Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe
-
Size
455KB
-
MD5
c7f1f4b8ae83f4a1949435c9192845a0
-
SHA1
7fc551e6b21a57f222aa3f10d744ea20b0b9ebbf
-
SHA256
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67
-
SHA512
0c22de0dac2048c13cd8f44f1c46f009a981b85c1ea34a55708be5e857a24679e8c1141c94c9cf5ae2d9142eea5e231d1c96dc83ddf5b5e2d164dd219799ca34
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR4:q7Tc2NYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1968-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-806-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-1272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4780 vvjjj.exe 4920 lrxrffl.exe 3512 bbbbbb.exe 5068 1hbthh.exe 2700 1ddpd.exe 1820 rlxlllx.exe 4312 5hhhbb.exe 4812 vjjvj.exe 2432 frffffl.exe 1980 frrfrlx.exe 2724 ntbnbt.exe 3940 9jpjv.exe 1320 pvpdp.exe 2576 tthtbb.exe 2208 5btntt.exe 1004 pvdvp.exe 1540 vvvjd.exe 5084 jvpdp.exe 948 rfxlfxr.exe 3616 tttnhb.exe 4892 jvvdv.exe 4440 dvvvj.exe 1588 fxlxrrr.exe 468 htbnhb.exe 4796 ttntnh.exe 3384 btttht.exe 2568 rrrxllx.exe 2716 nhhnbt.exe 2736 ppdvp.exe 1548 rrrfrfx.exe 4220 pdjvj.exe 4540 1hhtth.exe 2720 jjpdv.exe 4636 fxrxlfl.exe 2608 tbbnbt.exe 3596 vpppj.exe 1244 fflxxrx.exe 1956 nnbnbt.exe 5076 vvjpp.exe 4424 xxrffxf.exe 3584 xxfrrll.exe 4104 hhhbtn.exe 4272 jjpvp.exe 512 9jvjv.exe 3848 xrxllfl.exe 3264 3hbtnn.exe 3100 pjpdp.exe 4684 lxxfrll.exe 4832 rxxxrlx.exe 1532 nhhtht.exe 3812 7vpjv.exe 4628 1rlxlfx.exe 2356 fllrlxr.exe 2320 bthbnb.exe 1324 dppdj.exe 4036 ffxxlfr.exe 4688 bhnhtn.exe 1020 vvdvj.exe 4404 rflfxrl.exe 1976 htttnt.exe 3940 hhnhtn.exe 5060 pjpdj.exe 1240 lrxlrlx.exe 4236 9fllxfr.exe -
resource yara_rule behavioral2/memory/1968-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-1158-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 4780 1968 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe 83 PID 1968 wrote to memory of 4780 1968 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe 83 PID 1968 wrote to memory of 4780 1968 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe 83 PID 4780 wrote to memory of 4920 4780 vvjjj.exe 84 PID 4780 wrote to memory of 4920 4780 vvjjj.exe 84 PID 4780 wrote to memory of 4920 4780 vvjjj.exe 84 PID 4920 wrote to memory of 3512 4920 lrxrffl.exe 85 PID 4920 wrote to memory of 3512 4920 lrxrffl.exe 85 PID 4920 wrote to memory of 3512 4920 lrxrffl.exe 85 PID 3512 wrote to memory of 5068 3512 bbbbbb.exe 86 PID 3512 wrote to memory of 5068 3512 bbbbbb.exe 86 PID 3512 wrote to memory of 5068 3512 bbbbbb.exe 86 PID 5068 wrote to memory of 2700 5068 1hbthh.exe 87 PID 5068 wrote to memory of 2700 5068 1hbthh.exe 87 PID 5068 wrote to memory of 2700 5068 1hbthh.exe 87 PID 2700 wrote to memory of 1820 2700 1ddpd.exe 88 PID 2700 wrote to memory of 1820 2700 1ddpd.exe 88 PID 2700 wrote to memory of 1820 2700 1ddpd.exe 88 PID 1820 wrote to memory of 4312 1820 rlxlllx.exe 89 PID 1820 wrote to memory of 4312 1820 rlxlllx.exe 89 PID 1820 wrote to memory of 4312 1820 rlxlllx.exe 89 PID 4312 wrote to memory of 4812 4312 5hhhbb.exe 90 PID 4312 wrote to memory of 4812 4312 5hhhbb.exe 90 PID 4312 wrote to memory of 4812 4312 5hhhbb.exe 90 PID 4812 wrote to memory of 2432 4812 vjjvj.exe 91 PID 4812 wrote to memory of 2432 4812 vjjvj.exe 91 PID 4812 wrote to memory of 2432 4812 vjjvj.exe 91 PID 2432 wrote to memory of 1980 2432 frffffl.exe 92 PID 2432 wrote to memory of 1980 2432 frffffl.exe 92 PID 2432 wrote to memory of 1980 2432 frffffl.exe 92 PID 1980 wrote to memory of 2724 1980 frrfrlx.exe 93 PID 1980 wrote to memory of 2724 1980 frrfrlx.exe 93 PID 1980 wrote to memory of 2724 1980 frrfrlx.exe 93 PID 2724 wrote to memory of 3940 2724 ntbnbt.exe 94 PID 2724 wrote to memory of 3940 2724 ntbnbt.exe 94 PID 2724 wrote to memory of 3940 2724 ntbnbt.exe 94 PID 3940 wrote to memory of 1320 3940 9jpjv.exe 95 PID 3940 wrote to memory of 1320 3940 9jpjv.exe 95 PID 3940 wrote to memory of 1320 3940 9jpjv.exe 95 PID 1320 wrote to memory of 2576 1320 pvpdp.exe 96 PID 1320 wrote to memory of 2576 1320 pvpdp.exe 96 PID 1320 wrote to memory of 2576 1320 pvpdp.exe 96 PID 2576 wrote to memory of 2208 2576 tthtbb.exe 97 PID 2576 wrote to memory of 2208 2576 tthtbb.exe 97 PID 2576 wrote to memory of 2208 2576 tthtbb.exe 97 PID 2208 wrote to memory of 1004 2208 5btntt.exe 98 PID 2208 wrote to memory of 1004 2208 5btntt.exe 98 PID 2208 wrote to memory of 1004 2208 5btntt.exe 98 PID 1004 wrote to memory of 1540 1004 pvdvp.exe 99 PID 1004 wrote to memory of 1540 1004 pvdvp.exe 99 PID 1004 wrote to memory of 1540 1004 pvdvp.exe 99 PID 1540 wrote to memory of 5084 1540 vvvjd.exe 100 PID 1540 wrote to memory of 5084 1540 vvvjd.exe 100 PID 1540 wrote to memory of 5084 1540 vvvjd.exe 100 PID 5084 wrote to memory of 948 5084 jvpdp.exe 101 PID 5084 wrote to memory of 948 5084 jvpdp.exe 101 PID 5084 wrote to memory of 948 5084 jvpdp.exe 101 PID 948 wrote to memory of 3616 948 rfxlfxr.exe 102 PID 948 wrote to memory of 3616 948 rfxlfxr.exe 102 PID 948 wrote to memory of 3616 948 rfxlfxr.exe 102 PID 3616 wrote to memory of 4892 3616 tttnhb.exe 103 PID 3616 wrote to memory of 4892 3616 tttnhb.exe 103 PID 3616 wrote to memory of 4892 3616 tttnhb.exe 103 PID 4892 wrote to memory of 4440 4892 jvvdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe"C:\Users\Admin\AppData\Local\Temp\08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\vvjjj.exec:\vvjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\lrxrffl.exec:\lrxrffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\bbbbbb.exec:\bbbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\1hbthh.exec:\1hbthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\1ddpd.exec:\1ddpd.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rlxlllx.exec:\rlxlllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\5hhhbb.exec:\5hhhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\vjjvj.exec:\vjjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\frffffl.exec:\frffffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\frrfrlx.exec:\frrfrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\ntbnbt.exec:\ntbnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\9jpjv.exec:\9jpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\pvpdp.exec:\pvpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\tthtbb.exec:\tthtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\5btntt.exec:\5btntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\pvdvp.exec:\pvdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\vvvjd.exec:\vvvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\jvpdp.exec:\jvpdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\rfxlfxr.exec:\rfxlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\tttnhb.exec:\tttnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\jvvdv.exec:\jvvdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\dvvvj.exec:\dvvvj.exe23⤵
- Executes dropped EXE
PID:4440 -
\??\c:\fxlxrrr.exec:\fxlxrrr.exe24⤵
- Executes dropped EXE
PID:1588 -
\??\c:\htbnhb.exec:\htbnhb.exe25⤵
- Executes dropped EXE
PID:468 -
\??\c:\ttntnh.exec:\ttntnh.exe26⤵
- Executes dropped EXE
PID:4796 -
\??\c:\btttht.exec:\btttht.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3384 -
\??\c:\rrrxllx.exec:\rrrxllx.exe28⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nhhnbt.exec:\nhhnbt.exe29⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ppdvp.exec:\ppdvp.exe30⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rrrfrfx.exec:\rrrfrfx.exe31⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pdjvj.exec:\pdjvj.exe32⤵
- Executes dropped EXE
PID:4220 -
\??\c:\1hhtth.exec:\1hhtth.exe33⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jjpdv.exec:\jjpdv.exe34⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxrxlfl.exec:\fxrxlfl.exe35⤵
- Executes dropped EXE
PID:4636 -
\??\c:\tbbnbt.exec:\tbbnbt.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vpppj.exec:\vpppj.exe37⤵
- Executes dropped EXE
PID:3596 -
\??\c:\fflxxrx.exec:\fflxxrx.exe38⤵
- Executes dropped EXE
PID:1244 -
\??\c:\nnbnbt.exec:\nnbnbt.exe39⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vvjpp.exec:\vvjpp.exe40⤵
- Executes dropped EXE
PID:5076 -
\??\c:\xxrffxf.exec:\xxrffxf.exe41⤵
- Executes dropped EXE
PID:4424 -
\??\c:\xxfrrll.exec:\xxfrrll.exe42⤵
- Executes dropped EXE
PID:3584 -
\??\c:\hhhbtn.exec:\hhhbtn.exe43⤵
- Executes dropped EXE
PID:4104 -
\??\c:\jjpvp.exec:\jjpvp.exe44⤵
- Executes dropped EXE
PID:4272 -
\??\c:\9jvjv.exec:\9jvjv.exe45⤵
- Executes dropped EXE
PID:512 -
\??\c:\xrxllfl.exec:\xrxllfl.exe46⤵
- Executes dropped EXE
PID:3848 -
\??\c:\3hbtnn.exec:\3hbtnn.exe47⤵
- Executes dropped EXE
PID:3264 -
\??\c:\pjpdp.exec:\pjpdp.exe48⤵
- Executes dropped EXE
PID:3100 -
\??\c:\lxxfrll.exec:\lxxfrll.exe49⤵
- Executes dropped EXE
PID:4684 -
\??\c:\rxxxrlx.exec:\rxxxrlx.exe50⤵
- Executes dropped EXE
PID:4832 -
\??\c:\nhhtht.exec:\nhhtht.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1532 -
\??\c:\7vpjv.exec:\7vpjv.exe52⤵
- Executes dropped EXE
PID:3812 -
\??\c:\1rlxlfx.exec:\1rlxlfx.exe53⤵
- Executes dropped EXE
PID:4628 -
\??\c:\fllrlxr.exec:\fllrlxr.exe54⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bthbnb.exec:\bthbnb.exe55⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dppdj.exec:\dppdj.exe56⤵
- Executes dropped EXE
PID:1324 -
\??\c:\ffxxlfr.exec:\ffxxlfr.exe57⤵
- Executes dropped EXE
PID:4036 -
\??\c:\bhnhtn.exec:\bhnhtn.exe58⤵
- Executes dropped EXE
PID:4688 -
\??\c:\vvdvj.exec:\vvdvj.exe59⤵
- Executes dropped EXE
PID:1020 -
\??\c:\rflfxrl.exec:\rflfxrl.exe60⤵
- Executes dropped EXE
PID:4404 -
\??\c:\htttnt.exec:\htttnt.exe61⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hhnhtn.exec:\hhnhtn.exe62⤵
- Executes dropped EXE
PID:3940 -
\??\c:\pjpdj.exec:\pjpdj.exe63⤵
- Executes dropped EXE
PID:5060 -
\??\c:\lrxlrlx.exec:\lrxlrlx.exe64⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9fllxfr.exec:\9fllxfr.exe65⤵
- Executes dropped EXE
PID:4236 -
\??\c:\htbbnn.exec:\htbbnn.exe66⤵PID:4616
-
\??\c:\jpvjv.exec:\jpvjv.exe67⤵PID:3580
-
\??\c:\rxxrxrl.exec:\rxxrxrl.exe68⤵PID:4492
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe69⤵PID:3800
-
\??\c:\tnthht.exec:\tnthht.exe70⤵PID:1556
-
\??\c:\jjdvj.exec:\jjdvj.exe71⤵PID:2676
-
\??\c:\5ddvp.exec:\5ddvp.exe72⤵PID:1600
-
\??\c:\lxxxlfr.exec:\lxxxlfr.exe73⤵PID:3276
-
\??\c:\tnnbtb.exec:\tnnbtb.exe74⤵PID:3352
-
\??\c:\ppdvj.exec:\ppdvj.exe75⤵PID:4396
-
\??\c:\5djpj.exec:\5djpj.exe76⤵PID:640
-
\??\c:\lrfrfxr.exec:\lrfrfxr.exe77⤵PID:3840
-
\??\c:\thnbbn.exec:\thnbbn.exe78⤵PID:2852
-
\??\c:\vpvjd.exec:\vpvjd.exe79⤵
- System Location Discovery: System Language Discovery
PID:64 -
\??\c:\rlxrffr.exec:\rlxrffr.exe80⤵PID:2928
-
\??\c:\7ttnbb.exec:\7ttnbb.exe81⤵PID:4292
-
\??\c:\tbhttn.exec:\tbhttn.exe82⤵PID:2260
-
\??\c:\pvdvj.exec:\pvdvj.exe83⤵PID:4544
-
\??\c:\xxfrlll.exec:\xxfrlll.exe84⤵PID:2104
-
\??\c:\rfxlfxl.exec:\rfxlfxl.exe85⤵PID:4792
-
\??\c:\ttthbb.exec:\ttthbb.exe86⤵PID:5056
-
\??\c:\5jjvj.exec:\5jjvj.exe87⤵PID:2644
-
\??\c:\xrrfrfr.exec:\xrrfrfr.exe88⤵PID:4980
-
\??\c:\bbbnhb.exec:\bbbnhb.exe89⤵PID:2352
-
\??\c:\jdjvd.exec:\jdjvd.exe90⤵PID:2156
-
\??\c:\flffxrf.exec:\flffxrf.exe91⤵PID:928
-
\??\c:\fllrxrx.exec:\fllrxrx.exe92⤵PID:3996
-
\??\c:\nnthtt.exec:\nnthtt.exe93⤵PID:3168
-
\??\c:\vppdp.exec:\vppdp.exe94⤵PID:1760
-
\??\c:\rrlrfxl.exec:\rrlrfxl.exe95⤵PID:4816
-
\??\c:\9btnbb.exec:\9btnbb.exe96⤵PID:5116
-
\??\c:\htthnh.exec:\htthnh.exe97⤵PID:4808
-
\??\c:\3pjdv.exec:\3pjdv.exe98⤵PID:1956
-
\??\c:\xlfrxrx.exec:\xlfrxrx.exe99⤵PID:4716
-
\??\c:\9ttnnh.exec:\9ttnnh.exe100⤵PID:820
-
\??\c:\bnthnb.exec:\bnthnb.exe101⤵PID:620
-
\??\c:\vjpjd.exec:\vjpjd.exe102⤵PID:3476
-
\??\c:\rlxlrlx.exec:\rlxlrlx.exe103⤵PID:4104
-
\??\c:\xllxrfr.exec:\xllxrfr.exe104⤵PID:4272
-
\??\c:\bnhbnh.exec:\bnhbnh.exe105⤵PID:772
-
\??\c:\vdjpd.exec:\vdjpd.exe106⤵PID:536
-
\??\c:\dpjvj.exec:\dpjvj.exe107⤵PID:720
-
\??\c:\fxxlrlx.exec:\fxxlrlx.exe108⤵PID:4472
-
\??\c:\ntbnhb.exec:\ntbnhb.exe109⤵PID:3796
-
\??\c:\vvvpv.exec:\vvvpv.exe110⤵PID:4736
-
\??\c:\jvdpj.exec:\jvdpj.exe111⤵PID:3620
-
\??\c:\xlflxfr.exec:\xlflxfr.exe112⤵PID:3672
-
\??\c:\hnthht.exec:\hnthht.exe113⤵PID:2108
-
\??\c:\djddj.exec:\djddj.exe114⤵PID:4164
-
\??\c:\jpvjp.exec:\jpvjp.exe115⤵PID:1712
-
\??\c:\9rlxlfl.exec:\9rlxlfl.exe116⤵PID:2724
-
\??\c:\ntttht.exec:\ntttht.exe117⤵PID:2064
-
\??\c:\pddpd.exec:\pddpd.exe118⤵PID:1980
-
\??\c:\djvvj.exec:\djvvj.exe119⤵PID:4824
-
\??\c:\xlrfxrf.exec:\xlrfxrf.exe120⤵PID:4688
-
\??\c:\3bthbt.exec:\3bthbt.exe121⤵PID:2964
-
\??\c:\dddvj.exec:\dddvj.exe122⤵PID:4844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-