Size
454KB
-
MD5
cda2374ed123383a6ca4815a46f961a0
-
SHA1
8c1e6fafece381afdfbaab2bc046b0112c896812
-
SHA256
79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101
-
SHA512
b09c1bbbecdcd4559e76dce673efcd824c78f3bd0b2c61981fd93c4d45730e3735259bbf48c5b7ffac78f1e2e755d4c2cf198bbf7d377cc4c6adac016014ff54
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1136-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/508-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/696-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-926-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-1018-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-1082-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-1263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3308 vvjjp.exe 3560 xrxxxff.exe 396 hhbbbb.exe 4308 dvddd.exe 212 jppjp.exe 4908 bnbbnh.exe 4412 bnnthn.exe 2488 rrlxxrf.exe 1320 3vddd.exe 3448 pvpjd.exe 2752 xfxrllf.exe 3960 vpdpp.exe 4056 rflrxll.exe 4180 thbhtn.exe 2080 lxrlllx.exe 5000 9dddj.exe 1848 jjpvd.exe 3836 dvddd.exe 1416 llflfff.exe 2704 lrfrrff.exe 1588 pvddd.exe 2700 1hbbnt.exe 508 rxxlrfl.exe 2444 bhtthn.exe 2876 nthbtt.exe 8 lrlrlfx.exe 4640 tbhnnn.exe 3956 jvjjj.exe 1268 fflrrrf.exe 2780 ddddd.exe 4500 nhnnbb.exe 5104 lffxflf.exe 1000 thtttt.exe 3964 lrfxrff.exe 1792 5hhbtt.exe 1748 pjppj.exe 2472 5hbbth.exe 2140 jddvv.exe 4672 5llfxfx.exe 732 pdpjd.exe 3340 lfffxxr.exe 3476 jjpdv.exe 696 llrrlfr.exe 224 hhhbtt.exe 4852 vdpjp.exe 3568 xrflfxr.exe 1464 5ntnhn.exe 4420 ppjvj.exe 4460 1fllllr.exe 2716 nnnttb.exe 2832 3jpjd.exe 1720 xrxrrrr.exe 3560 bbbnhn.exe 3508 vvvpp.exe 836 xlfffff.exe 4800 bbtnnn.exe 1404 5vvvv.exe 212 ppvpj.exe 2228 xxfxrxr.exe 1480 bttnhh.exe 4412 dvdvp.exe 3224 lrlfxrr.exe 2824 nnnhbt.exe 4796 vvvdd.exe -
resource yara_rule behavioral2/memory/1136-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/508-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-926-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1136 wrote to memory of 3308 1136 79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe 83 PID 1136 wrote to memory of 3308 1136 79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe 83 PID 1136 wrote to memory of 3308 1136 79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe 83 PID 3308 wrote to memory of 3560 3308 vvjjp.exe 84 PID 3308 wrote to memory of 3560 3308 vvjjp.exe 84 PID 3308 wrote to memory of 3560 3308 vvjjp.exe 84 PID 3560 wrote to memory of 396 3560 xrxxxff.exe 85 PID 3560 wrote to memory of 396 3560 xrxxxff.exe 85 PID 3560 wrote to memory of 396 3560 xrxxxff.exe 85 PID 396 wrote to memory of 4308 396 hhbbbb.exe 86 PID 396 wrote to memory of 4308 396 hhbbbb.exe 86 PID 396 wrote to memory of 4308 396 hhbbbb.exe 86 PID 4308 wrote to memory of 212 4308 dvddd.exe 87 PID 4308 wrote to memory of 212 4308 dvddd.exe 87 PID 4308 wrote to memory of 212 4308 dvddd.exe 87 PID 212 wrote to memory of 4908 212 jppjp.exe 88 PID 212 wrote to memory of 4908 212 jppjp.exe 88 PID 212 wrote to memory of 4908 212 jppjp.exe 88 PID 4908 wrote to memory of 4412 4908 bnbbnh.exe 89 PID 4908 wrote to memory of 4412 4908 bnbbnh.exe 89 PID 4908 wrote to memory of 4412 4908 bnbbnh.exe 89 PID 4412 wrote to memory of 2488 4412 bnnthn.exe 90 PID 4412 wrote to memory of 2488 4412 bnnthn.exe 90 PID 4412 wrote to memory of 2488 4412 bnnthn.exe 90 PID 2488 wrote to memory of 1320 2488 rrlxxrf.exe 91 PID 2488 wrote to memory of 1320 2488 rrlxxrf.exe 91 PID 2488 wrote to memory of 1320 2488 rrlxxrf.exe 91 PID 1320 wrote to memory of 3448 1320 3vddd.exe 92 PID 1320 wrote to memory of 3448 1320 3vddd.exe 92 PID 1320 wrote to memory of 3448 1320 3vddd.exe 92 PID 3448 wrote to memory of 2752 3448 pvpjd.exe 93 PID 3448 wrote to memory of 2752 3448 pvpjd.exe 93 PID 3448 wrote to memory of 2752 3448 pvpjd.exe 93 PID 2752 wrote to memory of 3960 2752 xfxrllf.exe 94 PID 2752 wrote to memory of 3960 2752 xfxrllf.exe 94 PID 2752 wrote to memory of 3960 2752 xfxrllf.exe 94 PID 3960 wrote to memory of 4056 3960 vpdpp.exe 95 PID 3960 wrote to memory of 4056 3960 vpdpp.exe 95 PID 3960 wrote to memory of 4056 3960 vpdpp.exe 95 PID 4056 wrote to memory of 4180 4056 rflrxll.exe 96 PID 4056 wrote to memory of 4180 4056 rflrxll.exe 96 PID 4056 wrote to memory of 4180 4056 rflrxll.exe 96 PID 4180 wrote to memory of 2080 4180 thbhtn.exe 97 PID 4180 wrote to memory of 2080 4180 thbhtn.exe 97 PID 4180 wrote to memory of 2080 4180 thbhtn.exe 97 PID 2080 wrote to memory of 5000 2080 lxrlllx.exe 98 PID 2080 wrote to memory of 5000 2080 lxrlllx.exe 98 PID 2080 wrote to memory of 5000 2080 lxrlllx.exe 98 PID 5000 wrote to memory of 1848 5000 9dddj.exe 99 PID 5000 wrote to memory of 1848 5000 9dddj.exe 99 PID 5000 wrote to memory of 1848 5000 9dddj.exe 99 PID 1848 wrote to memory of 3836 1848 jjpvd.exe 100 PID 1848 wrote to memory of 3836 1848 jjpvd.exe 100 PID 1848 wrote to memory of 3836 1848 jjpvd.exe 100 PID 3836 wrote to memory of 1416 3836 dvddd.exe 101 PID 3836 wrote to memory of 1416 3836 dvddd.exe 101 PID 3836 wrote to memory of 1416 3836 dvddd.exe 101 PID 1416 wrote to memory of 2704 1416 llflfff.exe 102 PID 1416 wrote to memory of 2704 1416 llflfff.exe 102 PID 1416 wrote to memory of 2704 1416 llflfff.exe 102 PID 2704 wrote to memory of 1588 2704 lrfrrff.exe 103 PID 2704 wrote to memory of 1588 2704 lrfrrff.exe 103 PID 2704 wrote to memory of 1588 2704 lrfrrff.exe 103 PID 1588 wrote to memory of 2700 1588 pvddd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe"C:\Users\Admin\AppData\Local\Temp\79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\vvjjp.exec:\vvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\xrxxxff.exec:\xrxxxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\hhbbbb.exec:\hhbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\dvddd.exec:\dvddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\jppjp.exec:\jppjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\bnbbnh.exec:\bnbbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\bnnthn.exec:\bnnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\rrlxxrf.exec:\rrlxxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\3vddd.exec:\3vddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\pvpjd.exec:\pvpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\xfxrllf.exec:\xfxrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vpdpp.exec:\vpdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\rflrxll.exec:\rflrxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\thbhtn.exec:\thbhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\lxrlllx.exec:\lxrlllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\9dddj.exec:\9dddj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\jjpvd.exec:\jjpvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\dvddd.exec:\dvddd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\llflfff.exec:\llflfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\lrfrrff.exec:\lrfrrff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\pvddd.exec:\pvddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\1hbbnt.exec:\1hbbnt.exe23⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rxxlrfl.exec:\rxxlrfl.exe24⤵
- Executes dropped EXE
PID:508 -
\??\c:\bhtthn.exec:\bhtthn.exe25⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nthbtt.exec:\nthbtt.exe26⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lrlrlfx.exec:\lrlrlfx.exe27⤵
- Executes dropped EXE
PID:8 -
\??\c:\tbhnnn.exec:\tbhnnn.exe28⤵
- Executes dropped EXE
PID:4640 -
\??\c:\jvjjj.exec:\jvjjj.exe29⤵
- Executes dropped EXE
PID:3956 -
\??\c:\fflrrrf.exec:\fflrrrf.exe30⤵
- Executes dropped EXE
PID:1268 -
\??\c:\ddddd.exec:\ddddd.exe31⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nhnnbb.exec:\nhnnbb.exe32⤵
- Executes dropped EXE
PID:4500 -
\??\c:\lffxflf.exec:\lffxflf.exe33⤵
- Executes dropped EXE
PID:5104 -
\??\c:\thtttt.exec:\thtttt.exe34⤵
- Executes dropped EXE
PID:1000 -
\??\c:\lrfxrff.exec:\lrfxrff.exe35⤵
- Executes dropped EXE
PID:3964 -
\??\c:\5hhbtt.exec:\5hhbtt.exe36⤵
- Executes dropped EXE
PID:1792 -
\??\c:\pjppj.exec:\pjppj.exe37⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5hbbth.exec:\5hbbth.exe38⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jddvv.exec:\jddvv.exe39⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5llfxfx.exec:\5llfxfx.exe40⤵
- Executes dropped EXE
PID:4672 -
\??\c:\pdpjd.exec:\pdpjd.exe41⤵
- Executes dropped EXE
PID:732 -
\??\c:\lfffxxr.exec:\lfffxxr.exe42⤵
- Executes dropped EXE
PID:3340 -
\??\c:\jjpdv.exec:\jjpdv.exe43⤵
- Executes dropped EXE
PID:3476 -
\??\c:\llrrlfr.exec:\llrrlfr.exe44⤵
- Executes dropped EXE
PID:696 -
\??\c:\hhhbtt.exec:\hhhbtt.exe45⤵
- Executes dropped EXE
PID:224 -
\??\c:\vdpjp.exec:\vdpjp.exe46⤵
- Executes dropped EXE
PID:4852 -
\??\c:\xrflfxr.exec:\xrflfxr.exe47⤵
- Executes dropped EXE
PID:3568 -
\??\c:\5ntnhn.exec:\5ntnhn.exe48⤵
- Executes dropped EXE
PID:1464 -
\??\c:\ppjvj.exec:\ppjvj.exe49⤵
- Executes dropped EXE
PID:4420 -
\??\c:\1fllllr.exec:\1fllllr.exe50⤵
- Executes dropped EXE
PID:4460 -
\??\c:\nnnttb.exec:\nnnttb.exe51⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3jpjd.exec:\3jpjd.exe52⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe53⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bbbnhn.exec:\bbbnhn.exe54⤵
- Executes dropped EXE
PID:3560 -
\??\c:\vvvpp.exec:\vvvpp.exe55⤵
- Executes dropped EXE
PID:3508 -
\??\c:\xlfffff.exec:\xlfffff.exe56⤵
- Executes dropped EXE
PID:836 -
\??\c:\bbtnnn.exec:\bbtnnn.exe57⤵
- Executes dropped EXE
PID:4800 -
\??\c:\5vvvv.exec:\5vvvv.exe58⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ppvpj.exec:\ppvpj.exe59⤵
- Executes dropped EXE
PID:212 -
\??\c:\xxfxrxr.exec:\xxfxrxr.exe60⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bttnhh.exec:\bttnhh.exe61⤵
- Executes dropped EXE
PID:1480 -
\??\c:\dvdvp.exec:\dvdvp.exe62⤵
- Executes dropped EXE
PID:4412 -
\??\c:\lrlfxrr.exec:\lrlfxrr.exe63⤵
- Executes dropped EXE
PID:3224 -
\??\c:\nnnhbt.exec:\nnnhbt.exe64⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vvvdd.exec:\vvvdd.exe65⤵
- Executes dropped EXE
PID:4796 -
\??\c:\3pvpv.exec:\3pvpv.exe66⤵PID:3064
-
\??\c:\rxfxxxl.exec:\rxfxxxl.exe67⤵PID:4828
-
\??\c:\thnhbb.exec:\thnhbb.exe68⤵PID:4660
-
\??\c:\pjvvd.exec:\pjvvd.exe69⤵PID:4620
-
\??\c:\xxxfffr.exec:\xxxfffr.exe70⤵PID:1264
-
\??\c:\thtnbt.exec:\thtnbt.exe71⤵
- System Location Discovery: System Language Discovery
PID:4440 -
\??\c:\djddj.exec:\djddj.exe72⤵PID:1724
-
\??\c:\jpvdp.exec:\jpvdp.exe73⤵PID:5040
-
\??\c:\tttnhh.exec:\tttnhh.exe74⤵PID:2096
-
\??\c:\vdppp.exec:\vdppp.exe75⤵PID:3452
-
\??\c:\7rrrlrr.exec:\7rrrlrr.exe76⤵PID:4536
-
\??\c:\pvddj.exec:\pvddj.exe77⤵PID:3940
-
\??\c:\7vjpd.exec:\7vjpd.exe78⤵PID:4592
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe79⤵PID:760
-
\??\c:\bnbtnn.exec:\bnbtnn.exe80⤵PID:5052
-
\??\c:\ppjdv.exec:\ppjdv.exe81⤵PID:2308
-
\??\c:\xffffxx.exec:\xffffxx.exe82⤵PID:1588
-
\??\c:\ttttht.exec:\ttttht.exe83⤵PID:5016
-
\??\c:\ppvpj.exec:\ppvpj.exe84⤵PID:2892
-
\??\c:\jddvd.exec:\jddvd.exe85⤵PID:3236
-
\??\c:\xfrrlfx.exec:\xfrrlfx.exe86⤵PID:4600
-
\??\c:\hbbttn.exec:\hbbttn.exe87⤵PID:3428
-
\??\c:\jjjvv.exec:\jjjvv.exe88⤵PID:2876
-
\??\c:\frlfxxx.exec:\frlfxxx.exe89⤵PID:1528
-
\??\c:\htnbth.exec:\htnbth.exe90⤵PID:4744
-
\??\c:\5nthht.exec:\5nthht.exe91⤵PID:3460
-
\??\c:\9vpjv.exec:\9vpjv.exe92⤵PID:4568
-
\??\c:\lffxrrx.exec:\lffxrrx.exe93⤵PID:4988
-
\??\c:\nnhhtn.exec:\nnhhtn.exe94⤵PID:4288
-
\??\c:\3dpdv.exec:\3dpdv.exe95⤵PID:2608
-
\??\c:\5xrrrrl.exec:\5xrrrrl.exe96⤵PID:4848
-
\??\c:\nnnhbb.exec:\nnnhbb.exe97⤵PID:5104
-
\??\c:\jdpjj.exec:\jdpjj.exe98⤵PID:1000
-
\??\c:\ppjpj.exec:\ppjpj.exe99⤵PID:3632
-
\??\c:\7xlfffx.exec:\7xlfffx.exe100⤵PID:1792
-
\??\c:\vdvvd.exec:\vdvvd.exe101⤵PID:1748
-
\??\c:\dddvv.exec:\dddvv.exe102⤵PID:2664
-
\??\c:\lllxrxf.exec:\lllxrxf.exe103⤵PID:2140
-
\??\c:\bttnnh.exec:\bttnnh.exe104⤵PID:4672
-
\??\c:\5dpjv.exec:\5dpjv.exe105⤵PID:3576
-
\??\c:\lxfxxfx.exec:\lxfxxfx.exe106⤵PID:3340
-
\??\c:\bhnbnt.exec:\bhnbnt.exe107⤵PID:3476
-
\??\c:\jpppp.exec:\jpppp.exe108⤵PID:4368
-
\??\c:\fllfrrr.exec:\fllfrrr.exe109⤵PID:2584
-
\??\c:\tbbbtt.exec:\tbbbtt.exe110⤵PID:2256
-
\??\c:\dpvjj.exec:\dpvjj.exe111⤵PID:3568
-
\??\c:\lrllffx.exec:\lrllffx.exe112⤵PID:4344
-
\??\c:\thtttt.exec:\thtttt.exe113⤵PID:2084
-
\??\c:\ppjpp.exec:\ppjpp.exe114⤵PID:3592
-
\??\c:\rlfrrxx.exec:\rlfrrxx.exe115⤵PID:3308
-
\??\c:\bnthbt.exec:\bnthbt.exe116⤵PID:1140
-
\??\c:\3pvpj.exec:\3pvpj.exe117⤵PID:2380
-
\??\c:\xlxfxff.exec:\xlxfxff.exe118⤵PID:5008
-
\??\c:\httnnb.exec:\httnnb.exe119⤵PID:2172
-
\??\c:\ppvdv.exec:\ppvdv.exe120⤵PID:3260
-
\??\c:\lxfxxrl.exec:\lxfxxrl.exe121⤵PID:4308
-
\??\c:\hhbbtb.exec:\hhbbtb.exe122⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-