Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 16:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe
-
Size
454KB
-
MD5
4a708c5f273a8507099a1ac209af1405
-
SHA1
cd746a14c31b2543c2bf46c1edce499b13e76f85
-
SHA256
3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b
-
SHA512
b2bbbc21a0777896976654489e4a3762fd9fd50c43ce6a540fbb1c97671584a3aaae3d5da7f6e446217fc9d610ac78c41201fc4141354831f4233af85b2e9e86
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1664-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/780-1054-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-1136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-1146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-1303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-1822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4616 5ddvp.exe 4844 7vdvv.exe 3724 1lrfxfl.exe 812 nbbhbt.exe 3496 htbbbt.exe 700 lfrrxxf.exe 3604 dpjdd.exe 2096 bbhhnn.exe 4584 jjvdd.exe 5036 xrxrrrr.exe 2152 llxxflr.exe 4204 btbbhh.exe 232 htbnnn.exe 2628 rrlfxlf.exe 4576 vpvpj.exe 3560 7ffxrrl.exe 1716 jddvp.exe 3228 nhhhbt.exe 3316 dvddj.exe 3484 jjjdv.exe 1348 rlrllll.exe 2964 1lxxrrl.exe 3884 5fxrlrl.exe 5044 btbnhh.exe 1740 vjdjd.exe 976 fxrlfrl.exe 1200 dpdvp.exe 3660 frxrxrx.exe 4652 tntnbt.exe 2420 flrrlff.exe 716 rfrlfff.exe 4440 lrrlxrr.exe 752 vppjd.exe 1344 lrrrrrr.exe 4220 lrxrrrl.exe 1944 tnnhhn.exe 1312 1djjj.exe 1224 xrrlllf.exe 4092 5bhbtn.exe 1608 jvvpj.exe 4168 pvdjd.exe 1528 xlxrxrr.exe 2508 xrrlfxr.exe 632 ntnhhb.exe 1536 3vjvp.exe 3268 7xrlffx.exe 1524 tbbbhh.exe 620 9jvpp.exe 5020 pdjdv.exe 3816 fflllll.exe 448 bbbttt.exe 2680 dvdvv.exe 320 pvpjj.exe 4376 lfxrllf.exe 5012 btnhhh.exe 3424 vpjdv.exe 1016 lfrlfrl.exe 4844 xxfxrlf.exe 1144 nhthbt.exe 4588 pddvv.exe 2744 nnhbbb.exe 1552 ddppp.exe 1696 vvvvv.exe 116 rrfxrlf.exe -
resource yara_rule behavioral2/memory/4616-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/700-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/780-1054-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-1136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-1146-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1664 wrote to memory of 4616 1664 3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe 82 PID 1664 wrote to memory of 4616 1664 3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe 82 PID 1664 wrote to memory of 4616 1664 3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe 82 PID 4616 wrote to memory of 4844 4616 5ddvp.exe 83 PID 4616 wrote to memory of 4844 4616 5ddvp.exe 83 PID 4616 wrote to memory of 4844 4616 5ddvp.exe 83 PID 4844 wrote to memory of 3724 4844 7vdvv.exe 84 PID 4844 wrote to memory of 3724 4844 7vdvv.exe 84 PID 4844 wrote to memory of 3724 4844 7vdvv.exe 84 PID 3724 wrote to memory of 812 3724 1lrfxfl.exe 85 PID 3724 wrote to memory of 812 3724 1lrfxfl.exe 85 PID 3724 wrote to memory of 812 3724 1lrfxfl.exe 85 PID 812 wrote to memory of 3496 812 nbbhbt.exe 86 PID 812 wrote to memory of 3496 812 nbbhbt.exe 86 PID 812 wrote to memory of 3496 812 nbbhbt.exe 86 PID 3496 wrote to memory of 700 3496 htbbbt.exe 87 PID 3496 wrote to memory of 700 3496 htbbbt.exe 87 PID 3496 wrote to memory of 700 3496 htbbbt.exe 87 PID 700 wrote to memory of 3604 700 lfrrxxf.exe 88 PID 700 wrote to memory of 3604 700 lfrrxxf.exe 88 PID 700 wrote to memory of 3604 700 lfrrxxf.exe 88 PID 3604 wrote to memory of 2096 3604 dpjdd.exe 89 PID 3604 wrote to memory of 2096 3604 dpjdd.exe 89 PID 3604 wrote to memory of 2096 3604 dpjdd.exe 89 PID 2096 wrote to memory of 4584 2096 bbhhnn.exe 90 PID 2096 wrote to memory of 4584 2096 bbhhnn.exe 90 PID 2096 wrote to memory of 4584 2096 bbhhnn.exe 90 PID 4584 wrote to memory of 5036 4584 jjvdd.exe 91 PID 4584 wrote to memory of 5036 4584 jjvdd.exe 91 PID 4584 wrote to memory of 5036 4584 jjvdd.exe 91 PID 5036 wrote to memory of 2152 5036 xrxrrrr.exe 92 PID 5036 wrote to memory of 2152 5036 xrxrrrr.exe 92 PID 5036 wrote to memory of 2152 5036 xrxrrrr.exe 92 PID 2152 wrote to memory of 4204 2152 llxxflr.exe 93 PID 2152 wrote to memory of 4204 2152 llxxflr.exe 93 PID 2152 wrote to memory of 4204 2152 llxxflr.exe 93 PID 4204 wrote to memory of 232 4204 btbbhh.exe 94 PID 4204 wrote to memory of 232 4204 btbbhh.exe 94 PID 4204 wrote to memory of 232 4204 btbbhh.exe 94 PID 232 wrote to memory of 2628 232 htbnnn.exe 95 PID 232 wrote to memory of 2628 232 htbnnn.exe 95 PID 232 wrote to memory of 2628 232 htbnnn.exe 95 PID 2628 wrote to memory of 4576 2628 rrlfxlf.exe 96 PID 2628 wrote to memory of 4576 2628 rrlfxlf.exe 96 PID 2628 wrote to memory of 4576 2628 rrlfxlf.exe 96 PID 4576 wrote to memory of 3560 4576 vpvpj.exe 97 PID 4576 wrote to memory of 3560 4576 vpvpj.exe 97 PID 4576 wrote to memory of 3560 4576 vpvpj.exe 97 PID 3560 wrote to memory of 1716 3560 7ffxrrl.exe 98 PID 3560 wrote to memory of 1716 3560 7ffxrrl.exe 98 PID 3560 wrote to memory of 1716 3560 7ffxrrl.exe 98 PID 1716 wrote to memory of 3228 1716 jddvp.exe 99 PID 1716 wrote to memory of 3228 1716 jddvp.exe 99 PID 1716 wrote to memory of 3228 1716 jddvp.exe 99 PID 3228 wrote to memory of 3316 3228 nhhhbt.exe 100 PID 3228 wrote to memory of 3316 3228 nhhhbt.exe 100 PID 3228 wrote to memory of 3316 3228 nhhhbt.exe 100 PID 3316 wrote to memory of 3484 3316 dvddj.exe 101 PID 3316 wrote to memory of 3484 3316 dvddj.exe 101 PID 3316 wrote to memory of 3484 3316 dvddj.exe 101 PID 3484 wrote to memory of 1348 3484 jjjdv.exe 102 PID 3484 wrote to memory of 1348 3484 jjjdv.exe 102 PID 3484 wrote to memory of 1348 3484 jjjdv.exe 102 PID 1348 wrote to memory of 2964 1348 rlrllll.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe"C:\Users\Admin\AppData\Local\Temp\3c4f9104fa72e4b33730906c9de6020a1f5f26df66af099c5d0bb24cac06fe4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\5ddvp.exec:\5ddvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\7vdvv.exec:\7vdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\1lrfxfl.exec:\1lrfxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\nbbhbt.exec:\nbbhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\htbbbt.exec:\htbbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\dpjdd.exec:\dpjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\bbhhnn.exec:\bbhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\jjvdd.exec:\jjvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\llxxflr.exec:\llxxflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\btbbhh.exec:\btbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\htbnnn.exec:\htbnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\rrlfxlf.exec:\rrlfxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vpvpj.exec:\vpvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\7ffxrrl.exec:\7ffxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\jddvp.exec:\jddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\nhhhbt.exec:\nhhhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\dvddj.exec:\dvddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\jjjdv.exec:\jjjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\rlrllll.exec:\rlrllll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\1lxxrrl.exec:\1lxxrrl.exe23⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5fxrlrl.exec:\5fxrlrl.exe24⤵
- Executes dropped EXE
PID:3884 -
\??\c:\btbnhh.exec:\btbnhh.exe25⤵
- Executes dropped EXE
PID:5044 -
\??\c:\vjdjd.exec:\vjdjd.exe26⤵
- Executes dropped EXE
PID:1740 -
\??\c:\fxrlfrl.exec:\fxrlfrl.exe27⤵
- Executes dropped EXE
PID:976 -
\??\c:\dpdvp.exec:\dpdvp.exe28⤵
- Executes dropped EXE
PID:1200 -
\??\c:\frxrxrx.exec:\frxrxrx.exe29⤵
- Executes dropped EXE
PID:3660 -
\??\c:\tntnbt.exec:\tntnbt.exe30⤵
- Executes dropped EXE
PID:4652 -
\??\c:\flrrlff.exec:\flrrlff.exe31⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rfrlfff.exec:\rfrlfff.exe32⤵
- Executes dropped EXE
PID:716 -
\??\c:\lrrlxrr.exec:\lrrlxrr.exe33⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vppjd.exec:\vppjd.exe34⤵
- Executes dropped EXE
PID:752 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe35⤵
- Executes dropped EXE
PID:1344 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe36⤵
- Executes dropped EXE
PID:4220 -
\??\c:\tnnhhn.exec:\tnnhhn.exe37⤵
- Executes dropped EXE
PID:1944 -
\??\c:\1djjj.exec:\1djjj.exe38⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xrrlllf.exec:\xrrlllf.exe39⤵
- Executes dropped EXE
PID:1224 -
\??\c:\5bhbtn.exec:\5bhbtn.exe40⤵
- Executes dropped EXE
PID:4092 -
\??\c:\jvvpj.exec:\jvvpj.exe41⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pvdjd.exec:\pvdjd.exe42⤵
- Executes dropped EXE
PID:4168 -
\??\c:\xlxrxrr.exec:\xlxrxrr.exe43⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ntnhhb.exec:\ntnhhb.exe45⤵
- Executes dropped EXE
PID:632 -
\??\c:\3vjvp.exec:\3vjvp.exe46⤵
- Executes dropped EXE
PID:1536 -
\??\c:\7xrlffx.exec:\7xrlffx.exe47⤵
- Executes dropped EXE
PID:3268 -
\??\c:\tbbbhh.exec:\tbbbhh.exe48⤵
- Executes dropped EXE
PID:1524 -
\??\c:\9jvpp.exec:\9jvpp.exe49⤵
- Executes dropped EXE
PID:620 -
\??\c:\pdjdv.exec:\pdjdv.exe50⤵
- Executes dropped EXE
PID:5020 -
\??\c:\fflllll.exec:\fflllll.exe51⤵
- Executes dropped EXE
PID:3816 -
\??\c:\bbbttt.exec:\bbbttt.exe52⤵
- Executes dropped EXE
PID:448 -
\??\c:\dvdvv.exec:\dvdvv.exe53⤵
- Executes dropped EXE
PID:2680 -
\??\c:\pvpjj.exec:\pvpjj.exe54⤵
- Executes dropped EXE
PID:320 -
\??\c:\lfxrllf.exec:\lfxrllf.exe55⤵
- Executes dropped EXE
PID:4376 -
\??\c:\btnhhh.exec:\btnhhh.exe56⤵
- Executes dropped EXE
PID:5012 -
\??\c:\vpjdv.exec:\vpjdv.exe57⤵
- Executes dropped EXE
PID:3424 -
\??\c:\lfrlfrl.exec:\lfrlfrl.exe58⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe59⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nhthbt.exec:\nhthbt.exe60⤵
- Executes dropped EXE
PID:1144 -
\??\c:\pddvv.exec:\pddvv.exe61⤵
- Executes dropped EXE
PID:4588 -
\??\c:\nnhbbb.exec:\nnhbbb.exe62⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ddppp.exec:\ddppp.exe63⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vvvvv.exec:\vvvvv.exe64⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rrfxrlf.exec:\rrfxrlf.exe65⤵
- Executes dropped EXE
PID:116 -
\??\c:\nntbhh.exec:\nntbhh.exe66⤵PID:2244
-
\??\c:\nnbtnn.exec:\nnbtnn.exe67⤵PID:212
-
\??\c:\vjjdd.exec:\vjjdd.exe68⤵PID:2132
-
\??\c:\ffrllll.exec:\ffrllll.exe69⤵PID:232
-
\??\c:\hnbtnn.exec:\hnbtnn.exe70⤵PID:4624
-
\??\c:\jddpj.exec:\jddpj.exe71⤵PID:2388
-
\??\c:\jppjd.exec:\jppjd.exe72⤵PID:2040
-
\??\c:\xrfxffx.exec:\xrfxffx.exe73⤵PID:4960
-
\??\c:\tbnhtt.exec:\tbnhtt.exe74⤵PID:1716
-
\??\c:\pjppj.exec:\pjppj.exe75⤵PID:1008
-
\??\c:\lrfxllf.exec:\lrfxllf.exe76⤵PID:3972
-
\??\c:\5flffff.exec:\5flffff.exe77⤵PID:1976
-
\??\c:\hbnnhh.exec:\hbnnhh.exe78⤵PID:2864
-
\??\c:\vpvpp.exec:\vpvpp.exe79⤵PID:2644
-
\??\c:\7xrlffx.exec:\7xrlffx.exe80⤵PID:4528
-
\??\c:\tthhbb.exec:\tthhbb.exe81⤵PID:3976
-
\??\c:\3jvpj.exec:\3jvpj.exe82⤵PID:4708
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe83⤵PID:1636
-
\??\c:\flfxflx.exec:\flfxflx.exe84⤵PID:4328
-
\??\c:\1hhbhn.exec:\1hhbhn.exe85⤵PID:3880
-
\??\c:\7jjjd.exec:\7jjjd.exe86⤵PID:4248
-
\??\c:\5flffff.exec:\5flffff.exe87⤵PID:1200
-
\??\c:\lrlllrr.exec:\lrlllrr.exe88⤵PID:2160
-
\??\c:\tnnnnt.exec:\tnnnnt.exe89⤵
- System Location Discovery: System Language Discovery
PID:2860 -
\??\c:\dvvdd.exec:\dvvdd.exe90⤵PID:5088
-
\??\c:\rrffllf.exec:\rrffllf.exe91⤵PID:3432
-
\??\c:\7bbbbb.exec:\7bbbbb.exe92⤵PID:4552
-
\??\c:\pvpjv.exec:\pvpjv.exe93⤵PID:1980
-
\??\c:\dvddj.exec:\dvddj.exe94⤵PID:1172
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe95⤵PID:936
-
\??\c:\tnnhbb.exec:\tnnhbb.exe96⤵PID:3544
-
\??\c:\ddvpv.exec:\ddvpv.exe97⤵PID:1248
-
\??\c:\9lrlxfl.exec:\9lrlxfl.exe98⤵PID:4484
-
\??\c:\btbbtt.exec:\btbbtt.exe99⤵PID:3348
-
\??\c:\dvjdd.exec:\dvjdd.exe100⤵PID:3416
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe101⤵PID:1960
-
\??\c:\thntbb.exec:\thntbb.exe102⤵PID:4780
-
\??\c:\5pvvd.exec:\5pvvd.exe103⤵PID:2752
-
\??\c:\rlrlllr.exec:\rlrlllr.exe104⤵PID:2568
-
\??\c:\rffllff.exec:\rffllff.exe105⤵PID:632
-
\??\c:\thbttb.exec:\thbttb.exe106⤵PID:3628
-
\??\c:\jpvpj.exec:\jpvpj.exe107⤵
- System Location Discovery: System Language Discovery
PID:1564 -
\??\c:\lxfllll.exec:\lxfllll.exe108⤵PID:1524
-
\??\c:\ttttnt.exec:\ttttnt.exe109⤵PID:2328
-
\??\c:\hhthbb.exec:\hhthbb.exe110⤵PID:1844
-
\??\c:\pjpjd.exec:\pjpjd.exe111⤵PID:4540
-
\??\c:\rxrlfxx.exec:\rxrlfxx.exe112⤵PID:4636
-
\??\c:\nnttbb.exec:\nnttbb.exe113⤵PID:3920
-
\??\c:\dpvpj.exec:\dpvpj.exe114⤵PID:4304
-
\??\c:\vjpjv.exec:\vjpjv.exe115⤵
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\lfrrlrl.exec:\lfrrlrl.exe116⤵PID:1828
-
\??\c:\nntnnn.exec:\nntnnn.exe117⤵PID:1384
-
\??\c:\3pvvp.exec:\3pvvp.exe118⤵PID:1140
-
\??\c:\vjjjd.exec:\vjjjd.exe119⤵PID:1204
-
\??\c:\llffffx.exec:\llffffx.exe120⤵PID:4700
-
\??\c:\bthbbb.exec:\bthbbb.exe121⤵PID:2324
-
\??\c:\nbhbbb.exec:\nbhbbb.exe122⤵PID:4896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-