Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 07:38
Static task
static1
Behavioral task
behavioral1
Sample
cef90047963c9cf67e4ee9120c8196c04c6386304ec4f512d0a9ffe8d58a5894.exe
Resource
win7-20240708-en
General
-
Target
cef90047963c9cf67e4ee9120c8196c04c6386304ec4f512d0a9ffe8d58a5894.exe
-
Size
337KB
-
MD5
04ba193d6fd0f8ffd778b9bacb7cd8f6
-
SHA1
90e9d9540e6f8296404142a2a5698e373920d3da
-
SHA256
cef90047963c9cf67e4ee9120c8196c04c6386304ec4f512d0a9ffe8d58a5894
-
SHA512
89c8c5f0a36087ce87975f7333e137a0277c02073e4237f651c03e1c4dfa0a3e137c27a09637f32eb1b5ed69cef4aa43cd5b489a47fac73530edda41d7461bbb
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhd:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/468-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-851-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-933-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-1202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3544 dpvvv.exe 2924 dpppj.exe 4136 hhbthb.exe 752 jjpjj.exe 3536 jvdvj.exe 2248 hhnhnb.exe 624 lxlrllx.exe 3496 nttnbn.exe 3432 7xrxlrx.exe 1140 jpdpp.exe 2348 flrfllf.exe 1292 hhbhtt.exe 4724 vddpj.exe 2196 5tttnh.exe 1620 1hnnnt.exe 2208 jppjp.exe 3664 xllfffx.exe 4928 3tbnnh.exe 3488 dvjjv.exe 4220 bhttnt.exe 3304 pjjjj.exe 1096 lrlrxlx.exe 3364 bntbhn.exe 5028 dddpv.exe 1268 lrfxrrl.exe 4564 rlxrlrl.exe 1068 lxffffx.exe 396 rrffflx.exe 1464 hhtbhh.exe 4588 ppjpv.exe 456 jpjdj.exe 4984 rrrxxff.exe 2436 1tttnb.exe 1304 5xlfffl.exe 3832 7jpjd.exe 5036 xflllrr.exe 3792 ddppd.exe 1832 pdppp.exe 4104 bttnnt.exe 3716 dvvvv.exe 2760 rrllrrx.exe 3656 tthhtt.exe 2532 jdvdj.exe 2688 9xfxxff.exe 1504 pdjpp.exe 4872 lrrfrlr.exe 4800 lxllflf.exe 1664 nhnnhn.exe 5096 vdjjj.exe 1136 xlffffx.exe 4392 nhhhhh.exe 2176 vvvvp.exe 3156 1pjdd.exe 1904 lxxxrrr.exe 4164 btbbhn.exe 3876 jvvjv.exe 4168 llrrrxl.exe 2364 thntbt.exe 1656 pppvv.exe 5068 lffflff.exe 3572 flrfrrf.exe 624 hbthtn.exe 1560 vjvpj.exe 1636 9xlllrx.exe -
resource yara_rule behavioral2/memory/468-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-624-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 468 wrote to memory of 3544 468 cef90047963c9cf67e4ee9120c8196c04c6386304ec4f512d0a9ffe8d58a5894.exe 82 PID 468 wrote to memory of 3544 468 cef90047963c9cf67e4ee9120c8196c04c6386304ec4f512d0a9ffe8d58a5894.exe 82 PID 468 wrote to memory of 3544 468 cef90047963c9cf67e4ee9120c8196c04c6386304ec4f512d0a9ffe8d58a5894.exe 82 PID 3544 wrote to memory of 2924 3544 dpvvv.exe 83 PID 3544 wrote to memory of 2924 3544 dpvvv.exe 83 PID 3544 wrote to memory of 2924 3544 dpvvv.exe 83 PID 2924 wrote to memory of 4136 2924 dpppj.exe 84 PID 2924 wrote to memory of 4136 2924 dpppj.exe 84 PID 2924 wrote to memory of 4136 2924 dpppj.exe 84 PID 4136 wrote to memory of 752 4136 hhbthb.exe 85 PID 4136 wrote to memory of 752 4136 hhbthb.exe 85 PID 4136 wrote to memory of 752 4136 hhbthb.exe 85 PID 752 wrote to memory of 3536 752 jjpjj.exe 86 PID 752 wrote to memory of 3536 752 jjpjj.exe 86 PID 752 wrote to memory of 3536 752 jjpjj.exe 86 PID 3536 wrote to memory of 2248 3536 jvdvj.exe 87 PID 3536 wrote to memory of 2248 3536 jvdvj.exe 87 PID 3536 wrote to memory of 2248 3536 jvdvj.exe 87 PID 2248 wrote to memory of 624 2248 hhnhnb.exe 88 PID 2248 wrote to memory of 624 2248 hhnhnb.exe 88 PID 2248 wrote to memory of 624 2248 hhnhnb.exe 88 PID 624 wrote to memory of 3496 624 lxlrllx.exe 89 PID 624 wrote to memory of 3496 624 lxlrllx.exe 89 PID 624 wrote to memory of 3496 624 lxlrllx.exe 89 PID 3496 wrote to memory of 3432 3496 nttnbn.exe 90 PID 3496 wrote to memory of 3432 3496 nttnbn.exe 90 PID 3496 wrote to memory of 3432 3496 nttnbn.exe 90 PID 3432 wrote to memory of 1140 3432 7xrxlrx.exe 91 PID 3432 wrote to memory of 1140 3432 7xrxlrx.exe 91 PID 3432 wrote to memory of 1140 3432 7xrxlrx.exe 91 PID 1140 wrote to memory of 2348 1140 jpdpp.exe 92 PID 1140 wrote to memory of 2348 1140 jpdpp.exe 92 PID 1140 wrote to memory of 2348 1140 jpdpp.exe 92 PID 2348 wrote to memory of 1292 2348 flrfllf.exe 93 PID 2348 wrote to memory of 1292 2348 flrfllf.exe 93 PID 2348 wrote to memory of 1292 2348 flrfllf.exe 93 PID 1292 wrote to memory of 4724 1292 hhbhtt.exe 94 PID 1292 wrote to memory of 4724 1292 hhbhtt.exe 94 PID 1292 wrote to memory of 4724 1292 hhbhtt.exe 94 PID 4724 wrote to memory of 2196 4724 vddpj.exe 95 PID 4724 wrote to memory of 2196 4724 vddpj.exe 95 PID 4724 wrote to memory of 2196 4724 vddpj.exe 95 PID 2196 wrote to memory of 1620 2196 5tttnh.exe 96 PID 2196 wrote to memory of 1620 2196 5tttnh.exe 96 PID 2196 wrote to memory of 1620 2196 5tttnh.exe 96 PID 1620 wrote to memory of 2208 1620 1hnnnt.exe 97 PID 1620 wrote to memory of 2208 1620 1hnnnt.exe 97 PID 1620 wrote to memory of 2208 1620 1hnnnt.exe 97 PID 2208 wrote to memory of 3664 2208 jppjp.exe 98 PID 2208 wrote to memory of 3664 2208 jppjp.exe 98 PID 2208 wrote to memory of 3664 2208 jppjp.exe 98 PID 3664 wrote to memory of 4928 3664 xllfffx.exe 99 PID 3664 wrote to memory of 4928 3664 xllfffx.exe 99 PID 3664 wrote to memory of 4928 3664 xllfffx.exe 99 PID 4928 wrote to memory of 3488 4928 3tbnnh.exe 100 PID 4928 wrote to memory of 3488 4928 3tbnnh.exe 100 PID 4928 wrote to memory of 3488 4928 3tbnnh.exe 100 PID 3488 wrote to memory of 4220 3488 dvjjv.exe 101 PID 3488 wrote to memory of 4220 3488 dvjjv.exe 101 PID 3488 wrote to memory of 4220 3488 dvjjv.exe 101 PID 4220 wrote to memory of 3304 4220 bhttnt.exe 102 PID 4220 wrote to memory of 3304 4220 bhttnt.exe 102 PID 4220 wrote to memory of 3304 4220 bhttnt.exe 102 PID 3304 wrote to memory of 1096 3304 pjjjj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\cef90047963c9cf67e4ee9120c8196c04c6386304ec4f512d0a9ffe8d58a5894.exe"C:\Users\Admin\AppData\Local\Temp\cef90047963c9cf67e4ee9120c8196c04c6386304ec4f512d0a9ffe8d58a5894.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\dpvvv.exec:\dpvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\dpppj.exec:\dpppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\hhbthb.exec:\hhbthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\jjpjj.exec:\jjpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\jvdvj.exec:\jvdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\hhnhnb.exec:\hhnhnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\lxlrllx.exec:\lxlrllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\nttnbn.exec:\nttnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\7xrxlrx.exec:\7xrxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\jpdpp.exec:\jpdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\flrfllf.exec:\flrfllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\hhbhtt.exec:\hhbhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\vddpj.exec:\vddpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\5tttnh.exec:\5tttnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\1hnnnt.exec:\1hnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jppjp.exec:\jppjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xllfffx.exec:\xllfffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\3tbnnh.exec:\3tbnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\dvjjv.exec:\dvjjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\bhttnt.exec:\bhttnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\pjjjj.exec:\pjjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\lrlrxlx.exec:\lrlrxlx.exe23⤵
- Executes dropped EXE
PID:1096 -
\??\c:\bntbhn.exec:\bntbhn.exe24⤵
- Executes dropped EXE
PID:3364 -
\??\c:\dddpv.exec:\dddpv.exe25⤵
- Executes dropped EXE
PID:5028 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe26⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rlxrlrl.exec:\rlxrlrl.exe27⤵
- Executes dropped EXE
PID:4564 -
\??\c:\lxffffx.exec:\lxffffx.exe28⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rrffflx.exec:\rrffflx.exe29⤵
- Executes dropped EXE
PID:396 -
\??\c:\hhtbhh.exec:\hhtbhh.exe30⤵
- Executes dropped EXE
PID:1464 -
\??\c:\ppjpv.exec:\ppjpv.exe31⤵
- Executes dropped EXE
PID:4588 -
\??\c:\jpjdj.exec:\jpjdj.exe32⤵
- Executes dropped EXE
PID:456 -
\??\c:\rrrxxff.exec:\rrrxxff.exe33⤵
- Executes dropped EXE
PID:4984 -
\??\c:\1tttnb.exec:\1tttnb.exe34⤵
- Executes dropped EXE
PID:2436 -
\??\c:\5xlfffl.exec:\5xlfffl.exe35⤵
- Executes dropped EXE
PID:1304 -
\??\c:\7jpjd.exec:\7jpjd.exe36⤵
- Executes dropped EXE
PID:3832 -
\??\c:\xflllrr.exec:\xflllrr.exe37⤵
- Executes dropped EXE
PID:5036 -
\??\c:\ddppd.exec:\ddppd.exe38⤵
- Executes dropped EXE
PID:3792 -
\??\c:\pdppp.exec:\pdppp.exe39⤵
- Executes dropped EXE
PID:1832 -
\??\c:\bttnnt.exec:\bttnnt.exe40⤵
- Executes dropped EXE
PID:4104 -
\??\c:\dvvvv.exec:\dvvvv.exe41⤵
- Executes dropped EXE
PID:3716 -
\??\c:\rrllrrx.exec:\rrllrrx.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\tthhtt.exec:\tthhtt.exe43⤵
- Executes dropped EXE
PID:3656 -
\??\c:\jdvdj.exec:\jdvdj.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9xfxxff.exec:\9xfxxff.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pdjpp.exec:\pdjpp.exe46⤵
- Executes dropped EXE
PID:1504 -
\??\c:\lrrfrlr.exec:\lrrfrlr.exe47⤵
- Executes dropped EXE
PID:4872 -
\??\c:\lxllflf.exec:\lxllflf.exe48⤵
- Executes dropped EXE
PID:4800 -
\??\c:\nhnnhn.exec:\nhnnhn.exe49⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vdjjj.exec:\vdjjj.exe50⤵
- Executes dropped EXE
PID:5096 -
\??\c:\xlffffx.exec:\xlffffx.exe51⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nhhhhh.exec:\nhhhhh.exe52⤵
- Executes dropped EXE
PID:4392 -
\??\c:\vvvvp.exec:\vvvvp.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\1pjdd.exec:\1pjdd.exe54⤵
- Executes dropped EXE
PID:3156 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe55⤵
- Executes dropped EXE
PID:1904 -
\??\c:\btbbhn.exec:\btbbhn.exe56⤵
- Executes dropped EXE
PID:4164 -
\??\c:\jvvjv.exec:\jvvjv.exe57⤵
- Executes dropped EXE
PID:3876 -
\??\c:\llrrrxl.exec:\llrrrxl.exe58⤵
- Executes dropped EXE
PID:4168 -
\??\c:\thntbt.exec:\thntbt.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pppvv.exec:\pppvv.exe60⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lffflff.exec:\lffflff.exe61⤵
- Executes dropped EXE
PID:5068 -
\??\c:\flrfrrf.exec:\flrfrrf.exe62⤵
- Executes dropped EXE
PID:3572 -
\??\c:\hbthtn.exec:\hbthtn.exe63⤵
- Executes dropped EXE
PID:624 -
\??\c:\vjvpj.exec:\vjvpj.exe64⤵
- Executes dropped EXE
PID:1560 -
\??\c:\9xlllrx.exec:\9xlllrx.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1636 -
\??\c:\nhbbnb.exec:\nhbbnb.exe66⤵PID:3308
-
\??\c:\djvvd.exec:\djvvd.exe67⤵PID:2092
-
\??\c:\xxllxrr.exec:\xxllxrr.exe68⤵PID:3988
-
\??\c:\xxfxrrx.exec:\xxfxrrx.exe69⤵PID:1456
-
\??\c:\nnbbtb.exec:\nnbbtb.exe70⤵PID:2756
-
\??\c:\xfrrxfl.exec:\xfrrxfl.exe71⤵PID:3948
-
\??\c:\lflxxll.exec:\lflxxll.exe72⤵PID:3780
-
\??\c:\hhhhbh.exec:\hhhhbh.exe73⤵PID:1616
-
\??\c:\vjjdd.exec:\vjjdd.exe74⤵PID:3788
-
\??\c:\lrrxxff.exec:\lrrxxff.exe75⤵PID:2408
-
\??\c:\bbhhnn.exec:\bbhhnn.exe76⤵PID:3960
-
\??\c:\hbbttb.exec:\hbbttb.exe77⤵PID:3252
-
\??\c:\dvpvv.exec:\dvpvv.exe78⤵PID:2220
-
\??\c:\rfrrxff.exec:\rfrrxff.exe79⤵PID:212
-
\??\c:\lllllrr.exec:\lllllrr.exe80⤵PID:2068
-
\??\c:\ttbbhn.exec:\ttbbhn.exe81⤵PID:1344
-
\??\c:\jpvvp.exec:\jpvvp.exe82⤵PID:4400
-
\??\c:\5xlfxxr.exec:\5xlfxxr.exe83⤵PID:3304
-
\??\c:\flllfll.exec:\flllfll.exe84⤵PID:1932
-
\??\c:\ppvvv.exec:\ppvvv.exe85⤵PID:4476
-
\??\c:\dpvdj.exec:\dpvdj.exe86⤵PID:3364
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe87⤵PID:2028
-
\??\c:\hbnhbb.exec:\hbnhbb.exe88⤵PID:4920
-
\??\c:\jpjjp.exec:\jpjjp.exe89⤵PID:5020
-
\??\c:\llrlfll.exec:\llrlfll.exe90⤵
- System Location Discovery: System Language Discovery
PID:4564 -
\??\c:\tbnhnt.exec:\tbnhnt.exe91⤵PID:3956
-
\??\c:\tttttb.exec:\tttttb.exe92⤵PID:1216
-
\??\c:\vjddv.exec:\vjddv.exe93⤵PID:2736
-
\??\c:\xlxrlll.exec:\xlxrlll.exe94⤵PID:1644
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe95⤵PID:4592
-
\??\c:\thntbn.exec:\thntbn.exe96⤵PID:2848
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe97⤵PID:4284
-
\??\c:\hhbthh.exec:\hhbthh.exe98⤵PID:920
-
\??\c:\5bnnhh.exec:\5bnnhh.exe99⤵PID:2752
-
\??\c:\3dvvp.exec:\3dvvp.exe100⤵PID:3332
-
\??\c:\hhhttn.exec:\hhhttn.exe101⤵PID:4036
-
\??\c:\7nbbbb.exec:\7nbbbb.exe102⤵PID:3448
-
\??\c:\1pppj.exec:\1pppj.exe103⤵PID:5036
-
\??\c:\rxffrfl.exec:\rxffrfl.exe104⤵PID:3792
-
\??\c:\ntbhht.exec:\ntbhht.exe105⤵PID:4696
-
\??\c:\djvdp.exec:\djvdp.exe106⤵PID:5092
-
\??\c:\lrxxflr.exec:\lrxxflr.exe107⤵PID:5108
-
\??\c:\hnnhhh.exec:\hnnhhh.exe108⤵PID:560
-
\??\c:\vpddd.exec:\vpddd.exe109⤵PID:2056
-
\??\c:\llffllr.exec:\llffllr.exe110⤵PID:4584
-
\??\c:\hhbttt.exec:\hhbttt.exe111⤵PID:2532
-
\??\c:\jjjdj.exec:\jjjdj.exe112⤵PID:2688
-
\??\c:\llffrrr.exec:\llffrrr.exe113⤵PID:2472
-
\??\c:\tbnhtn.exec:\tbnhtn.exe114⤵PID:1732
-
\??\c:\dddpj.exec:\dddpj.exe115⤵PID:4684
-
\??\c:\lrrlllx.exec:\lrrlllx.exe116⤵PID:1000
-
\??\c:\hhtttt.exec:\hhtttt.exe117⤵PID:4804
-
\??\c:\bnttbn.exec:\bnttbn.exe118⤵PID:1136
-
\??\c:\ddvvp.exec:\ddvvp.exe119⤵PID:2052
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe120⤵PID:2176
-
\??\c:\ddvjd.exec:\ddvjd.exe121⤵PID:2924
-
\??\c:\lfrlfrl.exec:\lfrlfrl.exe122⤵PID:4464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-