Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c0b728c5f0634f9228442d887125652a7154084557b341407449c24b6c6add6fN.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c0b728c5f0634f9228442d887125652a7154084557b341407449c24b6c6add6fN.exe
-
Size
454KB
-
MD5
cc0bc1fd24568300c632244b7c75c890
-
SHA1
72b1ef4c0ee2959a1aba17f02d4f25ec908fc0aa
-
SHA256
c0b728c5f0634f9228442d887125652a7154084557b341407449c24b6c6add6f
-
SHA512
d1c8cfa8ce402ade83faee3f2a1ffbc3778b3b0f7f421f1778cdccdf54b3f9dbb7c1364c2090d8bbf51044b3e418b28a8d4d5b51b3ccbfd244b13a6da60643f2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1360-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-1236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5036 pjvjj.exe 2592 rlfxffl.exe 1332 tnnnbn.exe 5072 ddddv.exe 3428 dvvdd.exe 4232 fxlffff.exe 2520 nthhbb.exe 3496 3thbtt.exe 4212 jvjdv.exe 3616 flxrlll.exe 2944 btbbtt.exe 1488 jvdvp.exe 1920 vdvpp.exe 4192 bnbtnn.exe 364 lrrlffx.exe 4248 rlrlffx.exe 2196 nthhhh.exe 4992 frfxrll.exe 4324 ffrrlrr.exe 3168 ntttbh.exe 1116 ppddd.exe 3460 jpppd.exe 2360 nhbnnb.exe 3584 ddppd.exe 4152 ntbbhh.exe 4840 vjvdv.exe 1764 bbtnbb.exe 3664 lflfxrl.exe 2608 pvvvv.exe 3356 hhtnhh.exe 4004 ddppv.exe 4208 tnbttb.exe 2860 fffxrrr.exe 2400 bttnhh.exe 624 jjjdd.exe 1776 7jppv.exe 3656 fxrllrr.exe 3668 hhhhnt.exe 2816 ttnnnt.exe 2344 jvpjp.exe 2252 5rllrxl.exe 3888 thtttb.exe 532 tnbbnb.exe 2460 jdpvv.exe 4292 rxxrrlf.exe 3108 nhhnth.exe 4020 frrllrl.exe 3068 tntttb.exe 4688 nnntnt.exe 2504 vvjjp.exe 2520 7lfffxr.exe 4232 nbnnnn.exe 4392 nthbtb.exe 4052 jjppj.exe 4268 rlffxff.exe 2892 nnntnn.exe 5104 ddpjd.exe 2440 llrfffl.exe 1652 nnnttt.exe 1696 5nhttb.exe 4388 vvppd.exe 4948 rllflxx.exe 1488 3tbtnn.exe 1780 vvppp.exe -
resource yara_rule behavioral2/memory/1360-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-744-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1360 wrote to memory of 5036 1360 c0b728c5f0634f9228442d887125652a7154084557b341407449c24b6c6add6fN.exe 82 PID 1360 wrote to memory of 5036 1360 c0b728c5f0634f9228442d887125652a7154084557b341407449c24b6c6add6fN.exe 82 PID 1360 wrote to memory of 5036 1360 c0b728c5f0634f9228442d887125652a7154084557b341407449c24b6c6add6fN.exe 82 PID 5036 wrote to memory of 2592 5036 pjvjj.exe 83 PID 5036 wrote to memory of 2592 5036 pjvjj.exe 83 PID 5036 wrote to memory of 2592 5036 pjvjj.exe 83 PID 2592 wrote to memory of 1332 2592 rlfxffl.exe 84 PID 2592 wrote to memory of 1332 2592 rlfxffl.exe 84 PID 2592 wrote to memory of 1332 2592 rlfxffl.exe 84 PID 1332 wrote to memory of 5072 1332 tnnnbn.exe 85 PID 1332 wrote to memory of 5072 1332 tnnnbn.exe 85 PID 1332 wrote to memory of 5072 1332 tnnnbn.exe 85 PID 5072 wrote to memory of 3428 5072 ddddv.exe 86 PID 5072 wrote to memory of 3428 5072 ddddv.exe 86 PID 5072 wrote to memory of 3428 5072 ddddv.exe 86 PID 3428 wrote to memory of 4232 3428 dvvdd.exe 87 PID 3428 wrote to memory of 4232 3428 dvvdd.exe 87 PID 3428 wrote to memory of 4232 3428 dvvdd.exe 87 PID 4232 wrote to memory of 2520 4232 fxlffff.exe 88 PID 4232 wrote to memory of 2520 4232 fxlffff.exe 88 PID 4232 wrote to memory of 2520 4232 fxlffff.exe 88 PID 2520 wrote to memory of 3496 2520 nthhbb.exe 89 PID 2520 wrote to memory of 3496 2520 nthhbb.exe 89 PID 2520 wrote to memory of 3496 2520 nthhbb.exe 89 PID 3496 wrote to memory of 4212 3496 3thbtt.exe 90 PID 3496 wrote to memory of 4212 3496 3thbtt.exe 90 PID 3496 wrote to memory of 4212 3496 3thbtt.exe 90 PID 4212 wrote to memory of 3616 4212 jvjdv.exe 91 PID 4212 wrote to memory of 3616 4212 jvjdv.exe 91 PID 4212 wrote to memory of 3616 4212 jvjdv.exe 91 PID 3616 wrote to memory of 2944 3616 flxrlll.exe 92 PID 3616 wrote to memory of 2944 3616 flxrlll.exe 92 PID 3616 wrote to memory of 2944 3616 flxrlll.exe 92 PID 2944 wrote to memory of 1488 2944 btbbtt.exe 93 PID 2944 wrote to memory of 1488 2944 btbbtt.exe 93 PID 2944 wrote to memory of 1488 2944 btbbtt.exe 93 PID 1488 wrote to memory of 1920 1488 jvdvp.exe 94 PID 1488 wrote to memory of 1920 1488 jvdvp.exe 94 PID 1488 wrote to memory of 1920 1488 jvdvp.exe 94 PID 1920 wrote to memory of 4192 1920 vdvpp.exe 95 PID 1920 wrote to memory of 4192 1920 vdvpp.exe 95 PID 1920 wrote to memory of 4192 1920 vdvpp.exe 95 PID 4192 wrote to memory of 364 4192 bnbtnn.exe 96 PID 4192 wrote to memory of 364 4192 bnbtnn.exe 96 PID 4192 wrote to memory of 364 4192 bnbtnn.exe 96 PID 364 wrote to memory of 4248 364 lrrlffx.exe 97 PID 364 wrote to memory of 4248 364 lrrlffx.exe 97 PID 364 wrote to memory of 4248 364 lrrlffx.exe 97 PID 4248 wrote to memory of 2196 4248 rlrlffx.exe 98 PID 4248 wrote to memory of 2196 4248 rlrlffx.exe 98 PID 4248 wrote to memory of 2196 4248 rlrlffx.exe 98 PID 2196 wrote to memory of 4992 2196 nthhhh.exe 99 PID 2196 wrote to memory of 4992 2196 nthhhh.exe 99 PID 2196 wrote to memory of 4992 2196 nthhhh.exe 99 PID 4992 wrote to memory of 4324 4992 frfxrll.exe 100 PID 4992 wrote to memory of 4324 4992 frfxrll.exe 100 PID 4992 wrote to memory of 4324 4992 frfxrll.exe 100 PID 4324 wrote to memory of 3168 4324 ffrrlrr.exe 101 PID 4324 wrote to memory of 3168 4324 ffrrlrr.exe 101 PID 4324 wrote to memory of 3168 4324 ffrrlrr.exe 101 PID 3168 wrote to memory of 1116 3168 ntttbh.exe 102 PID 3168 wrote to memory of 1116 3168 ntttbh.exe 102 PID 3168 wrote to memory of 1116 3168 ntttbh.exe 102 PID 1116 wrote to memory of 3460 1116 ppddd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0b728c5f0634f9228442d887125652a7154084557b341407449c24b6c6add6fN.exe"C:\Users\Admin\AppData\Local\Temp\c0b728c5f0634f9228442d887125652a7154084557b341407449c24b6c6add6fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\pjvjj.exec:\pjvjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\rlfxffl.exec:\rlfxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\tnnnbn.exec:\tnnnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\ddddv.exec:\ddddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\dvvdd.exec:\dvvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\fxlffff.exec:\fxlffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\nthhbb.exec:\nthhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3thbtt.exec:\3thbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\jvjdv.exec:\jvjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\flxrlll.exec:\flxrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\btbbtt.exec:\btbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jvdvp.exec:\jvdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\vdvpp.exec:\vdvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\bnbtnn.exec:\bnbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\lrrlffx.exec:\lrrlffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\rlrlffx.exec:\rlrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\nthhhh.exec:\nthhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\frfxrll.exec:\frfxrll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\ffrrlrr.exec:\ffrrlrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\ntttbh.exec:\ntttbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\ppddd.exec:\ppddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\jpppd.exec:\jpppd.exe23⤵
- Executes dropped EXE
PID:3460 -
\??\c:\nhbnnb.exec:\nhbnnb.exe24⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ddppd.exec:\ddppd.exe25⤵
- Executes dropped EXE
PID:3584 -
\??\c:\ntbbhh.exec:\ntbbhh.exe26⤵
- Executes dropped EXE
PID:4152 -
\??\c:\vjvdv.exec:\vjvdv.exe27⤵
- Executes dropped EXE
PID:4840 -
\??\c:\bbtnbb.exec:\bbtnbb.exe28⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lflfxrl.exec:\lflfxrl.exe29⤵
- Executes dropped EXE
PID:3664 -
\??\c:\pvvvv.exec:\pvvvv.exe30⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hhtnhh.exec:\hhtnhh.exe31⤵
- Executes dropped EXE
PID:3356 -
\??\c:\ddppv.exec:\ddppv.exe32⤵
- Executes dropped EXE
PID:4004 -
\??\c:\tnbttb.exec:\tnbttb.exe33⤵
- Executes dropped EXE
PID:4208 -
\??\c:\fffxrrr.exec:\fffxrrr.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bttnhh.exec:\bttnhh.exe35⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jjjdd.exec:\jjjdd.exe36⤵
- Executes dropped EXE
PID:624 -
\??\c:\7jppv.exec:\7jppv.exe37⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fxrllrr.exec:\fxrllrr.exe38⤵
- Executes dropped EXE
PID:3656 -
\??\c:\hhhhnt.exec:\hhhhnt.exe39⤵
- Executes dropped EXE
PID:3668 -
\??\c:\ttnnnt.exec:\ttnnnt.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jvpjp.exec:\jvpjp.exe41⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5rllrxl.exec:\5rllrxl.exe42⤵
- Executes dropped EXE
PID:2252 -
\??\c:\thtttb.exec:\thtttb.exe43⤵
- Executes dropped EXE
PID:3888 -
\??\c:\tnbbnb.exec:\tnbbnb.exe44⤵
- Executes dropped EXE
PID:532 -
\??\c:\jdpvv.exec:\jdpvv.exe45⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe46⤵
- Executes dropped EXE
PID:4292 -
\??\c:\nhhnth.exec:\nhhnth.exe47⤵
- Executes dropped EXE
PID:3108 -
\??\c:\vdjjp.exec:\vdjjp.exe48⤵PID:3764
-
\??\c:\frrllrl.exec:\frrllrl.exe49⤵
- Executes dropped EXE
PID:4020 -
\??\c:\tntttb.exec:\tntttb.exe50⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nnntnt.exec:\nnntnt.exe51⤵
- Executes dropped EXE
PID:4688 -
\??\c:\vvjjp.exec:\vvjjp.exe52⤵
- Executes dropped EXE
PID:2504 -
\??\c:\7lfffxr.exec:\7lfffxr.exe53⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nbnnnn.exec:\nbnnnn.exe54⤵
- Executes dropped EXE
PID:4232 -
\??\c:\nthbtb.exec:\nthbtb.exe55⤵
- Executes dropped EXE
PID:4392 -
\??\c:\jjppj.exec:\jjppj.exe56⤵
- Executes dropped EXE
PID:4052 -
\??\c:\rlffxff.exec:\rlffxff.exe57⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nnntnn.exec:\nnntnn.exe58⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ddpjd.exec:\ddpjd.exe59⤵
- Executes dropped EXE
PID:5104 -
\??\c:\llrfffl.exec:\llrfffl.exe60⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nnnttt.exec:\nnnttt.exe61⤵
- Executes dropped EXE
PID:1652 -
\??\c:\5nhttb.exec:\5nhttb.exe62⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vvppd.exec:\vvppd.exe63⤵
- Executes dropped EXE
PID:4388 -
\??\c:\rllflxx.exec:\rllflxx.exe64⤵
- Executes dropped EXE
PID:4948 -
\??\c:\3tbtnn.exec:\3tbtnn.exe65⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vvppp.exec:\vvppp.exe66⤵
- Executes dropped EXE
PID:1780 -
\??\c:\dpddd.exec:\dpddd.exe67⤵PID:3064
-
\??\c:\lrflflr.exec:\lrflflr.exe68⤵PID:1300
-
\??\c:\tbtnnn.exec:\tbtnnn.exe69⤵PID:364
-
\??\c:\vppvv.exec:\vppvv.exe70⤵PID:3736
-
\??\c:\5fxrlfl.exec:\5fxrlfl.exe71⤵PID:3432
-
\??\c:\7nnhbb.exec:\7nnhbb.exe72⤵PID:3024
-
\??\c:\vdjdv.exec:\vdjdv.exe73⤵PID:1444
-
\??\c:\3djjj.exec:\3djjj.exe74⤵PID:112
-
\??\c:\lxxxfff.exec:\lxxxfff.exe75⤵PID:3852
-
\??\c:\tnbtnt.exec:\tnbtnt.exe76⤵PID:556
-
\??\c:\pdpjv.exec:\pdpjv.exe77⤵
- System Location Discovery: System Language Discovery
PID:2616 -
\??\c:\9xxrxxf.exec:\9xxrxxf.exe78⤵PID:3620
-
\??\c:\btnhtb.exec:\btnhtb.exe79⤵PID:3436
-
\??\c:\vvppd.exec:\vvppd.exe80⤵PID:4200
-
\??\c:\jjdjj.exec:\jjdjj.exe81⤵PID:2708
-
\??\c:\frfffll.exec:\frfffll.exe82⤵PID:1616
-
\??\c:\hbnnnn.exec:\hbnnnn.exe83⤵PID:1604
-
\??\c:\vvjjj.exec:\vvjjj.exe84⤵PID:4760
-
\??\c:\rflfxxx.exec:\rflfxxx.exe85⤵PID:2388
-
\??\c:\ttnnbh.exec:\ttnnbh.exe86⤵PID:548
-
\??\c:\pvjpv.exec:\pvjpv.exe87⤵PID:744
-
\??\c:\1jdvp.exec:\1jdvp.exe88⤵PID:3580
-
\??\c:\3lxxrxr.exec:\3lxxrxr.exe89⤵PID:3104
-
\??\c:\tthhbn.exec:\tthhbn.exe90⤵PID:4808
-
\??\c:\jdppp.exec:\jdppp.exe91⤵PID:836
-
\??\c:\llxxfxx.exec:\llxxfxx.exe92⤵PID:3372
-
\??\c:\hbhbtt.exec:\hbhbtt.exe93⤵
- System Location Discovery: System Language Discovery
PID:956 -
\??\c:\3jjjv.exec:\3jjjv.exe94⤵PID:1544
-
\??\c:\lxxrrxr.exec:\lxxrrxr.exe95⤵PID:1776
-
\??\c:\7rrrlll.exec:\7rrrlll.exe96⤵PID:540
-
\??\c:\ttbbnt.exec:\ttbbnt.exe97⤵PID:372
-
\??\c:\vpjjp.exec:\vpjjp.exe98⤵PID:3652
-
\??\c:\rlxxfff.exec:\rlxxfff.exe99⤵PID:2816
-
\??\c:\7bhbbb.exec:\7bhbbb.exe100⤵PID:4828
-
\??\c:\7jvvv.exec:\7jvvv.exe101⤵PID:628
-
\??\c:\5xfrrrl.exec:\5xfrrrl.exe102⤵PID:4988
-
\??\c:\tbbbtt.exec:\tbbbtt.exe103⤵PID:3140
-
\??\c:\vpvvd.exec:\vpvvd.exe104⤵PID:4996
-
\??\c:\vdjdv.exec:\vdjdv.exe105⤵PID:4284
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe106⤵PID:3248
-
\??\c:\nhnhhh.exec:\nhnhhh.exe107⤵PID:3280
-
\??\c:\7nnhtt.exec:\7nnhtt.exe108⤵PID:2592
-
\??\c:\pjpjv.exec:\pjpjv.exe109⤵PID:2412
-
\??\c:\rrrrfff.exec:\rrrrfff.exe110⤵PID:2632
-
\??\c:\9hnhhh.exec:\9hnhhh.exe111⤵PID:440
-
\??\c:\bntnhb.exec:\bntnhb.exe112⤵PID:1492
-
\??\c:\9ddvj.exec:\9ddvj.exe113⤵PID:3156
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe114⤵PID:3504
-
\??\c:\btbbbh.exec:\btbbbh.exe115⤵PID:4212
-
\??\c:\pdjjj.exec:\pdjjj.exe116⤵PID:3304
-
\??\c:\xfxxflx.exec:\xfxxflx.exe117⤵PID:2712
-
\??\c:\tnbbbb.exec:\tnbbbb.exe118⤵PID:1680
-
\??\c:\tnbbhh.exec:\tnbbhh.exe119⤵PID:2756
-
\??\c:\1pppp.exec:\1pppp.exe120⤵PID:1596
-
\??\c:\rfxrfrx.exec:\rfxrfrx.exe121⤵PID:1184
-
\??\c:\hnthbh.exec:\hnthbh.exe122⤵PID:1540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-