Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c1586964fe5de79aa8c74f25f6eb4d71602c555fb0002cb86ef4ebce361b6bd1N.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c1586964fe5de79aa8c74f25f6eb4d71602c555fb0002cb86ef4ebce361b6bd1N.exe
-
Size
453KB
-
MD5
6e059c89ad572569048ba3f21e1f1eb0
-
SHA1
918edc55bd6d5ec9e375d91071156e4b3b5be265
-
SHA256
c1586964fe5de79aa8c74f25f6eb4d71602c555fb0002cb86ef4ebce361b6bd1
-
SHA512
2ba0d70b2571d2b0281ad24678033dd8e4b3f73a7196386b54dd455f0702f0f89d8a3cbac81deb807354018aa9745d7254da55b0fc641d40e113071d1cc5954a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4088-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3348 dddvv.exe 3536 tnhbtb.exe 2364 dpvdv.exe 1036 5ffxllf.exe 3532 hthtnn.exe 3112 bnnbnb.exe 4520 fxrxlxl.exe 928 htthtn.exe 3088 rrrlxxl.exe 4772 pjdvp.exe 3128 tbbnht.exe 3540 rffxxrr.exe 1468 thhthb.exe 1440 1lfrllf.exe 5100 3vdvp.exe 1284 lflfxrf.exe 2400 htbthb.exe 4952 jvjvp.exe 2120 lrrlfxr.exe 116 dvvpj.exe 1764 dpvpv.exe 2420 pvpjd.exe 3240 nhnbtn.exe 3624 fxrlflf.exe 2752 7bbtbb.exe 2820 1lrfxrl.exe 2204 3vvpj.exe 3964 lllxlfx.exe 4892 fxllfxr.exe 2388 bttntb.exe 4076 lfxrfxr.exe 4736 vdpjd.exe 3900 tnnnhb.exe 2696 dvvpj.exe 2432 pjjdv.exe 1120 frfrfxr.exe 1920 nhnhtn.exe 5056 jjpjp.exe 5004 flrfxrf.exe 1832 lfxfllf.exe 4572 5ppjj.exe 5016 jvdvj.exe 2576 fxfrllx.exe 4800 bnttnb.exe 2960 dpvpj.exe 3976 bnnhtt.exe 2896 bttnhb.exe 5008 lfrllff.exe 3224 9bhbhh.exe 380 thhbtn.exe 4436 vdjvj.exe 4840 rlxrxlx.exe 3676 lrrfrlf.exe 4084 nthhbb.exe 448 9ddvp.exe 3396 rfrlrrr.exe 4492 btbthh.exe 3388 tnntnt.exe 972 hhbtnn.exe 4100 hhnhnh.exe 1136 vpvvj.exe 3112 3xffxrl.exe 884 bhtnnn.exe 3544 5vjdv.exe -
resource yara_rule behavioral2/memory/3348-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-689-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4088 wrote to memory of 3348 4088 c1586964fe5de79aa8c74f25f6eb4d71602c555fb0002cb86ef4ebce361b6bd1N.exe 81 PID 4088 wrote to memory of 3348 4088 c1586964fe5de79aa8c74f25f6eb4d71602c555fb0002cb86ef4ebce361b6bd1N.exe 81 PID 4088 wrote to memory of 3348 4088 c1586964fe5de79aa8c74f25f6eb4d71602c555fb0002cb86ef4ebce361b6bd1N.exe 81 PID 3348 wrote to memory of 3536 3348 dddvv.exe 82 PID 3348 wrote to memory of 3536 3348 dddvv.exe 82 PID 3348 wrote to memory of 3536 3348 dddvv.exe 82 PID 3536 wrote to memory of 2364 3536 tnhbtb.exe 83 PID 3536 wrote to memory of 2364 3536 tnhbtb.exe 83 PID 3536 wrote to memory of 2364 3536 tnhbtb.exe 83 PID 2364 wrote to memory of 1036 2364 dpvdv.exe 84 PID 2364 wrote to memory of 1036 2364 dpvdv.exe 84 PID 2364 wrote to memory of 1036 2364 dpvdv.exe 84 PID 1036 wrote to memory of 3532 1036 5ffxllf.exe 85 PID 1036 wrote to memory of 3532 1036 5ffxllf.exe 85 PID 1036 wrote to memory of 3532 1036 5ffxllf.exe 85 PID 3532 wrote to memory of 3112 3532 hthtnn.exe 86 PID 3532 wrote to memory of 3112 3532 hthtnn.exe 86 PID 3532 wrote to memory of 3112 3532 hthtnn.exe 86 PID 3112 wrote to memory of 4520 3112 bnnbnb.exe 87 PID 3112 wrote to memory of 4520 3112 bnnbnb.exe 87 PID 3112 wrote to memory of 4520 3112 bnnbnb.exe 87 PID 4520 wrote to memory of 928 4520 fxrxlxl.exe 88 PID 4520 wrote to memory of 928 4520 fxrxlxl.exe 88 PID 4520 wrote to memory of 928 4520 fxrxlxl.exe 88 PID 928 wrote to memory of 3088 928 htthtn.exe 89 PID 928 wrote to memory of 3088 928 htthtn.exe 89 PID 928 wrote to memory of 3088 928 htthtn.exe 89 PID 3088 wrote to memory of 4772 3088 rrrlxxl.exe 90 PID 3088 wrote to memory of 4772 3088 rrrlxxl.exe 90 PID 3088 wrote to memory of 4772 3088 rrrlxxl.exe 90 PID 4772 wrote to memory of 3128 4772 pjdvp.exe 91 PID 4772 wrote to memory of 3128 4772 pjdvp.exe 91 PID 4772 wrote to memory of 3128 4772 pjdvp.exe 91 PID 3128 wrote to memory of 3540 3128 tbbnht.exe 92 PID 3128 wrote to memory of 3540 3128 tbbnht.exe 92 PID 3128 wrote to memory of 3540 3128 tbbnht.exe 92 PID 3540 wrote to memory of 1468 3540 rffxxrr.exe 93 PID 3540 wrote to memory of 1468 3540 rffxxrr.exe 93 PID 3540 wrote to memory of 1468 3540 rffxxrr.exe 93 PID 1468 wrote to memory of 1440 1468 thhthb.exe 94 PID 1468 wrote to memory of 1440 1468 thhthb.exe 94 PID 1468 wrote to memory of 1440 1468 thhthb.exe 94 PID 1440 wrote to memory of 5100 1440 1lfrllf.exe 95 PID 1440 wrote to memory of 5100 1440 1lfrllf.exe 95 PID 1440 wrote to memory of 5100 1440 1lfrllf.exe 95 PID 5100 wrote to memory of 1284 5100 3vdvp.exe 96 PID 5100 wrote to memory of 1284 5100 3vdvp.exe 96 PID 5100 wrote to memory of 1284 5100 3vdvp.exe 96 PID 1284 wrote to memory of 2400 1284 lflfxrf.exe 97 PID 1284 wrote to memory of 2400 1284 lflfxrf.exe 97 PID 1284 wrote to memory of 2400 1284 lflfxrf.exe 97 PID 2400 wrote to memory of 4952 2400 htbthb.exe 98 PID 2400 wrote to memory of 4952 2400 htbthb.exe 98 PID 2400 wrote to memory of 4952 2400 htbthb.exe 98 PID 4952 wrote to memory of 2120 4952 jvjvp.exe 99 PID 4952 wrote to memory of 2120 4952 jvjvp.exe 99 PID 4952 wrote to memory of 2120 4952 jvjvp.exe 99 PID 2120 wrote to memory of 116 2120 lrrlfxr.exe 100 PID 2120 wrote to memory of 116 2120 lrrlfxr.exe 100 PID 2120 wrote to memory of 116 2120 lrrlfxr.exe 100 PID 116 wrote to memory of 1764 116 dvvpj.exe 101 PID 116 wrote to memory of 1764 116 dvvpj.exe 101 PID 116 wrote to memory of 1764 116 dvvpj.exe 101 PID 1764 wrote to memory of 2420 1764 dpvpv.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1586964fe5de79aa8c74f25f6eb4d71602c555fb0002cb86ef4ebce361b6bd1N.exe"C:\Users\Admin\AppData\Local\Temp\c1586964fe5de79aa8c74f25f6eb4d71602c555fb0002cb86ef4ebce361b6bd1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\dddvv.exec:\dddvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\tnhbtb.exec:\tnhbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\dpvdv.exec:\dpvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\5ffxllf.exec:\5ffxllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\hthtnn.exec:\hthtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\bnnbnb.exec:\bnnbnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\fxrxlxl.exec:\fxrxlxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\htthtn.exec:\htthtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\rrrlxxl.exec:\rrrlxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\pjdvp.exec:\pjdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\tbbnht.exec:\tbbnht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\rffxxrr.exec:\rffxxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\thhthb.exec:\thhthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\1lfrllf.exec:\1lfrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\3vdvp.exec:\3vdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\lflfxrf.exec:\lflfxrf.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\htbthb.exec:\htbthb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jvjvp.exec:\jvjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\dvvpj.exec:\dvvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\dpvpv.exec:\dpvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\pvpjd.exec:\pvpjd.exe23⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nhnbtn.exec:\nhnbtn.exe24⤵
- Executes dropped EXE
PID:3240 -
\??\c:\fxrlflf.exec:\fxrlflf.exe25⤵
- Executes dropped EXE
PID:3624 -
\??\c:\7bbtbb.exec:\7bbtbb.exe26⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1lrfxrl.exec:\1lrfxrl.exe27⤵
- Executes dropped EXE
PID:2820 -
\??\c:\3vvpj.exec:\3vvpj.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lllxlfx.exec:\lllxlfx.exe29⤵
- Executes dropped EXE
PID:3964 -
\??\c:\fxllfxr.exec:\fxllfxr.exe30⤵
- Executes dropped EXE
PID:4892 -
\??\c:\bttntb.exec:\bttntb.exe31⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe32⤵
- Executes dropped EXE
PID:4076 -
\??\c:\vdpjd.exec:\vdpjd.exe33⤵
- Executes dropped EXE
PID:4736 -
\??\c:\tnnnhb.exec:\tnnnhb.exe34⤵
- Executes dropped EXE
PID:3900 -
\??\c:\dvvpj.exec:\dvvpj.exe35⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pjjdv.exec:\pjjdv.exe36⤵
- Executes dropped EXE
PID:2432 -
\??\c:\frfrfxr.exec:\frfrfxr.exe37⤵
- Executes dropped EXE
PID:1120 -
\??\c:\nhnhtn.exec:\nhnhtn.exe38⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jjpjp.exec:\jjpjp.exe39⤵
- Executes dropped EXE
PID:5056 -
\??\c:\flrfxrf.exec:\flrfxrf.exe40⤵
- Executes dropped EXE
PID:5004 -
\??\c:\lfxfllf.exec:\lfxfllf.exe41⤵
- Executes dropped EXE
PID:1832 -
\??\c:\5ppjj.exec:\5ppjj.exe42⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jvdvj.exec:\jvdvj.exe43⤵
- Executes dropped EXE
PID:5016 -
\??\c:\fxfrllx.exec:\fxfrllx.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bnttnb.exec:\bnttnb.exe45⤵
- Executes dropped EXE
PID:4800 -
\??\c:\dpvpj.exec:\dpvpj.exe46⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bnnhtt.exec:\bnnhtt.exe47⤵
- Executes dropped EXE
PID:3976 -
\??\c:\bttnhb.exec:\bttnhb.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lfrllff.exec:\lfrllff.exe49⤵
- Executes dropped EXE
PID:5008 -
\??\c:\9bhbhh.exec:\9bhbhh.exe50⤵
- Executes dropped EXE
PID:3224 -
\??\c:\thhbtn.exec:\thhbtn.exe51⤵
- Executes dropped EXE
PID:380 -
\??\c:\vdjvj.exec:\vdjvj.exe52⤵
- Executes dropped EXE
PID:4436 -
\??\c:\rlxrxlx.exec:\rlxrxlx.exe53⤵
- Executes dropped EXE
PID:4840 -
\??\c:\lrrfrlf.exec:\lrrfrlf.exe54⤵
- Executes dropped EXE
PID:3676 -
\??\c:\nthhbb.exec:\nthhbb.exe55⤵
- Executes dropped EXE
PID:4084 -
\??\c:\9ddvp.exec:\9ddvp.exe56⤵
- Executes dropped EXE
PID:448 -
\??\c:\rfrlrrr.exec:\rfrlrrr.exe57⤵
- Executes dropped EXE
PID:3396 -
\??\c:\btbthh.exec:\btbthh.exe58⤵
- Executes dropped EXE
PID:4492 -
\??\c:\tnntnt.exec:\tnntnt.exe59⤵
- Executes dropped EXE
PID:3388 -
\??\c:\hhbtnn.exec:\hhbtnn.exe60⤵
- Executes dropped EXE
PID:972 -
\??\c:\hhnhnh.exec:\hhnhnh.exe61⤵
- Executes dropped EXE
PID:4100 -
\??\c:\vpvvj.exec:\vpvvj.exe62⤵
- Executes dropped EXE
PID:1136 -
\??\c:\3xffxrl.exec:\3xffxrl.exe63⤵
- Executes dropped EXE
PID:3112 -
\??\c:\bhtnnn.exec:\bhtnnn.exe64⤵
- Executes dropped EXE
PID:884 -
\??\c:\5vjdv.exec:\5vjdv.exe65⤵
- Executes dropped EXE
PID:3544 -
\??\c:\xlrrflx.exec:\xlrrflx.exe66⤵PID:3096
-
\??\c:\nbnnnn.exec:\nbnnnn.exe67⤵PID:4216
-
\??\c:\dpjdv.exec:\dpjdv.exe68⤵PID:3088
-
\??\c:\pvvjd.exec:\pvvjd.exe69⤵PID:2484
-
\??\c:\llrffxl.exec:\llrffxl.exe70⤵PID:3128
-
\??\c:\bhnbnh.exec:\bhnbnh.exe71⤵PID:3824
-
\??\c:\5hhthb.exec:\5hhthb.exe72⤵PID:4368
-
\??\c:\dppjv.exec:\dppjv.exe73⤵PID:1276
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe74⤵PID:2840
-
\??\c:\bntntn.exec:\bntntn.exe75⤵PID:4104
-
\??\c:\bhhtnh.exec:\bhhtnh.exe76⤵PID:3512
-
\??\c:\1jdvp.exec:\1jdvp.exe77⤵PID:764
-
\??\c:\dvdvv.exec:\dvdvv.exe78⤵PID:4568
-
\??\c:\xrxrfrx.exec:\xrxrfrx.exe79⤵PID:1868
-
\??\c:\1ttnhh.exec:\1ttnhh.exe80⤵PID:3264
-
\??\c:\jvjjj.exec:\jvjjj.exe81⤵PID:180
-
\??\c:\1xfxflr.exec:\1xfxflr.exe82⤵PID:2720
-
\??\c:\3thbbt.exec:\3thbbt.exe83⤵PID:116
-
\??\c:\dppjj.exec:\dppjj.exe84⤵PID:1764
-
\??\c:\pjvvj.exec:\pjvvj.exe85⤵PID:2164
-
\??\c:\lrxlfxl.exec:\lrxlfxl.exe86⤵PID:3204
-
\??\c:\htttnh.exec:\htttnh.exe87⤵PID:4700
-
\??\c:\jpppj.exec:\jpppj.exe88⤵PID:2096
-
\??\c:\pjjvp.exec:\pjjvp.exe89⤵PID:1620
-
\??\c:\fxxrfxr.exec:\fxxrfxr.exe90⤵PID:4996
-
\??\c:\bhtnhh.exec:\bhtnhh.exe91⤵PID:3104
-
\??\c:\vppjd.exec:\vppjd.exe92⤵PID:4320
-
\??\c:\xrfrrlf.exec:\xrfrrlf.exe93⤵PID:3956
-
\??\c:\lffrlxr.exec:\lffrlxr.exe94⤵PID:2388
-
\??\c:\hbbnbt.exec:\hbbnbt.exe95⤵PID:4632
-
\??\c:\dvddv.exec:\dvddv.exe96⤵PID:4904
-
\??\c:\rrxlxrf.exec:\rrxlxrf.exe97⤵PID:4620
-
\??\c:\tbbhbb.exec:\tbbhbb.exe98⤵PID:2892
-
\??\c:\btttnn.exec:\btttnn.exe99⤵PID:2812
-
\??\c:\1pvjd.exec:\1pvjd.exe100⤵PID:420
-
\??\c:\xflflff.exec:\xflflff.exe101⤵PID:2508
-
\??\c:\hbbnhb.exec:\hbbnhb.exe102⤵PID:5072
-
\??\c:\pvvjj.exec:\pvvjj.exe103⤵PID:3984
-
\??\c:\frfxrlf.exec:\frfxrlf.exe104⤵PID:5032
-
\??\c:\rrxllfl.exec:\rrxllfl.exe105⤵PID:1232
-
\??\c:\hbtnhb.exec:\hbtnhb.exe106⤵PID:4756
-
\??\c:\vjddv.exec:\vjddv.exe107⤵PID:3892
-
\??\c:\llrlfxl.exec:\llrlfxl.exe108⤵PID:1980
-
\??\c:\9ttthb.exec:\9ttthb.exe109⤵PID:3932
-
\??\c:\vvppj.exec:\vvppj.exe110⤵PID:1116
-
\??\c:\ffxrllf.exec:\ffxrllf.exe111⤵PID:3460
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe112⤵
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\hbhbnt.exec:\hbhbnt.exe113⤵PID:1040
-
\??\c:\vpjdv.exec:\vpjdv.exe114⤵PID:5008
-
\??\c:\pvvpd.exec:\pvvpd.exe115⤵PID:4316
-
\??\c:\1rfxfxr.exec:\1rfxfxr.exe116⤵PID:1484
-
\??\c:\9bbtht.exec:\9bbtht.exe117⤵PID:1572
-
\??\c:\dvvdv.exec:\dvvdv.exe118⤵PID:1032
-
\??\c:\lfxlffr.exec:\lfxlffr.exe119⤵
- System Location Discovery: System Language Discovery
PID:316 -
\??\c:\hhtbbh.exec:\hhtbbh.exe120⤵PID:5084
-
\??\c:\nntbtt.exec:\nntbtt.exe121⤵PID:4100
-
\??\c:\dvpjd.exec:\dvpjd.exe122⤵PID:1136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-