Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 21:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
34ba8e6efaae151de8ee551f01e15ce98d423e93b50a6b5fa50765b5c2da559c.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
34ba8e6efaae151de8ee551f01e15ce98d423e93b50a6b5fa50765b5c2da559c.exe
-
Size
454KB
-
MD5
e01dd784c21cd78ae072373a4663564a
-
SHA1
7fbed29a3db6aac77e7db463c64570353906c41d
-
SHA256
34ba8e6efaae151de8ee551f01e15ce98d423e93b50a6b5fa50765b5c2da559c
-
SHA512
062d5ab984a82ffc70d7db4f6ed0eab791ae277b99ae961794950722f510793e1af03f0fa652f90c1e3f5a6f041c15b9e0c05e0a5fc2687c7a2edf8836c9ed0e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3424-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-837-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-877-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-1008-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-1104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-1372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-1533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3424 dpvvp.exe 2180 flfrrll.exe 2208 hnhhbb.exe 2532 vvvvp.exe 1512 ffrfxxr.exe 4516 frfxxxx.exe 4832 ffrxxxx.exe 2844 jjjjj.exe 4836 lfxfxfx.exe 552 nnhhhh.exe 1956 jddvv.exe 4192 dpvpj.exe 2348 dvjjp.exe 816 3flfxfx.exe 4424 xllllfx.exe 772 vvddv.exe 4680 vvdvv.exe 4944 pjvpd.exe 1788 lrllfff.exe 3836 tbhbbt.exe 3780 rrxlxxr.exe 4016 tntttt.exe 456 fxrrxxl.exe 2284 3bhbbn.exe 1520 3bhbtt.exe 640 lxxxrrr.exe 4288 hbbtnh.exe 3504 httnhb.exe 1392 1nbtnn.exe 3088 7ffxxxx.exe 1360 tnhbnt.exe 4372 vjpjd.exe 3216 ddppp.exe 5092 lfrrxxf.exe 4472 xlrlfxx.exe 4572 thnbhb.exe 4784 vpdvj.exe 3608 lflfrrr.exe 4768 nnnnhh.exe 4316 pjpjd.exe 4024 3jdvp.exe 2984 rlxfffl.exe 2312 hhtnnh.exe 4404 dvdjd.exe 2732 vppvv.exe 5000 xrrrrrl.exe 3512 nbhbtn.exe 4492 jdpjd.exe 4960 vdjdv.exe 2456 lrxrllf.exe 4744 thhnhn.exe 3276 vppdv.exe 4840 fxfflfl.exe 1396 nnhhbb.exe 2864 vpddv.exe 4988 fxfxrrl.exe 3304 hnttnn.exe 1956 hbtnhb.exe 3120 1jpjd.exe 3700 rflfxlf.exe 4520 bhnnhh.exe 2708 bhhbhb.exe 5036 dpdjj.exe 468 ffrxlxl.exe -
resource yara_rule behavioral2/memory/3424-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-722-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2716 wrote to memory of 3424 2716 34ba8e6efaae151de8ee551f01e15ce98d423e93b50a6b5fa50765b5c2da559c.exe 83 PID 2716 wrote to memory of 3424 2716 34ba8e6efaae151de8ee551f01e15ce98d423e93b50a6b5fa50765b5c2da559c.exe 83 PID 2716 wrote to memory of 3424 2716 34ba8e6efaae151de8ee551f01e15ce98d423e93b50a6b5fa50765b5c2da559c.exe 83 PID 3424 wrote to memory of 2180 3424 dpvvp.exe 84 PID 3424 wrote to memory of 2180 3424 dpvvp.exe 84 PID 3424 wrote to memory of 2180 3424 dpvvp.exe 84 PID 2180 wrote to memory of 2208 2180 flfrrll.exe 85 PID 2180 wrote to memory of 2208 2180 flfrrll.exe 85 PID 2180 wrote to memory of 2208 2180 flfrrll.exe 85 PID 2208 wrote to memory of 2532 2208 hnhhbb.exe 86 PID 2208 wrote to memory of 2532 2208 hnhhbb.exe 86 PID 2208 wrote to memory of 2532 2208 hnhhbb.exe 86 PID 2532 wrote to memory of 1512 2532 vvvvp.exe 87 PID 2532 wrote to memory of 1512 2532 vvvvp.exe 87 PID 2532 wrote to memory of 1512 2532 vvvvp.exe 87 PID 1512 wrote to memory of 4516 1512 ffrfxxr.exe 88 PID 1512 wrote to memory of 4516 1512 ffrfxxr.exe 88 PID 1512 wrote to memory of 4516 1512 ffrfxxr.exe 88 PID 4516 wrote to memory of 4832 4516 frfxxxx.exe 89 PID 4516 wrote to memory of 4832 4516 frfxxxx.exe 89 PID 4516 wrote to memory of 4832 4516 frfxxxx.exe 89 PID 4832 wrote to memory of 2844 4832 ffrxxxx.exe 90 PID 4832 wrote to memory of 2844 4832 ffrxxxx.exe 90 PID 4832 wrote to memory of 2844 4832 ffrxxxx.exe 90 PID 2844 wrote to memory of 4836 2844 jjjjj.exe 91 PID 2844 wrote to memory of 4836 2844 jjjjj.exe 91 PID 2844 wrote to memory of 4836 2844 jjjjj.exe 91 PID 4836 wrote to memory of 552 4836 lfxfxfx.exe 92 PID 4836 wrote to memory of 552 4836 lfxfxfx.exe 92 PID 4836 wrote to memory of 552 4836 lfxfxfx.exe 92 PID 552 wrote to memory of 1956 552 nnhhhh.exe 93 PID 552 wrote to memory of 1956 552 nnhhhh.exe 93 PID 552 wrote to memory of 1956 552 nnhhhh.exe 93 PID 1956 wrote to memory of 4192 1956 jddvv.exe 94 PID 1956 wrote to memory of 4192 1956 jddvv.exe 94 PID 1956 wrote to memory of 4192 1956 jddvv.exe 94 PID 4192 wrote to memory of 2348 4192 dpvpj.exe 95 PID 4192 wrote to memory of 2348 4192 dpvpj.exe 95 PID 4192 wrote to memory of 2348 4192 dpvpj.exe 95 PID 2348 wrote to memory of 816 2348 dvjjp.exe 96 PID 2348 wrote to memory of 816 2348 dvjjp.exe 96 PID 2348 wrote to memory of 816 2348 dvjjp.exe 96 PID 816 wrote to memory of 4424 816 3flfxfx.exe 97 PID 816 wrote to memory of 4424 816 3flfxfx.exe 97 PID 816 wrote to memory of 4424 816 3flfxfx.exe 97 PID 4424 wrote to memory of 772 4424 xllllfx.exe 98 PID 4424 wrote to memory of 772 4424 xllllfx.exe 98 PID 4424 wrote to memory of 772 4424 xllllfx.exe 98 PID 772 wrote to memory of 4680 772 vvddv.exe 99 PID 772 wrote to memory of 4680 772 vvddv.exe 99 PID 772 wrote to memory of 4680 772 vvddv.exe 99 PID 4680 wrote to memory of 4944 4680 vvdvv.exe 100 PID 4680 wrote to memory of 4944 4680 vvdvv.exe 100 PID 4680 wrote to memory of 4944 4680 vvdvv.exe 100 PID 4944 wrote to memory of 1788 4944 pjvpd.exe 101 PID 4944 wrote to memory of 1788 4944 pjvpd.exe 101 PID 4944 wrote to memory of 1788 4944 pjvpd.exe 101 PID 1788 wrote to memory of 3836 1788 lrllfff.exe 102 PID 1788 wrote to memory of 3836 1788 lrllfff.exe 102 PID 1788 wrote to memory of 3836 1788 lrllfff.exe 102 PID 3836 wrote to memory of 3780 3836 tbhbbt.exe 103 PID 3836 wrote to memory of 3780 3836 tbhbbt.exe 103 PID 3836 wrote to memory of 3780 3836 tbhbbt.exe 103 PID 3780 wrote to memory of 4016 3780 rrxlxxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\34ba8e6efaae151de8ee551f01e15ce98d423e93b50a6b5fa50765b5c2da559c.exe"C:\Users\Admin\AppData\Local\Temp\34ba8e6efaae151de8ee551f01e15ce98d423e93b50a6b5fa50765b5c2da559c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\dpvvp.exec:\dpvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\flfrrll.exec:\flfrrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\hnhhbb.exec:\hnhhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\vvvvp.exec:\vvvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ffrfxxr.exec:\ffrfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\frfxxxx.exec:\frfxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\ffrxxxx.exec:\ffrxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\jjjjj.exec:\jjjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\nnhhhh.exec:\nnhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\jddvv.exec:\jddvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\dpvpj.exec:\dpvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\dvjjp.exec:\dvjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\3flfxfx.exec:\3flfxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\xllllfx.exec:\xllllfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\vvddv.exec:\vvddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\vvdvv.exec:\vvdvv.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\pjvpd.exec:\pjvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\lrllfff.exec:\lrllfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\tbhbbt.exec:\tbhbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\rrxlxxr.exec:\rrxlxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\tntttt.exec:\tntttt.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4016 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe24⤵
- Executes dropped EXE
PID:456 -
\??\c:\3bhbbn.exec:\3bhbbn.exe25⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3bhbtt.exec:\3bhbtt.exe26⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe27⤵
- Executes dropped EXE
PID:640 -
\??\c:\hbbtnh.exec:\hbbtnh.exe28⤵
- Executes dropped EXE
PID:4288 -
\??\c:\httnhb.exec:\httnhb.exe29⤵
- Executes dropped EXE
PID:3504 -
\??\c:\1nbtnn.exec:\1nbtnn.exe30⤵
- Executes dropped EXE
PID:1392 -
\??\c:\7ffxxxx.exec:\7ffxxxx.exe31⤵
- Executes dropped EXE
PID:3088 -
\??\c:\tnhbnt.exec:\tnhbnt.exe32⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vjpjd.exec:\vjpjd.exe33⤵
- Executes dropped EXE
PID:4372 -
\??\c:\ddppp.exec:\ddppp.exe34⤵
- Executes dropped EXE
PID:3216 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe35⤵
- Executes dropped EXE
PID:5092 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe36⤵
- Executes dropped EXE
PID:4472 -
\??\c:\thnbhb.exec:\thnbhb.exe37⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vpdvj.exec:\vpdvj.exe38⤵
- Executes dropped EXE
PID:4784 -
\??\c:\lflfrrr.exec:\lflfrrr.exe39⤵
- Executes dropped EXE
PID:3608 -
\??\c:\nnnnhh.exec:\nnnnhh.exe40⤵
- Executes dropped EXE
PID:4768 -
\??\c:\pjpjd.exec:\pjpjd.exe41⤵
- Executes dropped EXE
PID:4316 -
\??\c:\3jdvp.exec:\3jdvp.exe42⤵
- Executes dropped EXE
PID:4024 -
\??\c:\rlxfffl.exec:\rlxfffl.exe43⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hhtnnh.exec:\hhtnnh.exe44⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dvdjd.exec:\dvdjd.exe45⤵
- Executes dropped EXE
PID:4404 -
\??\c:\vppvv.exec:\vppvv.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe47⤵
- Executes dropped EXE
PID:5000 -
\??\c:\nbhbtn.exec:\nbhbtn.exe48⤵
- Executes dropped EXE
PID:3512 -
\??\c:\jdpjd.exec:\jdpjd.exe49⤵
- Executes dropped EXE
PID:4492 -
\??\c:\vdjdv.exec:\vdjdv.exe50⤵
- Executes dropped EXE
PID:4960 -
\??\c:\lrxrllf.exec:\lrxrllf.exe51⤵
- Executes dropped EXE
PID:2456 -
\??\c:\thhnhn.exec:\thhnhn.exe52⤵
- Executes dropped EXE
PID:4744 -
\??\c:\vppdv.exec:\vppdv.exe53⤵
- Executes dropped EXE
PID:3276 -
\??\c:\fxfflfl.exec:\fxfflfl.exe54⤵
- Executes dropped EXE
PID:4840 -
\??\c:\nnhhbb.exec:\nnhhbb.exe55⤵
- Executes dropped EXE
PID:1396 -
\??\c:\vpddv.exec:\vpddv.exe56⤵
- Executes dropped EXE
PID:2864 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe57⤵
- Executes dropped EXE
PID:4988 -
\??\c:\hnttnn.exec:\hnttnn.exe58⤵
- Executes dropped EXE
PID:3304 -
\??\c:\hbtnhb.exec:\hbtnhb.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\1jpjd.exec:\1jpjd.exe60⤵
- Executes dropped EXE
PID:3120 -
\??\c:\rflfxlf.exec:\rflfxlf.exe61⤵
- Executes dropped EXE
PID:3700 -
\??\c:\bhnnhh.exec:\bhnnhh.exe62⤵
- Executes dropped EXE
PID:4520 -
\??\c:\bhhbhb.exec:\bhhbhb.exe63⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dpdjj.exec:\dpdjj.exe64⤵
- Executes dropped EXE
PID:5036 -
\??\c:\ffrxlxl.exec:\ffrxlxl.exe65⤵
- Executes dropped EXE
PID:468 -
\??\c:\bbbttt.exec:\bbbttt.exe66⤵PID:4032
-
\??\c:\nhnhbt.exec:\nhnhbt.exe67⤵PID:2340
-
\??\c:\pjjdp.exec:\pjjdp.exe68⤵PID:3764
-
\??\c:\flrfrrf.exec:\flrfrrf.exe69⤵PID:4112
-
\??\c:\htbttt.exec:\htbttt.exe70⤵PID:3568
-
\??\c:\jdpjd.exec:\jdpjd.exe71⤵PID:3308
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe72⤵PID:2116
-
\??\c:\hthbbb.exec:\hthbbb.exe73⤵PID:3752
-
\??\c:\dvdvp.exec:\dvdvp.exe74⤵PID:3780
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe75⤵PID:1688
-
\??\c:\3hnhbb.exec:\3hnhbb.exe76⤵PID:5068
-
\??\c:\jvddd.exec:\jvddd.exe77⤵PID:5076
-
\??\c:\dpdjj.exec:\dpdjj.exe78⤵PID:5060
-
\??\c:\9rrlxxr.exec:\9rrlxxr.exe79⤵PID:2212
-
\??\c:\bthbbb.exec:\bthbbb.exe80⤵PID:2804
-
\??\c:\jjjdj.exec:\jjjdj.exe81⤵PID:3180
-
\??\c:\rffffxf.exec:\rffffxf.exe82⤵PID:3564
-
\??\c:\ttthbb.exec:\ttthbb.exe83⤵PID:1548
-
\??\c:\hbbttn.exec:\hbbttn.exe84⤵PID:2876
-
\??\c:\7jvdv.exec:\7jvdv.exe85⤵PID:4668
-
\??\c:\7rfxfff.exec:\7rfxfff.exe86⤵PID:3864
-
\??\c:\9ttttt.exec:\9ttttt.exe87⤵PID:4392
-
\??\c:\nnntnn.exec:\nnntnn.exe88⤵
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\jpdpp.exec:\jpdpp.exe89⤵PID:4372
-
\??\c:\llxrfff.exec:\llxrfff.exe90⤵PID:3108
-
\??\c:\bthbbb.exec:\bthbbb.exe91⤵PID:5092
-
\??\c:\nnnhbt.exec:\nnnhbt.exe92⤵PID:4596
-
\??\c:\djvpd.exec:\djvpd.exe93⤵PID:3376
-
\??\c:\9xffrrr.exec:\9xffrrr.exe94⤵PID:4784
-
\??\c:\thtnnh.exec:\thtnnh.exe95⤵PID:4580
-
\??\c:\tnnnhh.exec:\tnnnhh.exe96⤵PID:2900
-
\??\c:\dpddv.exec:\dpddv.exe97⤵PID:776
-
\??\c:\llrlxxr.exec:\llrlxxr.exe98⤵PID:3424
-
\??\c:\fxxxrff.exec:\fxxxrff.exe99⤵PID:2180
-
\??\c:\thnbtt.exec:\thnbtt.exe100⤵PID:4356
-
\??\c:\vjpjp.exec:\vjpjp.exe101⤵PID:2292
-
\??\c:\flxrlll.exec:\flxrlll.exe102⤵PID:2432
-
\??\c:\lffxrxr.exec:\lffxrxr.exe103⤵PID:3340
-
\??\c:\nhhbtt.exec:\nhhbtt.exe104⤵PID:32
-
\??\c:\vpvpp.exec:\vpvpp.exe105⤵PID:2332
-
\??\c:\llrlfxx.exec:\llrlfxx.exe106⤵PID:4940
-
\??\c:\7hnhhh.exec:\7hnhhh.exe107⤵PID:3604
-
\??\c:\nbhbtb.exec:\nbhbtb.exe108⤵PID:4832
-
\??\c:\pjjjd.exec:\pjjjd.exe109⤵PID:2112
-
\??\c:\ffffxxx.exec:\ffffxxx.exe110⤵PID:1976
-
\??\c:\nhtnnn.exec:\nhtnnn.exe111⤵PID:4840
-
\??\c:\bnbtnn.exec:\bnbtnn.exe112⤵PID:1396
-
\??\c:\jvjdv.exec:\jvjdv.exe113⤵PID:1528
-
\??\c:\5xrlfll.exec:\5xrlfll.exe114⤵PID:4524
-
\??\c:\bttbbb.exec:\bttbbb.exe115⤵PID:2124
-
\??\c:\nthbbb.exec:\nthbbb.exe116⤵PID:312
-
\??\c:\ppppj.exec:\ppppj.exe117⤵PID:5052
-
\??\c:\xlrlllf.exec:\xlrlllf.exe118⤵PID:4200
-
\??\c:\xrrllfx.exec:\xrrllfx.exe119⤵PID:1208
-
\??\c:\3bnhbb.exec:\3bnhbb.exe120⤵PID:3200
-
\??\c:\hthbtn.exec:\hthbtn.exe121⤵PID:3872
-
\??\c:\5jpjd.exec:\5jpjd.exe122⤵PID:1292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-