Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
123ba5e09e2ad8ad912eadba747f89d1f3c7a17de385d6c8e3d9d2a433f67fda.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
123ba5e09e2ad8ad912eadba747f89d1f3c7a17de385d6c8e3d9d2a433f67fda.exe
-
Size
456KB
-
MD5
5459785143b98aaac015c207defd9d76
-
SHA1
95a70b869265c0ee83bae62c099dc22a3adca73d
-
SHA256
123ba5e09e2ad8ad912eadba747f89d1f3c7a17de385d6c8e3d9d2a433f67fda
-
SHA512
ea818a07bec196b1c4e652714827674c5356b1dbffc8a74ecb618368192e1c41eba64d4ebe8ecdc48ac06f0c5e30626af136159381152fd047473b6ab4da8dfb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRN:q7Tc2NYHUrAwfMp3CDRN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1792-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-799-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-1188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-1219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-1373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 624 pdvpd.exe 3936 rxfxrrx.exe 4208 rxfxrrx.exe 2972 xfllfrl.exe 3232 tnhhbh.exe 4892 hnbhht.exe 3384 nnhhht.exe 3796 lffxxxr.exe 1936 djddd.exe 4864 tbtttt.exe 920 frxrllf.exe 2352 jdjjj.exe 1212 hnbbbb.exe 4972 frlrlfx.exe 4932 nhtbnh.exe 400 jjjvj.exe 1600 jjjdd.exe 764 nhbbbb.exe 3152 vpjdv.exe 4548 nbtnhh.exe 1048 hnhbtn.exe 1784 ntbtnn.exe 2836 pjjvp.exe 3940 5jppv.exe 376 tnbtbn.exe 4432 ddjdp.exe 1812 dppjd.exe 1300 jvvpj.exe 5036 7vvjd.exe 4840 7fxxrxr.exe 4588 3bnhbb.exe 4036 nhnbht.exe 2016 dvddj.exe 5028 ffffxxr.exe 1368 tnbtnn.exe 2596 djjpv.exe 4516 5rlfffx.exe 3264 bhttbh.exe 4384 3jdvp.exe 2624 1xrlffx.exe 3492 vppjj.exe 1056 llfrxxr.exe 2880 5tthbt.exe 5088 vjpjd.exe 452 nttttt.exe 2964 ddppv.exe 2668 3lrlxxx.exe 4448 btbhnt.exe 3712 lrrllrl.exe 1112 tttnnn.exe 4372 jjppp.exe 2304 rflffxx.exe 2440 bbbbtt.exe 60 tnbtnn.exe 3328 djppp.exe 4564 frrllll.exe 2396 9nttbh.exe 5044 pjpdv.exe 3120 pvppp.exe 3232 rllllll.exe 2036 bhbtnn.exe 2556 btttnt.exe 4496 7jppp.exe 4352 7lxrxfl.exe -
resource yara_rule behavioral2/memory/1792-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-799-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 624 1792 123ba5e09e2ad8ad912eadba747f89d1f3c7a17de385d6c8e3d9d2a433f67fda.exe 83 PID 1792 wrote to memory of 624 1792 123ba5e09e2ad8ad912eadba747f89d1f3c7a17de385d6c8e3d9d2a433f67fda.exe 83 PID 1792 wrote to memory of 624 1792 123ba5e09e2ad8ad912eadba747f89d1f3c7a17de385d6c8e3d9d2a433f67fda.exe 83 PID 624 wrote to memory of 3936 624 pdvpd.exe 84 PID 624 wrote to memory of 3936 624 pdvpd.exe 84 PID 624 wrote to memory of 3936 624 pdvpd.exe 84 PID 3936 wrote to memory of 4208 3936 rxfxrrx.exe 85 PID 3936 wrote to memory of 4208 3936 rxfxrrx.exe 85 PID 3936 wrote to memory of 4208 3936 rxfxrrx.exe 85 PID 4208 wrote to memory of 2972 4208 rxfxrrx.exe 86 PID 4208 wrote to memory of 2972 4208 rxfxrrx.exe 86 PID 4208 wrote to memory of 2972 4208 rxfxrrx.exe 86 PID 2972 wrote to memory of 3232 2972 xfllfrl.exe 87 PID 2972 wrote to memory of 3232 2972 xfllfrl.exe 87 PID 2972 wrote to memory of 3232 2972 xfllfrl.exe 87 PID 3232 wrote to memory of 4892 3232 tnhhbh.exe 88 PID 3232 wrote to memory of 4892 3232 tnhhbh.exe 88 PID 3232 wrote to memory of 4892 3232 tnhhbh.exe 88 PID 4892 wrote to memory of 3384 4892 hnbhht.exe 89 PID 4892 wrote to memory of 3384 4892 hnbhht.exe 89 PID 4892 wrote to memory of 3384 4892 hnbhht.exe 89 PID 3384 wrote to memory of 3796 3384 nnhhht.exe 90 PID 3384 wrote to memory of 3796 3384 nnhhht.exe 90 PID 3384 wrote to memory of 3796 3384 nnhhht.exe 90 PID 3796 wrote to memory of 1936 3796 lffxxxr.exe 91 PID 3796 wrote to memory of 1936 3796 lffxxxr.exe 91 PID 3796 wrote to memory of 1936 3796 lffxxxr.exe 91 PID 1936 wrote to memory of 4864 1936 djddd.exe 92 PID 1936 wrote to memory of 4864 1936 djddd.exe 92 PID 1936 wrote to memory of 4864 1936 djddd.exe 92 PID 4864 wrote to memory of 920 4864 tbtttt.exe 93 PID 4864 wrote to memory of 920 4864 tbtttt.exe 93 PID 4864 wrote to memory of 920 4864 tbtttt.exe 93 PID 920 wrote to memory of 2352 920 frxrllf.exe 94 PID 920 wrote to memory of 2352 920 frxrllf.exe 94 PID 920 wrote to memory of 2352 920 frxrllf.exe 94 PID 2352 wrote to memory of 1212 2352 jdjjj.exe 95 PID 2352 wrote to memory of 1212 2352 jdjjj.exe 95 PID 2352 wrote to memory of 1212 2352 jdjjj.exe 95 PID 1212 wrote to memory of 4972 1212 hnbbbb.exe 96 PID 1212 wrote to memory of 4972 1212 hnbbbb.exe 96 PID 1212 wrote to memory of 4972 1212 hnbbbb.exe 96 PID 4972 wrote to memory of 4932 4972 frlrlfx.exe 97 PID 4972 wrote to memory of 4932 4972 frlrlfx.exe 97 PID 4972 wrote to memory of 4932 4972 frlrlfx.exe 97 PID 4932 wrote to memory of 400 4932 nhtbnh.exe 98 PID 4932 wrote to memory of 400 4932 nhtbnh.exe 98 PID 4932 wrote to memory of 400 4932 nhtbnh.exe 98 PID 400 wrote to memory of 1600 400 jjjvj.exe 99 PID 400 wrote to memory of 1600 400 jjjvj.exe 99 PID 400 wrote to memory of 1600 400 jjjvj.exe 99 PID 1600 wrote to memory of 764 1600 jjjdd.exe 100 PID 1600 wrote to memory of 764 1600 jjjdd.exe 100 PID 1600 wrote to memory of 764 1600 jjjdd.exe 100 PID 764 wrote to memory of 3152 764 nhbbbb.exe 101 PID 764 wrote to memory of 3152 764 nhbbbb.exe 101 PID 764 wrote to memory of 3152 764 nhbbbb.exe 101 PID 3152 wrote to memory of 4548 3152 vpjdv.exe 102 PID 3152 wrote to memory of 4548 3152 vpjdv.exe 102 PID 3152 wrote to memory of 4548 3152 vpjdv.exe 102 PID 4548 wrote to memory of 1048 4548 nbtnhh.exe 103 PID 4548 wrote to memory of 1048 4548 nbtnhh.exe 103 PID 4548 wrote to memory of 1048 4548 nbtnhh.exe 103 PID 1048 wrote to memory of 1784 1048 hnhbtn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\123ba5e09e2ad8ad912eadba747f89d1f3c7a17de385d6c8e3d9d2a433f67fda.exe"C:\Users\Admin\AppData\Local\Temp\123ba5e09e2ad8ad912eadba747f89d1f3c7a17de385d6c8e3d9d2a433f67fda.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\pdvpd.exec:\pdvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\rxfxrrx.exec:\rxfxrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\rxfxrrx.exec:\rxfxrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\xfllfrl.exec:\xfllfrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\tnhhbh.exec:\tnhhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\hnbhht.exec:\hnbhht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\nnhhht.exec:\nnhhht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\lffxxxr.exec:\lffxxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\djddd.exec:\djddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\tbtttt.exec:\tbtttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\frxrllf.exec:\frxrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\jdjjj.exec:\jdjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\hnbbbb.exec:\hnbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\frlrlfx.exec:\frlrlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\nhtbnh.exec:\nhtbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\jjjvj.exec:\jjjvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\jjjdd.exec:\jjjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\nhbbbb.exec:\nhbbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\vpjdv.exec:\vpjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\nbtnhh.exec:\nbtnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\hnhbtn.exec:\hnhbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\ntbtnn.exec:\ntbtnn.exe23⤵
- Executes dropped EXE
PID:1784 -
\??\c:\pjjvp.exec:\pjjvp.exe24⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5jppv.exec:\5jppv.exe25⤵
- Executes dropped EXE
PID:3940 -
\??\c:\tnbtbn.exec:\tnbtbn.exe26⤵
- Executes dropped EXE
PID:376 -
\??\c:\ddjdp.exec:\ddjdp.exe27⤵
- Executes dropped EXE
PID:4432 -
\??\c:\dppjd.exec:\dppjd.exe28⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jvvpj.exec:\jvvpj.exe29⤵
- Executes dropped EXE
PID:1300 -
\??\c:\7vvjd.exec:\7vvjd.exe30⤵
- Executes dropped EXE
PID:5036 -
\??\c:\7fxxrxr.exec:\7fxxrxr.exe31⤵
- Executes dropped EXE
PID:4840 -
\??\c:\3bnhbb.exec:\3bnhbb.exe32⤵
- Executes dropped EXE
PID:4588 -
\??\c:\nhnbht.exec:\nhnbht.exe33⤵
- Executes dropped EXE
PID:4036 -
\??\c:\dvddj.exec:\dvddj.exe34⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ffffxxr.exec:\ffffxxr.exe35⤵
- Executes dropped EXE
PID:5028 -
\??\c:\tnbtnn.exec:\tnbtnn.exe36⤵
- Executes dropped EXE
PID:1368 -
\??\c:\djjpv.exec:\djjpv.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5rlfffx.exec:\5rlfffx.exe38⤵
- Executes dropped EXE
PID:4516 -
\??\c:\bhttbh.exec:\bhttbh.exe39⤵
- Executes dropped EXE
PID:3264 -
\??\c:\3jdvp.exec:\3jdvp.exe40⤵
- Executes dropped EXE
PID:4384 -
\??\c:\1xrlffx.exec:\1xrlffx.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vppjj.exec:\vppjj.exe42⤵
- Executes dropped EXE
PID:3492 -
\??\c:\llfrxxr.exec:\llfrxxr.exe43⤵
- Executes dropped EXE
PID:1056 -
\??\c:\5tthbt.exec:\5tthbt.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vjpjd.exec:\vjpjd.exe45⤵
- Executes dropped EXE
PID:5088 -
\??\c:\nttttt.exec:\nttttt.exe46⤵
- Executes dropped EXE
PID:452 -
\??\c:\ddppv.exec:\ddppv.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964 -
\??\c:\3lrlxxx.exec:\3lrlxxx.exe48⤵
- Executes dropped EXE
PID:2668 -
\??\c:\btbhnt.exec:\btbhnt.exe49⤵
- Executes dropped EXE
PID:4448 -
\??\c:\lrrllrl.exec:\lrrllrl.exe50⤵
- Executes dropped EXE
PID:3712 -
\??\c:\tttnnn.exec:\tttnnn.exe51⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jjppp.exec:\jjppp.exe52⤵
- Executes dropped EXE
PID:4372 -
\??\c:\rflffxx.exec:\rflffxx.exe53⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bbbbtt.exec:\bbbbtt.exe54⤵
- Executes dropped EXE
PID:2440 -
\??\c:\tnbtnn.exec:\tnbtnn.exe55⤵
- Executes dropped EXE
PID:60 -
\??\c:\djppp.exec:\djppp.exe56⤵
- Executes dropped EXE
PID:3328 -
\??\c:\frrllll.exec:\frrllll.exe57⤵
- Executes dropped EXE
PID:4564 -
\??\c:\9nttbh.exec:\9nttbh.exe58⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pjpdv.exec:\pjpdv.exe59⤵
- Executes dropped EXE
PID:5044 -
\??\c:\pvppp.exec:\pvppp.exe60⤵
- Executes dropped EXE
PID:3120 -
\??\c:\rllllll.exec:\rllllll.exe61⤵
- Executes dropped EXE
PID:3232 -
\??\c:\bhbtnn.exec:\bhbtnn.exe62⤵
- Executes dropped EXE
PID:2036 -
\??\c:\btttnt.exec:\btttnt.exe63⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7jppp.exec:\7jppp.exe64⤵
- Executes dropped EXE
PID:4496 -
\??\c:\7lxrxfl.exec:\7lxrxfl.exe65⤵
- Executes dropped EXE
PID:4352 -
\??\c:\5lxxxff.exec:\5lxxxff.exe66⤵PID:952
-
\??\c:\9ttnhh.exec:\9ttnhh.exe67⤵PID:5020
-
\??\c:\thbbtt.exec:\thbbtt.exe68⤵PID:1960
-
\??\c:\djjjd.exec:\djjjd.exe69⤵PID:4520
-
\??\c:\rlllflf.exec:\rlllflf.exe70⤵PID:2196
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe71⤵PID:4880
-
\??\c:\dvdjj.exec:\dvdjj.exe72⤵PID:2020
-
\??\c:\jvddd.exec:\jvddd.exe73⤵PID:4820
-
\??\c:\rrxxffl.exec:\rrxxffl.exe74⤵PID:404
-
\??\c:\tbhbtt.exec:\tbhbtt.exe75⤵PID:1364
-
\??\c:\btbtbb.exec:\btbtbb.exe76⤵PID:3500
-
\??\c:\jddvj.exec:\jddvj.exe77⤵PID:2552
-
\??\c:\lxxxrff.exec:\lxxxrff.exe78⤵PID:3952
-
\??\c:\ttthbb.exec:\ttthbb.exe79⤵PID:388
-
\??\c:\jvppj.exec:\jvppj.exe80⤵PID:4836
-
\??\c:\pjddd.exec:\pjddd.exe81⤵PID:1236
-
\??\c:\xflfxff.exec:\xflfxff.exe82⤵PID:1320
-
\??\c:\tbbbtt.exec:\tbbbtt.exe83⤵PID:2888
-
\??\c:\jppjd.exec:\jppjd.exe84⤵PID:5104
-
\??\c:\ddvjv.exec:\ddvjv.exe85⤵PID:1996
-
\??\c:\xxlfffx.exec:\xxlfffx.exe86⤵PID:3316
-
\??\c:\tbbbtt.exec:\tbbbtt.exe87⤵PID:4844
-
\??\c:\ddvvd.exec:\ddvvd.exe88⤵PID:2164
-
\??\c:\xxlfllr.exec:\xxlfllr.exe89⤵PID:1804
-
\??\c:\9xfxrxr.exec:\9xfxrxr.exe90⤵PID:3288
-
\??\c:\htbbbb.exec:\htbbbb.exe91⤵PID:3736
-
\??\c:\ddddd.exec:\ddddd.exe92⤵PID:5036
-
\??\c:\5vdvp.exec:\5vdvp.exe93⤵PID:1824
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe94⤵PID:2456
-
\??\c:\1tbbtt.exec:\1tbbtt.exe95⤵PID:4824
-
\??\c:\jjvvv.exec:\jjvvv.exe96⤵PID:2772
-
\??\c:\5rrxxff.exec:\5rrxxff.exe97⤵PID:1420
-
\??\c:\xfllrrx.exec:\xfllrrx.exe98⤵PID:4788
-
\??\c:\nnnnhh.exec:\nnnnhh.exe99⤵PID:1316
-
\??\c:\vdpjv.exec:\vdpjv.exe100⤵PID:1132
-
\??\c:\xflllll.exec:\xflllll.exe101⤵PID:1044
-
\??\c:\frrllrx.exec:\frrllrx.exe102⤵PID:1748
-
\??\c:\thtbbh.exec:\thtbbh.exe103⤵PID:4928
-
\??\c:\vdjpj.exec:\vdjpj.exe104⤵PID:1860
-
\??\c:\vdvvp.exec:\vdvvp.exe105⤵PID:3532
-
\??\c:\frlfxxr.exec:\frlfxxr.exe106⤵PID:3776
-
\??\c:\nntttt.exec:\nntttt.exe107⤵PID:2472
-
\??\c:\7vvvp.exec:\7vvvp.exe108⤵PID:208
-
\??\c:\xfffllr.exec:\xfffllr.exe109⤵PID:2560
-
\??\c:\ttttnn.exec:\ttttnn.exe110⤵PID:3588
-
\??\c:\tbbbth.exec:\tbbbth.exe111⤵PID:348
-
\??\c:\jjjjj.exec:\jjjjj.exe112⤵PID:1208
-
\??\c:\xxxrlll.exec:\xxxrlll.exe113⤵PID:1012
-
\??\c:\5lrrllf.exec:\5lrrllf.exe114⤵PID:740
-
\??\c:\tbtttt.exec:\tbtttt.exe115⤵PID:4440
-
\??\c:\jvddj.exec:\jvddj.exe116⤵PID:4980
-
\??\c:\flxrxfl.exec:\flxrxfl.exe117⤵PID:3300
-
\??\c:\xxrrrrl.exec:\xxrrrrl.exe118⤵PID:4016
-
\??\c:\tbbhtb.exec:\tbbhtb.exe119⤵PID:696
-
\??\c:\pvvvv.exec:\pvvvv.exe120⤵PID:2124
-
\??\c:\rrrrlll.exec:\rrrrlll.exe121⤵PID:392
-
\??\c:\ffrfxxr.exec:\ffrfxxr.exe122⤵PID:5004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-