Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 03:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe
-
Size
453KB
-
MD5
ed8c8d463ad043014f34b78cd8e79bce
-
SHA1
868ac639d881f675b0a7dbbf235e607924d80ed0
-
SHA256
d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc
-
SHA512
2b87252b074d4523b778f4db3495e1878dfed86d29e2369f7fa583e9f7a160e74eddbba81dcd874b53ceedf623c39084d149634a726250e438e99ed8c90ea99e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2856-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1316-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/592-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-823-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-1359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-1703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2160 7jjjd.exe 1116 vvjvp.exe 1000 vppdv.exe 3148 7rffxxr.exe 1316 hhhbnh.exe 3496 1hhbtt.exe 4592 llllrrl.exe 2864 nhbbnn.exe 1872 ffxrrlx.exe 5108 hnhtnh.exe 1832 dpddv.exe 628 htbtnn.exe 2676 jvdpj.exe 1412 1jdpj.exe 4024 jvvpj.exe 4260 ddppp.exe 2236 ffrrrlr.exe 3932 fflfxxr.exe 2612 hnhbhb.exe 4540 lxrrxxf.exe 4156 rlfxlrl.exe 4232 bhnhnn.exe 4796 5dvjv.exe 3508 7hhthh.exe 3740 btbttt.exe 2736 flxrllx.exe 2688 pjdpj.exe 1920 lfxrlxl.exe 860 pjjjv.exe 4604 jdpvv.exe 4048 lxfxlfl.exe 2216 nhbbtn.exe 4460 rlfxxxr.exe 768 bttntn.exe 2240 ppddd.exe 1808 1xlfxxr.exe 4620 ffrlxrl.exe 3688 htnnhn.exe 3484 ddpjd.exe 4432 lfxrlfr.exe 4512 hhtntn.exe 740 nnhbtn.exe 3212 9vdvp.exe 1360 7dvpj.exe 2448 lfxrllf.exe 592 tbnhbt.exe 1912 pjjvp.exe 4372 pjjdv.exe 2128 1llxxrr.exe 5064 tnbhtn.exe 1124 7djvp.exe 4020 rlrlffl.exe 1760 hhnhtt.exe 4844 hhhtnh.exe 5004 pjdvp.exe 1952 llfxllx.exe 3184 7ttttt.exe 864 djpdd.exe 2368 jddpd.exe 800 7xfxllf.exe 1412 ttbtth.exe 956 ppjdv.exe 2888 rrrffff.exe 1312 7hbnhh.exe -
resource yara_rule behavioral2/memory/2856-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/592-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-722-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbhb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2160 2856 d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe 83 PID 2856 wrote to memory of 2160 2856 d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe 83 PID 2856 wrote to memory of 2160 2856 d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe 83 PID 2160 wrote to memory of 1116 2160 7jjjd.exe 84 PID 2160 wrote to memory of 1116 2160 7jjjd.exe 84 PID 2160 wrote to memory of 1116 2160 7jjjd.exe 84 PID 1116 wrote to memory of 1000 1116 vvjvp.exe 85 PID 1116 wrote to memory of 1000 1116 vvjvp.exe 85 PID 1116 wrote to memory of 1000 1116 vvjvp.exe 85 PID 1000 wrote to memory of 3148 1000 vppdv.exe 86 PID 1000 wrote to memory of 3148 1000 vppdv.exe 86 PID 1000 wrote to memory of 3148 1000 vppdv.exe 86 PID 3148 wrote to memory of 1316 3148 7rffxxr.exe 87 PID 3148 wrote to memory of 1316 3148 7rffxxr.exe 87 PID 3148 wrote to memory of 1316 3148 7rffxxr.exe 87 PID 1316 wrote to memory of 3496 1316 hhhbnh.exe 88 PID 1316 wrote to memory of 3496 1316 hhhbnh.exe 88 PID 1316 wrote to memory of 3496 1316 hhhbnh.exe 88 PID 3496 wrote to memory of 4592 3496 1hhbtt.exe 89 PID 3496 wrote to memory of 4592 3496 1hhbtt.exe 89 PID 3496 wrote to memory of 4592 3496 1hhbtt.exe 89 PID 4592 wrote to memory of 2864 4592 llllrrl.exe 90 PID 4592 wrote to memory of 2864 4592 llllrrl.exe 90 PID 4592 wrote to memory of 2864 4592 llllrrl.exe 90 PID 2864 wrote to memory of 1872 2864 nhbbnn.exe 91 PID 2864 wrote to memory of 1872 2864 nhbbnn.exe 91 PID 2864 wrote to memory of 1872 2864 nhbbnn.exe 91 PID 1872 wrote to memory of 5108 1872 ffxrrlx.exe 92 PID 1872 wrote to memory of 5108 1872 ffxrrlx.exe 92 PID 1872 wrote to memory of 5108 1872 ffxrrlx.exe 92 PID 5108 wrote to memory of 1832 5108 hnhtnh.exe 93 PID 5108 wrote to memory of 1832 5108 hnhtnh.exe 93 PID 5108 wrote to memory of 1832 5108 hnhtnh.exe 93 PID 1832 wrote to memory of 628 1832 dpddv.exe 94 PID 1832 wrote to memory of 628 1832 dpddv.exe 94 PID 1832 wrote to memory of 628 1832 dpddv.exe 94 PID 628 wrote to memory of 2676 628 htbtnn.exe 95 PID 628 wrote to memory of 2676 628 htbtnn.exe 95 PID 628 wrote to memory of 2676 628 htbtnn.exe 95 PID 2676 wrote to memory of 1412 2676 jvdpj.exe 96 PID 2676 wrote to memory of 1412 2676 jvdpj.exe 96 PID 2676 wrote to memory of 1412 2676 jvdpj.exe 96 PID 1412 wrote to memory of 4024 1412 1jdpj.exe 97 PID 1412 wrote to memory of 4024 1412 1jdpj.exe 97 PID 1412 wrote to memory of 4024 1412 1jdpj.exe 97 PID 4024 wrote to memory of 4260 4024 jvvpj.exe 98 PID 4024 wrote to memory of 4260 4024 jvvpj.exe 98 PID 4024 wrote to memory of 4260 4024 jvvpj.exe 98 PID 4260 wrote to memory of 2236 4260 ddppp.exe 99 PID 4260 wrote to memory of 2236 4260 ddppp.exe 99 PID 4260 wrote to memory of 2236 4260 ddppp.exe 99 PID 2236 wrote to memory of 3932 2236 ffrrrlr.exe 100 PID 2236 wrote to memory of 3932 2236 ffrrrlr.exe 100 PID 2236 wrote to memory of 3932 2236 ffrrrlr.exe 100 PID 3932 wrote to memory of 2612 3932 fflfxxr.exe 101 PID 3932 wrote to memory of 2612 3932 fflfxxr.exe 101 PID 3932 wrote to memory of 2612 3932 fflfxxr.exe 101 PID 2612 wrote to memory of 4540 2612 hnhbhb.exe 102 PID 2612 wrote to memory of 4540 2612 hnhbhb.exe 102 PID 2612 wrote to memory of 4540 2612 hnhbhb.exe 102 PID 4540 wrote to memory of 4156 4540 lxrrxxf.exe 103 PID 4540 wrote to memory of 4156 4540 lxrrxxf.exe 103 PID 4540 wrote to memory of 4156 4540 lxrrxxf.exe 103 PID 4156 wrote to memory of 4232 4156 rlfxlrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe"C:\Users\Admin\AppData\Local\Temp\d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\7jjjd.exec:\7jjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\vvjvp.exec:\vvjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\vppdv.exec:\vppdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\7rffxxr.exec:\7rffxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\hhhbnh.exec:\hhhbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\1hhbtt.exec:\1hhbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\llllrrl.exec:\llllrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\nhbbnn.exec:\nhbbnn.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\ffxrrlx.exec:\ffxrrlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\hnhtnh.exec:\hnhtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\dpddv.exec:\dpddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\htbtnn.exec:\htbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\jvdpj.exec:\jvdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1jdpj.exec:\1jdpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\jvvpj.exec:\jvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\ddppp.exec:\ddppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\ffrrrlr.exec:\ffrrrlr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\fflfxxr.exec:\fflfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\hnhbhb.exec:\hnhbhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\rlfxlrl.exec:\rlfxlrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\bhnhnn.exec:\bhnhnn.exe23⤵
- Executes dropped EXE
PID:4232 -
\??\c:\5dvjv.exec:\5dvjv.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4796 -
\??\c:\7hhthh.exec:\7hhthh.exe25⤵
- Executes dropped EXE
PID:3508 -
\??\c:\btbttt.exec:\btbttt.exe26⤵
- Executes dropped EXE
PID:3740 -
\??\c:\flxrllx.exec:\flxrllx.exe27⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pjdpj.exec:\pjdpj.exe28⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lfxrlxl.exec:\lfxrlxl.exe29⤵
- Executes dropped EXE
PID:1920 -
\??\c:\pjjjv.exec:\pjjjv.exe30⤵
- Executes dropped EXE
PID:860 -
\??\c:\jdpvv.exec:\jdpvv.exe31⤵
- Executes dropped EXE
PID:4604 -
\??\c:\lxfxlfl.exec:\lxfxlfl.exe32⤵
- Executes dropped EXE
PID:4048 -
\??\c:\nhbbtn.exec:\nhbbtn.exe33⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe34⤵
- Executes dropped EXE
PID:4460 -
\??\c:\bttntn.exec:\bttntn.exe35⤵
- Executes dropped EXE
PID:768 -
\??\c:\ppddd.exec:\ppddd.exe36⤵
- Executes dropped EXE
PID:2240 -
\??\c:\1xlfxxr.exec:\1xlfxxr.exe37⤵
- Executes dropped EXE
PID:1808 -
\??\c:\ffrlxrl.exec:\ffrlxrl.exe38⤵
- Executes dropped EXE
PID:4620 -
\??\c:\htnnhn.exec:\htnnhn.exe39⤵
- Executes dropped EXE
PID:3688 -
\??\c:\ddpjd.exec:\ddpjd.exe40⤵
- Executes dropped EXE
PID:3484 -
\??\c:\lfxrlfr.exec:\lfxrlfr.exe41⤵
- Executes dropped EXE
PID:4432 -
\??\c:\hhtntn.exec:\hhtntn.exe42⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nnhbtn.exec:\nnhbtn.exe43⤵
- Executes dropped EXE
PID:740 -
\??\c:\9vdvp.exec:\9vdvp.exe44⤵
- Executes dropped EXE
PID:3212 -
\??\c:\7dvpj.exec:\7dvpj.exe45⤵
- Executes dropped EXE
PID:1360 -
\??\c:\lfxrllf.exec:\lfxrllf.exe46⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tbnhbt.exec:\tbnhbt.exe47⤵
- Executes dropped EXE
PID:592 -
\??\c:\pjjvp.exec:\pjjvp.exe48⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pjjdv.exec:\pjjdv.exe49⤵
- Executes dropped EXE
PID:4372 -
\??\c:\1llxxrr.exec:\1llxxrr.exe50⤵
- Executes dropped EXE
PID:2128 -
\??\c:\tnbhtn.exec:\tnbhtn.exe51⤵
- Executes dropped EXE
PID:5064 -
\??\c:\7djvp.exec:\7djvp.exe52⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rlrlffl.exec:\rlrlffl.exe53⤵
- Executes dropped EXE
PID:4020 -
\??\c:\hhnhtt.exec:\hhnhtt.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hhhtnh.exec:\hhhtnh.exe55⤵
- Executes dropped EXE
PID:4844 -
\??\c:\pjdvp.exec:\pjdvp.exe56⤵
- Executes dropped EXE
PID:5004 -
\??\c:\llfxllx.exec:\llfxllx.exe57⤵
- Executes dropped EXE
PID:1952 -
\??\c:\7ttttt.exec:\7ttttt.exe58⤵
- Executes dropped EXE
PID:3184 -
\??\c:\djpdd.exec:\djpdd.exe59⤵
- Executes dropped EXE
PID:864 -
\??\c:\jddpd.exec:\jddpd.exe60⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7xfxllf.exec:\7xfxllf.exe61⤵
- Executes dropped EXE
PID:800 -
\??\c:\ttbtth.exec:\ttbtth.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1412 -
\??\c:\ppjdv.exec:\ppjdv.exe63⤵
- Executes dropped EXE
PID:956 -
\??\c:\rrrffff.exec:\rrrffff.exe64⤵
- Executes dropped EXE
PID:2888 -
\??\c:\7hbnhh.exec:\7hbnhh.exe65⤵
- Executes dropped EXE
PID:1312 -
\??\c:\dvddd.exec:\dvddd.exe66⤵PID:1276
-
\??\c:\1rxrlfx.exec:\1rxrlfx.exe67⤵PID:5052
-
\??\c:\9xrlfxr.exec:\9xrlfxr.exe68⤵PID:4600
-
\??\c:\bbthbt.exec:\bbthbt.exe69⤵PID:464
-
\??\c:\dvjdv.exec:\dvjdv.exe70⤵PID:2428
-
\??\c:\fxxrllf.exec:\fxxrllf.exe71⤵PID:4616
-
\??\c:\lrfxxff.exec:\lrfxxff.exe72⤵PID:2584
-
\??\c:\bntnhb.exec:\bntnhb.exe73⤵PID:3440
-
\??\c:\vjjjv.exec:\vjjjv.exe74⤵PID:3320
-
\??\c:\xlllllr.exec:\xlllllr.exe75⤵PID:2708
-
\??\c:\7rfxrlf.exec:\7rfxrlf.exe76⤵PID:4580
-
\??\c:\hbtnhb.exec:\hbtnhb.exe77⤵PID:804
-
\??\c:\dvpvj.exec:\dvpvj.exe78⤵PID:3292
-
\??\c:\xxxxfxr.exec:\xxxxfxr.exe79⤵PID:2960
-
\??\c:\xrfxllf.exec:\xrfxllf.exe80⤵PID:4032
-
\??\c:\bbtnhh.exec:\bbtnhh.exe81⤵PID:3848
-
\??\c:\pjvpd.exec:\pjvpd.exe82⤵PID:2040
-
\??\c:\lfffllf.exec:\lfffllf.exe83⤵PID:2292
-
\??\c:\ffxrffx.exec:\ffxrffx.exe84⤵PID:1652
-
\??\c:\nbhbbt.exec:\nbhbbt.exe85⤵PID:428
-
\??\c:\pddvp.exec:\pddvp.exe86⤵PID:2380
-
\??\c:\jvpjj.exec:\jvpjj.exe87⤵PID:3832
-
\??\c:\rlrrlll.exec:\rlrrlll.exe88⤵PID:2760
-
\??\c:\ttnhtt.exec:\ttnhtt.exe89⤵PID:1200
-
\??\c:\hnnttt.exec:\hnnttt.exe90⤵PID:3004
-
\??\c:\vdvdv.exec:\vdvdv.exe91⤵PID:1544
-
\??\c:\3xfrrlr.exec:\3xfrrlr.exe92⤵PID:3908
-
\??\c:\7hbtnn.exec:\7hbtnn.exe93⤵PID:4560
-
\??\c:\pjpjj.exec:\pjpjj.exe94⤵PID:768
-
\??\c:\vppdv.exec:\vppdv.exe95⤵PID:4768
-
\??\c:\5ffxrlf.exec:\5ffxrlf.exe96⤵PID:2412
-
\??\c:\nbhbtn.exec:\nbhbtn.exe97⤵PID:3792
-
\??\c:\btnnnb.exec:\btnnnb.exe98⤵PID:3100
-
\??\c:\7dpjd.exec:\7dpjd.exe99⤵PID:3688
-
\??\c:\llfxllx.exec:\llfxllx.exe100⤵PID:3484
-
\??\c:\5thhtt.exec:\5thhtt.exe101⤵PID:4924
-
\??\c:\5vppd.exec:\5vppd.exe102⤵PID:1692
-
\??\c:\7xlfrlr.exec:\7xlfrlr.exe103⤵PID:1392
-
\??\c:\bnnbtn.exec:\bnnbtn.exe104⤵PID:4456
-
\??\c:\htbtnn.exec:\htbtnn.exe105⤵PID:3920
-
\??\c:\jjpdv.exec:\jjpdv.exe106⤵PID:1000
-
\??\c:\llfxllf.exec:\llfxllf.exe107⤵PID:4544
-
\??\c:\bbbbtn.exec:\bbbbtn.exe108⤵PID:2280
-
\??\c:\pvpjd.exec:\pvpjd.exe109⤵PID:3760
-
\??\c:\pjdvp.exec:\pjdvp.exe110⤵PID:1316
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe111⤵PID:4392
-
\??\c:\btntnh.exec:\btntnh.exe112⤵PID:5016
-
\??\c:\bhnbhh.exec:\bhnbhh.exe113⤵PID:3312
-
\??\c:\vvpjd.exec:\vvpjd.exe114⤵PID:4112
-
\??\c:\1flfrrx.exec:\1flfrrx.exe115⤵PID:2864
-
\??\c:\rxfffxr.exec:\rxfffxr.exe116⤵PID:2392
-
\??\c:\hbbthh.exec:\hbbthh.exe117⤵PID:752
-
\??\c:\ddvpj.exec:\ddvpj.exe118⤵PID:4108
-
\??\c:\lffllll.exec:\lffllll.exe119⤵PID:1952
-
\??\c:\9nnhbb.exec:\9nnhbb.exe120⤵PID:3164
-
\??\c:\ttttbt.exec:\ttttbt.exe121⤵PID:1520
-
\??\c:\vvvpp.exec:\vvvpp.exe122⤵PID:1260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-