Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5b2a428ad3a9314b183a748afa17982526b17d1784d92504baa2cd696dc9512N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d5b2a428ad3a9314b183a748afa17982526b17d1784d92504baa2cd696dc9512N.exe
-
Size
453KB
-
MD5
f70deb67007b21ff975470ee71f0e050
-
SHA1
4324430fa729015528bab1a1554cc8817d6531c8
-
SHA256
d5b2a428ad3a9314b183a748afa17982526b17d1784d92504baa2cd696dc9512
-
SHA512
6d7760f10b25fefb95ffdd9d72bc3952ea3630568404f322f365c5f81513289fb1a005809e45a7e0e25a6f17fa8f7173cf7dd166d1411b97339c489655883f88
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/936-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-779-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-887-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-903-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-1018-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-1600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5072 ppddv.exe 5116 7hnhbb.exe 1688 pjpvd.exe 4164 lxffxxx.exe 2544 htbtnb.exe 4600 nbhbbb.exe 1800 dvdvp.exe 1556 9vvpj.exe 4200 1hbbtt.exe 1776 nnnntt.exe 2064 lrxrxrl.exe 4692 dpvvp.exe 1256 3btnhh.exe 4952 vppjd.exe 224 ddppp.exe 4928 7rxxxxr.exe 4960 vpvvd.exe 3348 7ffxllf.exe 3572 vpjjd.exe 4428 xlrlflf.exe 4784 nntnhh.exe 3352 1jjvp.exe 3360 httttt.exe 3104 3nnhbb.exe 2452 1pvpj.exe 2552 bthnhh.exe 4180 jpddv.exe 4956 vpdvp.exe 4088 pjpjd.exe 4968 5hnhhn.exe 1456 tnnhbt.exe 3540 lrxxrrr.exe 1888 dpdvp.exe 3616 lffxrrl.exe 1512 nhnhbt.exe 2568 fxxrrrl.exe 684 rffxrlf.exe 2072 btttnh.exe 4788 vdddv.exe 1204 7rxxrff.exe 644 nbnhtn.exe 3524 5vvjd.exe 4988 9xxrffr.exe 2084 fxlfflf.exe 3756 nhhbnn.exe 3832 djppj.exe 2148 9fxrllf.exe 2940 bntnbb.exe 3988 pjpjj.exe 1520 vvpvv.exe 1832 9lrlffx.exe 4420 btbbhh.exe 5092 1vvvp.exe 4472 9rlrlll.exe 3592 fffxxrl.exe 1348 hnbnnh.exe 1064 5vjjp.exe 252 dpvpv.exe 1884 xrrlffr.exe 3744 9hhbtt.exe 4392 dpvjj.exe 2888 1rlfxxr.exe 3680 bhnnnh.exe 2504 ddpjp.exe -
resource yara_rule behavioral2/memory/936-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-887-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 936 wrote to memory of 5072 936 d5b2a428ad3a9314b183a748afa17982526b17d1784d92504baa2cd696dc9512N.exe 82 PID 936 wrote to memory of 5072 936 d5b2a428ad3a9314b183a748afa17982526b17d1784d92504baa2cd696dc9512N.exe 82 PID 936 wrote to memory of 5072 936 d5b2a428ad3a9314b183a748afa17982526b17d1784d92504baa2cd696dc9512N.exe 82 PID 5072 wrote to memory of 5116 5072 ppddv.exe 83 PID 5072 wrote to memory of 5116 5072 ppddv.exe 83 PID 5072 wrote to memory of 5116 5072 ppddv.exe 83 PID 5116 wrote to memory of 1688 5116 7hnhbb.exe 84 PID 5116 wrote to memory of 1688 5116 7hnhbb.exe 84 PID 5116 wrote to memory of 1688 5116 7hnhbb.exe 84 PID 1688 wrote to memory of 4164 1688 pjpvd.exe 85 PID 1688 wrote to memory of 4164 1688 pjpvd.exe 85 PID 1688 wrote to memory of 4164 1688 pjpvd.exe 85 PID 4164 wrote to memory of 2544 4164 lxffxxx.exe 86 PID 4164 wrote to memory of 2544 4164 lxffxxx.exe 86 PID 4164 wrote to memory of 2544 4164 lxffxxx.exe 86 PID 2544 wrote to memory of 4600 2544 htbtnb.exe 87 PID 2544 wrote to memory of 4600 2544 htbtnb.exe 87 PID 2544 wrote to memory of 4600 2544 htbtnb.exe 87 PID 4600 wrote to memory of 1800 4600 nbhbbb.exe 88 PID 4600 wrote to memory of 1800 4600 nbhbbb.exe 88 PID 4600 wrote to memory of 1800 4600 nbhbbb.exe 88 PID 1800 wrote to memory of 1556 1800 dvdvp.exe 89 PID 1800 wrote to memory of 1556 1800 dvdvp.exe 89 PID 1800 wrote to memory of 1556 1800 dvdvp.exe 89 PID 1556 wrote to memory of 4200 1556 9vvpj.exe 90 PID 1556 wrote to memory of 4200 1556 9vvpj.exe 90 PID 1556 wrote to memory of 4200 1556 9vvpj.exe 90 PID 4200 wrote to memory of 1776 4200 1hbbtt.exe 91 PID 4200 wrote to memory of 1776 4200 1hbbtt.exe 91 PID 4200 wrote to memory of 1776 4200 1hbbtt.exe 91 PID 1776 wrote to memory of 2064 1776 nnnntt.exe 92 PID 1776 wrote to memory of 2064 1776 nnnntt.exe 92 PID 1776 wrote to memory of 2064 1776 nnnntt.exe 92 PID 2064 wrote to memory of 4692 2064 lrxrxrl.exe 93 PID 2064 wrote to memory of 4692 2064 lrxrxrl.exe 93 PID 2064 wrote to memory of 4692 2064 lrxrxrl.exe 93 PID 4692 wrote to memory of 1256 4692 dpvvp.exe 94 PID 4692 wrote to memory of 1256 4692 dpvvp.exe 94 PID 4692 wrote to memory of 1256 4692 dpvvp.exe 94 PID 1256 wrote to memory of 4952 1256 3btnhh.exe 95 PID 1256 wrote to memory of 4952 1256 3btnhh.exe 95 PID 1256 wrote to memory of 4952 1256 3btnhh.exe 95 PID 4952 wrote to memory of 224 4952 vppjd.exe 96 PID 4952 wrote to memory of 224 4952 vppjd.exe 96 PID 4952 wrote to memory of 224 4952 vppjd.exe 96 PID 224 wrote to memory of 4928 224 ddppp.exe 97 PID 224 wrote to memory of 4928 224 ddppp.exe 97 PID 224 wrote to memory of 4928 224 ddppp.exe 97 PID 4928 wrote to memory of 4960 4928 7rxxxxr.exe 98 PID 4928 wrote to memory of 4960 4928 7rxxxxr.exe 98 PID 4928 wrote to memory of 4960 4928 7rxxxxr.exe 98 PID 4960 wrote to memory of 3348 4960 vpvvd.exe 99 PID 4960 wrote to memory of 3348 4960 vpvvd.exe 99 PID 4960 wrote to memory of 3348 4960 vpvvd.exe 99 PID 3348 wrote to memory of 3572 3348 7ffxllf.exe 100 PID 3348 wrote to memory of 3572 3348 7ffxllf.exe 100 PID 3348 wrote to memory of 3572 3348 7ffxllf.exe 100 PID 3572 wrote to memory of 4428 3572 vpjjd.exe 101 PID 3572 wrote to memory of 4428 3572 vpjjd.exe 101 PID 3572 wrote to memory of 4428 3572 vpjjd.exe 101 PID 4428 wrote to memory of 4784 4428 xlrlflf.exe 102 PID 4428 wrote to memory of 4784 4428 xlrlflf.exe 102 PID 4428 wrote to memory of 4784 4428 xlrlflf.exe 102 PID 4784 wrote to memory of 3352 4784 nntnhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5b2a428ad3a9314b183a748afa17982526b17d1784d92504baa2cd696dc9512N.exe"C:\Users\Admin\AppData\Local\Temp\d5b2a428ad3a9314b183a748afa17982526b17d1784d92504baa2cd696dc9512N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\ppddv.exec:\ppddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\7hnhbb.exec:\7hnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\pjpvd.exec:\pjpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\lxffxxx.exec:\lxffxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\htbtnb.exec:\htbtnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\nbhbbb.exec:\nbhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\dvdvp.exec:\dvdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\9vvpj.exec:\9vvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\1hbbtt.exec:\1hbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\nnnntt.exec:\nnnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\lrxrxrl.exec:\lrxrxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\dpvvp.exec:\dpvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\3btnhh.exec:\3btnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\vppjd.exec:\vppjd.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\ddppp.exec:\ddppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\7rxxxxr.exec:\7rxxxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\vpvvd.exec:\vpvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\7ffxllf.exec:\7ffxllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\vpjjd.exec:\vpjjd.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\xlrlflf.exec:\xlrlflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\nntnhh.exec:\nntnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\1jjvp.exec:\1jjvp.exe23⤵
- Executes dropped EXE
PID:3352 -
\??\c:\httttt.exec:\httttt.exe24⤵
- Executes dropped EXE
PID:3360 -
\??\c:\3nnhbb.exec:\3nnhbb.exe25⤵
- Executes dropped EXE
PID:3104 -
\??\c:\1pvpj.exec:\1pvpj.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bthnhh.exec:\bthnhh.exe27⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jpddv.exec:\jpddv.exe28⤵
- Executes dropped EXE
PID:4180 -
\??\c:\vpdvp.exec:\vpdvp.exe29⤵
- Executes dropped EXE
PID:4956 -
\??\c:\pjpjd.exec:\pjpjd.exe30⤵
- Executes dropped EXE
PID:4088 -
\??\c:\5hnhhn.exec:\5hnhhn.exe31⤵
- Executes dropped EXE
PID:4968 -
\??\c:\tnnhbt.exec:\tnnhbt.exe32⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe33⤵
- Executes dropped EXE
PID:3540 -
\??\c:\dpdvp.exec:\dpdvp.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lffxrrl.exec:\lffxrrl.exe35⤵
- Executes dropped EXE
PID:3616 -
\??\c:\nhnhbt.exec:\nhnhbt.exe36⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe37⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rffxrlf.exec:\rffxrlf.exe38⤵
- Executes dropped EXE
PID:684 -
\??\c:\btttnh.exec:\btttnh.exe39⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vdddv.exec:\vdddv.exe40⤵
- Executes dropped EXE
PID:4788 -
\??\c:\7rxxrff.exec:\7rxxrff.exe41⤵
- Executes dropped EXE
PID:1204 -
\??\c:\nbnhtn.exec:\nbnhtn.exe42⤵
- Executes dropped EXE
PID:644 -
\??\c:\5vvjd.exec:\5vvjd.exe43⤵
- Executes dropped EXE
PID:3524 -
\??\c:\9xxrffr.exec:\9xxrffr.exe44⤵
- Executes dropped EXE
PID:4988 -
\??\c:\fxlfflf.exec:\fxlfflf.exe45⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nhhbnn.exec:\nhhbnn.exe46⤵
- Executes dropped EXE
PID:3756 -
\??\c:\djppj.exec:\djppj.exe47⤵
- Executes dropped EXE
PID:3832 -
\??\c:\9fxrllf.exec:\9fxrllf.exe48⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bntnbb.exec:\bntnbb.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pjpjj.exec:\pjpjj.exe50⤵
- Executes dropped EXE
PID:3988 -
\??\c:\vvpvv.exec:\vvpvv.exe51⤵
- Executes dropped EXE
PID:1520 -
\??\c:\9lrlffx.exec:\9lrlffx.exe52⤵
- Executes dropped EXE
PID:1832 -
\??\c:\btbbhh.exec:\btbbhh.exe53⤵
- Executes dropped EXE
PID:4420 -
\??\c:\1vvvp.exec:\1vvvp.exe54⤵
- Executes dropped EXE
PID:5092 -
\??\c:\9rlrlll.exec:\9rlrlll.exe55⤵
- Executes dropped EXE
PID:4472 -
\??\c:\fffxxrl.exec:\fffxxrl.exe56⤵
- Executes dropped EXE
PID:3592 -
\??\c:\hnbnnh.exec:\hnbnnh.exe57⤵
- Executes dropped EXE
PID:1348 -
\??\c:\5vjjp.exec:\5vjjp.exe58⤵
- Executes dropped EXE
PID:1064 -
\??\c:\dpvpv.exec:\dpvpv.exe59⤵
- Executes dropped EXE
PID:252 -
\??\c:\xrrlffr.exec:\xrrlffr.exe60⤵
- Executes dropped EXE
PID:1884 -
\??\c:\9hhbtt.exec:\9hhbtt.exe61⤵
- Executes dropped EXE
PID:3744 -
\??\c:\dpvjj.exec:\dpvjj.exe62⤵
- Executes dropped EXE
PID:4392 -
\??\c:\1rlfxxr.exec:\1rlfxxr.exe63⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bhnnnh.exec:\bhnnnh.exe64⤵
- Executes dropped EXE
PID:3680 -
\??\c:\ddpjp.exec:\ddpjp.exe65⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jvdpj.exec:\jvdpj.exe66⤵PID:1524
-
\??\c:\frxrlfx.exec:\frxrlfx.exe67⤵PID:3332
-
\??\c:\7hnbnn.exec:\7hnbnn.exe68⤵PID:720
-
\??\c:\btthbn.exec:\btthbn.exe69⤵PID:1660
-
\??\c:\vppjd.exec:\vppjd.exe70⤵PID:4200
-
\??\c:\xxxxffx.exec:\xxxxffx.exe71⤵PID:4868
-
\??\c:\btbtnh.exec:\btbtnh.exe72⤵PID:3320
-
\??\c:\jvdvp.exec:\jvdvp.exe73⤵PID:5028
-
\??\c:\7ddpj.exec:\7ddpj.exe74⤵PID:2972
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe75⤵PID:1344
-
\??\c:\nhnnhh.exec:\nhnnhh.exe76⤵PID:4248
-
\??\c:\3nthbt.exec:\3nthbt.exe77⤵PID:248
-
\??\c:\3jdvv.exec:\3jdvv.exe78⤵PID:3576
-
\??\c:\flfrrxx.exec:\flfrrxx.exe79⤵PID:228
-
\??\c:\9rrlflf.exec:\9rrlflf.exe80⤵PID:3888
-
\??\c:\ttbttt.exec:\ttbttt.exe81⤵PID:236
-
\??\c:\jdpjj.exec:\jdpjj.exe82⤵PID:4332
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe83⤵PID:1748
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe84⤵PID:1616
-
\??\c:\nbhbbb.exec:\nbhbbb.exe85⤵PID:5004
-
\??\c:\1pdvp.exec:\1pdvp.exe86⤵PID:2948
-
\??\c:\dvvjd.exec:\dvvjd.exe87⤵PID:2868
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe88⤵PID:2984
-
\??\c:\tttnnn.exec:\tttnnn.exe89⤵PID:3620
-
\??\c:\ddpdv.exec:\ddpdv.exe90⤵PID:4404
-
\??\c:\jdpjp.exec:\jdpjp.exe91⤵PID:2116
-
\??\c:\rllfxrl.exec:\rllfxrl.exe92⤵PID:4892
-
\??\c:\bnthbb.exec:\bnthbb.exe93⤵PID:1172
-
\??\c:\pjpjp.exec:\pjpjp.exe94⤵PID:3304
-
\??\c:\dvjdp.exec:\dvjdp.exe95⤵PID:888
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe96⤵PID:1280
-
\??\c:\nbbbbt.exec:\nbbbbt.exe97⤵PID:4684
-
\??\c:\pppjd.exec:\pppjd.exe98⤵PID:1900
-
\??\c:\1djdv.exec:\1djdv.exe99⤵PID:2884
-
\??\c:\lflfxxr.exec:\lflfxxr.exe100⤵PID:4920
-
\??\c:\tnnnhh.exec:\tnnnhh.exe101⤵PID:5112
-
\??\c:\9ttnhh.exec:\9ttnhh.exe102⤵PID:3160
-
\??\c:\pjppj.exec:\pjppj.exe103⤵PID:4424
-
\??\c:\fffxrfx.exec:\fffxrfx.exe104⤵PID:2824
-
\??\c:\thhbtn.exec:\thhbtn.exe105⤵PID:5100
-
\??\c:\pjpjd.exec:\pjpjd.exe106⤵PID:4808
-
\??\c:\vjdjd.exec:\vjdjd.exe107⤵PID:2072
-
\??\c:\lffxrrl.exec:\lffxrrl.exe108⤵PID:2212
-
\??\c:\tnnttt.exec:\tnnttt.exe109⤵PID:1204
-
\??\c:\5vvjj.exec:\5vvjj.exe110⤵PID:1668
-
\??\c:\7lfxrxr.exec:\7lfxrxr.exe111⤵PID:3524
-
\??\c:\tthbtt.exec:\tthbtt.exe112⤵PID:3772
-
\??\c:\jdjdv.exec:\jdjdv.exe113⤵PID:2368
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe114⤵PID:3756
-
\??\c:\rfrffxl.exec:\rfrffxl.exe115⤵PID:3016
-
\??\c:\nnbtnn.exec:\nnbtnn.exe116⤵PID:5080
-
\??\c:\5pvpp.exec:\5pvpp.exe117⤵PID:2940
-
\??\c:\jvdvv.exec:\jvdvv.exe118⤵PID:2980
-
\??\c:\rxlxffx.exec:\rxlxffx.exe119⤵PID:3300
-
\??\c:\htbnhb.exec:\htbnhb.exe120⤵PID:4312
-
\??\c:\7jdvp.exec:\7jdvp.exe121⤵PID:4008
-
\??\c:\ffrfxrl.exec:\ffrfxrl.exe122⤵PID:3776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-