Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b58f334e4a9ed6e76dc7b2c864332a78cc9eeba1af613f894c9a8b09602dd37d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b58f334e4a9ed6e76dc7b2c864332a78cc9eeba1af613f894c9a8b09602dd37d.exe
-
Size
456KB
-
MD5
22485038899e682d2afcd01d723fd2ee
-
SHA1
1c115cf1b8496b6458a57447625a71152970d784
-
SHA256
b58f334e4a9ed6e76dc7b2c864332a78cc9eeba1af613f894c9a8b09602dd37d
-
SHA512
5975d92721c6917ce31dcbcf1b8f17c9ea95354fbe22f83755087b32f3ba82c2210018f8812b51a21d74d734458f8db6b1607d657f0324fb3b37a36b581d3a0b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2968-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-899-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-955-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-1211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-1354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 224 jvdvp.exe 4776 1tnhtt.exe 2420 dvdpd.exe 1940 xffrlxr.exe 3572 frxlfxr.exe 1268 hnnttb.exe 4500 nbntbn.exe 924 jdddp.exe 3916 5jdvd.exe 4968 flfxlfx.exe 700 3thbtn.exe 948 9jjdd.exe 3896 3ttnhh.exe 744 vddpj.exe 2888 3tbnnn.exe 3972 hntnhh.exe 2192 9rxrffx.exe 4964 3ttbtt.exe 880 jpddd.exe 4472 btbbtt.exe 3112 rlrrrrr.exe 2672 pppjd.exe 1312 hntnnt.exe 1808 7jvvv.exe 2060 7lrfflf.exe 932 nhnhbh.exe 4556 xxrxxxx.exe 1376 rrxxfff.exe 1608 ttbttt.exe 2076 frllrxr.exe 5072 xrlrrxf.exe 3484 tttnnn.exe 1184 5rlllrr.exe 3968 llxrrll.exe 3052 tbhhbh.exe 4300 ppvvj.exe 3904 lrlffff.exe 2368 nnhhtb.exe 980 1vdjd.exe 3864 lrflrrl.exe 840 ffflflf.exe 4616 hntttb.exe 3412 ddpvv.exe 2892 xlffxxf.exe 3932 nnhhbb.exe 2116 ttbhbb.exe 1244 ppddv.exe 2292 flllrrf.exe 3992 llxrlrr.exe 4612 1ntbnn.exe 4848 ddpjd.exe 2824 rlxxxll.exe 1256 xlrrrrr.exe 748 hthbnb.exe 3152 vvppj.exe 1964 xfllxxl.exe 4988 5nbnht.exe 2784 5nhnhn.exe 4960 vvdjd.exe 2080 rfxxrll.exe 2192 rrlrlrx.exe 4772 nntnnt.exe 4844 vdddd.exe 4768 3xffrxr.exe -
resource yara_rule behavioral2/memory/2968-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/700-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-732-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 224 2968 b58f334e4a9ed6e76dc7b2c864332a78cc9eeba1af613f894c9a8b09602dd37d.exe 82 PID 2968 wrote to memory of 224 2968 b58f334e4a9ed6e76dc7b2c864332a78cc9eeba1af613f894c9a8b09602dd37d.exe 82 PID 2968 wrote to memory of 224 2968 b58f334e4a9ed6e76dc7b2c864332a78cc9eeba1af613f894c9a8b09602dd37d.exe 82 PID 224 wrote to memory of 4776 224 jvdvp.exe 83 PID 224 wrote to memory of 4776 224 jvdvp.exe 83 PID 224 wrote to memory of 4776 224 jvdvp.exe 83 PID 4776 wrote to memory of 2420 4776 1tnhtt.exe 84 PID 4776 wrote to memory of 2420 4776 1tnhtt.exe 84 PID 4776 wrote to memory of 2420 4776 1tnhtt.exe 84 PID 2420 wrote to memory of 1940 2420 dvdpd.exe 85 PID 2420 wrote to memory of 1940 2420 dvdpd.exe 85 PID 2420 wrote to memory of 1940 2420 dvdpd.exe 85 PID 1940 wrote to memory of 3572 1940 xffrlxr.exe 86 PID 1940 wrote to memory of 3572 1940 xffrlxr.exe 86 PID 1940 wrote to memory of 3572 1940 xffrlxr.exe 86 PID 3572 wrote to memory of 1268 3572 frxlfxr.exe 87 PID 3572 wrote to memory of 1268 3572 frxlfxr.exe 87 PID 3572 wrote to memory of 1268 3572 frxlfxr.exe 87 PID 1268 wrote to memory of 4500 1268 hnnttb.exe 88 PID 1268 wrote to memory of 4500 1268 hnnttb.exe 88 PID 1268 wrote to memory of 4500 1268 hnnttb.exe 88 PID 4500 wrote to memory of 924 4500 nbntbn.exe 89 PID 4500 wrote to memory of 924 4500 nbntbn.exe 89 PID 4500 wrote to memory of 924 4500 nbntbn.exe 89 PID 924 wrote to memory of 3916 924 jdddp.exe 90 PID 924 wrote to memory of 3916 924 jdddp.exe 90 PID 924 wrote to memory of 3916 924 jdddp.exe 90 PID 3916 wrote to memory of 4968 3916 5jdvd.exe 91 PID 3916 wrote to memory of 4968 3916 5jdvd.exe 91 PID 3916 wrote to memory of 4968 3916 5jdvd.exe 91 PID 4968 wrote to memory of 700 4968 flfxlfx.exe 92 PID 4968 wrote to memory of 700 4968 flfxlfx.exe 92 PID 4968 wrote to memory of 700 4968 flfxlfx.exe 92 PID 700 wrote to memory of 948 700 3thbtn.exe 93 PID 700 wrote to memory of 948 700 3thbtn.exe 93 PID 700 wrote to memory of 948 700 3thbtn.exe 93 PID 948 wrote to memory of 3896 948 9jjdd.exe 94 PID 948 wrote to memory of 3896 948 9jjdd.exe 94 PID 948 wrote to memory of 3896 948 9jjdd.exe 94 PID 3896 wrote to memory of 744 3896 3ttnhh.exe 95 PID 3896 wrote to memory of 744 3896 3ttnhh.exe 95 PID 3896 wrote to memory of 744 3896 3ttnhh.exe 95 PID 744 wrote to memory of 2888 744 vddpj.exe 96 PID 744 wrote to memory of 2888 744 vddpj.exe 96 PID 744 wrote to memory of 2888 744 vddpj.exe 96 PID 2888 wrote to memory of 3972 2888 3tbnnn.exe 97 PID 2888 wrote to memory of 3972 2888 3tbnnn.exe 97 PID 2888 wrote to memory of 3972 2888 3tbnnn.exe 97 PID 3972 wrote to memory of 2192 3972 hntnhh.exe 98 PID 3972 wrote to memory of 2192 3972 hntnhh.exe 98 PID 3972 wrote to memory of 2192 3972 hntnhh.exe 98 PID 2192 wrote to memory of 4964 2192 9rxrffx.exe 99 PID 2192 wrote to memory of 4964 2192 9rxrffx.exe 99 PID 2192 wrote to memory of 4964 2192 9rxrffx.exe 99 PID 4964 wrote to memory of 880 4964 3ttbtt.exe 100 PID 4964 wrote to memory of 880 4964 3ttbtt.exe 100 PID 4964 wrote to memory of 880 4964 3ttbtt.exe 100 PID 880 wrote to memory of 4472 880 jpddd.exe 101 PID 880 wrote to memory of 4472 880 jpddd.exe 101 PID 880 wrote to memory of 4472 880 jpddd.exe 101 PID 4472 wrote to memory of 3112 4472 btbbtt.exe 102 PID 4472 wrote to memory of 3112 4472 btbbtt.exe 102 PID 4472 wrote to memory of 3112 4472 btbbtt.exe 102 PID 3112 wrote to memory of 2672 3112 rlrrrrr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b58f334e4a9ed6e76dc7b2c864332a78cc9eeba1af613f894c9a8b09602dd37d.exe"C:\Users\Admin\AppData\Local\Temp\b58f334e4a9ed6e76dc7b2c864332a78cc9eeba1af613f894c9a8b09602dd37d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\jvdvp.exec:\jvdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\1tnhtt.exec:\1tnhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\dvdpd.exec:\dvdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\xffrlxr.exec:\xffrlxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\frxlfxr.exec:\frxlfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\hnnttb.exec:\hnnttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\nbntbn.exec:\nbntbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\jdddp.exec:\jdddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\5jdvd.exec:\5jdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\flfxlfx.exec:\flfxlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\3thbtn.exec:\3thbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\9jjdd.exec:\9jjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\3ttnhh.exec:\3ttnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\vddpj.exec:\vddpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\3tbnnn.exec:\3tbnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\hntnhh.exec:\hntnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\9rxrffx.exec:\9rxrffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\3ttbtt.exec:\3ttbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\jpddd.exec:\jpddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\btbbtt.exec:\btbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\pppjd.exec:\pppjd.exe23⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hntnnt.exec:\hntnnt.exe24⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7jvvv.exec:\7jvvv.exe25⤵
- Executes dropped EXE
PID:1808 -
\??\c:\7lrfflf.exec:\7lrfflf.exe26⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nhnhbh.exec:\nhnhbh.exe27⤵
- Executes dropped EXE
PID:932 -
\??\c:\xxrxxxx.exec:\xxrxxxx.exe28⤵
- Executes dropped EXE
PID:4556 -
\??\c:\rrxxfff.exec:\rrxxfff.exe29⤵
- Executes dropped EXE
PID:1376 -
\??\c:\ttbttt.exec:\ttbttt.exe30⤵
- Executes dropped EXE
PID:1608 -
\??\c:\frllrxr.exec:\frllrxr.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xrlrrxf.exec:\xrlrrxf.exe32⤵
- Executes dropped EXE
PID:5072 -
\??\c:\tttnnn.exec:\tttnnn.exe33⤵
- Executes dropped EXE
PID:3484 -
\??\c:\5rlllrr.exec:\5rlllrr.exe34⤵
- Executes dropped EXE
PID:1184 -
\??\c:\llxrrll.exec:\llxrrll.exe35⤵
- Executes dropped EXE
PID:3968 -
\??\c:\tbhhbh.exec:\tbhhbh.exe36⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ppvvj.exec:\ppvvj.exe37⤵
- Executes dropped EXE
PID:4300 -
\??\c:\lrlffff.exec:\lrlffff.exe38⤵
- Executes dropped EXE
PID:3904 -
\??\c:\nnhhtb.exec:\nnhhtb.exe39⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1vdjd.exec:\1vdjd.exe40⤵
- Executes dropped EXE
PID:980 -
\??\c:\lrflrrl.exec:\lrflrrl.exe41⤵
- Executes dropped EXE
PID:3864 -
\??\c:\ffflflf.exec:\ffflflf.exe42⤵
- Executes dropped EXE
PID:840 -
\??\c:\hntttb.exec:\hntttb.exe43⤵
- Executes dropped EXE
PID:4616 -
\??\c:\ddpvv.exec:\ddpvv.exe44⤵
- Executes dropped EXE
PID:3412 -
\??\c:\xlffxxf.exec:\xlffxxf.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nnhhbb.exec:\nnhhbb.exe46⤵
- Executes dropped EXE
PID:3932 -
\??\c:\ttbhbb.exec:\ttbhbb.exe47⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ppddv.exec:\ppddv.exe48⤵
- Executes dropped EXE
PID:1244 -
\??\c:\flllrrf.exec:\flllrrf.exe49⤵
- Executes dropped EXE
PID:2292 -
\??\c:\llxrlrr.exec:\llxrlrr.exe50⤵
- Executes dropped EXE
PID:3992 -
\??\c:\1ntbnn.exec:\1ntbnn.exe51⤵
- Executes dropped EXE
PID:4612 -
\??\c:\ddpjd.exec:\ddpjd.exe52⤵
- Executes dropped EXE
PID:4848 -
\??\c:\rlxxxll.exec:\rlxxxll.exe53⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe54⤵
- Executes dropped EXE
PID:1256 -
\??\c:\hthbnb.exec:\hthbnb.exe55⤵
- Executes dropped EXE
PID:748 -
\??\c:\vvppj.exec:\vvppj.exe56⤵
- Executes dropped EXE
PID:3152 -
\??\c:\xfllxxl.exec:\xfllxxl.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5nbnht.exec:\5nbnht.exe58⤵
- Executes dropped EXE
PID:4988 -
\??\c:\5nhnhn.exec:\5nhnhn.exe59⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vvdjd.exec:\vvdjd.exe60⤵
- Executes dropped EXE
PID:4960 -
\??\c:\rfxxrll.exec:\rfxxrll.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rrlrlrx.exec:\rrlrlrx.exe62⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nntnnt.exec:\nntnnt.exe63⤵
- Executes dropped EXE
PID:4772 -
\??\c:\vdddd.exec:\vdddd.exe64⤵
- Executes dropped EXE
PID:4844 -
\??\c:\3xffrxr.exec:\3xffrxr.exe65⤵
- Executes dropped EXE
PID:4768 -
\??\c:\ttnbtb.exec:\ttnbtb.exe66⤵PID:832
-
\??\c:\jvjpj.exec:\jvjpj.exe67⤵PID:3796
-
\??\c:\9vvvv.exec:\9vvvv.exe68⤵PID:3620
-
\??\c:\1fllllr.exec:\1fllllr.exe69⤵PID:4780
-
\??\c:\tthhnn.exec:\tthhnn.exe70⤵PID:4880
-
\??\c:\btnhbh.exec:\btnhbh.exe71⤵PID:2672
-
\??\c:\1rxxrxx.exec:\1rxxrxx.exe72⤵PID:724
-
\??\c:\bhbbtt.exec:\bhbbtt.exe73⤵PID:4060
-
\??\c:\vpvvp.exec:\vpvvp.exe74⤵PID:4064
-
\??\c:\ddvpv.exec:\ddvpv.exe75⤵PID:3000
-
\??\c:\fxlrlll.exec:\fxlrlll.exe76⤵PID:2364
-
\??\c:\hthhbh.exec:\hthhbh.exe77⤵PID:3892
-
\??\c:\1jvdv.exec:\1jvdv.exe78⤵PID:4688
-
\??\c:\dvppj.exec:\dvppj.exe79⤵PID:932
-
\??\c:\xflfxff.exec:\xflfxff.exe80⤵PID:4440
-
\??\c:\nnbbhh.exec:\nnbbhh.exe81⤵PID:2712
-
\??\c:\jdjjd.exec:\jdjjd.exe82⤵PID:3240
-
\??\c:\jdjjd.exec:\jdjjd.exe83⤵PID:2352
-
\??\c:\ffffxxf.exec:\ffffxxf.exe84⤵PID:1608
-
\??\c:\5tbttt.exec:\5tbttt.exe85⤵PID:2076
-
\??\c:\1bhbtb.exec:\1bhbtb.exe86⤵PID:4452
-
\??\c:\jjvdv.exec:\jjvdv.exe87⤵PID:3468
-
\??\c:\7fffxrr.exec:\7fffxrr.exe88⤵PID:1180
-
\??\c:\htbbbb.exec:\htbbbb.exe89⤵PID:3160
-
\??\c:\vvjjv.exec:\vvjjv.exe90⤵PID:5048
-
\??\c:\dvjdv.exec:\dvjdv.exe91⤵PID:4864
-
\??\c:\xlxxrll.exec:\xlxxrll.exe92⤵PID:2684
-
\??\c:\7nhhbb.exec:\7nhhbb.exe93⤵PID:3376
-
\??\c:\dpddd.exec:\dpddd.exe94⤵PID:3092
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe95⤵PID:3332
-
\??\c:\llrrlrr.exec:\llrrlrr.exe96⤵PID:4676
-
\??\c:\hhbbhn.exec:\hhbbhn.exe97⤵PID:4280
-
\??\c:\dvddv.exec:\dvddv.exe98⤵PID:872
-
\??\c:\xxlllll.exec:\xxlllll.exe99⤵PID:1872
-
\??\c:\nnbbbh.exec:\nnbbbh.exe100⤵PID:3456
-
\??\c:\jjvdv.exec:\jjvdv.exe101⤵PID:3156
-
\??\c:\djpvv.exec:\djpvv.exe102⤵PID:2724
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe103⤵PID:448
-
\??\c:\nthbbb.exec:\nthbbb.exe104⤵PID:3208
-
\??\c:\dvdpp.exec:\dvdpp.exe105⤵
- System Location Discovery: System Language Discovery
PID:2420 -
\??\c:\pdpvp.exec:\pdpvp.exe106⤵PID:4832
-
\??\c:\xfxrllx.exec:\xfxrllx.exe107⤵PID:2108
-
\??\c:\nnbhhn.exec:\nnbhhn.exe108⤵PID:2756
-
\??\c:\5vvdj.exec:\5vvdj.exe109⤵PID:3132
-
\??\c:\dpjjd.exec:\dpjjd.exe110⤵PID:1272
-
\??\c:\rrfxxxf.exec:\rrfxxxf.exe111⤵PID:2180
-
\??\c:\bhnnnt.exec:\bhnnnt.exe112⤵PID:1492
-
\??\c:\vjpjd.exec:\vjpjd.exe113⤵PID:436
-
\??\c:\rrffrxl.exec:\rrffrxl.exe114⤵PID:3992
-
\??\c:\llfffrr.exec:\llfffrr.exe115⤵PID:2792
-
\??\c:\nhttbb.exec:\nhttbb.exe116⤵PID:4876
-
\??\c:\vpjjv.exec:\vpjjv.exe117⤵PID:4804
-
\??\c:\ppvvj.exec:\ppvvj.exe118⤵PID:316
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe119⤵PID:948
-
\??\c:\hbhntt.exec:\hbhntt.exe120⤵PID:1500
-
\??\c:\ppjjv.exec:\ppjjv.exe121⤵PID:4480
-
\??\c:\ffxfllf.exec:\ffxfllf.exe122⤵PID:744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-