Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe
-
Size
453KB
-
MD5
4acc2022623063c9e94a68ce0a853284
-
SHA1
08fca9da56af8208e83745322f24152eed9409a0
-
SHA256
e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008
-
SHA512
fbc9103af675cd9d22094b16a3ddd67e29f305e31db78420f997f4c506262408f810b9436c735f64483231e255b3ec4f6e051cf086dad16aaf56bd6ec829335a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe6:q7Tc2NYHUrAwfMp3CD6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2024-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-881-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-915-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-964-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2024 a4206.exe 64 k62626.exe 856 vdjpd.exe 3440 4026048.exe 216 c464888.exe 2476 0864888.exe 624 vvpvd.exe 4024 8404448.exe 1628 7vdvp.exe 1112 nntnhn.exe 4244 466666.exe 1872 4264444.exe 4988 1rlfxxr.exe 4112 6066084.exe 1196 ntbtnh.exe 2000 fflfxxx.exe 2016 1hbtnt.exe 4340 06264.exe 3456 pdddv.exe 1204 8682660.exe 764 42840.exe 1932 4226200.exe 3720 httnhh.exe 2312 dpdvd.exe 2440 djpvd.exe 3664 4804484.exe 4588 dvjdd.exe 4036 o248620.exe 4952 8242226.exe 3592 046000.exe 4824 djpdv.exe 4900 8400826.exe 4464 djjdv.exe 4600 k80888.exe 3568 pppjd.exe 3188 fllxxxl.exe 1288 6808226.exe 2380 5jvpj.exe 1668 lflflff.exe 664 6284404.exe 1912 thnntt.exe 3236 a2220.exe 4292 64660.exe 3448 002082.exe 2192 s8486.exe 3544 nhbtnh.exe 3140 pddvp.exe 2620 frxrrlf.exe 4580 1bntbn.exe 1864 06264.exe 1976 k02006.exe 4120 ffrxrlf.exe 4608 6686048.exe 4512 vppjd.exe 4476 jvddv.exe 2624 9bbtnb.exe 2524 66864.exe 5024 a0642.exe 4364 k62600.exe 4412 pdddv.exe 4904 3nhnnn.exe 4772 g4048.exe 2024 42084.exe 64 46882.exe -
resource yara_rule behavioral2/memory/2024-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-743-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u860004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k48266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 002082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 244208.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1056 wrote to memory of 2024 1056 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 83 PID 1056 wrote to memory of 2024 1056 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 83 PID 1056 wrote to memory of 2024 1056 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 83 PID 2024 wrote to memory of 64 2024 a4206.exe 146 PID 2024 wrote to memory of 64 2024 a4206.exe 146 PID 2024 wrote to memory of 64 2024 a4206.exe 146 PID 64 wrote to memory of 856 64 k62626.exe 85 PID 64 wrote to memory of 856 64 k62626.exe 85 PID 64 wrote to memory of 856 64 k62626.exe 85 PID 856 wrote to memory of 3440 856 vdjpd.exe 149 PID 856 wrote to memory of 3440 856 vdjpd.exe 149 PID 856 wrote to memory of 3440 856 vdjpd.exe 149 PID 3440 wrote to memory of 216 3440 4026048.exe 87 PID 3440 wrote to memory of 216 3440 4026048.exe 87 PID 3440 wrote to memory of 216 3440 4026048.exe 87 PID 216 wrote to memory of 2476 216 c464888.exe 88 PID 216 wrote to memory of 2476 216 c464888.exe 88 PID 216 wrote to memory of 2476 216 c464888.exe 88 PID 2476 wrote to memory of 624 2476 0864888.exe 89 PID 2476 wrote to memory of 624 2476 0864888.exe 89 PID 2476 wrote to memory of 624 2476 0864888.exe 89 PID 624 wrote to memory of 4024 624 vvpvd.exe 90 PID 624 wrote to memory of 4024 624 vvpvd.exe 90 PID 624 wrote to memory of 4024 624 vvpvd.exe 90 PID 4024 wrote to memory of 1628 4024 8404448.exe 91 PID 4024 wrote to memory of 1628 4024 8404448.exe 91 PID 4024 wrote to memory of 1628 4024 8404448.exe 91 PID 1628 wrote to memory of 1112 1628 7vdvp.exe 92 PID 1628 wrote to memory of 1112 1628 7vdvp.exe 92 PID 1628 wrote to memory of 1112 1628 7vdvp.exe 92 PID 1112 wrote to memory of 4244 1112 nntnhn.exe 93 PID 1112 wrote to memory of 4244 1112 nntnhn.exe 93 PID 1112 wrote to memory of 4244 1112 nntnhn.exe 93 PID 4244 wrote to memory of 1872 4244 466666.exe 94 PID 4244 wrote to memory of 1872 4244 466666.exe 94 PID 4244 wrote to memory of 1872 4244 466666.exe 94 PID 1872 wrote to memory of 4988 1872 4264444.exe 159 PID 1872 wrote to memory of 4988 1872 4264444.exe 159 PID 1872 wrote to memory of 4988 1872 4264444.exe 159 PID 4988 wrote to memory of 4112 4988 1rlfxxr.exe 96 PID 4988 wrote to memory of 4112 4988 1rlfxxr.exe 96 PID 4988 wrote to memory of 4112 4988 1rlfxxr.exe 96 PID 4112 wrote to memory of 1196 4112 6066084.exe 97 PID 4112 wrote to memory of 1196 4112 6066084.exe 97 PID 4112 wrote to memory of 1196 4112 6066084.exe 97 PID 1196 wrote to memory of 2000 1196 ntbtnh.exe 98 PID 1196 wrote to memory of 2000 1196 ntbtnh.exe 98 PID 1196 wrote to memory of 2000 1196 ntbtnh.exe 98 PID 2000 wrote to memory of 2016 2000 fflfxxx.exe 99 PID 2000 wrote to memory of 2016 2000 fflfxxx.exe 99 PID 2000 wrote to memory of 2016 2000 fflfxxx.exe 99 PID 2016 wrote to memory of 4340 2016 1hbtnt.exe 100 PID 2016 wrote to memory of 4340 2016 1hbtnt.exe 100 PID 2016 wrote to memory of 4340 2016 1hbtnt.exe 100 PID 4340 wrote to memory of 3456 4340 06264.exe 101 PID 4340 wrote to memory of 3456 4340 06264.exe 101 PID 4340 wrote to memory of 3456 4340 06264.exe 101 PID 3456 wrote to memory of 1204 3456 pdddv.exe 102 PID 3456 wrote to memory of 1204 3456 pdddv.exe 102 PID 3456 wrote to memory of 1204 3456 pdddv.exe 102 PID 1204 wrote to memory of 764 1204 8682660.exe 103 PID 1204 wrote to memory of 764 1204 8682660.exe 103 PID 1204 wrote to memory of 764 1204 8682660.exe 103 PID 764 wrote to memory of 1932 764 42840.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe"C:\Users\Admin\AppData\Local\Temp\e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\a4206.exec:\a4206.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\k62626.exec:\k62626.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\vdjpd.exec:\vdjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\4026048.exec:\4026048.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\c464888.exec:\c464888.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\0864888.exec:\0864888.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\vvpvd.exec:\vvpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\8404448.exec:\8404448.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\7vdvp.exec:\7vdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\nntnhn.exec:\nntnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\466666.exec:\466666.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\4264444.exec:\4264444.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\1rlfxxr.exec:\1rlfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\6066084.exec:\6066084.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\ntbtnh.exec:\ntbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\fflfxxx.exec:\fflfxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\1hbtnt.exec:\1hbtnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\06264.exec:\06264.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\pdddv.exec:\pdddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\8682660.exec:\8682660.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\42840.exec:\42840.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\4226200.exec:\4226200.exe23⤵
- Executes dropped EXE
PID:1932 -
\??\c:\httnhh.exec:\httnhh.exe24⤵
- Executes dropped EXE
PID:3720 -
\??\c:\dpdvd.exec:\dpdvd.exe25⤵
- Executes dropped EXE
PID:2312 -
\??\c:\djpvd.exec:\djpvd.exe26⤵
- Executes dropped EXE
PID:2440 -
\??\c:\4804484.exec:\4804484.exe27⤵
- Executes dropped EXE
PID:3664 -
\??\c:\dvjdd.exec:\dvjdd.exe28⤵
- Executes dropped EXE
PID:4588 -
\??\c:\o248620.exec:\o248620.exe29⤵
- Executes dropped EXE
PID:4036 -
\??\c:\8242226.exec:\8242226.exe30⤵
- Executes dropped EXE
PID:4952 -
\??\c:\046000.exec:\046000.exe31⤵
- Executes dropped EXE
PID:3592 -
\??\c:\djpdv.exec:\djpdv.exe32⤵
- Executes dropped EXE
PID:4824 -
\??\c:\8400826.exec:\8400826.exe33⤵
- Executes dropped EXE
PID:4900 -
\??\c:\djjdv.exec:\djjdv.exe34⤵
- Executes dropped EXE
PID:4464 -
\??\c:\k80888.exec:\k80888.exe35⤵
- Executes dropped EXE
PID:4600 -
\??\c:\pppjd.exec:\pppjd.exe36⤵
- Executes dropped EXE
PID:3568 -
\??\c:\fllxxxl.exec:\fllxxxl.exe37⤵
- Executes dropped EXE
PID:3188 -
\??\c:\6808226.exec:\6808226.exe38⤵
- Executes dropped EXE
PID:1288 -
\??\c:\5jvpj.exec:\5jvpj.exe39⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lflflff.exec:\lflflff.exe40⤵
- Executes dropped EXE
PID:1668 -
\??\c:\6284404.exec:\6284404.exe41⤵
- Executes dropped EXE
PID:664 -
\??\c:\thnntt.exec:\thnntt.exe42⤵
- Executes dropped EXE
PID:1912 -
\??\c:\a2220.exec:\a2220.exe43⤵
- Executes dropped EXE
PID:3236 -
\??\c:\64660.exec:\64660.exe44⤵
- Executes dropped EXE
PID:4292 -
\??\c:\002082.exec:\002082.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3448 -
\??\c:\s8486.exec:\s8486.exe46⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nhbtnh.exec:\nhbtnh.exe47⤵
- Executes dropped EXE
PID:3544 -
\??\c:\pddvp.exec:\pddvp.exe48⤵
- Executes dropped EXE
PID:3140 -
\??\c:\frxrrlf.exec:\frxrrlf.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\1bntbn.exec:\1bntbn.exe50⤵
- Executes dropped EXE
PID:4580 -
\??\c:\06264.exec:\06264.exe51⤵
- Executes dropped EXE
PID:1864 -
\??\c:\k02006.exec:\k02006.exe52⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ffrxrlf.exec:\ffrxrlf.exe53⤵
- Executes dropped EXE
PID:4120 -
\??\c:\6686048.exec:\6686048.exe54⤵
- Executes dropped EXE
PID:4608 -
\??\c:\vppjd.exec:\vppjd.exe55⤵
- Executes dropped EXE
PID:4512 -
\??\c:\jvddv.exec:\jvddv.exe56⤵
- Executes dropped EXE
PID:4476 -
\??\c:\9bbtnb.exec:\9bbtnb.exe57⤵
- Executes dropped EXE
PID:2624 -
\??\c:\66864.exec:\66864.exe58⤵
- Executes dropped EXE
PID:2524 -
\??\c:\a0642.exec:\a0642.exe59⤵
- Executes dropped EXE
PID:5024 -
\??\c:\k62600.exec:\k62600.exe60⤵
- Executes dropped EXE
PID:4364 -
\??\c:\pdddv.exec:\pdddv.exe61⤵
- Executes dropped EXE
PID:4412 -
\??\c:\3nhnnn.exec:\3nhnnn.exe62⤵
- Executes dropped EXE
PID:4904 -
\??\c:\g4048.exec:\g4048.exe63⤵
- Executes dropped EXE
PID:4772 -
\??\c:\42084.exec:\42084.exe64⤵
- Executes dropped EXE
PID:2024 -
\??\c:\46882.exec:\46882.exe65⤵
- Executes dropped EXE
PID:64 -
\??\c:\00260.exec:\00260.exe66⤵PID:4700
-
\??\c:\28840.exec:\28840.exe67⤵PID:4736
-
\??\c:\rllfxrr.exec:\rllfxrr.exe68⤵PID:3440
-
\??\c:\28048.exec:\28048.exe69⤵PID:2476
-
\??\c:\xflfxrl.exec:\xflfxrl.exe70⤵PID:1768
-
\??\c:\8484640.exec:\8484640.exe71⤵PID:880
-
\??\c:\420448.exec:\420448.exe72⤵PID:4252
-
\??\c:\8626004.exec:\8626004.exe73⤵PID:2432
-
\??\c:\nhbtnn.exec:\nhbtnn.exe74⤵PID:1112
-
\??\c:\lxfxrll.exec:\lxfxrll.exe75⤵PID:3076
-
\??\c:\s2422.exec:\s2422.exe76⤵PID:2240
-
\??\c:\1ffxxxx.exec:\1ffxxxx.exe77⤵PID:1872
-
\??\c:\628260.exec:\628260.exe78⤵PID:4988
-
\??\c:\806886.exec:\806886.exe79⤵PID:2224
-
\??\c:\jpjdp.exec:\jpjdp.exe80⤵PID:3964
-
\??\c:\tbtnbn.exec:\tbtnbn.exe81⤵PID:4628
-
\??\c:\pppvj.exec:\pppvj.exe82⤵PID:3412
-
\??\c:\fxfxlfx.exec:\fxfxlfx.exe83⤵PID:468
-
\??\c:\266082.exec:\266082.exe84⤵PID:4932
-
\??\c:\pvdpj.exec:\pvdpj.exe85⤵PID:3720
-
\??\c:\1jvdp.exec:\1jvdp.exe86⤵PID:1448
-
\??\c:\i488608.exec:\i488608.exe87⤵PID:1104
-
\??\c:\7fxlfxl.exec:\7fxlfxl.exe88⤵PID:1116
-
\??\c:\hnbttt.exec:\hnbttt.exe89⤵PID:4116
-
\??\c:\ttthtn.exec:\ttthtn.exe90⤵PID:4428
-
\??\c:\pvdvp.exec:\pvdvp.exe91⤵PID:4820
-
\??\c:\pdpvp.exec:\pdpvp.exe92⤵PID:4900
-
\??\c:\pvvpd.exec:\pvvpd.exe93⤵PID:4452
-
\??\c:\1ppdp.exec:\1ppdp.exe94⤵PID:4544
-
\??\c:\488600.exec:\488600.exe95⤵PID:2028
-
\??\c:\xllxlfx.exec:\xllxlfx.exe96⤵PID:1004
-
\??\c:\lrrfrxr.exec:\lrrfrxr.exe97⤵PID:2380
-
\??\c:\vddvj.exec:\vddvj.exe98⤵PID:1668
-
\??\c:\7tnbtn.exec:\7tnbtn.exe99⤵PID:1912
-
\??\c:\bhtnhn.exec:\bhtnhn.exe100⤵PID:1172
-
\??\c:\8662064.exec:\8662064.exe101⤵PID:2192
-
\??\c:\866060.exec:\866060.exe102⤵PID:4788
-
\??\c:\xllxlxr.exec:\xllxlxr.exe103⤵PID:1824
-
\??\c:\e28048.exec:\e28048.exe104⤵PID:1784
-
\??\c:\8424004.exec:\8424004.exe105⤵PID:1140
-
\??\c:\e84286.exec:\e84286.exe106⤵PID:2596
-
\??\c:\1nhtbt.exec:\1nhtbt.exe107⤵PID:2696
-
\??\c:\flfxlfx.exec:\flfxlfx.exe108⤵PID:3548
-
\??\c:\684220.exec:\684220.exe109⤵PID:404
-
\??\c:\bhbbtn.exec:\bhbbtn.exe110⤵PID:2100
-
\??\c:\frxlrlf.exec:\frxlrlf.exe111⤵PID:1340
-
\??\c:\o624820.exec:\o624820.exe112⤵PID:3232
-
\??\c:\242420.exec:\242420.exe113⤵PID:2524
-
\??\c:\8024482.exec:\8024482.exe114⤵PID:1436
-
\??\c:\244208.exec:\244208.exe115⤵
- System Location Discovery: System Language Discovery
PID:5024 -
\??\c:\884248.exec:\884248.exe116⤵PID:4412
-
\??\c:\thhthb.exec:\thhthb.exe117⤵PID:4576
-
\??\c:\00042.exec:\00042.exe118⤵PID:4772
-
\??\c:\80042.exec:\80042.exe119⤵PID:2732
-
\??\c:\206060.exec:\206060.exe120⤵PID:4304
-
\??\c:\9fxrfxl.exec:\9fxrfxl.exe121⤵PID:856
-
\??\c:\e88648.exec:\e88648.exe122⤵PID:3872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-