Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe
-
Size
454KB
-
MD5
d2082844fdb1d2289f641e1cebf22ffa
-
SHA1
87b3841f8dbb98119140f2a385126e5f39663045
-
SHA256
caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432
-
SHA512
42bb7f46c5ed45cc994cc971cf0b9480b053b0a73817330576c290bfbbef452c8b6961a43f785a5c15b38e5db54c5f5c50bb8f407f2a8f9ba057362b21a6707e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3360-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/560-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-1087-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-1217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-1801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3232 7llrffr.exe 4660 5vppd.exe 4612 9pvjd.exe 2800 dpjdp.exe 912 ttnhbb.exe 3156 rrxlfxl.exe 3924 vvdvp.exe 3428 rlrlxxl.exe 2008 5hhnnh.exe 1224 pdpdv.exe 1064 hhthtn.exe 1924 9jdpd.exe 4008 rfxlrxl.exe 532 ttthtn.exe 100 vjjpd.exe 3772 rxrfrfx.exe 1484 dpvjv.exe 4724 rrxxrxr.exe 3736 hnbttb.exe 4316 rxxrfxl.exe 1420 rffxrxr.exe 436 lrxlxlx.exe 4972 3thbnh.exe 1220 jdpjv.exe 4436 nhnbht.exe 3372 dpjdj.exe 396 tttbtb.exe 1048 thhbbn.exe 4784 lfxlxrf.exe 1448 3tnhtt.exe 1996 rxxlxrf.exe 2284 5tnnht.exe 3100 pvvjd.exe 3796 flrfrlx.exe 716 hbbttt.exe 4488 pdjvj.exe 560 7pdpd.exe 3968 fxrrlff.exe 1212 vpvpp.exe 2112 vddjv.exe 1752 frrfrlx.exe 1648 hhhthb.exe 4704 vvddd.exe 5100 djvpj.exe 3712 nbbtnh.exe 3424 3ppjp.exe 1620 rrrlfxr.exe 2668 7bthhb.exe 2004 djdvd.exe 4332 jvjvv.exe 692 btnhbb.exe 1168 hbbnbt.exe 1644 dppvj.exe 5000 1lfrfxl.exe 4560 rxxrxff.exe 4000 nhnbhb.exe 2344 pjjvj.exe 4384 xxrfxrf.exe 916 rffxllf.exe 4952 3nhbtt.exe 4420 vddvj.exe 3680 1vvjv.exe 2176 3xfrlrr.exe 4820 nttnbt.exe -
resource yara_rule behavioral2/memory/3360-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/560-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-643-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3360 wrote to memory of 3232 3360 caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe 82 PID 3360 wrote to memory of 3232 3360 caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe 82 PID 3360 wrote to memory of 3232 3360 caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe 82 PID 3232 wrote to memory of 4660 3232 7llrffr.exe 83 PID 3232 wrote to memory of 4660 3232 7llrffr.exe 83 PID 3232 wrote to memory of 4660 3232 7llrffr.exe 83 PID 4660 wrote to memory of 4612 4660 5vppd.exe 84 PID 4660 wrote to memory of 4612 4660 5vppd.exe 84 PID 4660 wrote to memory of 4612 4660 5vppd.exe 84 PID 4612 wrote to memory of 2800 4612 9pvjd.exe 85 PID 4612 wrote to memory of 2800 4612 9pvjd.exe 85 PID 4612 wrote to memory of 2800 4612 9pvjd.exe 85 PID 2800 wrote to memory of 912 2800 dpjdp.exe 86 PID 2800 wrote to memory of 912 2800 dpjdp.exe 86 PID 2800 wrote to memory of 912 2800 dpjdp.exe 86 PID 912 wrote to memory of 3156 912 ttnhbb.exe 87 PID 912 wrote to memory of 3156 912 ttnhbb.exe 87 PID 912 wrote to memory of 3156 912 ttnhbb.exe 87 PID 3156 wrote to memory of 3924 3156 rrxlfxl.exe 88 PID 3156 wrote to memory of 3924 3156 rrxlfxl.exe 88 PID 3156 wrote to memory of 3924 3156 rrxlfxl.exe 88 PID 3924 wrote to memory of 3428 3924 vvdvp.exe 89 PID 3924 wrote to memory of 3428 3924 vvdvp.exe 89 PID 3924 wrote to memory of 3428 3924 vvdvp.exe 89 PID 3428 wrote to memory of 2008 3428 rlrlxxl.exe 90 PID 3428 wrote to memory of 2008 3428 rlrlxxl.exe 90 PID 3428 wrote to memory of 2008 3428 rlrlxxl.exe 90 PID 2008 wrote to memory of 1224 2008 5hhnnh.exe 91 PID 2008 wrote to memory of 1224 2008 5hhnnh.exe 91 PID 2008 wrote to memory of 1224 2008 5hhnnh.exe 91 PID 1224 wrote to memory of 1064 1224 pdpdv.exe 92 PID 1224 wrote to memory of 1064 1224 pdpdv.exe 92 PID 1224 wrote to memory of 1064 1224 pdpdv.exe 92 PID 1064 wrote to memory of 1924 1064 hhthtn.exe 93 PID 1064 wrote to memory of 1924 1064 hhthtn.exe 93 PID 1064 wrote to memory of 1924 1064 hhthtn.exe 93 PID 1924 wrote to memory of 4008 1924 9jdpd.exe 94 PID 1924 wrote to memory of 4008 1924 9jdpd.exe 94 PID 1924 wrote to memory of 4008 1924 9jdpd.exe 94 PID 4008 wrote to memory of 532 4008 rfxlrxl.exe 95 PID 4008 wrote to memory of 532 4008 rfxlrxl.exe 95 PID 4008 wrote to memory of 532 4008 rfxlrxl.exe 95 PID 532 wrote to memory of 100 532 ttthtn.exe 96 PID 532 wrote to memory of 100 532 ttthtn.exe 96 PID 532 wrote to memory of 100 532 ttthtn.exe 96 PID 100 wrote to memory of 3772 100 vjjpd.exe 97 PID 100 wrote to memory of 3772 100 vjjpd.exe 97 PID 100 wrote to memory of 3772 100 vjjpd.exe 97 PID 3772 wrote to memory of 1484 3772 rxrfrfx.exe 98 PID 3772 wrote to memory of 1484 3772 rxrfrfx.exe 98 PID 3772 wrote to memory of 1484 3772 rxrfrfx.exe 98 PID 1484 wrote to memory of 4724 1484 dpvjv.exe 99 PID 1484 wrote to memory of 4724 1484 dpvjv.exe 99 PID 1484 wrote to memory of 4724 1484 dpvjv.exe 99 PID 4724 wrote to memory of 3736 4724 rrxxrxr.exe 100 PID 4724 wrote to memory of 3736 4724 rrxxrxr.exe 100 PID 4724 wrote to memory of 3736 4724 rrxxrxr.exe 100 PID 3736 wrote to memory of 4316 3736 hnbttb.exe 101 PID 3736 wrote to memory of 4316 3736 hnbttb.exe 101 PID 3736 wrote to memory of 4316 3736 hnbttb.exe 101 PID 4316 wrote to memory of 1420 4316 rxxrfxl.exe 102 PID 4316 wrote to memory of 1420 4316 rxxrfxl.exe 102 PID 4316 wrote to memory of 1420 4316 rxxrfxl.exe 102 PID 1420 wrote to memory of 436 1420 rffxrxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe"C:\Users\Admin\AppData\Local\Temp\caeabcdb72c5f170f9cd2d510e5c9b7a00bd528d0505198bb5a0ca689cd23432.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\7llrffr.exec:\7llrffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\5vppd.exec:\5vppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\9pvjd.exec:\9pvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\dpjdp.exec:\dpjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ttnhbb.exec:\ttnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\rrxlfxl.exec:\rrxlfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\vvdvp.exec:\vvdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\rlrlxxl.exec:\rlrlxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\5hhnnh.exec:\5hhnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\pdpdv.exec:\pdpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\hhthtn.exec:\hhthtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\9jdpd.exec:\9jdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\rfxlrxl.exec:\rfxlrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\ttthtn.exec:\ttthtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\vjjpd.exec:\vjjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\rxrfrfx.exec:\rxrfrfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\dpvjv.exec:\dpvjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\rrxxrxr.exec:\rrxxrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\hnbttb.exec:\hnbttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\rxxrfxl.exec:\rxxrfxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\rffxrxr.exec:\rffxrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\lrxlxlx.exec:\lrxlxlx.exe23⤵
- Executes dropped EXE
PID:436 -
\??\c:\3thbnh.exec:\3thbnh.exe24⤵
- Executes dropped EXE
PID:4972 -
\??\c:\jdpjv.exec:\jdpjv.exe25⤵
- Executes dropped EXE
PID:1220 -
\??\c:\nhnbht.exec:\nhnbht.exe26⤵
- Executes dropped EXE
PID:4436 -
\??\c:\dpjdj.exec:\dpjdj.exe27⤵
- Executes dropped EXE
PID:3372 -
\??\c:\tttbtb.exec:\tttbtb.exe28⤵
- Executes dropped EXE
PID:396 -
\??\c:\thhbbn.exec:\thhbbn.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\lfxlxrf.exec:\lfxlxrf.exe30⤵
- Executes dropped EXE
PID:4784 -
\??\c:\3tnhtt.exec:\3tnhtt.exe31⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rxxlxrf.exec:\rxxlxrf.exe32⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5tnnht.exec:\5tnnht.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pvvjd.exec:\pvvjd.exe34⤵
- Executes dropped EXE
PID:3100 -
\??\c:\flrfrlx.exec:\flrfrlx.exe35⤵
- Executes dropped EXE
PID:3796 -
\??\c:\hbbttt.exec:\hbbttt.exe36⤵
- Executes dropped EXE
PID:716 -
\??\c:\pdjvj.exec:\pdjvj.exe37⤵
- Executes dropped EXE
PID:4488 -
\??\c:\7pdpd.exec:\7pdpd.exe38⤵
- Executes dropped EXE
PID:560 -
\??\c:\fxrrlff.exec:\fxrrlff.exe39⤵
- Executes dropped EXE
PID:3968 -
\??\c:\vpvpp.exec:\vpvpp.exe40⤵
- Executes dropped EXE
PID:1212 -
\??\c:\vddjv.exec:\vddjv.exe41⤵
- Executes dropped EXE
PID:2112 -
\??\c:\frrfrlx.exec:\frrfrlx.exe42⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hhhthb.exec:\hhhthb.exe43⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vvddd.exec:\vvddd.exe44⤵
- Executes dropped EXE
PID:4704 -
\??\c:\djvpj.exec:\djvpj.exe45⤵
- Executes dropped EXE
PID:5100 -
\??\c:\nbbtnh.exec:\nbbtnh.exe46⤵
- Executes dropped EXE
PID:3712 -
\??\c:\3ppjp.exec:\3ppjp.exe47⤵
- Executes dropped EXE
PID:3424 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe48⤵
- Executes dropped EXE
PID:1620 -
\??\c:\7bthhb.exec:\7bthhb.exe49⤵
- Executes dropped EXE
PID:2668 -
\??\c:\djdvd.exec:\djdvd.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jvjvv.exec:\jvjvv.exe51⤵
- Executes dropped EXE
PID:4332 -
\??\c:\btnhbb.exec:\btnhbb.exe52⤵
- Executes dropped EXE
PID:692 -
\??\c:\hbbnbt.exec:\hbbnbt.exe53⤵
- Executes dropped EXE
PID:1168 -
\??\c:\dppvj.exec:\dppvj.exe54⤵
- Executes dropped EXE
PID:1644 -
\??\c:\1lfrfxl.exec:\1lfrfxl.exe55⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rxxrxff.exec:\rxxrxff.exe56⤵
- Executes dropped EXE
PID:4560 -
\??\c:\nhnbhb.exec:\nhnbhb.exe57⤵
- Executes dropped EXE
PID:4000 -
\??\c:\pjjvj.exec:\pjjvj.exe58⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xxrfxrf.exec:\xxrfxrf.exe59⤵
- Executes dropped EXE
PID:4384 -
\??\c:\rffxllf.exec:\rffxllf.exe60⤵
- Executes dropped EXE
PID:916 -
\??\c:\3nhbtt.exec:\3nhbtt.exe61⤵
- Executes dropped EXE
PID:4952 -
\??\c:\vddvj.exec:\vddvj.exe62⤵
- Executes dropped EXE
PID:4420 -
\??\c:\1vvjv.exec:\1vvjv.exe63⤵
- Executes dropped EXE
PID:3680 -
\??\c:\3xfrlrr.exec:\3xfrlrr.exe64⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nttnbt.exec:\nttnbt.exe65⤵
- Executes dropped EXE
PID:4820 -
\??\c:\bhhbnh.exec:\bhhbnh.exe66⤵PID:516
-
\??\c:\dddpd.exec:\dddpd.exe67⤵PID:732
-
\??\c:\1ffrfrl.exec:\1ffrfrl.exe68⤵PID:548
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe69⤵PID:952
-
\??\c:\btnhnh.exec:\btnhnh.exe70⤵PID:2032
-
\??\c:\jjjdp.exec:\jjjdp.exe71⤵PID:1064
-
\??\c:\xrlflfx.exec:\xrlflfx.exe72⤵PID:1596
-
\??\c:\tnhbtn.exec:\tnhbtn.exe73⤵PID:4168
-
\??\c:\1nbnbt.exec:\1nbnbt.exe74⤵PID:3000
-
\??\c:\jvvjv.exec:\jvvjv.exe75⤵PID:2188
-
\??\c:\ddjdv.exec:\ddjdv.exe76⤵PID:2348
-
\??\c:\rlfrfxx.exec:\rlfrfxx.exe77⤵PID:4412
-
\??\c:\nhnbbt.exec:\nhnbbt.exe78⤵PID:2824
-
\??\c:\1ddvp.exec:\1ddvp.exe79⤵PID:3892
-
\??\c:\jppdd.exec:\jppdd.exe80⤵PID:5104
-
\??\c:\xflfxrr.exec:\xflfxrr.exe81⤵PID:2764
-
\??\c:\9nhbtn.exec:\9nhbtn.exe82⤵PID:3664
-
\??\c:\vjjvd.exec:\vjjvd.exe83⤵PID:4272
-
\??\c:\fxxlxrf.exec:\fxxlxrf.exe84⤵PID:1704
-
\??\c:\7hnnnn.exec:\7hnnnn.exe85⤵PID:224
-
\??\c:\1pdpj.exec:\1pdpj.exe86⤵PID:4664
-
\??\c:\rlfrfxr.exec:\rlfrfxr.exe87⤵PID:972
-
\??\c:\5rfxlfx.exec:\5rfxlfx.exe88⤵PID:1104
-
\??\c:\1htnbt.exec:\1htnbt.exe89⤵PID:404
-
\??\c:\vdjdj.exec:\vdjdj.exe90⤵PID:2116
-
\??\c:\pjdpd.exec:\pjdpd.exe91⤵PID:1444
-
\??\c:\fxlxxrx.exec:\fxlxxrx.exe92⤵PID:1396
-
\??\c:\nbttnh.exec:\nbttnh.exe93⤵PID:2204
-
\??\c:\hnthtn.exec:\hnthtn.exe94⤵PID:2192
-
\??\c:\jvdpp.exec:\jvdpp.exe95⤵PID:1048
-
\??\c:\1rfrfxl.exec:\1rfrfxl.exe96⤵PID:4284
-
\??\c:\xxrllff.exec:\xxrllff.exe97⤵PID:4176
-
\??\c:\3bhbtn.exec:\3bhbtn.exe98⤵PID:1564
-
\??\c:\jpddd.exec:\jpddd.exe99⤵PID:1776
-
\??\c:\xrxlfxx.exec:\xrxlfxx.exe100⤵PID:3592
-
\??\c:\llfxrlf.exec:\llfxrlf.exe101⤵PID:1956
-
\??\c:\7tnhbt.exec:\7tnhbt.exe102⤵PID:4028
-
\??\c:\jdjdv.exec:\jdjdv.exe103⤵PID:3796
-
\??\c:\dvjpd.exec:\dvjpd.exe104⤵PID:1480
-
\??\c:\9rlfllx.exec:\9rlfllx.exe105⤵PID:1948
-
\??\c:\nnnnbt.exec:\nnnnbt.exe106⤵PID:4752
-
\??\c:\5vpdp.exec:\5vpdp.exe107⤵PID:2412
-
\??\c:\jvpvd.exec:\jvpvd.exe108⤵PID:2352
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe109⤵PID:2448
-
\??\c:\thbnhh.exec:\thbnhh.exe110⤵PID:4536
-
\??\c:\7pvpj.exec:\7pvpj.exe111⤵PID:2944
-
\??\c:\1jjvj.exec:\1jjvj.exe112⤵PID:4896
-
\??\c:\fxxxlff.exec:\fxxxlff.exe113⤵PID:2624
-
\??\c:\bhhthb.exec:\bhhthb.exe114⤵PID:4200
-
\??\c:\djddj.exec:\djddj.exe115⤵PID:1992
-
\??\c:\pdjdp.exec:\pdjdp.exe116⤵PID:2444
-
\??\c:\rfxlxrf.exec:\rfxlxrf.exe117⤵PID:3116
-
\??\c:\nttnbt.exec:\nttnbt.exe118⤵PID:312
-
\??\c:\9pvdp.exec:\9pvdp.exe119⤵PID:868
-
\??\c:\7pjdj.exec:\7pjdj.exe120⤵PID:752
-
\??\c:\5rrfrlr.exec:\5rrfrlr.exe121⤵PID:4288
-
\??\c:\bnhtnh.exec:\bnhtnh.exe122⤵PID:4296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-