Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 03:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe
-
Size
454KB
-
MD5
1194c8f7783166fc7c9637e2169b4e65
-
SHA1
e66e589a3e64ee01a71a517a34a96d0853b24fbb
-
SHA256
d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1
-
SHA512
2ca85b93e68ccd966e632e2b18b97acbd32409025ded5e77a4389b9a40a4179b7bbe5f7f8263cab8ba530ed45dc6353ae7d74cd92c1964b1d4d7493936f332aa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2024-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-932-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-1238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-1312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-1687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4020 jdvvv.exe 840 nbnntb.exe 5060 vvppj.exe 2340 lrfflrx.exe 3772 7htbnb.exe 2592 ffxxxxr.exe 2680 rlrrrxx.exe 3924 vpvvd.exe 3304 flxxxff.exe 1528 btbbbh.exe 1600 djvpj.exe 4812 xrfxxxx.exe 2920 hnhtnn.exe 5048 9rxlllf.exe 4684 jpvpv.exe 4992 llfflrf.exe 3916 1hbhbt.exe 3760 vvppv.exe 4724 bbhhhn.exe 3704 jjddd.exe 4000 fflfrrl.exe 2320 ddddd.exe 3216 llxrlrl.exe 4780 ttbbbh.exe 2860 5rrlllf.exe 1456 ntbntb.exe 4864 ppvpj.exe 3820 ddddj.exe 2228 fffxxxx.exe 5040 vvpvj.exe 3032 ttnnnn.exe 64 ddppp.exe 2404 btnnhn.exe 1372 3dvvv.exe 1576 xlxxxfx.exe 4204 hthnbh.exe 4524 dvvpj.exe 4168 jdpjv.exe 3560 3fllfff.exe 536 ntnnnn.exe 2940 vvjvp.exe 3564 lrxxrxf.exe 1552 bthntt.exe 1808 3pppp.exe 3660 rrxfrxl.exe 4132 7xrrlff.exe 264 ttbttn.exe 1428 pjvjd.exe 2180 3lllrxx.exe 4264 tnbbbb.exe 4280 jjvdv.exe 2024 vppjp.exe 4324 9frlrfl.exe 2400 nttthh.exe 2848 jvdjj.exe 1880 fxfffll.exe 2952 tthhhn.exe 3716 jdjdv.exe 1036 fflllll.exe 620 bhbthn.exe 4304 ppvvd.exe 512 xlflllx.exe 2544 bhtttb.exe 2316 1vjjp.exe -
resource yara_rule behavioral2/memory/2024-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-966-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 4020 2024 d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe 82 PID 2024 wrote to memory of 4020 2024 d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe 82 PID 2024 wrote to memory of 4020 2024 d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe 82 PID 4020 wrote to memory of 840 4020 jdvvv.exe 83 PID 4020 wrote to memory of 840 4020 jdvvv.exe 83 PID 4020 wrote to memory of 840 4020 jdvvv.exe 83 PID 840 wrote to memory of 5060 840 nbnntb.exe 84 PID 840 wrote to memory of 5060 840 nbnntb.exe 84 PID 840 wrote to memory of 5060 840 nbnntb.exe 84 PID 5060 wrote to memory of 2340 5060 vvppj.exe 85 PID 5060 wrote to memory of 2340 5060 vvppj.exe 85 PID 5060 wrote to memory of 2340 5060 vvppj.exe 85 PID 2340 wrote to memory of 3772 2340 lrfflrx.exe 86 PID 2340 wrote to memory of 3772 2340 lrfflrx.exe 86 PID 2340 wrote to memory of 3772 2340 lrfflrx.exe 86 PID 3772 wrote to memory of 2592 3772 7htbnb.exe 87 PID 3772 wrote to memory of 2592 3772 7htbnb.exe 87 PID 3772 wrote to memory of 2592 3772 7htbnb.exe 87 PID 2592 wrote to memory of 2680 2592 ffxxxxr.exe 88 PID 2592 wrote to memory of 2680 2592 ffxxxxr.exe 88 PID 2592 wrote to memory of 2680 2592 ffxxxxr.exe 88 PID 2680 wrote to memory of 3924 2680 rlrrrxx.exe 89 PID 2680 wrote to memory of 3924 2680 rlrrrxx.exe 89 PID 2680 wrote to memory of 3924 2680 rlrrrxx.exe 89 PID 3924 wrote to memory of 3304 3924 vpvvd.exe 90 PID 3924 wrote to memory of 3304 3924 vpvvd.exe 90 PID 3924 wrote to memory of 3304 3924 vpvvd.exe 90 PID 3304 wrote to memory of 1528 3304 flxxxff.exe 91 PID 3304 wrote to memory of 1528 3304 flxxxff.exe 91 PID 3304 wrote to memory of 1528 3304 flxxxff.exe 91 PID 1528 wrote to memory of 1600 1528 btbbbh.exe 92 PID 1528 wrote to memory of 1600 1528 btbbbh.exe 92 PID 1528 wrote to memory of 1600 1528 btbbbh.exe 92 PID 1600 wrote to memory of 4812 1600 djvpj.exe 93 PID 1600 wrote to memory of 4812 1600 djvpj.exe 93 PID 1600 wrote to memory of 4812 1600 djvpj.exe 93 PID 4812 wrote to memory of 2920 4812 xrfxxxx.exe 94 PID 4812 wrote to memory of 2920 4812 xrfxxxx.exe 94 PID 4812 wrote to memory of 2920 4812 xrfxxxx.exe 94 PID 2920 wrote to memory of 5048 2920 hnhtnn.exe 95 PID 2920 wrote to memory of 5048 2920 hnhtnn.exe 95 PID 2920 wrote to memory of 5048 2920 hnhtnn.exe 95 PID 5048 wrote to memory of 4684 5048 9rxlllf.exe 96 PID 5048 wrote to memory of 4684 5048 9rxlllf.exe 96 PID 5048 wrote to memory of 4684 5048 9rxlllf.exe 96 PID 4684 wrote to memory of 4992 4684 jpvpv.exe 97 PID 4684 wrote to memory of 4992 4684 jpvpv.exe 97 PID 4684 wrote to memory of 4992 4684 jpvpv.exe 97 PID 4992 wrote to memory of 3916 4992 llfflrf.exe 98 PID 4992 wrote to memory of 3916 4992 llfflrf.exe 98 PID 4992 wrote to memory of 3916 4992 llfflrf.exe 98 PID 3916 wrote to memory of 3760 3916 1hbhbt.exe 99 PID 3916 wrote to memory of 3760 3916 1hbhbt.exe 99 PID 3916 wrote to memory of 3760 3916 1hbhbt.exe 99 PID 3760 wrote to memory of 4724 3760 vvppv.exe 100 PID 3760 wrote to memory of 4724 3760 vvppv.exe 100 PID 3760 wrote to memory of 4724 3760 vvppv.exe 100 PID 4724 wrote to memory of 3704 4724 bbhhhn.exe 101 PID 4724 wrote to memory of 3704 4724 bbhhhn.exe 101 PID 4724 wrote to memory of 3704 4724 bbhhhn.exe 101 PID 3704 wrote to memory of 4000 3704 jjddd.exe 102 PID 3704 wrote to memory of 4000 3704 jjddd.exe 102 PID 3704 wrote to memory of 4000 3704 jjddd.exe 102 PID 4000 wrote to memory of 2320 4000 fflfrrl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe"C:\Users\Admin\AppData\Local\Temp\d124405736d89bc8e58bdf58e0becfb28d5fa3784e2b55c73cdaebc4d8cebad1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\jdvvv.exec:\jdvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\nbnntb.exec:\nbnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\vvppj.exec:\vvppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\lrfflrx.exec:\lrfflrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\7htbnb.exec:\7htbnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\ffxxxxr.exec:\ffxxxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\vpvvd.exec:\vpvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\flxxxff.exec:\flxxxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\btbbbh.exec:\btbbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\djvpj.exec:\djvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\hnhtnn.exec:\hnhtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\9rxlllf.exec:\9rxlllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\jpvpv.exec:\jpvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\llfflrf.exec:\llfflrf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\1hbhbt.exec:\1hbhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\vvppv.exec:\vvppv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\bbhhhn.exec:\bbhhhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\jjddd.exec:\jjddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\fflfrrl.exec:\fflfrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\ddddd.exec:\ddddd.exe23⤵
- Executes dropped EXE
PID:2320 -
\??\c:\llxrlrl.exec:\llxrlrl.exe24⤵
- Executes dropped EXE
PID:3216 -
\??\c:\ttbbbh.exec:\ttbbbh.exe25⤵
- Executes dropped EXE
PID:4780 -
\??\c:\5rrlllf.exec:\5rrlllf.exe26⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ntbntb.exec:\ntbntb.exe27⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ppvpj.exec:\ppvpj.exe28⤵
- Executes dropped EXE
PID:4864 -
\??\c:\ddddj.exec:\ddddj.exe29⤵
- Executes dropped EXE
PID:3820 -
\??\c:\fffxxxx.exec:\fffxxxx.exe30⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vvpvj.exec:\vvpvj.exe31⤵
- Executes dropped EXE
PID:5040 -
\??\c:\ttnnnn.exec:\ttnnnn.exe32⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ddppp.exec:\ddppp.exe33⤵
- Executes dropped EXE
PID:64 -
\??\c:\btnnhn.exec:\btnnhn.exe34⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3dvvv.exec:\3dvvv.exe35⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xlxxxfx.exec:\xlxxxfx.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hthnbh.exec:\hthnbh.exe37⤵
- Executes dropped EXE
PID:4204 -
\??\c:\dvvpj.exec:\dvvpj.exe38⤵
- Executes dropped EXE
PID:4524 -
\??\c:\jdpjv.exec:\jdpjv.exe39⤵
- Executes dropped EXE
PID:4168 -
\??\c:\3fllfff.exec:\3fllfff.exe40⤵
- Executes dropped EXE
PID:3560 -
\??\c:\ntnnnn.exec:\ntnnnn.exe41⤵
- Executes dropped EXE
PID:536 -
\??\c:\vvjvp.exec:\vvjvp.exe42⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lrxxrxf.exec:\lrxxrxf.exe43⤵
- Executes dropped EXE
PID:3564 -
\??\c:\bthntt.exec:\bthntt.exe44⤵
- Executes dropped EXE
PID:1552 -
\??\c:\3pppp.exec:\3pppp.exe45⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rrxfrxl.exec:\rrxfrxl.exe46⤵
- Executes dropped EXE
PID:3660 -
\??\c:\7xrrlff.exec:\7xrrlff.exe47⤵
- Executes dropped EXE
PID:4132 -
\??\c:\ttbttn.exec:\ttbttn.exe48⤵
- Executes dropped EXE
PID:264 -
\??\c:\pjvjd.exec:\pjvjd.exe49⤵
- Executes dropped EXE
PID:1428 -
\??\c:\3lllrxx.exec:\3lllrxx.exe50⤵
- Executes dropped EXE
PID:2180 -
\??\c:\tnbbbb.exec:\tnbbbb.exe51⤵
- Executes dropped EXE
PID:4264 -
\??\c:\jjvdv.exec:\jjvdv.exe52⤵
- Executes dropped EXE
PID:4280 -
\??\c:\vppjp.exec:\vppjp.exe53⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9frlrfl.exec:\9frlrfl.exe54⤵
- Executes dropped EXE
PID:4324 -
\??\c:\nttthh.exec:\nttthh.exe55⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jvdjj.exec:\jvdjj.exe56⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fxfffll.exec:\fxfffll.exe57⤵
- Executes dropped EXE
PID:1880 -
\??\c:\tthhhn.exec:\tthhhn.exe58⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jdjdv.exec:\jdjdv.exe59⤵
- Executes dropped EXE
PID:3716 -
\??\c:\fflllll.exec:\fflllll.exe60⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bhbthn.exec:\bhbthn.exe61⤵
- Executes dropped EXE
PID:620 -
\??\c:\ppvvd.exec:\ppvvd.exe62⤵
- Executes dropped EXE
PID:4304 -
\??\c:\xlflllx.exec:\xlflllx.exe63⤵
- Executes dropped EXE
PID:512 -
\??\c:\bhtttb.exec:\bhtttb.exe64⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1vjjp.exec:\1vjjp.exe65⤵
- Executes dropped EXE
PID:2316 -
\??\c:\djjjv.exec:\djjjv.exe66⤵PID:4036
-
\??\c:\ffrrlll.exec:\ffrrlll.exe67⤵PID:408
-
\??\c:\1hhhhh.exec:\1hhhhh.exe68⤵PID:1488
-
\??\c:\dvddv.exec:\dvddv.exe69⤵PID:2004
-
\??\c:\pvjdv.exec:\pvjdv.exe70⤵PID:3204
-
\??\c:\xrfxrrx.exec:\xrfxrrx.exe71⤵PID:952
-
\??\c:\5nttbb.exec:\5nttbb.exe72⤵PID:2856
-
\??\c:\5pvvd.exec:\5pvvd.exe73⤵PID:216
-
\??\c:\vvddv.exec:\vvddv.exe74⤵PID:5048
-
\??\c:\xrfxxfr.exec:\xrfxxfr.exe75⤵PID:4956
-
\??\c:\hhnnnt.exec:\hhnnnt.exe76⤵PID:4048
-
\??\c:\djjdj.exec:\djjdj.exe77⤵PID:1756
-
\??\c:\lrlflxx.exec:\lrlflxx.exe78⤵PID:4356
-
\??\c:\fxffxxx.exec:\fxffxxx.exe79⤵PID:4312
-
\??\c:\jjjjd.exec:\jjjjd.exe80⤵PID:4784
-
\??\c:\jdjdp.exec:\jdjdp.exe81⤵PID:5012
-
\??\c:\9rlfrfx.exec:\9rlfrfx.exe82⤵PID:3704
-
\??\c:\nnthhh.exec:\nnthhh.exe83⤵PID:4732
-
\??\c:\pvvvd.exec:\pvvvd.exe84⤵PID:4136
-
\??\c:\rflfffx.exec:\rflfffx.exe85⤵PID:4448
-
\??\c:\lxrrlll.exec:\lxrrlll.exe86⤵PID:2016
-
\??\c:\btthbb.exec:\btthbb.exe87⤵PID:2460
-
\??\c:\vpppj.exec:\vpppj.exe88⤵PID:4772
-
\??\c:\jpjdd.exec:\jpjdd.exe89⤵PID:5116
-
\??\c:\xxllllf.exec:\xxllllf.exe90⤵PID:1524
-
\??\c:\bthtbb.exec:\bthtbb.exe91⤵PID:4344
-
\??\c:\5tnhtt.exec:\5tnhtt.exe92⤵PID:5000
-
\??\c:\3pvjv.exec:\3pvjv.exe93⤵PID:208
-
\??\c:\vpjdv.exec:\vpjdv.exe94⤵PID:4876
-
\??\c:\nhnnnt.exec:\nhnnnt.exe95⤵PID:4820
-
\??\c:\btbbtt.exec:\btbbtt.exe96⤵PID:3032
-
\??\c:\dpvpj.exec:\dpvpj.exe97⤵PID:924
-
\??\c:\fffxrrr.exec:\fffxrrr.exe98⤵PID:1624
-
\??\c:\hntttb.exec:\hntttb.exe99⤵PID:3964
-
\??\c:\5jddp.exec:\5jddp.exe100⤵PID:4480
-
\??\c:\lrxxxrl.exec:\lrxxxrl.exe101⤵PID:968
-
\??\c:\hththb.exec:\hththb.exe102⤵PID:4744
-
\??\c:\jjddv.exec:\jjddv.exe103⤵PID:1676
-
\??\c:\vjpdp.exec:\vjpdp.exe104⤵PID:4168
-
\??\c:\1llfxxr.exec:\1llfxxr.exe105⤵PID:372
-
\??\c:\btttnn.exec:\btttnn.exe106⤵PID:536
-
\??\c:\1jjjd.exec:\1jjjd.exe107⤵PID:5092
-
\??\c:\jdpjd.exec:\jdpjd.exe108⤵PID:856
-
\??\c:\fxfrlff.exec:\fxfrlff.exe109⤵PID:2388
-
\??\c:\5nhbnn.exec:\5nhbnn.exe110⤵PID:2432
-
\??\c:\tnbtbb.exec:\tnbtbb.exe111⤵PID:672
-
\??\c:\vvjdd.exec:\vvjdd.exe112⤵PID:776
-
\??\c:\ffxrlll.exec:\ffxrlll.exe113⤵PID:4132
-
\??\c:\lfrfxfx.exec:\lfrfxfx.exe114⤵PID:264
-
\??\c:\bbbtnn.exec:\bbbtnn.exe115⤵PID:1936
-
\??\c:\jjvvv.exec:\jjvvv.exe116⤵PID:2180
-
\??\c:\frlxllf.exec:\frlxllf.exe117⤵PID:1840
-
\??\c:\tbhbtt.exec:\tbhbtt.exe118⤵PID:4280
-
\??\c:\jvjdv.exec:\jvjdv.exe119⤵PID:2300
-
\??\c:\lrxrlrr.exec:\lrxrlrr.exe120⤵PID:840
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe121⤵PID:3896
-
\??\c:\nnhhbb.exec:\nnhhbb.exe122⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-