Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 22:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56eddd9a026683d3b3bca08f8d8190284182fbd169938726263824e21359b0c7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
56eddd9a026683d3b3bca08f8d8190284182fbd169938726263824e21359b0c7.exe
-
Size
453KB
-
MD5
c5635b363b4ae0ae521742f05336de72
-
SHA1
e730427e712324952ca17a53fea9a5ff176b43b3
-
SHA256
56eddd9a026683d3b3bca08f8d8190284182fbd169938726263824e21359b0c7
-
SHA512
08f0671c25e0bddbe4b69e2532975ecdc30b599862c25694bff2504b9e7644a15e26b8f107fff79e5e18fd3731286ce9e6bc2e05773cebbfbf3db1b39f16245c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2944-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-828-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-980-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-1053-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-1292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2864 fxxlxxr.exe 1708 thbtnn.exe 2216 djpvp.exe 1168 lfrrrxl.exe 3548 pjjdv.exe 2180 nhnnnb.exe 4728 bhbthh.exe 4568 frxrrxr.exe 764 pdjdd.exe 3104 9ppdd.exe 1084 1dpdv.exe 2508 bbhntt.exe 2104 pjpjd.exe 2876 ffffffx.exe 2280 btntnh.exe 2444 bnnnnn.exe 2432 dvppj.exe 1420 btnnnn.exe 3864 vpvpp.exe 4944 xlfxxxr.exe 3944 djvvv.exe 2248 xfrrxfr.exe 4988 7bhbbb.exe 1840 3flllrx.exe 4312 1pjvp.exe 4432 fxfxxrr.exe 5064 jdjjd.exe 3008 9ntnhh.exe 2168 ffxrrxf.exe 1036 xxfllrl.exe 1324 nbhbtt.exe 320 rlrrllr.exe 3684 pjjjv.exe 4700 dvjjd.exe 744 flxxfff.exe 2584 tnhbbn.exe 4336 pdvpp.exe 2720 1rfxlrx.exe 4252 7rrrlrr.exe 2076 7hhbbb.exe 4632 1jvvp.exe 5004 fxrrflr.exe 4772 bbtttt.exe 3872 jpddv.exe 4792 rrllrff.exe 2892 nhbbtt.exe 4816 hnbtnn.exe 4564 jvjdp.exe 1580 1rxrrrr.exe 3368 9bttht.exe 4216 9vjdv.exe 2008 rrxxxff.exe 4292 nnbbbh.exe 4348 pvvpj.exe 2740 fxrrrxx.exe 2932 bthhhb.exe 2300 ddvvd.exe 2064 xxrfxll.exe 468 hnbtht.exe 1528 7vvpd.exe 1168 5rrrrxx.exe 3596 tbhhbh.exe 2160 hbhbtt.exe 3584 5pvvv.exe -
resource yara_rule behavioral2/memory/2944-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-980-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2864 2944 56eddd9a026683d3b3bca08f8d8190284182fbd169938726263824e21359b0c7.exe 81 PID 2944 wrote to memory of 2864 2944 56eddd9a026683d3b3bca08f8d8190284182fbd169938726263824e21359b0c7.exe 81 PID 2944 wrote to memory of 2864 2944 56eddd9a026683d3b3bca08f8d8190284182fbd169938726263824e21359b0c7.exe 81 PID 2864 wrote to memory of 1708 2864 fxxlxxr.exe 82 PID 2864 wrote to memory of 1708 2864 fxxlxxr.exe 82 PID 2864 wrote to memory of 1708 2864 fxxlxxr.exe 82 PID 1708 wrote to memory of 2216 1708 thbtnn.exe 83 PID 1708 wrote to memory of 2216 1708 thbtnn.exe 83 PID 1708 wrote to memory of 2216 1708 thbtnn.exe 83 PID 2216 wrote to memory of 1168 2216 djpvp.exe 84 PID 2216 wrote to memory of 1168 2216 djpvp.exe 84 PID 2216 wrote to memory of 1168 2216 djpvp.exe 84 PID 1168 wrote to memory of 3548 1168 lfrrrxl.exe 85 PID 1168 wrote to memory of 3548 1168 lfrrrxl.exe 85 PID 1168 wrote to memory of 3548 1168 lfrrrxl.exe 85 PID 3548 wrote to memory of 2180 3548 pjjdv.exe 86 PID 3548 wrote to memory of 2180 3548 pjjdv.exe 86 PID 3548 wrote to memory of 2180 3548 pjjdv.exe 86 PID 2180 wrote to memory of 4728 2180 nhnnnb.exe 87 PID 2180 wrote to memory of 4728 2180 nhnnnb.exe 87 PID 2180 wrote to memory of 4728 2180 nhnnnb.exe 87 PID 4728 wrote to memory of 4568 4728 bhbthh.exe 88 PID 4728 wrote to memory of 4568 4728 bhbthh.exe 88 PID 4728 wrote to memory of 4568 4728 bhbthh.exe 88 PID 4568 wrote to memory of 764 4568 frxrrxr.exe 89 PID 4568 wrote to memory of 764 4568 frxrrxr.exe 89 PID 4568 wrote to memory of 764 4568 frxrrxr.exe 89 PID 764 wrote to memory of 3104 764 pdjdd.exe 90 PID 764 wrote to memory of 3104 764 pdjdd.exe 90 PID 764 wrote to memory of 3104 764 pdjdd.exe 90 PID 3104 wrote to memory of 1084 3104 9ppdd.exe 91 PID 3104 wrote to memory of 1084 3104 9ppdd.exe 91 PID 3104 wrote to memory of 1084 3104 9ppdd.exe 91 PID 1084 wrote to memory of 2508 1084 1dpdv.exe 92 PID 1084 wrote to memory of 2508 1084 1dpdv.exe 92 PID 1084 wrote to memory of 2508 1084 1dpdv.exe 92 PID 2508 wrote to memory of 2104 2508 bbhntt.exe 93 PID 2508 wrote to memory of 2104 2508 bbhntt.exe 93 PID 2508 wrote to memory of 2104 2508 bbhntt.exe 93 PID 2104 wrote to memory of 2876 2104 pjpjd.exe 94 PID 2104 wrote to memory of 2876 2104 pjpjd.exe 94 PID 2104 wrote to memory of 2876 2104 pjpjd.exe 94 PID 2876 wrote to memory of 2280 2876 ffffffx.exe 95 PID 2876 wrote to memory of 2280 2876 ffffffx.exe 95 PID 2876 wrote to memory of 2280 2876 ffffffx.exe 95 PID 2280 wrote to memory of 2444 2280 btntnh.exe 96 PID 2280 wrote to memory of 2444 2280 btntnh.exe 96 PID 2280 wrote to memory of 2444 2280 btntnh.exe 96 PID 2444 wrote to memory of 2432 2444 bnnnnn.exe 97 PID 2444 wrote to memory of 2432 2444 bnnnnn.exe 97 PID 2444 wrote to memory of 2432 2444 bnnnnn.exe 97 PID 2432 wrote to memory of 1420 2432 dvppj.exe 98 PID 2432 wrote to memory of 1420 2432 dvppj.exe 98 PID 2432 wrote to memory of 1420 2432 dvppj.exe 98 PID 1420 wrote to memory of 3864 1420 btnnnn.exe 99 PID 1420 wrote to memory of 3864 1420 btnnnn.exe 99 PID 1420 wrote to memory of 3864 1420 btnnnn.exe 99 PID 3864 wrote to memory of 4944 3864 vpvpp.exe 100 PID 3864 wrote to memory of 4944 3864 vpvpp.exe 100 PID 3864 wrote to memory of 4944 3864 vpvpp.exe 100 PID 4944 wrote to memory of 3944 4944 xlfxxxr.exe 101 PID 4944 wrote to memory of 3944 4944 xlfxxxr.exe 101 PID 4944 wrote to memory of 3944 4944 xlfxxxr.exe 101 PID 3944 wrote to memory of 2248 3944 djvvv.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\56eddd9a026683d3b3bca08f8d8190284182fbd169938726263824e21359b0c7.exe"C:\Users\Admin\AppData\Local\Temp\56eddd9a026683d3b3bca08f8d8190284182fbd169938726263824e21359b0c7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\fxxlxxr.exec:\fxxlxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\thbtnn.exec:\thbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\djpvp.exec:\djpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\lfrrrxl.exec:\lfrrrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\pjjdv.exec:\pjjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\nhnnnb.exec:\nhnnnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\bhbthh.exec:\bhbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\frxrrxr.exec:\frxrrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\pdjdd.exec:\pdjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\9ppdd.exec:\9ppdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\1dpdv.exec:\1dpdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\bbhntt.exec:\bbhntt.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\pjpjd.exec:\pjpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\ffffffx.exec:\ffffffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\btntnh.exec:\btntnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\bnnnnn.exec:\bnnnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\dvppj.exec:\dvppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\btnnnn.exec:\btnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\vpvpp.exec:\vpvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\djvvv.exec:\djvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\xfrrxfr.exec:\xfrrxfr.exe23⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7bhbbb.exec:\7bhbbb.exe24⤵
- Executes dropped EXE
PID:4988 -
\??\c:\3flllrx.exec:\3flllrx.exe25⤵
- Executes dropped EXE
PID:1840 -
\??\c:\1pjvp.exec:\1pjvp.exe26⤵
- Executes dropped EXE
PID:4312 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe27⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jdjjd.exec:\jdjjd.exe28⤵
- Executes dropped EXE
PID:5064 -
\??\c:\9ntnhh.exec:\9ntnhh.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ffxrrxf.exec:\ffxrrxf.exe30⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xxfllrl.exec:\xxfllrl.exe31⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nbhbtt.exec:\nbhbtt.exe32⤵
- Executes dropped EXE
PID:1324 -
\??\c:\rlrrllr.exec:\rlrrllr.exe33⤵
- Executes dropped EXE
PID:320 -
\??\c:\pjjjv.exec:\pjjjv.exe34⤵
- Executes dropped EXE
PID:3684 -
\??\c:\dvjjd.exec:\dvjjd.exe35⤵
- Executes dropped EXE
PID:4700 -
\??\c:\flxxfff.exec:\flxxfff.exe36⤵
- Executes dropped EXE
PID:744 -
\??\c:\tnhbbn.exec:\tnhbbn.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pdvpp.exec:\pdvpp.exe38⤵
- Executes dropped EXE
PID:4336 -
\??\c:\1rfxlrx.exec:\1rfxlrx.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7rrrlrr.exec:\7rrrlrr.exe40⤵
- Executes dropped EXE
PID:4252 -
\??\c:\7hhbbb.exec:\7hhbbb.exe41⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1jvvp.exec:\1jvvp.exe42⤵
- Executes dropped EXE
PID:4632 -
\??\c:\fxrrflr.exec:\fxrrflr.exe43⤵
- Executes dropped EXE
PID:5004 -
\??\c:\bbtttt.exec:\bbtttt.exe44⤵
- Executes dropped EXE
PID:4772 -
\??\c:\jpddv.exec:\jpddv.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3872 -
\??\c:\rrllrff.exec:\rrllrff.exe46⤵
- Executes dropped EXE
PID:4792 -
\??\c:\nhbbtt.exec:\nhbbtt.exe47⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hnbtnn.exec:\hnbtnn.exe48⤵
- Executes dropped EXE
PID:4816 -
\??\c:\jvjdp.exec:\jvjdp.exe49⤵
- Executes dropped EXE
PID:4564 -
\??\c:\1rxrrrr.exec:\1rxrrrr.exe50⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9bttht.exec:\9bttht.exe51⤵
- Executes dropped EXE
PID:3368 -
\??\c:\9vjdv.exec:\9vjdv.exe52⤵
- Executes dropped EXE
PID:4216 -
\??\c:\rrxxxff.exec:\rrxxxff.exe53⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nnbbbh.exec:\nnbbbh.exe54⤵
- Executes dropped EXE
PID:4292 -
\??\c:\pvvpj.exec:\pvvpj.exe55⤵
- Executes dropped EXE
PID:4348 -
\??\c:\fxrrrxx.exec:\fxrrrxx.exe56⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bthhhb.exec:\bthhhb.exe57⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ddvvd.exec:\ddvvd.exe58⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xxrfxll.exec:\xxrfxll.exe59⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hnbtht.exec:\hnbtht.exe60⤵
- Executes dropped EXE
PID:468 -
\??\c:\7vvpd.exec:\7vvpd.exe61⤵
- Executes dropped EXE
PID:1528 -
\??\c:\5rrrrxx.exec:\5rrrrxx.exe62⤵
- Executes dropped EXE
PID:1168 -
\??\c:\tbhhbh.exec:\tbhhbh.exe63⤵
- Executes dropped EXE
PID:3596 -
\??\c:\hbhbtt.exec:\hbhbtt.exe64⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5pvvv.exec:\5pvvv.exe65⤵
- Executes dropped EXE
PID:3584 -
\??\c:\5lrllrr.exec:\5lrllrr.exe66⤵PID:2180
-
\??\c:\9hhbtb.exec:\9hhbtb.exe67⤵PID:3516
-
\??\c:\pjddj.exec:\pjddj.exe68⤵PID:3156
-
\??\c:\jvjjd.exec:\jvjjd.exe69⤵PID:1740
-
\??\c:\fllfxfx.exec:\fllfxfx.exe70⤵PID:5036
-
\??\c:\1hnhhh.exec:\1hnhhh.exe71⤵PID:2612
-
\??\c:\nhbbtb.exec:\nhbbtb.exe72⤵PID:4748
-
\??\c:\rrlfrrr.exec:\rrlfrrr.exe73⤵PID:2308
-
\??\c:\btttbb.exec:\btttbb.exe74⤵PID:1552
-
\??\c:\vvjjd.exec:\vvjjd.exe75⤵PID:2876
-
\??\c:\dppdd.exec:\dppdd.exe76⤵PID:2200
-
\??\c:\rxllxff.exec:\rxllxff.exe77⤵PID:4640
-
\??\c:\9hbbth.exec:\9hbbth.exe78⤵PID:2280
-
\??\c:\hhbbnn.exec:\hhbbnn.exe79⤵PID:1204
-
\??\c:\pvvvv.exec:\pvvvv.exe80⤵PID:2204
-
\??\c:\llrrrrr.exec:\llrrrrr.exe81⤵PID:4484
-
\??\c:\hnhbbh.exec:\hnhbbh.exe82⤵PID:1420
-
\??\c:\1pvvv.exec:\1pvvv.exe83⤵PID:2832
-
\??\c:\vdpdv.exec:\vdpdv.exe84⤵PID:3128
-
\??\c:\xrllrxf.exec:\xrllrxf.exe85⤵PID:4664
-
\??\c:\ttttnn.exec:\ttttnn.exe86⤵PID:1956
-
\??\c:\9dvvp.exec:\9dvvp.exe87⤵PID:1636
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe88⤵PID:4060
-
\??\c:\7rrrllf.exec:\7rrrllf.exe89⤵PID:4108
-
\??\c:\bhtnhh.exec:\bhtnhh.exe90⤵PID:5100
-
\??\c:\vvpvv.exec:\vvpvv.exe91⤵PID:4296
-
\??\c:\ffxrxff.exec:\ffxrxff.exe92⤵
- System Location Discovery: System Language Discovery
PID:4420 -
\??\c:\nbnnbh.exec:\nbnnbh.exe93⤵PID:2624
-
\??\c:\bhtnbb.exec:\bhtnbb.exe94⤵PID:2360
-
\??\c:\dvdvp.exec:\dvdvp.exe95⤵PID:4712
-
\??\c:\1lxfxxr.exec:\1lxfxxr.exe96⤵PID:2768
-
\??\c:\bhttnn.exec:\bhttnn.exe97⤵PID:1784
-
\??\c:\1nbttb.exec:\1nbttb.exe98⤵PID:2636
-
\??\c:\ddjvd.exec:\ddjvd.exe99⤵PID:2616
-
\??\c:\frxffxx.exec:\frxffxx.exe100⤵PID:4036
-
\??\c:\bthhhh.exec:\bthhhh.exe101⤵PID:932
-
\??\c:\vvpjd.exec:\vvpjd.exe102⤵PID:2452
-
\??\c:\lfffxxr.exec:\lfffxxr.exe103⤵
- System Location Discovery: System Language Discovery
PID:1652 -
\??\c:\9lrffff.exec:\9lrffff.exe104⤵PID:4592
-
\??\c:\bntnbb.exec:\bntnbb.exe105⤵PID:2584
-
\??\c:\vdjdp.exec:\vdjdp.exe106⤵PID:4032
-
\??\c:\7xlrlrr.exec:\7xlrlrr.exe107⤵PID:2720
-
\??\c:\tttttt.exec:\tttttt.exe108⤵PID:2176
-
\??\c:\jjjdd.exec:\jjjdd.exe109⤵PID:2076
-
\??\c:\ddjjj.exec:\ddjjj.exe110⤵PID:3400
-
\??\c:\flrrrrx.exec:\flrrrrx.exe111⤵PID:4804
-
\??\c:\3htttb.exec:\3htttb.exe112⤵PID:4772
-
\??\c:\jjvpj.exec:\jjvpj.exe113⤵PID:3872
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe114⤵PID:4792
-
\??\c:\3thtbt.exec:\3thtbt.exe115⤵PID:4368
-
\??\c:\ttbttt.exec:\ttbttt.exe116⤵PID:3092
-
\??\c:\vvppv.exec:\vvppv.exe117⤵PID:1912
-
\??\c:\xrfflll.exec:\xrfflll.exe118⤵PID:1216
-
\??\c:\hthtnn.exec:\hthtnn.exe119⤵
- System Location Discovery: System Language Discovery
PID:884 -
\??\c:\hhtttb.exec:\hhtttb.exe120⤵PID:2172
-
\??\c:\ddvvp.exec:\ddvvp.exe121⤵PID:4356
-
\??\c:\rxxllxr.exec:\rxxllxr.exe122⤵PID:1408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-