Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe
-
Size
454KB
-
MD5
3a60934f3a36726fd73bd87c4505c1b7
-
SHA1
e2b0ad012941fc3e6a15a4b7a0c3bf7cebd2654a
-
SHA256
bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36
-
SHA512
a75f880b37de0ca3c06f9401904576d37d5405b181f3f82af5565b6a07962bbc38402211d5591887b5510c620566200e2c579e9449a55d401252ad94b3cbdc41
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2940-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/336-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/560-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/680-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-1006-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-1559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-1692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3312 ddpdj.exe 2324 nhbnht.exe 2848 rflfxrf.exe 3352 vvpdp.exe 3936 nbthbt.exe 2544 vvvpp.exe 3832 tbbnnh.exe 3708 jjjdj.exe 8 llfrllx.exe 460 rrrllff.exe 4024 3dpdv.exe 1900 nbhthb.exe 1788 vddpd.exe 5068 tttnhb.exe 3088 pvpdp.exe 3348 xxfrrll.exe 2676 hbtnbt.exe 2448 pvpjd.exe 4320 pjjjd.exe 2340 lffxrrr.exe 5020 nhhhhh.exe 2788 hhnnhh.exe 4020 pdjdd.exe 2976 rxrrlll.exe 2084 btbtnn.exe 3188 tntnhh.exe 2708 pvpvp.exe 4108 dpvpj.exe 3336 rrrrflf.exe 2900 nnhbtb.exe 516 jjjdv.exe 4004 jppjd.exe 2996 rxlxlrx.exe 1952 nnttnn.exe 4072 ntthbh.exe 4184 djppd.exe 3256 rxrlfxl.exe 1644 rrrrxfr.exe 1608 hnhbbb.exe 1840 jpppp.exe 4588 djvpd.exe 1940 3ffxrrx.exe 3668 fffxxxr.exe 1060 thbbnh.exe 1796 vpvvp.exe 1516 vddvd.exe 3504 llxrllf.exe 4408 tttntn.exe 3484 bbbttt.exe 2236 jppdv.exe 3312 ffxxrrl.exe 2916 xfffxxr.exe 4788 vjjvp.exe 3584 fxxrlxx.exe 3352 nnnhbb.exe 2296 vvvpp.exe 212 9lxrrrr.exe 1028 flrlrrl.exe 1868 hhnhbh.exe 3588 5xxxxff.exe 3708 hbhbbb.exe 1164 rllllll.exe 3968 ntbtnh.exe 632 vpppj.exe -
resource yara_rule behavioral2/memory/2940-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/336-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/560-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/680-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-679-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 3312 2940 bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe 84 PID 2940 wrote to memory of 3312 2940 bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe 84 PID 2940 wrote to memory of 3312 2940 bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe 84 PID 3312 wrote to memory of 2324 3312 ddpdj.exe 85 PID 3312 wrote to memory of 2324 3312 ddpdj.exe 85 PID 3312 wrote to memory of 2324 3312 ddpdj.exe 85 PID 2324 wrote to memory of 2848 2324 nhbnht.exe 86 PID 2324 wrote to memory of 2848 2324 nhbnht.exe 86 PID 2324 wrote to memory of 2848 2324 nhbnht.exe 86 PID 2848 wrote to memory of 3352 2848 rflfxrf.exe 87 PID 2848 wrote to memory of 3352 2848 rflfxrf.exe 87 PID 2848 wrote to memory of 3352 2848 rflfxrf.exe 87 PID 3352 wrote to memory of 3936 3352 vvpdp.exe 88 PID 3352 wrote to memory of 3936 3352 vvpdp.exe 88 PID 3352 wrote to memory of 3936 3352 vvpdp.exe 88 PID 3936 wrote to memory of 2544 3936 nbthbt.exe 89 PID 3936 wrote to memory of 2544 3936 nbthbt.exe 89 PID 3936 wrote to memory of 2544 3936 nbthbt.exe 89 PID 2544 wrote to memory of 3832 2544 vvvpp.exe 90 PID 2544 wrote to memory of 3832 2544 vvvpp.exe 90 PID 2544 wrote to memory of 3832 2544 vvvpp.exe 90 PID 3832 wrote to memory of 3708 3832 tbbnnh.exe 91 PID 3832 wrote to memory of 3708 3832 tbbnnh.exe 91 PID 3832 wrote to memory of 3708 3832 tbbnnh.exe 91 PID 3708 wrote to memory of 8 3708 jjjdj.exe 92 PID 3708 wrote to memory of 8 3708 jjjdj.exe 92 PID 3708 wrote to memory of 8 3708 jjjdj.exe 92 PID 8 wrote to memory of 460 8 llfrllx.exe 93 PID 8 wrote to memory of 460 8 llfrllx.exe 93 PID 8 wrote to memory of 460 8 llfrllx.exe 93 PID 460 wrote to memory of 4024 460 rrrllff.exe 94 PID 460 wrote to memory of 4024 460 rrrllff.exe 94 PID 460 wrote to memory of 4024 460 rrrllff.exe 94 PID 4024 wrote to memory of 1900 4024 3dpdv.exe 95 PID 4024 wrote to memory of 1900 4024 3dpdv.exe 95 PID 4024 wrote to memory of 1900 4024 3dpdv.exe 95 PID 1900 wrote to memory of 1788 1900 nbhthb.exe 96 PID 1900 wrote to memory of 1788 1900 nbhthb.exe 96 PID 1900 wrote to memory of 1788 1900 nbhthb.exe 96 PID 1788 wrote to memory of 5068 1788 vddpd.exe 97 PID 1788 wrote to memory of 5068 1788 vddpd.exe 97 PID 1788 wrote to memory of 5068 1788 vddpd.exe 97 PID 5068 wrote to memory of 3088 5068 tttnhb.exe 98 PID 5068 wrote to memory of 3088 5068 tttnhb.exe 98 PID 5068 wrote to memory of 3088 5068 tttnhb.exe 98 PID 3088 wrote to memory of 3348 3088 pvpdp.exe 99 PID 3088 wrote to memory of 3348 3088 pvpdp.exe 99 PID 3088 wrote to memory of 3348 3088 pvpdp.exe 99 PID 3348 wrote to memory of 2676 3348 xxfrrll.exe 100 PID 3348 wrote to memory of 2676 3348 xxfrrll.exe 100 PID 3348 wrote to memory of 2676 3348 xxfrrll.exe 100 PID 2676 wrote to memory of 2448 2676 hbtnbt.exe 101 PID 2676 wrote to memory of 2448 2676 hbtnbt.exe 101 PID 2676 wrote to memory of 2448 2676 hbtnbt.exe 101 PID 2448 wrote to memory of 4320 2448 pvpjd.exe 102 PID 2448 wrote to memory of 4320 2448 pvpjd.exe 102 PID 2448 wrote to memory of 4320 2448 pvpjd.exe 102 PID 4320 wrote to memory of 2340 4320 pjjjd.exe 103 PID 4320 wrote to memory of 2340 4320 pjjjd.exe 103 PID 4320 wrote to memory of 2340 4320 pjjjd.exe 103 PID 2340 wrote to memory of 5020 2340 lffxrrr.exe 104 PID 2340 wrote to memory of 5020 2340 lffxrrr.exe 104 PID 2340 wrote to memory of 5020 2340 lffxrrr.exe 104 PID 5020 wrote to memory of 2788 5020 nhhhhh.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe"C:\Users\Admin\AppData\Local\Temp\bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\ddpdj.exec:\ddpdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\nhbnht.exec:\nhbnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\rflfxrf.exec:\rflfxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vvpdp.exec:\vvpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\nbthbt.exec:\nbthbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\vvvpp.exec:\vvvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\tbbnnh.exec:\tbbnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\jjjdj.exec:\jjjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\llfrllx.exec:\llfrllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\rrrllff.exec:\rrrllff.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\3dpdv.exec:\3dpdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\nbhthb.exec:\nbhthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\vddpd.exec:\vddpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\tttnhb.exec:\tttnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\pvpdp.exec:\pvpdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\xxfrrll.exec:\xxfrrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\hbtnbt.exec:\hbtnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\pvpjd.exec:\pvpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\pjjjd.exec:\pjjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\lffxrrr.exec:\lffxrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\nhhhhh.exec:\nhhhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\hhnnhh.exec:\hhnnhh.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788 -
\??\c:\pdjdd.exec:\pdjdd.exe24⤵
- Executes dropped EXE
PID:4020 -
\??\c:\rxrrlll.exec:\rxrrlll.exe25⤵
- Executes dropped EXE
PID:2976 -
\??\c:\btbtnn.exec:\btbtnn.exe26⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tntnhh.exec:\tntnhh.exe27⤵
- Executes dropped EXE
PID:3188 -
\??\c:\pvpvp.exec:\pvpvp.exe28⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dpvpj.exec:\dpvpj.exe29⤵
- Executes dropped EXE
PID:4108 -
\??\c:\rrrrflf.exec:\rrrrflf.exe30⤵
- Executes dropped EXE
PID:3336 -
\??\c:\nnhbtb.exec:\nnhbtb.exe31⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jjjdv.exec:\jjjdv.exe32⤵
- Executes dropped EXE
PID:516 -
\??\c:\jppjd.exec:\jppjd.exe33⤵
- Executes dropped EXE
PID:4004 -
\??\c:\rxlxlrx.exec:\rxlxlrx.exe34⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nnttnn.exec:\nnttnn.exe35⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ntthbh.exec:\ntthbh.exe36⤵
- Executes dropped EXE
PID:4072 -
\??\c:\djppd.exec:\djppd.exe37⤵
- Executes dropped EXE
PID:4184 -
\??\c:\rxrlfxl.exec:\rxrlfxl.exe38⤵
- Executes dropped EXE
PID:3256 -
\??\c:\rrrrxfr.exec:\rrrrxfr.exe39⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hnhbbb.exec:\hnhbbb.exe40⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jpppp.exec:\jpppp.exe41⤵
- Executes dropped EXE
PID:1840 -
\??\c:\djvpd.exec:\djvpd.exe42⤵
- Executes dropped EXE
PID:4588 -
\??\c:\3ffxrrx.exec:\3ffxrrx.exe43⤵
- Executes dropped EXE
PID:1940 -
\??\c:\fffxxxr.exec:\fffxxxr.exe44⤵
- Executes dropped EXE
PID:3668 -
\??\c:\thbbnh.exec:\thbbnh.exe45⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vpvvp.exec:\vpvvp.exe46⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vddvd.exec:\vddvd.exe47⤵
- Executes dropped EXE
PID:1516 -
\??\c:\llxrllf.exec:\llxrllf.exe48⤵
- Executes dropped EXE
PID:3504 -
\??\c:\tttntn.exec:\tttntn.exe49⤵
- Executes dropped EXE
PID:4408 -
\??\c:\bbbttt.exec:\bbbttt.exe50⤵
- Executes dropped EXE
PID:3484 -
\??\c:\jppdv.exec:\jppdv.exe51⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ffxxrrl.exec:\ffxxrrl.exe52⤵
- Executes dropped EXE
PID:3312 -
\??\c:\xfffxxr.exec:\xfffxxr.exe53⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vjjvp.exec:\vjjvp.exe54⤵
- Executes dropped EXE
PID:4788 -
\??\c:\fxxrlxx.exec:\fxxrlxx.exe55⤵
- Executes dropped EXE
PID:3584 -
\??\c:\nnnhbb.exec:\nnnhbb.exe56⤵
- Executes dropped EXE
PID:3352 -
\??\c:\vvvpp.exec:\vvvpp.exe57⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9lxrrrr.exec:\9lxrrrr.exe58⤵
- Executes dropped EXE
PID:212 -
\??\c:\flrlrrl.exec:\flrlrrl.exe59⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hhnhbh.exec:\hhnhbh.exe60⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5xxxxff.exec:\5xxxxff.exe61⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hbhbbb.exec:\hbhbbb.exe62⤵
- Executes dropped EXE
PID:3708 -
\??\c:\rllllll.exec:\rllllll.exe63⤵
- Executes dropped EXE
PID:1164 -
\??\c:\ntbtnh.exec:\ntbtnh.exe64⤵
- Executes dropped EXE
PID:3968 -
\??\c:\vpppj.exec:\vpppj.exe65⤵
- Executes dropped EXE
PID:632 -
\??\c:\rfxrfxx.exec:\rfxrfxx.exe66⤵PID:3464
-
\??\c:\hnhhbb.exec:\hnhhbb.exe67⤵PID:1836
-
\??\c:\jpjdv.exec:\jpjdv.exe68⤵PID:4720
-
\??\c:\nnbthh.exec:\nnbthh.exe69⤵PID:4620
-
\??\c:\dvvdv.exec:\dvvdv.exe70⤵PID:2560
-
\??\c:\xlrlfff.exec:\xlrlfff.exe71⤵
- System Location Discovery: System Language Discovery
PID:4092 -
\??\c:\nbnhhb.exec:\nbnhhb.exe72⤵PID:1264
-
\??\c:\jpppj.exec:\jpppj.exe73⤵PID:2980
-
\??\c:\dpvvp.exec:\dpvvp.exe74⤵PID:5012
-
\??\c:\hhhhbt.exec:\hhhhbt.exe75⤵PID:4776
-
\??\c:\vvdjj.exec:\vvdjj.exe76⤵PID:1444
-
\??\c:\llllffx.exec:\llllffx.exe77⤵PID:3660
-
\??\c:\lrllxxx.exec:\lrllxxx.exe78⤵PID:4160
-
\??\c:\tbbttt.exec:\tbbttt.exe79⤵PID:4552
-
\??\c:\1jjpj.exec:\1jjpj.exe80⤵PID:336
-
\??\c:\9flflfl.exec:\9flflfl.exe81⤵PID:2148
-
\??\c:\hhnnnt.exec:\hhnnnt.exe82⤵PID:2984
-
\??\c:\9vpjd.exec:\9vpjd.exe83⤵PID:2708
-
\??\c:\xxffffx.exec:\xxffffx.exe84⤵PID:4108
-
\??\c:\htnnhh.exec:\htnnhh.exe85⤵PID:936
-
\??\c:\jvvpj.exec:\jvvpj.exe86⤵PID:4760
-
\??\c:\xfxxxxr.exec:\xfxxxxr.exe87⤵PID:4736
-
\??\c:\7tbhtt.exec:\7tbhtt.exe88⤵PID:1508
-
\??\c:\vpvvp.exec:\vpvvp.exe89⤵PID:5100
-
\??\c:\vdjjj.exec:\vdjjj.exe90⤵PID:560
-
\??\c:\ffffxxf.exec:\ffffxxf.exe91⤵PID:2892
-
\??\c:\1htntt.exec:\1htntt.exe92⤵PID:4528
-
\??\c:\vpddd.exec:\vpddd.exe93⤵PID:3868
-
\??\c:\nnnhhn.exec:\nnnhhn.exe94⤵PID:680
-
\??\c:\vvpjv.exec:\vvpjv.exe95⤵PID:544
-
\??\c:\xlrrrfx.exec:\xlrrrfx.exe96⤵
- System Location Discovery: System Language Discovery
PID:4484 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe97⤵PID:2508
-
\??\c:\ttttnb.exec:\ttttnb.exe98⤵PID:4712
-
\??\c:\ppdvd.exec:\ppdvd.exe99⤵PID:5060
-
\??\c:\rfrrllr.exec:\rfrrllr.exe100⤵PID:3876
-
\??\c:\hbhhbh.exec:\hbhhbh.exe101⤵PID:3416
-
\??\c:\bnnnhh.exec:\bnnnhh.exe102⤵PID:3772
-
\??\c:\dvdvv.exec:\dvdvv.exe103⤵PID:644
-
\??\c:\rrxrflf.exec:\rrxrflf.exe104⤵PID:1992
-
\??\c:\nhhbtt.exec:\nhhbtt.exe105⤵PID:1552
-
\??\c:\5vppp.exec:\5vppp.exe106⤵PID:4652
-
\??\c:\dpjdv.exec:\dpjdv.exe107⤵PID:4816
-
\??\c:\3fxrfff.exec:\3fxrfff.exe108⤵PID:3476
-
\??\c:\7nhhhb.exec:\7nhhhb.exe109⤵PID:4304
-
\??\c:\ppvjd.exec:\ppvjd.exe110⤵
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\vdvpd.exec:\vdvpd.exe111⤵PID:3904
-
\??\c:\llrffxf.exec:\llrffxf.exe112⤵PID:4784
-
\??\c:\5nnnhb.exec:\5nnnhb.exe113⤵PID:4788
-
\??\c:\pdvpd.exec:\pdvpd.exe114⤵
- System Location Discovery: System Language Discovery
PID:2692 -
\??\c:\lflxxrx.exec:\lflxxrx.exe115⤵PID:4812
-
\??\c:\nbhbtt.exec:\nbhbtt.exe116⤵
- System Location Discovery: System Language Discovery
PID:456 -
\??\c:\7pjvv.exec:\7pjvv.exe117⤵PID:4440
-
\??\c:\xxrrllx.exec:\xxrrllx.exe118⤵PID:3648
-
\??\c:\lffrrrf.exec:\lffrrrf.exe119⤵
- System Location Discovery: System Language Discovery
PID:1932 -
\??\c:\9btnhh.exec:\9btnhh.exe120⤵PID:2668
-
\??\c:\ppvpj.exec:\ppvpj.exe121⤵PID:708
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe122⤵PID:3200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-