Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 20:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe
-
Size
454KB
-
MD5
ddc2edbcfadbf0fba0dfef67551b3dcf
-
SHA1
2f1f1c0037361eeeb20de50ec4fd809166a25e9d
-
SHA256
2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956
-
SHA512
dd0d730ede188ae4222dc43bb03ccd9da40d91e98c143416d411b16b598b65913ad598ae2a415921306e1efec0b1967022546f1b2ce773d3872d9c7e1b0f77a1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4204-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-740-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-1064-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-1495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 212 tbhtnn.exe 1508 vvpdj.exe 3008 xlrfxxr.exe 2640 1jvpj.exe 3652 xfxxrrr.exe 544 5xfxrlf.exe 2436 tnhthh.exe 2472 ppddj.exe 1060 xxrrffx.exe 1484 llfxrrf.exe 2084 btbbbt.exe 872 vpdjp.exe 2836 xlrlxxx.exe 2856 jpppd.exe 3268 nhbttt.exe 32 ppjpj.exe 3860 lrxrrll.exe 4872 tbbbtt.exe 2656 rlfxrrr.exe 1892 jvdvv.exe 2364 xrlxrll.exe 4276 vppjj.exe 5080 xfxfffl.exe 1360 1hnhtt.exe 5108 hntnnh.exe 3984 jdjdp.exe 232 rfrllll.exe 1568 hntnhh.exe 3748 jpppj.exe 3672 bbtbtn.exe 4076 9vvvv.exe 1308 bbhtth.exe 1384 fxxxxrl.exe 4912 1dddp.exe 2240 rrffffx.exe 3104 1rrxxxx.exe 3944 ntnhbb.exe 4748 pjjdd.exe 2992 9xllflf.exe 720 rxfrrlf.exe 4440 nthbhn.exe 4328 dvvvp.exe 1968 1fxrxxr.exe 1792 htttnn.exe 2324 jpdvv.exe 3720 fxxrlfx.exe 3880 lllflll.exe 3608 bnttnn.exe 2432 djjvp.exe 2528 rrxrffx.exe 2996 fxrrllf.exe 5012 httnhh.exe 2864 7jppd.exe 2472 fxxfxxf.exe 2484 bnnhhh.exe 2008 bntnhh.exe 4236 pjvjv.exe 1028 7llllrl.exe 1840 hhtntn.exe 1924 bbtttn.exe 4924 jjdvv.exe 3636 fxfxxxr.exe 2488 7bttnn.exe 4984 jppjd.exe -
resource yara_rule behavioral2/memory/4204-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-672-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbtn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4204 wrote to memory of 212 4204 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 82 PID 4204 wrote to memory of 212 4204 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 82 PID 4204 wrote to memory of 212 4204 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 82 PID 212 wrote to memory of 1508 212 tbhtnn.exe 83 PID 212 wrote to memory of 1508 212 tbhtnn.exe 83 PID 212 wrote to memory of 1508 212 tbhtnn.exe 83 PID 1508 wrote to memory of 3008 1508 vvpdj.exe 84 PID 1508 wrote to memory of 3008 1508 vvpdj.exe 84 PID 1508 wrote to memory of 3008 1508 vvpdj.exe 84 PID 3008 wrote to memory of 2640 3008 xlrfxxr.exe 85 PID 3008 wrote to memory of 2640 3008 xlrfxxr.exe 85 PID 3008 wrote to memory of 2640 3008 xlrfxxr.exe 85 PID 2640 wrote to memory of 3652 2640 1jvpj.exe 86 PID 2640 wrote to memory of 3652 2640 1jvpj.exe 86 PID 2640 wrote to memory of 3652 2640 1jvpj.exe 86 PID 3652 wrote to memory of 544 3652 xfxxrrr.exe 87 PID 3652 wrote to memory of 544 3652 xfxxrrr.exe 87 PID 3652 wrote to memory of 544 3652 xfxxrrr.exe 87 PID 544 wrote to memory of 2436 544 5xfxrlf.exe 88 PID 544 wrote to memory of 2436 544 5xfxrlf.exe 88 PID 544 wrote to memory of 2436 544 5xfxrlf.exe 88 PID 2436 wrote to memory of 2472 2436 tnhthh.exe 89 PID 2436 wrote to memory of 2472 2436 tnhthh.exe 89 PID 2436 wrote to memory of 2472 2436 tnhthh.exe 89 PID 2472 wrote to memory of 1060 2472 ppddj.exe 90 PID 2472 wrote to memory of 1060 2472 ppddj.exe 90 PID 2472 wrote to memory of 1060 2472 ppddj.exe 90 PID 1060 wrote to memory of 1484 1060 xxrrffx.exe 91 PID 1060 wrote to memory of 1484 1060 xxrrffx.exe 91 PID 1060 wrote to memory of 1484 1060 xxrrffx.exe 91 PID 1484 wrote to memory of 2084 1484 llfxrrf.exe 92 PID 1484 wrote to memory of 2084 1484 llfxrrf.exe 92 PID 1484 wrote to memory of 2084 1484 llfxrrf.exe 92 PID 2084 wrote to memory of 872 2084 btbbbt.exe 93 PID 2084 wrote to memory of 872 2084 btbbbt.exe 93 PID 2084 wrote to memory of 872 2084 btbbbt.exe 93 PID 872 wrote to memory of 2836 872 vpdjp.exe 94 PID 872 wrote to memory of 2836 872 vpdjp.exe 94 PID 872 wrote to memory of 2836 872 vpdjp.exe 94 PID 2836 wrote to memory of 2856 2836 xlrlxxx.exe 95 PID 2836 wrote to memory of 2856 2836 xlrlxxx.exe 95 PID 2836 wrote to memory of 2856 2836 xlrlxxx.exe 95 PID 2856 wrote to memory of 3268 2856 jpppd.exe 96 PID 2856 wrote to memory of 3268 2856 jpppd.exe 96 PID 2856 wrote to memory of 3268 2856 jpppd.exe 96 PID 3268 wrote to memory of 32 3268 nhbttt.exe 97 PID 3268 wrote to memory of 32 3268 nhbttt.exe 97 PID 3268 wrote to memory of 32 3268 nhbttt.exe 97 PID 32 wrote to memory of 3860 32 ppjpj.exe 98 PID 32 wrote to memory of 3860 32 ppjpj.exe 98 PID 32 wrote to memory of 3860 32 ppjpj.exe 98 PID 3860 wrote to memory of 4872 3860 lrxrrll.exe 99 PID 3860 wrote to memory of 4872 3860 lrxrrll.exe 99 PID 3860 wrote to memory of 4872 3860 lrxrrll.exe 99 PID 4872 wrote to memory of 2656 4872 tbbbtt.exe 100 PID 4872 wrote to memory of 2656 4872 tbbbtt.exe 100 PID 4872 wrote to memory of 2656 4872 tbbbtt.exe 100 PID 2656 wrote to memory of 1892 2656 rlfxrrr.exe 101 PID 2656 wrote to memory of 1892 2656 rlfxrrr.exe 101 PID 2656 wrote to memory of 1892 2656 rlfxrrr.exe 101 PID 1892 wrote to memory of 2364 1892 jvdvv.exe 102 PID 1892 wrote to memory of 2364 1892 jvdvv.exe 102 PID 1892 wrote to memory of 2364 1892 jvdvv.exe 102 PID 2364 wrote to memory of 4276 2364 xrlxrll.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe"C:\Users\Admin\AppData\Local\Temp\2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\tbhtnn.exec:\tbhtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\vvpdj.exec:\vvpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\xlrfxxr.exec:\xlrfxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\1jvpj.exec:\1jvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xfxxrrr.exec:\xfxxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\5xfxrlf.exec:\5xfxrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\tnhthh.exec:\tnhthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\ppddj.exec:\ppddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\xxrrffx.exec:\xxrrffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\llfxrrf.exec:\llfxrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\btbbbt.exec:\btbbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\vpdjp.exec:\vpdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\xlrlxxx.exec:\xlrlxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jpppd.exec:\jpppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nhbttt.exec:\nhbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\ppjpj.exec:\ppjpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\lrxrrll.exec:\lrxrrll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\tbbbtt.exec:\tbbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\jvdvv.exec:\jvdvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\xrlxrll.exec:\xrlxrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\vppjj.exec:\vppjj.exe23⤵
- Executes dropped EXE
PID:4276 -
\??\c:\xfxfffl.exec:\xfxfffl.exe24⤵
- Executes dropped EXE
PID:5080 -
\??\c:\1hnhtt.exec:\1hnhtt.exe25⤵
- Executes dropped EXE
PID:1360 -
\??\c:\hntnnh.exec:\hntnnh.exe26⤵
- Executes dropped EXE
PID:5108 -
\??\c:\jdjdp.exec:\jdjdp.exe27⤵
- Executes dropped EXE
PID:3984 -
\??\c:\rfrllll.exec:\rfrllll.exe28⤵
- Executes dropped EXE
PID:232 -
\??\c:\hntnhh.exec:\hntnhh.exe29⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jpppj.exec:\jpppj.exe30⤵
- Executes dropped EXE
PID:3748 -
\??\c:\bbtbtn.exec:\bbtbtn.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3672 -
\??\c:\9vvvv.exec:\9vvvv.exe32⤵
- Executes dropped EXE
PID:4076 -
\??\c:\bbhtth.exec:\bbhtth.exe33⤵
- Executes dropped EXE
PID:1308 -
\??\c:\fxxxxrl.exec:\fxxxxrl.exe34⤵
- Executes dropped EXE
PID:1384 -
\??\c:\1dddp.exec:\1dddp.exe35⤵
- Executes dropped EXE
PID:4912 -
\??\c:\rrffffx.exec:\rrffffx.exe36⤵
- Executes dropped EXE
PID:2240 -
\??\c:\1rrxxxx.exec:\1rrxxxx.exe37⤵
- Executes dropped EXE
PID:3104 -
\??\c:\ntnhbb.exec:\ntnhbb.exe38⤵
- Executes dropped EXE
PID:3944 -
\??\c:\pjjdd.exec:\pjjdd.exe39⤵
- Executes dropped EXE
PID:4748 -
\??\c:\9xllflf.exec:\9xllflf.exe40⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rxfrrlf.exec:\rxfrrlf.exe41⤵
- Executes dropped EXE
PID:720 -
\??\c:\nthbhn.exec:\nthbhn.exe42⤵
- Executes dropped EXE
PID:4440 -
\??\c:\dvvvp.exec:\dvvvp.exe43⤵
- Executes dropped EXE
PID:4328 -
\??\c:\1fxrxxr.exec:\1fxrxxr.exe44⤵
- Executes dropped EXE
PID:1968 -
\??\c:\htttnn.exec:\htttnn.exe45⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jpdvv.exec:\jpdvv.exe46⤵
- Executes dropped EXE
PID:2324 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe47⤵
- Executes dropped EXE
PID:3720 -
\??\c:\lllflll.exec:\lllflll.exe48⤵
- Executes dropped EXE
PID:3880 -
\??\c:\bnttnn.exec:\bnttnn.exe49⤵
- Executes dropped EXE
PID:3608 -
\??\c:\djjvp.exec:\djjvp.exe50⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rrxrffx.exec:\rrxrffx.exe51⤵
- Executes dropped EXE
PID:2528 -
\??\c:\fxrrllf.exec:\fxrrllf.exe52⤵
- Executes dropped EXE
PID:2996 -
\??\c:\httnhh.exec:\httnhh.exe53⤵
- Executes dropped EXE
PID:5012 -
\??\c:\7jppd.exec:\7jppd.exe54⤵
- Executes dropped EXE
PID:2864 -
\??\c:\fxxfxxf.exec:\fxxfxxf.exe55⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bnnhhh.exec:\bnnhhh.exe56⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bntnhh.exec:\bntnhh.exe57⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pjvjv.exec:\pjvjv.exe58⤵
- Executes dropped EXE
PID:4236 -
\??\c:\7llllrl.exec:\7llllrl.exe59⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hhtntn.exec:\hhtntn.exe60⤵
- Executes dropped EXE
PID:1840 -
\??\c:\bbtttn.exec:\bbtttn.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jjdvv.exec:\jjdvv.exe62⤵
- Executes dropped EXE
PID:4924 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe63⤵
- Executes dropped EXE
PID:3636 -
\??\c:\7bttnn.exec:\7bttnn.exe64⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jppjd.exec:\jppjd.exe65⤵
- Executes dropped EXE
PID:4984 -
\??\c:\vjdvp.exec:\vjdvp.exe66⤵PID:3388
-
\??\c:\fffxffr.exec:\fffxffr.exe67⤵PID:2760
-
\??\c:\bbbhhh.exec:\bbbhhh.exe68⤵PID:5032
-
\??\c:\dppjv.exec:\dppjv.exe69⤵PID:3968
-
\??\c:\xrlxxrl.exec:\xrlxxrl.exe70⤵PID:4400
-
\??\c:\ntbtnn.exec:\ntbtnn.exe71⤵PID:1056
-
\??\c:\jpvpp.exec:\jpvpp.exe72⤵PID:2676
-
\??\c:\9lfxrlf.exec:\9lfxrlf.exe73⤵PID:4932
-
\??\c:\3bhnnn.exec:\3bhnnn.exe74⤵PID:4792
-
\??\c:\nhnhtt.exec:\nhnhtt.exe75⤵PID:2540
-
\??\c:\jpppj.exec:\jpppj.exe76⤵PID:2788
-
\??\c:\9xllffx.exec:\9xllffx.exe77⤵PID:4352
-
\??\c:\ttbtnh.exec:\ttbtnh.exe78⤵PID:2148
-
\??\c:\jjjdp.exec:\jjjdp.exe79⤵PID:1972
-
\??\c:\lxlrrxr.exec:\lxlrrxr.exe80⤵PID:2052
-
\??\c:\7xxfllf.exec:\7xxfllf.exe81⤵PID:2696
-
\??\c:\9tbtbb.exec:\9tbtbb.exe82⤵PID:1532
-
\??\c:\dpdpj.exec:\dpdpj.exe83⤵PID:3964
-
\??\c:\rflfxrl.exec:\rflfxrl.exe84⤵PID:4288
-
\??\c:\hhbtnh.exec:\hhbtnh.exe85⤵PID:1356
-
\??\c:\bnnbtt.exec:\bnnbtt.exe86⤵PID:804
-
\??\c:\jjvpd.exec:\jjvpd.exe87⤵PID:5076
-
\??\c:\xfxxrlx.exec:\xfxxrlx.exe88⤵PID:920
-
\??\c:\3tttnn.exec:\3tttnn.exe89⤵PID:4664
-
\??\c:\bttnnn.exec:\bttnnn.exe90⤵PID:4456
-
\??\c:\flrrlrl.exec:\flrrlrl.exe91⤵PID:4396
-
\??\c:\fxlrlfl.exec:\fxlrlfl.exe92⤵PID:1432
-
\??\c:\tnttnh.exec:\tnttnh.exe93⤵PID:1816
-
\??\c:\jdvjv.exec:\jdvjv.exe94⤵PID:3596
-
\??\c:\xffxrlf.exec:\xffxrlf.exe95⤵PID:636
-
\??\c:\hbtttb.exec:\hbtttb.exe96⤵PID:5024
-
\??\c:\pdjdv.exec:\pdjdv.exe97⤵PID:3632
-
\??\c:\xrxlffr.exec:\xrxlffr.exe98⤵PID:720
-
\??\c:\bbtnhh.exec:\bbtnhh.exe99⤵PID:3384
-
\??\c:\dvvjp.exec:\dvvjp.exe100⤵PID:4328
-
\??\c:\jpdvv.exec:\jpdvv.exe101⤵PID:4200
-
\??\c:\lxlfrfx.exec:\lxlfrfx.exe102⤵PID:4092
-
\??\c:\btnnhb.exec:\btnnhb.exe103⤵PID:3428
-
\??\c:\dddvp.exec:\dddvp.exe104⤵PID:2876
-
\??\c:\dvppj.exec:\dvppj.exe105⤵PID:4000
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe106⤵PID:3824
-
\??\c:\btnhbt.exec:\btnhbt.exe107⤵PID:3152
-
\??\c:\ppdpj.exec:\ppdpj.exe108⤵PID:2432
-
\??\c:\pddvp.exec:\pddvp.exe109⤵PID:2572
-
\??\c:\flrlfll.exec:\flrlfll.exe110⤵PID:2828
-
\??\c:\btthbt.exec:\btthbt.exe111⤵PID:1004
-
\??\c:\djpjj.exec:\djpjj.exe112⤵
- System Location Discovery: System Language Discovery
PID:5012 -
\??\c:\7frfrlf.exec:\7frfrlf.exe113⤵PID:3368
-
\??\c:\lxxrlxr.exec:\lxxrlxr.exe114⤵PID:4496
-
\??\c:\ttbtnn.exec:\ttbtnn.exe115⤵PID:4232
-
\??\c:\3jjvp.exec:\3jjvp.exe116⤵PID:4800
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe117⤵PID:2008
-
\??\c:\nhnhth.exec:\nhnhth.exe118⤵PID:3424
-
\??\c:\bntnhb.exec:\bntnhb.exe119⤵PID:3688
-
\??\c:\7rlxxrx.exec:\7rlxxrx.exe120⤵PID:3460
-
\??\c:\btthbb.exec:\btthbb.exe121⤵PID:2304
-
\??\c:\vpdpd.exec:\vpdpd.exe122⤵PID:3900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-