Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 03:47
Behavioral task
behavioral1
Sample
dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe
-
Size
406KB
-
MD5
a54435cfa0729aba573f4eb2abd3f827
-
SHA1
3d8968b4c79a64ac0e61ad27808301b65e74c5ff
-
SHA256
dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518
-
SHA512
f86dae4b94c54600a1a10aea59b325ca4269f49e2319330f492fb47b20ec82b295f48b7771cb86c539436cdd7d9274d07a098dc86e156e51306057292bb3282d
-
SSDEEP
6144:0cm4FmowdHoSH5BCwdyPUVn1/PRN2kIHVtS6o:C4wFHoS3C8Vnnqo6o
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2944-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3788-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1292-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/864-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1240-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1864-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/856-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1596-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-678-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-787-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-1187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-1428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-1826-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2864 5nnhhh.exe 3788 pvdvp.exe 2976 rlrxxlf.exe 3936 ntbtnn.exe 2132 nhhbbb.exe 1736 dvjdv.exe 1520 vdvdj.exe 3984 tttnhb.exe 3692 pjdpj.exe 3156 hbtbnb.exe 4496 lflfxrl.exe 2688 5dddv.exe 1292 frfxlfx.exe 4940 9bhhbb.exe 2280 9nhbtn.exe 1700 3nhbnh.exe 116 tbhbtb.exe 3900 lllfxxf.exe 3676 3nthhh.exe 1400 dvdvp.exe 3552 hbnhtt.exe 4224 ppdvj.exe 864 xlxfxrr.exe 1864 hhtthh.exe 1492 5bbbhh.exe 1240 9ppdd.exe 4420 rllfffx.exe 5064 nbntnt.exe 2168 htnbtt.exe 1036 frxxxrr.exe 2616 hhnnhh.exe 320 fxxxllf.exe 3828 rfrrrfr.exe 2504 rlffrff.exe 1568 tnbttt.exe 2652 jjdjj.exe 1820 bntnnt.exe 5092 llxffxl.exe 2076 rlxxrll.exe 4964 rlxxxll.exe 5016 nthbtt.exe 4772 pdjdv.exe 3872 3vddj.exe 4792 fxlxrrl.exe 3108 bnnbtn.exe 3576 ppjdv.exe 4172 3djdv.exe 4228 5llxrrx.exe 2052 7tnhtn.exe 2608 1dvpd.exe 3148 jpvpj.exe 4020 llfxrrl.exe 3580 nbhhbt.exe 4768 thnnbb.exe 4544 1dvpd.exe 1332 xrxxxrr.exe 512 thtnhb.exe 2156 7btnbn.exe 1168 djppj.exe 1760 lxlfrrl.exe 5044 xrrrrrr.exe 3432 tbhbtt.exe 3584 tntnhb.exe 1520 3djdp.exe -
resource yara_rule behavioral2/memory/2944-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0010000000023bd7-3.dat upx behavioral2/memory/2944-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023ca4-9.dat upx behavioral2/memory/3788-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca5-16.dat upx behavioral2/memory/2864-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca6-21.dat upx behavioral2/memory/2976-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2132-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3936-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca8-35.dat upx behavioral2/memory/1736-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca7-27.dat upx behavioral2/files/0x0007000000023ca9-39.dat upx behavioral2/memory/1736-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023caa-45.dat upx behavioral2/memory/1520-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cac-51.dat upx behavioral2/memory/3984-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cad-57.dat upx behavioral2/files/0x0007000000023cae-62.dat upx behavioral2/memory/3156-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023caf-68.dat upx behavioral2/files/0x0007000000023cb0-76.dat upx behavioral2/files/0x0007000000023cb1-80.dat upx behavioral2/memory/4940-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1292-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2688-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4496-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-87.dat upx behavioral2/files/0x0008000000023ca2-92.dat upx behavioral2/memory/116-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb3-99.dat upx behavioral2/memory/2280-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb4-105.dat upx behavioral2/files/0x0007000000023cb5-111.dat upx behavioral2/files/0x0007000000023cb6-114.dat upx behavioral2/memory/3676-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb8-121.dat upx behavioral2/files/0x0007000000023cb9-125.dat upx behavioral2/memory/3552-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cba-132.dat upx behavioral2/memory/4224-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbb-137.dat upx behavioral2/memory/1864-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/864-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbc-144.dat upx behavioral2/memory/1492-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-151.dat upx behavioral2/files/0x0007000000023cbe-157.dat upx behavioral2/memory/4420-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1240-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbf-163.dat upx behavioral2/memory/5064-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1864-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5064-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc0-171.dat upx behavioral2/files/0x0007000000023cc1-175.dat upx behavioral2/files/0x0007000000023cc2-180.dat upx behavioral2/files/0x0007000000023cc3-184.dat upx behavioral2/memory/2616-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3828-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1568-202-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2864 2944 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 81 PID 2944 wrote to memory of 2864 2944 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 81 PID 2944 wrote to memory of 2864 2944 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 81 PID 2864 wrote to memory of 3788 2864 5nnhhh.exe 82 PID 2864 wrote to memory of 3788 2864 5nnhhh.exe 82 PID 2864 wrote to memory of 3788 2864 5nnhhh.exe 82 PID 3788 wrote to memory of 2976 3788 pvdvp.exe 83 PID 3788 wrote to memory of 2976 3788 pvdvp.exe 83 PID 3788 wrote to memory of 2976 3788 pvdvp.exe 83 PID 2976 wrote to memory of 3936 2976 rlrxxlf.exe 84 PID 2976 wrote to memory of 3936 2976 rlrxxlf.exe 84 PID 2976 wrote to memory of 3936 2976 rlrxxlf.exe 84 PID 3936 wrote to memory of 2132 3936 ntbtnn.exe 85 PID 3936 wrote to memory of 2132 3936 ntbtnn.exe 85 PID 3936 wrote to memory of 2132 3936 ntbtnn.exe 85 PID 2132 wrote to memory of 1736 2132 nhhbbb.exe 86 PID 2132 wrote to memory of 1736 2132 nhhbbb.exe 86 PID 2132 wrote to memory of 1736 2132 nhhbbb.exe 86 PID 1736 wrote to memory of 1520 1736 dvjdv.exe 87 PID 1736 wrote to memory of 1520 1736 dvjdv.exe 87 PID 1736 wrote to memory of 1520 1736 dvjdv.exe 87 PID 1520 wrote to memory of 3984 1520 vdvdj.exe 88 PID 1520 wrote to memory of 3984 1520 vdvdj.exe 88 PID 1520 wrote to memory of 3984 1520 vdvdj.exe 88 PID 3984 wrote to memory of 3692 3984 tttnhb.exe 89 PID 3984 wrote to memory of 3692 3984 tttnhb.exe 89 PID 3984 wrote to memory of 3692 3984 tttnhb.exe 89 PID 3692 wrote to memory of 3156 3692 pjdpj.exe 90 PID 3692 wrote to memory of 3156 3692 pjdpj.exe 90 PID 3692 wrote to memory of 3156 3692 pjdpj.exe 90 PID 3156 wrote to memory of 4496 3156 hbtbnb.exe 91 PID 3156 wrote to memory of 4496 3156 hbtbnb.exe 91 PID 3156 wrote to memory of 4496 3156 hbtbnb.exe 91 PID 4496 wrote to memory of 2688 4496 lflfxrl.exe 92 PID 4496 wrote to memory of 2688 4496 lflfxrl.exe 92 PID 4496 wrote to memory of 2688 4496 lflfxrl.exe 92 PID 2688 wrote to memory of 1292 2688 5dddv.exe 93 PID 2688 wrote to memory of 1292 2688 5dddv.exe 93 PID 2688 wrote to memory of 1292 2688 5dddv.exe 93 PID 1292 wrote to memory of 4940 1292 frfxlfx.exe 94 PID 1292 wrote to memory of 4940 1292 frfxlfx.exe 94 PID 1292 wrote to memory of 4940 1292 frfxlfx.exe 94 PID 4940 wrote to memory of 2280 4940 9bhhbb.exe 95 PID 4940 wrote to memory of 2280 4940 9bhhbb.exe 95 PID 4940 wrote to memory of 2280 4940 9bhhbb.exe 95 PID 2280 wrote to memory of 1700 2280 9nhbtn.exe 96 PID 2280 wrote to memory of 1700 2280 9nhbtn.exe 96 PID 2280 wrote to memory of 1700 2280 9nhbtn.exe 96 PID 1700 wrote to memory of 116 1700 3nhbnh.exe 97 PID 1700 wrote to memory of 116 1700 3nhbnh.exe 97 PID 1700 wrote to memory of 116 1700 3nhbnh.exe 97 PID 116 wrote to memory of 3900 116 tbhbtb.exe 98 PID 116 wrote to memory of 3900 116 tbhbtb.exe 98 PID 116 wrote to memory of 3900 116 tbhbtb.exe 98 PID 3900 wrote to memory of 3676 3900 lllfxxf.exe 99 PID 3900 wrote to memory of 3676 3900 lllfxxf.exe 99 PID 3900 wrote to memory of 3676 3900 lllfxxf.exe 99 PID 3676 wrote to memory of 1400 3676 3nthhh.exe 100 PID 3676 wrote to memory of 1400 3676 3nthhh.exe 100 PID 3676 wrote to memory of 1400 3676 3nthhh.exe 100 PID 1400 wrote to memory of 3552 1400 dvdvp.exe 101 PID 1400 wrote to memory of 3552 1400 dvdvp.exe 101 PID 1400 wrote to memory of 3552 1400 dvdvp.exe 101 PID 3552 wrote to memory of 4224 3552 hbnhtt.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe"C:\Users\Admin\AppData\Local\Temp\dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\5nnhhh.exec:\5nnhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\pvdvp.exec:\pvdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\rlrxxlf.exec:\rlrxxlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\ntbtnn.exec:\ntbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\nhhbbb.exec:\nhhbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\dvjdv.exec:\dvjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\vdvdj.exec:\vdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\tttnhb.exec:\tttnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\pjdpj.exec:\pjdpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\hbtbnb.exec:\hbtbnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\lflfxrl.exec:\lflfxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\5dddv.exec:\5dddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\frfxlfx.exec:\frfxlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\9bhhbb.exec:\9bhhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\9nhbtn.exec:\9nhbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\3nhbnh.exec:\3nhbnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\tbhbtb.exec:\tbhbtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\lllfxxf.exec:\lllfxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\3nthhh.exec:\3nthhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\dvdvp.exec:\dvdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\hbnhtt.exec:\hbnhtt.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\ppdvj.exec:\ppdvj.exe23⤵
- Executes dropped EXE
PID:4224 -
\??\c:\xlxfxrr.exec:\xlxfxrr.exe24⤵
- Executes dropped EXE
PID:864 -
\??\c:\hhtthh.exec:\hhtthh.exe25⤵
- Executes dropped EXE
PID:1864 -
\??\c:\5bbbhh.exec:\5bbbhh.exe26⤵
- Executes dropped EXE
PID:1492 -
\??\c:\9ppdd.exec:\9ppdd.exe27⤵
- Executes dropped EXE
PID:1240 -
\??\c:\rllfffx.exec:\rllfffx.exe28⤵
- Executes dropped EXE
PID:4420 -
\??\c:\nbntnt.exec:\nbntnt.exe29⤵
- Executes dropped EXE
PID:5064 -
\??\c:\htnbtt.exec:\htnbtt.exe30⤵
- Executes dropped EXE
PID:2168 -
\??\c:\frxxxrr.exec:\frxxxrr.exe31⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hhnnhh.exec:\hhnnhh.exe32⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fxxxllf.exec:\fxxxllf.exe33⤵
- Executes dropped EXE
PID:320 -
\??\c:\rfrrrfr.exec:\rfrrrfr.exe34⤵
- Executes dropped EXE
PID:3828 -
\??\c:\rlffrff.exec:\rlffrff.exe35⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tnbttt.exec:\tnbttt.exe36⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jjdjj.exec:\jjdjj.exe37⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bntnnt.exec:\bntnnt.exe38⤵
- Executes dropped EXE
PID:1820 -
\??\c:\llxffxl.exec:\llxffxl.exe39⤵
- Executes dropped EXE
PID:5092 -
\??\c:\rlxxrll.exec:\rlxxrll.exe40⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rlxxxll.exec:\rlxxxll.exe41⤵
- Executes dropped EXE
PID:4964 -
\??\c:\nthbtt.exec:\nthbtt.exe42⤵
- Executes dropped EXE
PID:5016 -
\??\c:\pdjdv.exec:\pdjdv.exe43⤵
- Executes dropped EXE
PID:4772 -
\??\c:\3vddj.exec:\3vddj.exe44⤵
- Executes dropped EXE
PID:3872 -
\??\c:\fxlxrrl.exec:\fxlxrrl.exe45⤵
- Executes dropped EXE
PID:4792 -
\??\c:\bnnbtn.exec:\bnnbtn.exe46⤵
- Executes dropped EXE
PID:3108 -
\??\c:\ppjdv.exec:\ppjdv.exe47⤵
- Executes dropped EXE
PID:3576 -
\??\c:\3djdv.exec:\3djdv.exe48⤵
- Executes dropped EXE
PID:4172 -
\??\c:\5llxrrx.exec:\5llxrrx.exe49⤵
- Executes dropped EXE
PID:4228 -
\??\c:\7tnhtn.exec:\7tnhtn.exe50⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1dvpd.exec:\1dvpd.exe51⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jpvpj.exec:\jpvpj.exe52⤵
- Executes dropped EXE
PID:3148 -
\??\c:\llfxrrl.exec:\llfxrrl.exe53⤵
- Executes dropped EXE
PID:4020 -
\??\c:\nbhhbt.exec:\nbhhbt.exe54⤵
- Executes dropped EXE
PID:3580 -
\??\c:\thnnbb.exec:\thnnbb.exe55⤵
- Executes dropped EXE
PID:4768 -
\??\c:\1dvpd.exec:\1dvpd.exe56⤵
- Executes dropped EXE
PID:4544 -
\??\c:\xrxxxrr.exec:\xrxxxrr.exe57⤵
- Executes dropped EXE
PID:1332 -
\??\c:\thtnhb.exec:\thtnhb.exe58⤵
- Executes dropped EXE
PID:512 -
\??\c:\7btnbn.exec:\7btnbn.exe59⤵
- Executes dropped EXE
PID:2156 -
\??\c:\djppj.exec:\djppj.exe60⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lxlfrrl.exec:\lxlfrrl.exe61⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe62⤵
- Executes dropped EXE
PID:5044 -
\??\c:\tbhbtt.exec:\tbhbtt.exe63⤵
- Executes dropped EXE
PID:3432 -
\??\c:\tntnhb.exec:\tntnhb.exe64⤵
- Executes dropped EXE
PID:3584 -
\??\c:\3djdp.exec:\3djdp.exe65⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1lxrxxf.exec:\1lxrxxf.exe66⤵PID:2760
-
\??\c:\btnhbb.exec:\btnhbb.exe67⤵PID:1740
-
\??\c:\9nnbtt.exec:\9nnbtt.exe68⤵PID:856
-
\??\c:\1ppdd.exec:\1ppdd.exe69⤵PID:1140
-
\??\c:\1flflxl.exec:\1flflxl.exe70⤵PID:4496
-
\??\c:\nttnbb.exec:\nttnbb.exe71⤵PID:4148
-
\??\c:\nthnhb.exec:\nthnhb.exe72⤵PID:3616
-
\??\c:\vppjd.exec:\vppjd.exe73⤵PID:2080
-
\??\c:\hbtbht.exec:\hbtbht.exe74⤵PID:4648
-
\??\c:\7btnbb.exec:\7btnbb.exe75⤵PID:2444
-
\??\c:\5djdv.exec:\5djdv.exe76⤵PID:2696
-
\??\c:\rfrfxfx.exec:\rfrfxfx.exe77⤵PID:4480
-
\??\c:\3hhbth.exec:\3hhbth.exe78⤵PID:1420
-
\??\c:\bhhhtt.exec:\bhhhtt.exe79⤵PID:4880
-
\??\c:\9jddv.exec:\9jddv.exe80⤵PID:3808
-
\??\c:\flxrlll.exec:\flxrlll.exe81⤵PID:4656
-
\??\c:\hhnhtb.exec:\hhnhtb.exe82⤵PID:4664
-
\??\c:\jpvpj.exec:\jpvpj.exe83⤵PID:2340
-
\??\c:\pvvjj.exec:\pvvjj.exe84⤵PID:2248
-
\??\c:\rxfxllx.exec:\rxfxllx.exe85⤵PID:4636
-
\??\c:\7frllll.exec:\7frllll.exe86⤵PID:1840
-
\??\c:\hhthbn.exec:\hhthbn.exe87⤵PID:2272
-
\??\c:\djpjd.exec:\djpjd.exe88⤵PID:3324
-
\??\c:\dvdvp.exec:\dvdvp.exe89⤵PID:3348
-
\??\c:\rrlfllr.exec:\rrlfllr.exe90⤵PID:4296
-
\??\c:\3xxrllf.exec:\3xxrllf.exe91⤵PID:1240
-
\??\c:\bhnhbb.exec:\bhnhbb.exe92⤵PID:3908
-
\??\c:\dvjjj.exec:\dvjjj.exe93⤵PID:2632
-
\??\c:\3jjdv.exec:\3jjdv.exe94⤵PID:1868
-
\??\c:\fxfxlrl.exec:\fxfxlrl.exe95⤵PID:1892
-
\??\c:\1tbntt.exec:\1tbntt.exe96⤵PID:2736
-
\??\c:\tnhbbt.exec:\tnhbbt.exe97⤵PID:4476
-
\??\c:\3pppj.exec:\3pppj.exe98⤵PID:3968
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe99⤵PID:2616
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe100⤵PID:3500
-
\??\c:\bbbnhh.exec:\bbbnhh.exe101⤵PID:2452
-
\??\c:\9djvp.exec:\9djvp.exe102⤵PID:212
-
\??\c:\fxfxlll.exec:\fxfxlll.exe103⤵PID:1652
-
\??\c:\xrrlffx.exec:\xrrlffx.exe104⤵PID:3832
-
\??\c:\hhhbbb.exec:\hhhbbb.exe105⤵PID:1020
-
\??\c:\djppj.exec:\djppj.exe106⤵PID:2420
-
\??\c:\pdjjd.exec:\pdjjd.exe107⤵PID:1596
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe108⤵PID:4528
-
\??\c:\htbbtt.exec:\htbbtt.exe109⤵PID:4964
-
\??\c:\jdjdd.exec:\jdjdd.exe110⤵PID:3820
-
\??\c:\llxfflr.exec:\llxfflr.exe111⤵PID:1904
-
\??\c:\7httth.exec:\7httth.exe112⤵PID:5096
-
\??\c:\dpdvp.exec:\dpdvp.exe113⤵PID:2368
-
\??\c:\pddvd.exec:\pddvd.exe114⤵PID:4080
-
\??\c:\7rrrrxx.exec:\7rrrrxx.exe115⤵PID:1412
-
\??\c:\bbhhbt.exec:\bbhhbt.exe116⤵PID:2192
-
\??\c:\dpvpj.exec:\dpvpj.exe117⤵PID:4016
-
\??\c:\7pvjd.exec:\7pvjd.exe118⤵PID:4784
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe119⤵PID:2096
-
\??\c:\btnhbb.exec:\btnhbb.exe120⤵PID:4364
-
\??\c:\httnnt.exec:\httnnt.exe121⤵PID:4356
-
\??\c:\jddvp.exec:\jddvp.exe122⤵PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-