Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe
-
Size
453KB
-
MD5
08209054ad33ea477d1ccfd94857f84a
-
SHA1
cd38d36d0ee3b8a1f7beefc5a06e4dca91ceaec5
-
SHA256
810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42
-
SHA512
98a7cf3f4284b220cd5bb099201707f1e185dce844dfd731f2aa3a48bf8c2b6a3c4e84c43107cf02aa70bbab99016f5744d1e81c8c901f817b00a57a5a6b552b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2480-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/416-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-989-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-1344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-1580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 908 pvjjj.exe 1248 vpvvd.exe 4432 nbtnnb.exe 3536 lxfxrrx.exe 2148 nbbtbt.exe 1152 vddvv.exe 4804 nntnnn.exe 4000 ppvdd.exe 3080 rllllrr.exe 4288 1nntht.exe 1388 dvdjv.exe 208 xlrxxfl.exe 5028 tbnhhb.exe 4632 ffxxxff.exe 4416 nthhnt.exe 3748 llrxxfl.exe 3096 tnnnnb.exe 2624 rxlrflx.exe 3768 vdjjj.exe 1592 5rfflxf.exe 3992 pjpvd.exe 2300 rllxfxl.exe 2324 dvvdv.exe 3588 xrxxrxx.exe 940 hbhhhn.exe 2004 frrrrxx.exe 3124 hhnhht.exe 4860 pdvvd.exe 1172 nnhtbh.exe 3988 jvjjv.exe 2200 hhhhnt.exe 944 xxxlrfx.exe 4648 xrfllfr.exe 2596 tbnhbn.exe 412 jddpj.exe 4960 fflrrfl.exe 3896 xfxxxff.exe 2024 ttbbbh.exe 2788 dvjjj.exe 3372 xrlfxfx.exe 3516 nnhhtb.exe 1044 1vddp.exe 3500 jdjpj.exe 2784 lxrrrfl.exe 2840 thbbtb.exe 1660 1nbbbn.exe 416 pdpdp.exe 924 flxxxxr.exe 3836 nnhhtt.exe 1668 jdpjp.exe 3592 rrlxrff.exe 4436 7hnnnn.exe 1516 djvjp.exe 3404 xlxxxff.exe 3608 nnbbbt.exe 4432 vvppp.exe 1064 vvdvv.exe 2352 htbbnb.exe 2636 pdppd.exe 4848 xflfxxf.exe 3964 btbtnn.exe 3984 vpdjj.exe 1740 llxxrxx.exe 1356 9xllrlr.exe -
resource yara_rule behavioral2/memory/2480-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/416-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/236-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-724-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2480 wrote to memory of 908 2480 810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe 82 PID 2480 wrote to memory of 908 2480 810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe 82 PID 2480 wrote to memory of 908 2480 810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe 82 PID 908 wrote to memory of 1248 908 pvjjj.exe 83 PID 908 wrote to memory of 1248 908 pvjjj.exe 83 PID 908 wrote to memory of 1248 908 pvjjj.exe 83 PID 1248 wrote to memory of 4432 1248 vpvvd.exe 84 PID 1248 wrote to memory of 4432 1248 vpvvd.exe 84 PID 1248 wrote to memory of 4432 1248 vpvvd.exe 84 PID 4432 wrote to memory of 3536 4432 nbtnnb.exe 85 PID 4432 wrote to memory of 3536 4432 nbtnnb.exe 85 PID 4432 wrote to memory of 3536 4432 nbtnnb.exe 85 PID 3536 wrote to memory of 2148 3536 lxfxrrx.exe 86 PID 3536 wrote to memory of 2148 3536 lxfxrrx.exe 86 PID 3536 wrote to memory of 2148 3536 lxfxrrx.exe 86 PID 2148 wrote to memory of 1152 2148 nbbtbt.exe 87 PID 2148 wrote to memory of 1152 2148 nbbtbt.exe 87 PID 2148 wrote to memory of 1152 2148 nbbtbt.exe 87 PID 1152 wrote to memory of 4804 1152 vddvv.exe 88 PID 1152 wrote to memory of 4804 1152 vddvv.exe 88 PID 1152 wrote to memory of 4804 1152 vddvv.exe 88 PID 4804 wrote to memory of 4000 4804 nntnnn.exe 89 PID 4804 wrote to memory of 4000 4804 nntnnn.exe 89 PID 4804 wrote to memory of 4000 4804 nntnnn.exe 89 PID 4000 wrote to memory of 3080 4000 ppvdd.exe 90 PID 4000 wrote to memory of 3080 4000 ppvdd.exe 90 PID 4000 wrote to memory of 3080 4000 ppvdd.exe 90 PID 3080 wrote to memory of 4288 3080 rllllrr.exe 91 PID 3080 wrote to memory of 4288 3080 rllllrr.exe 91 PID 3080 wrote to memory of 4288 3080 rllllrr.exe 91 PID 4288 wrote to memory of 1388 4288 1nntht.exe 92 PID 4288 wrote to memory of 1388 4288 1nntht.exe 92 PID 4288 wrote to memory of 1388 4288 1nntht.exe 92 PID 1388 wrote to memory of 208 1388 dvdjv.exe 93 PID 1388 wrote to memory of 208 1388 dvdjv.exe 93 PID 1388 wrote to memory of 208 1388 dvdjv.exe 93 PID 208 wrote to memory of 5028 208 xlrxxfl.exe 94 PID 208 wrote to memory of 5028 208 xlrxxfl.exe 94 PID 208 wrote to memory of 5028 208 xlrxxfl.exe 94 PID 5028 wrote to memory of 4632 5028 tbnhhb.exe 95 PID 5028 wrote to memory of 4632 5028 tbnhhb.exe 95 PID 5028 wrote to memory of 4632 5028 tbnhhb.exe 95 PID 4632 wrote to memory of 4416 4632 ffxxxff.exe 96 PID 4632 wrote to memory of 4416 4632 ffxxxff.exe 96 PID 4632 wrote to memory of 4416 4632 ffxxxff.exe 96 PID 4416 wrote to memory of 3748 4416 nthhnt.exe 97 PID 4416 wrote to memory of 3748 4416 nthhnt.exe 97 PID 4416 wrote to memory of 3748 4416 nthhnt.exe 97 PID 3748 wrote to memory of 3096 3748 llrxxfl.exe 98 PID 3748 wrote to memory of 3096 3748 llrxxfl.exe 98 PID 3748 wrote to memory of 3096 3748 llrxxfl.exe 98 PID 3096 wrote to memory of 2624 3096 tnnnnb.exe 99 PID 3096 wrote to memory of 2624 3096 tnnnnb.exe 99 PID 3096 wrote to memory of 2624 3096 tnnnnb.exe 99 PID 2624 wrote to memory of 3768 2624 rxlrflx.exe 100 PID 2624 wrote to memory of 3768 2624 rxlrflx.exe 100 PID 2624 wrote to memory of 3768 2624 rxlrflx.exe 100 PID 3768 wrote to memory of 1592 3768 vdjjj.exe 101 PID 3768 wrote to memory of 1592 3768 vdjjj.exe 101 PID 3768 wrote to memory of 1592 3768 vdjjj.exe 101 PID 1592 wrote to memory of 3992 1592 5rfflxf.exe 102 PID 1592 wrote to memory of 3992 1592 5rfflxf.exe 102 PID 1592 wrote to memory of 3992 1592 5rfflxf.exe 102 PID 3992 wrote to memory of 2300 3992 pjpvd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe"C:\Users\Admin\AppData\Local\Temp\810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\pvjjj.exec:\pvjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\vpvvd.exec:\vpvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\nbtnnb.exec:\nbtnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\lxfxrrx.exec:\lxfxrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\nbbtbt.exec:\nbbtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\vddvv.exec:\vddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\nntnnn.exec:\nntnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\ppvdd.exec:\ppvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\rllllrr.exec:\rllllrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\1nntht.exec:\1nntht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\dvdjv.exec:\dvdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\xlrxxfl.exec:\xlrxxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\tbnhhb.exec:\tbnhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\ffxxxff.exec:\ffxxxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\nthhnt.exec:\nthhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\llrxxfl.exec:\llrxxfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\tnnnnb.exec:\tnnnnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\rxlrflx.exec:\rxlrflx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vdjjj.exec:\vdjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\5rfflxf.exec:\5rfflxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\pjpvd.exec:\pjpvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\rllxfxl.exec:\rllxfxl.exe23⤵
- Executes dropped EXE
PID:2300 -
\??\c:\dvvdv.exec:\dvvdv.exe24⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe25⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hbhhhn.exec:\hbhhhn.exe26⤵
- Executes dropped EXE
PID:940 -
\??\c:\frrrrxx.exec:\frrrrxx.exe27⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hhnhht.exec:\hhnhht.exe28⤵
- Executes dropped EXE
PID:3124 -
\??\c:\pdvvd.exec:\pdvvd.exe29⤵
- Executes dropped EXE
PID:4860 -
\??\c:\nnhtbh.exec:\nnhtbh.exe30⤵
- Executes dropped EXE
PID:1172 -
\??\c:\jvjjv.exec:\jvjjv.exe31⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hhhhnt.exec:\hhhhnt.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xxxlrfx.exec:\xxxlrfx.exe33⤵
- Executes dropped EXE
PID:944 -
\??\c:\xrfllfr.exec:\xrfllfr.exe34⤵
- Executes dropped EXE
PID:4648 -
\??\c:\tbnhbn.exec:\tbnhbn.exe35⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jddpj.exec:\jddpj.exe36⤵
- Executes dropped EXE
PID:412 -
\??\c:\fflrrfl.exec:\fflrrfl.exe37⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xfxxxff.exec:\xfxxxff.exe38⤵
- Executes dropped EXE
PID:3896 -
\??\c:\ttbbbh.exec:\ttbbbh.exe39⤵
- Executes dropped EXE
PID:2024 -
\??\c:\dvjjj.exec:\dvjjj.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xrlfxfx.exec:\xrlfxfx.exe41⤵
- Executes dropped EXE
PID:3372 -
\??\c:\nnhhtb.exec:\nnhhtb.exe42⤵
- Executes dropped EXE
PID:3516 -
\??\c:\1vddp.exec:\1vddp.exe43⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jdjpj.exec:\jdjpj.exe44⤵
- Executes dropped EXE
PID:3500 -
\??\c:\lxrrrfl.exec:\lxrrrfl.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\thbbtb.exec:\thbbtb.exe46⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1nbbbn.exec:\1nbbbn.exe47⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdpdp.exec:\pdpdp.exe48⤵
- Executes dropped EXE
PID:416 -
\??\c:\flxxxxr.exec:\flxxxxr.exe49⤵
- Executes dropped EXE
PID:924 -
\??\c:\nnhhtt.exec:\nnhhtt.exe50⤵
- Executes dropped EXE
PID:3836 -
\??\c:\jdpjp.exec:\jdpjp.exe51⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rrffxll.exec:\rrffxll.exe52⤵PID:4404
-
\??\c:\rrlxrff.exec:\rrlxrff.exe53⤵
- Executes dropped EXE
PID:3592 -
\??\c:\7hnnnn.exec:\7hnnnn.exe54⤵
- Executes dropped EXE
PID:4436 -
\??\c:\djvjp.exec:\djvjp.exe55⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xlxxxff.exec:\xlxxxff.exe56⤵
- Executes dropped EXE
PID:3404 -
\??\c:\nnbbbt.exec:\nnbbbt.exe57⤵
- Executes dropped EXE
PID:3608 -
\??\c:\vvppp.exec:\vvppp.exe58⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vvdvv.exec:\vvdvv.exe59⤵
- Executes dropped EXE
PID:1064 -
\??\c:\htbbnb.exec:\htbbnb.exe60⤵
- Executes dropped EXE
PID:2352 -
\??\c:\pdppd.exec:\pdppd.exe61⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xflfxxf.exec:\xflfxxf.exe62⤵
- Executes dropped EXE
PID:4848 -
\??\c:\btbtnn.exec:\btbtnn.exe63⤵
- Executes dropped EXE
PID:3964 -
\??\c:\vpdjj.exec:\vpdjj.exe64⤵
- Executes dropped EXE
PID:3984 -
\??\c:\llxxrxx.exec:\llxxrxx.exe65⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9xllrlr.exec:\9xllrlr.exe66⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3pjjd.exec:\3pjjd.exe67⤵PID:3172
-
\??\c:\pdjvv.exec:\pdjvv.exe68⤵PID:116
-
\??\c:\lrfrrxf.exec:\lrfrrxf.exe69⤵PID:4288
-
\??\c:\tntnhh.exec:\tntnhh.exe70⤵PID:1328
-
\??\c:\jpppp.exec:\jpppp.exe71⤵PID:236
-
\??\c:\rlrrlff.exec:\rlrrlff.exe72⤵PID:2248
-
\??\c:\9bbbhb.exec:\9bbbhb.exe73⤵PID:1648
-
\??\c:\ttbnhh.exec:\ttbnhh.exe74⤵PID:1348
-
\??\c:\ppvvv.exec:\ppvvv.exe75⤵PID:5020
-
\??\c:\lfxfxfr.exec:\lfxfxfr.exe76⤵PID:4416
-
\??\c:\bhhnnt.exec:\bhhnnt.exe77⤵PID:3028
-
\??\c:\vvddj.exec:\vvddj.exe78⤵PID:4676
-
\??\c:\rxxxxfx.exec:\rxxxxfx.exe79⤵PID:4460
-
\??\c:\lrfllfl.exec:\lrfllfl.exe80⤵PID:4644
-
\??\c:\bntttb.exec:\bntttb.exe81⤵PID:3104
-
\??\c:\pvvpp.exec:\pvvpp.exe82⤵PID:2988
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe83⤵PID:2272
-
\??\c:\bhtbbn.exec:\bhtbbn.exe84⤵PID:4912
-
\??\c:\pdvvv.exec:\pdvvv.exe85⤵PID:4856
-
\??\c:\7lxffrf.exec:\7lxffrf.exe86⤵PID:4308
-
\??\c:\nnnnhh.exec:\nnnnhh.exe87⤵PID:3588
-
\??\c:\ttbbbb.exec:\ttbbbb.exe88⤵PID:5084
-
\??\c:\djvpv.exec:\djvpv.exe89⤵PID:448
-
\??\c:\xxxxfll.exec:\xxxxfll.exe90⤵PID:380
-
\??\c:\nbtbnt.exec:\nbtbnt.exe91⤵PID:2816
-
\??\c:\ppvdd.exec:\ppvdd.exe92⤵
- System Location Discovery: System Language Discovery
PID:4468 -
\??\c:\flxffrx.exec:\flxffrx.exe93⤵PID:4860
-
\??\c:\nhbhhn.exec:\nhbhhn.exe94⤵PID:1812
-
\??\c:\tnnhbh.exec:\tnnhbh.exe95⤵PID:3456
-
\??\c:\ddppv.exec:\ddppv.exe96⤵PID:3988
-
\??\c:\llrrrxr.exec:\llrrrxr.exe97⤵PID:980
-
\??\c:\thnnhh.exec:\thnnhh.exe98⤵PID:4272
-
\??\c:\ddjjj.exec:\ddjjj.exe99⤵
- System Location Discovery: System Language Discovery
PID:1436 -
\??\c:\fffffff.exec:\fffffff.exe100⤵PID:3940
-
\??\c:\nnnhhb.exec:\nnnhhb.exe101⤵PID:1860
-
\??\c:\thnhbb.exec:\thnhbb.exe102⤵PID:552
-
\??\c:\dpppv.exec:\dpppv.exe103⤵PID:4960
-
\??\c:\xlxfflr.exec:\xlxfflr.exe104⤵PID:4236
-
\??\c:\nhtbbb.exec:\nhtbbb.exe105⤵PID:2436
-
\??\c:\nttthn.exec:\nttthn.exe106⤵PID:1512
-
\??\c:\pjvpj.exec:\pjvpj.exe107⤵PID:3524
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe108⤵PID:812
-
\??\c:\bbnnbh.exec:\bbnnbh.exe109⤵PID:1336
-
\??\c:\pvjdv.exec:\pvjdv.exe110⤵PID:4520
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe111⤵PID:1032
-
\??\c:\tntnhn.exec:\tntnhn.exe112⤵PID:3204
-
\??\c:\bnbtnn.exec:\bnbtnn.exe113⤵PID:4264
-
\??\c:\ddvdd.exec:\ddvdd.exe114⤵PID:4316
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe115⤵PID:2212
-
\??\c:\thnnnt.exec:\thnnnt.exe116⤵PID:2712
-
\??\c:\jvvpp.exec:\jvvpp.exe117⤵PID:2824
-
\??\c:\pjppj.exec:\pjppj.exe118⤵PID:4684
-
\??\c:\rxrxflr.exec:\rxrxflr.exe119⤵PID:4528
-
\??\c:\nnbbhh.exec:\nnbbhh.exe120⤵PID:908
-
\??\c:\ppvpj.exec:\ppvpj.exe121⤵PID:1472
-
\??\c:\rfxxlrx.exec:\rfxxlrx.exe122⤵PID:3712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-