Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 04:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe
-
Size
453KB
-
MD5
46b2d2bf23bafafc3fcaaca551002cd0
-
SHA1
3f8493c57af85fbe6de75c2e2c756c3f747ad724
-
SHA256
fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6
-
SHA512
8442598d62ead98abb16fbc3ab06a048f6779c0cb40bcbc2fe6f7c1d192d3563e961ffd8e95d92fffd6febdc0fd8491b85b152df072500c0c57c2d911f0c7450
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJY:q7Tc2NYHUrAwfMp3CDJY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/856-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-779-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-828-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-847-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-1167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2852 xrfrxrf.exe 3588 vvpdp.exe 1076 3lfrxrf.exe 2396 rrfxrxr.exe 4320 hbbnht.exe 4016 9pdpd.exe 4020 jvdpd.exe 4192 tnbnhb.exe 3632 vvvjp.exe 3120 tnhnth.exe 1612 xxllrlx.exe 4568 hhbthb.exe 4988 rxxrrrl.exe 940 tthbtn.exe 1484 5xfrlff.exe 4248 xxlfllf.exe 3844 nhttbb.exe 4132 lfxfxrl.exe 968 thhhbb.exe 3040 9jddv.exe 4184 nhnnhh.exe 1636 lxlxrlx.exe 1800 nhtnbh.exe 3388 vpjdj.exe 1284 vvdpv.exe 4492 1btbtb.exe 544 djdvj.exe 1140 vpvjv.exe 2328 7xlfxlx.exe 4932 bhhbnb.exe 764 nnnbhn.exe 4156 pppdp.exe 2148 btthbt.exe 3652 xffrfxf.exe 1300 lrlxlfr.exe 2372 thbnbt.exe 3528 3jjpd.exe 5020 rxlxfxf.exe 1776 bnbthb.exe 2332 pdppv.exe 4148 xllrfxl.exe 768 nbbnbt.exe 4340 tbthth.exe 2848 xxxllfx.exe 2852 htnbnh.exe 3556 9jjpv.exe 3760 1ddpv.exe 4376 xfrfrlx.exe 1368 3bbntn.exe 232 pvpjv.exe 2880 rxflfrr.exe 2444 1hbbnb.exe 2984 dddpv.exe 4268 5rlrfrf.exe 4964 fllxfxf.exe 1552 3thbth.exe 3276 pjdjv.exe 4536 rxrflfl.exe 1264 lflxrlf.exe 4468 thbnbb.exe 3360 dpjpv.exe 376 9frrxlf.exe 528 tbthth.exe 3868 7ttbnb.exe -
resource yara_rule behavioral2/memory/856-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-828-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxlrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 856 wrote to memory of 2852 856 fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe 82 PID 856 wrote to memory of 2852 856 fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe 82 PID 856 wrote to memory of 2852 856 fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe 82 PID 2852 wrote to memory of 3588 2852 xrfrxrf.exe 83 PID 2852 wrote to memory of 3588 2852 xrfrxrf.exe 83 PID 2852 wrote to memory of 3588 2852 xrfrxrf.exe 83 PID 3588 wrote to memory of 1076 3588 vvpdp.exe 84 PID 3588 wrote to memory of 1076 3588 vvpdp.exe 84 PID 3588 wrote to memory of 1076 3588 vvpdp.exe 84 PID 1076 wrote to memory of 2396 1076 3lfrxrf.exe 85 PID 1076 wrote to memory of 2396 1076 3lfrxrf.exe 85 PID 1076 wrote to memory of 2396 1076 3lfrxrf.exe 85 PID 2396 wrote to memory of 4320 2396 rrfxrxr.exe 86 PID 2396 wrote to memory of 4320 2396 rrfxrxr.exe 86 PID 2396 wrote to memory of 4320 2396 rrfxrxr.exe 86 PID 4320 wrote to memory of 4016 4320 hbbnht.exe 87 PID 4320 wrote to memory of 4016 4320 hbbnht.exe 87 PID 4320 wrote to memory of 4016 4320 hbbnht.exe 87 PID 4016 wrote to memory of 4020 4016 9pdpd.exe 88 PID 4016 wrote to memory of 4020 4016 9pdpd.exe 88 PID 4016 wrote to memory of 4020 4016 9pdpd.exe 88 PID 4020 wrote to memory of 4192 4020 jvdpd.exe 89 PID 4020 wrote to memory of 4192 4020 jvdpd.exe 89 PID 4020 wrote to memory of 4192 4020 jvdpd.exe 89 PID 4192 wrote to memory of 3632 4192 tnbnhb.exe 90 PID 4192 wrote to memory of 3632 4192 tnbnhb.exe 90 PID 4192 wrote to memory of 3632 4192 tnbnhb.exe 90 PID 3632 wrote to memory of 3120 3632 vvvjp.exe 91 PID 3632 wrote to memory of 3120 3632 vvvjp.exe 91 PID 3632 wrote to memory of 3120 3632 vvvjp.exe 91 PID 3120 wrote to memory of 1612 3120 tnhnth.exe 92 PID 3120 wrote to memory of 1612 3120 tnhnth.exe 92 PID 3120 wrote to memory of 1612 3120 tnhnth.exe 92 PID 1612 wrote to memory of 4568 1612 xxllrlx.exe 93 PID 1612 wrote to memory of 4568 1612 xxllrlx.exe 93 PID 1612 wrote to memory of 4568 1612 xxllrlx.exe 93 PID 4568 wrote to memory of 4988 4568 hhbthb.exe 94 PID 4568 wrote to memory of 4988 4568 hhbthb.exe 94 PID 4568 wrote to memory of 4988 4568 hhbthb.exe 94 PID 4988 wrote to memory of 940 4988 rxxrrrl.exe 95 PID 4988 wrote to memory of 940 4988 rxxrrrl.exe 95 PID 4988 wrote to memory of 940 4988 rxxrrrl.exe 95 PID 940 wrote to memory of 1484 940 tthbtn.exe 96 PID 940 wrote to memory of 1484 940 tthbtn.exe 96 PID 940 wrote to memory of 1484 940 tthbtn.exe 96 PID 1484 wrote to memory of 4248 1484 5xfrlff.exe 97 PID 1484 wrote to memory of 4248 1484 5xfrlff.exe 97 PID 1484 wrote to memory of 4248 1484 5xfrlff.exe 97 PID 4248 wrote to memory of 3844 4248 xxlfllf.exe 98 PID 4248 wrote to memory of 3844 4248 xxlfllf.exe 98 PID 4248 wrote to memory of 3844 4248 xxlfllf.exe 98 PID 3844 wrote to memory of 4132 3844 nhttbb.exe 99 PID 3844 wrote to memory of 4132 3844 nhttbb.exe 99 PID 3844 wrote to memory of 4132 3844 nhttbb.exe 99 PID 4132 wrote to memory of 968 4132 lfxfxrl.exe 100 PID 4132 wrote to memory of 968 4132 lfxfxrl.exe 100 PID 4132 wrote to memory of 968 4132 lfxfxrl.exe 100 PID 968 wrote to memory of 3040 968 thhhbb.exe 101 PID 968 wrote to memory of 3040 968 thhhbb.exe 101 PID 968 wrote to memory of 3040 968 thhhbb.exe 101 PID 3040 wrote to memory of 4184 3040 9jddv.exe 102 PID 3040 wrote to memory of 4184 3040 9jddv.exe 102 PID 3040 wrote to memory of 4184 3040 9jddv.exe 102 PID 4184 wrote to memory of 1636 4184 nhnnhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe"C:\Users\Admin\AppData\Local\Temp\fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\xrfrxrf.exec:\xrfrxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\vvpdp.exec:\vvpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\3lfrxrf.exec:\3lfrxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\rrfxrxr.exec:\rrfxrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hbbnht.exec:\hbbnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\9pdpd.exec:\9pdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\jvdpd.exec:\jvdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\tnbnhb.exec:\tnbnhb.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\vvvjp.exec:\vvvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\tnhnth.exec:\tnhnth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\xxllrlx.exec:\xxllrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\hhbthb.exec:\hhbthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\tthbtn.exec:\tthbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\5xfrlff.exec:\5xfrlff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\xxlfllf.exec:\xxlfllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\nhttbb.exec:\nhttbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\lfxfxrl.exec:\lfxfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\thhhbb.exec:\thhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\9jddv.exec:\9jddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\nhnnhh.exec:\nhnnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\lxlxrlx.exec:\lxlxrlx.exe23⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nhtnbh.exec:\nhtnbh.exe24⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vpjdj.exec:\vpjdj.exe25⤵
- Executes dropped EXE
PID:3388 -
\??\c:\vvdpv.exec:\vvdpv.exe26⤵
- Executes dropped EXE
PID:1284 -
\??\c:\1btbtb.exec:\1btbtb.exe27⤵
- Executes dropped EXE
PID:4492 -
\??\c:\djdvj.exec:\djdvj.exe28⤵
- Executes dropped EXE
PID:544 -
\??\c:\vpvjv.exec:\vpvjv.exe29⤵
- Executes dropped EXE
PID:1140 -
\??\c:\7xlfxlx.exec:\7xlfxlx.exe30⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bhhbnb.exec:\bhhbnb.exe31⤵
- Executes dropped EXE
PID:4932 -
\??\c:\nnnbhn.exec:\nnnbhn.exe32⤵
- Executes dropped EXE
PID:764 -
\??\c:\pppdp.exec:\pppdp.exe33⤵
- Executes dropped EXE
PID:4156 -
\??\c:\btthbt.exec:\btthbt.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xffrfxf.exec:\xffrfxf.exe35⤵
- Executes dropped EXE
PID:3652 -
\??\c:\lrlxlfr.exec:\lrlxlfr.exe36⤵
- Executes dropped EXE
PID:1300 -
\??\c:\thbnbt.exec:\thbnbt.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2372 -
\??\c:\3jjpd.exec:\3jjpd.exe38⤵
- Executes dropped EXE
PID:3528 -
\??\c:\rxlxfxf.exec:\rxlxfxf.exe39⤵
- Executes dropped EXE
PID:5020 -
\??\c:\bnbthb.exec:\bnbthb.exe40⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pdppv.exec:\pdppv.exe41⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xllrfxl.exec:\xllrfxl.exe42⤵
- Executes dropped EXE
PID:4148 -
\??\c:\nbbnbt.exec:\nbbnbt.exe43⤵
- Executes dropped EXE
PID:768 -
\??\c:\tbthth.exec:\tbthth.exe44⤵
- Executes dropped EXE
PID:4340 -
\??\c:\xxxllfx.exec:\xxxllfx.exe45⤵
- Executes dropped EXE
PID:2848 -
\??\c:\htnbnh.exec:\htnbnh.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2852 -
\??\c:\9jjpv.exec:\9jjpv.exe47⤵
- Executes dropped EXE
PID:3556 -
\??\c:\1ddpv.exec:\1ddpv.exe48⤵
- Executes dropped EXE
PID:3760 -
\??\c:\xfrfrlx.exec:\xfrfrlx.exe49⤵
- Executes dropped EXE
PID:4376 -
\??\c:\3bbntn.exec:\3bbntn.exe50⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pvpjv.exec:\pvpjv.exe51⤵
- Executes dropped EXE
PID:232 -
\??\c:\rxflfrr.exec:\rxflfrr.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1hbbnb.exec:\1hbbnb.exe53⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dddpv.exec:\dddpv.exe54⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5rlrfrf.exec:\5rlrfrf.exe55⤵
- Executes dropped EXE
PID:4268 -
\??\c:\fllxfxf.exec:\fllxfxf.exe56⤵
- Executes dropped EXE
PID:4964 -
\??\c:\3thbth.exec:\3thbth.exe57⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pjdjv.exec:\pjdjv.exe58⤵
- Executes dropped EXE
PID:3276 -
\??\c:\rxrflfl.exec:\rxrflfl.exe59⤵
- Executes dropped EXE
PID:4536 -
\??\c:\lflxrlf.exec:\lflxrlf.exe60⤵
- Executes dropped EXE
PID:1264 -
\??\c:\thbnbb.exec:\thbnbb.exe61⤵
- Executes dropped EXE
PID:4468 -
\??\c:\dpjpv.exec:\dpjpv.exe62⤵
- Executes dropped EXE
PID:3360 -
\??\c:\9frrxlf.exec:\9frrxlf.exe63⤵
- Executes dropped EXE
PID:376 -
\??\c:\tbthth.exec:\tbthth.exe64⤵
- Executes dropped EXE
PID:528 -
\??\c:\7ttbnb.exec:\7ttbnb.exe65⤵
- Executes dropped EXE
PID:3868 -
\??\c:\7jdpv.exec:\7jdpv.exe66⤵PID:1320
-
\??\c:\dvdjv.exec:\dvdjv.exe67⤵PID:3192
-
\??\c:\fxxlrfx.exec:\fxxlrfx.exe68⤵PID:1668
-
\??\c:\hhhtht.exec:\hhhtht.exe69⤵PID:1360
-
\??\c:\hhbntn.exec:\hhbntn.exe70⤵PID:2912
-
\??\c:\vppvd.exec:\vppvd.exe71⤵PID:3156
-
\??\c:\xxxlrff.exec:\xxxlrff.exe72⤵PID:456
-
\??\c:\ntthbt.exec:\ntthbt.exe73⤵PID:4556
-
\??\c:\3jjvj.exec:\3jjvj.exe74⤵PID:3844
-
\??\c:\ddjvj.exec:\ddjvj.exe75⤵PID:1328
-
\??\c:\1lxlrfx.exec:\1lxlrfx.exe76⤵PID:4116
-
\??\c:\fxfrfrf.exec:\fxfrfrf.exe77⤵PID:5080
-
\??\c:\3hhthb.exec:\3hhthb.exe78⤵PID:1704
-
\??\c:\ntbbbn.exec:\ntbbbn.exe79⤵PID:2324
-
\??\c:\jvvjj.exec:\jvvjj.exe80⤵PID:1992
-
\??\c:\flrffxl.exec:\flrffxl.exe81⤵PID:1092
-
\??\c:\5rrflfr.exec:\5rrflfr.exe82⤵PID:1800
-
\??\c:\9hhbhb.exec:\9hhbhb.exe83⤵PID:3388
-
\??\c:\3ppdj.exec:\3ppdj.exe84⤵PID:3332
-
\??\c:\jdvdj.exec:\jdvdj.exe85⤵PID:1284
-
\??\c:\9rfrxrf.exec:\9rfrxrf.exe86⤵PID:5016
-
\??\c:\lllxfrl.exec:\lllxfrl.exe87⤵PID:1308
-
\??\c:\nbnbnb.exec:\nbnbnb.exe88⤵PID:4908
-
\??\c:\ppdpv.exec:\ppdpv.exe89⤵PID:4472
-
\??\c:\jjjpv.exec:\jjjpv.exe90⤵PID:1488
-
\??\c:\xllxrlf.exec:\xllxrlf.exe91⤵PID:1516
-
\??\c:\bbthnh.exec:\bbthnh.exe92⤵PID:4460
-
\??\c:\hnntbt.exec:\hnntbt.exe93⤵PID:4752
-
\??\c:\vjppj.exec:\vjppj.exe94⤵PID:4928
-
\??\c:\5fxlrlx.exec:\5fxlrlx.exe95⤵PID:3336
-
\??\c:\htnbnt.exec:\htnbnt.exe96⤵PID:1428
-
\??\c:\7bhtnb.exec:\7bhtnb.exe97⤵PID:3676
-
\??\c:\9jdpp.exec:\9jdpp.exe98⤵PID:2644
-
\??\c:\rxxflfr.exec:\rxxflfr.exe99⤵PID:1432
-
\??\c:\xfxlrlx.exec:\xfxlrlx.exe100⤵PID:1300
-
\??\c:\ttnbhb.exec:\ttnbhb.exe101⤵PID:4780
-
\??\c:\vjdpd.exec:\vjdpd.exe102⤵PID:5008
-
\??\c:\5ffrlfx.exec:\5ffrlfx.exe103⤵PID:3188
-
\??\c:\ntnthb.exec:\ntnthb.exe104⤵PID:4520
-
\??\c:\thhtth.exec:\thhtth.exe105⤵PID:2504
-
\??\c:\5jdjp.exec:\5jdjp.exe106⤵PID:756
-
\??\c:\1lxlrlx.exec:\1lxlrlx.exe107⤵PID:4148
-
\??\c:\ntbhbt.exec:\ntbhbt.exe108⤵PID:2084
-
\??\c:\dpjvd.exec:\dpjvd.exe109⤵PID:4340
-
\??\c:\jjjvp.exec:\jjjvp.exe110⤵PID:2848
-
\??\c:\3lxrxrf.exec:\3lxrxrf.exe111⤵PID:428
-
\??\c:\bhhthh.exec:\bhhthh.exe112⤵PID:3556
-
\??\c:\hbhtnh.exec:\hbhtnh.exe113⤵PID:1564
-
\??\c:\dvvjv.exec:\dvvjv.exe114⤵PID:2184
-
\??\c:\rflfxrl.exec:\rflfxrl.exe115⤵PID:1616
-
\??\c:\nbtbnt.exec:\nbtbnt.exe116⤵PID:232
-
\??\c:\tnthbb.exec:\tnthbb.exe117⤵PID:1408
-
\??\c:\dpppd.exec:\dpppd.exe118⤵PID:348
-
\??\c:\9rrrllf.exec:\9rrrllf.exe119⤵PID:2068
-
\??\c:\tnhttn.exec:\tnhttn.exe120⤵PID:5036
-
\??\c:\9bhtnn.exec:\9bhtnn.exe121⤵PID:4672
-
\??\c:\xflxrfr.exec:\xflxrfr.exe122⤵PID:4268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-