Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 21:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe
-
Size
453KB
-
MD5
826da557ee188a7d9dd44b7cef36d42f
-
SHA1
210866eac5ebf2569c6e403484f990f8b17ef7aa
-
SHA256
2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2
-
SHA512
236dd1be386fb737724d4f7fda08866c2138a014a8978ce7b972659bea581f9057978158ae452d653171c658975da080b719e2044edfbe7e130fa6552d6c8285
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2032-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/416-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-867-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-1081-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-1151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-1414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-1534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-1538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4544 1vvpd.exe 556 3tthhb.exe 3048 frfxlfx.exe 3064 lflflfx.exe 1684 frrfrlx.exe 456 xlrlflx.exe 2540 jvvjj.exe 364 fflfrlf.exe 4880 xfxfxlf.exe 3104 9nthhh.exe 1944 7frlxxr.exe 872 nttnhb.exe 3904 1jddv.exe 2112 xlfrlxr.exe 4764 jdpjv.exe 4892 xflfffx.exe 4508 7rfxrxl.exe 1580 pvdpj.exe 3492 fxfxflf.exe 4864 pvvjv.exe 836 vpjjd.exe 1640 1hhthb.exe 2068 pvvpd.exe 916 3jdpd.exe 3112 7fxlxlf.exe 2424 1tnbhb.exe 5100 7llxllx.exe 3076 tbbnbt.exe 2556 pdpdp.exe 1504 ntthtn.exe 4716 xrxrrlf.exe 2164 vpjdp.exe 1808 nhtntn.exe 3664 vdppp.exe 4000 ffrfxxr.exe 4800 tntntn.exe 3220 3thbnn.exe 3644 pdjpd.exe 3508 5rrfrlr.exe 60 btbttt.exe 3680 vppdp.exe 4368 pddjd.exe 2568 lxxllfl.exe 3004 hththh.exe 2412 jdvpj.exe 4372 vppjv.exe 4360 fxrlffx.exe 4912 btbbhh.exe 4100 pddvj.exe 4496 djjvp.exe 4144 xrlffff.exe 3768 tnnbtn.exe 4768 vjjdp.exe 3064 1xxrllf.exe 3212 7nbtnh.exe 4808 dvdvv.exe 3688 rxxrlll.exe 4812 lxrlfxr.exe 232 thnbtn.exe 4084 nhbthb.exe 2588 ddjjd.exe 2804 ffrlrrx.exe 2368 dpdpv.exe 100 frrrlff.exe -
resource yara_rule behavioral2/memory/2032-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/416-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-1081-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-1151-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 4544 2032 2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe 84 PID 2032 wrote to memory of 4544 2032 2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe 84 PID 2032 wrote to memory of 4544 2032 2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe 84 PID 4544 wrote to memory of 556 4544 1vvpd.exe 85 PID 4544 wrote to memory of 556 4544 1vvpd.exe 85 PID 4544 wrote to memory of 556 4544 1vvpd.exe 85 PID 556 wrote to memory of 3048 556 3tthhb.exe 86 PID 556 wrote to memory of 3048 556 3tthhb.exe 86 PID 556 wrote to memory of 3048 556 3tthhb.exe 86 PID 3048 wrote to memory of 3064 3048 frfxlfx.exe 87 PID 3048 wrote to memory of 3064 3048 frfxlfx.exe 87 PID 3048 wrote to memory of 3064 3048 frfxlfx.exe 87 PID 3064 wrote to memory of 1684 3064 lflflfx.exe 88 PID 3064 wrote to memory of 1684 3064 lflflfx.exe 88 PID 3064 wrote to memory of 1684 3064 lflflfx.exe 88 PID 1684 wrote to memory of 456 1684 frrfrlx.exe 89 PID 1684 wrote to memory of 456 1684 frrfrlx.exe 89 PID 1684 wrote to memory of 456 1684 frrfrlx.exe 89 PID 456 wrote to memory of 2540 456 xlrlflx.exe 90 PID 456 wrote to memory of 2540 456 xlrlflx.exe 90 PID 456 wrote to memory of 2540 456 xlrlflx.exe 90 PID 2540 wrote to memory of 364 2540 jvvjj.exe 91 PID 2540 wrote to memory of 364 2540 jvvjj.exe 91 PID 2540 wrote to memory of 364 2540 jvvjj.exe 91 PID 364 wrote to memory of 4880 364 fflfrlf.exe 92 PID 364 wrote to memory of 4880 364 fflfrlf.exe 92 PID 364 wrote to memory of 4880 364 fflfrlf.exe 92 PID 4880 wrote to memory of 3104 4880 xfxfxlf.exe 93 PID 4880 wrote to memory of 3104 4880 xfxfxlf.exe 93 PID 4880 wrote to memory of 3104 4880 xfxfxlf.exe 93 PID 3104 wrote to memory of 1944 3104 9nthhh.exe 94 PID 3104 wrote to memory of 1944 3104 9nthhh.exe 94 PID 3104 wrote to memory of 1944 3104 9nthhh.exe 94 PID 1944 wrote to memory of 872 1944 7frlxxr.exe 95 PID 1944 wrote to memory of 872 1944 7frlxxr.exe 95 PID 1944 wrote to memory of 872 1944 7frlxxr.exe 95 PID 872 wrote to memory of 3904 872 nttnhb.exe 96 PID 872 wrote to memory of 3904 872 nttnhb.exe 96 PID 872 wrote to memory of 3904 872 nttnhb.exe 96 PID 3904 wrote to memory of 2112 3904 1jddv.exe 97 PID 3904 wrote to memory of 2112 3904 1jddv.exe 97 PID 3904 wrote to memory of 2112 3904 1jddv.exe 97 PID 2112 wrote to memory of 4764 2112 xlfrlxr.exe 98 PID 2112 wrote to memory of 4764 2112 xlfrlxr.exe 98 PID 2112 wrote to memory of 4764 2112 xlfrlxr.exe 98 PID 4764 wrote to memory of 4892 4764 jdpjv.exe 99 PID 4764 wrote to memory of 4892 4764 jdpjv.exe 99 PID 4764 wrote to memory of 4892 4764 jdpjv.exe 99 PID 4892 wrote to memory of 4508 4892 xflfffx.exe 100 PID 4892 wrote to memory of 4508 4892 xflfffx.exe 100 PID 4892 wrote to memory of 4508 4892 xflfffx.exe 100 PID 4508 wrote to memory of 1580 4508 7rfxrxl.exe 101 PID 4508 wrote to memory of 1580 4508 7rfxrxl.exe 101 PID 4508 wrote to memory of 1580 4508 7rfxrxl.exe 101 PID 1580 wrote to memory of 3492 1580 pvdpj.exe 102 PID 1580 wrote to memory of 3492 1580 pvdpj.exe 102 PID 1580 wrote to memory of 3492 1580 pvdpj.exe 102 PID 3492 wrote to memory of 4864 3492 fxfxflf.exe 103 PID 3492 wrote to memory of 4864 3492 fxfxflf.exe 103 PID 3492 wrote to memory of 4864 3492 fxfxflf.exe 103 PID 4864 wrote to memory of 836 4864 pvvjv.exe 104 PID 4864 wrote to memory of 836 4864 pvvjv.exe 104 PID 4864 wrote to memory of 836 4864 pvvjv.exe 104 PID 836 wrote to memory of 1640 836 vpjjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe"C:\Users\Admin\AppData\Local\Temp\2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\1vvpd.exec:\1vvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\3tthhb.exec:\3tthhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\frfxlfx.exec:\frfxlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\lflflfx.exec:\lflflfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\frrfrlx.exec:\frrfrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\xlrlflx.exec:\xlrlflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\jvvjj.exec:\jvvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\fflfrlf.exec:\fflfrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\xfxfxlf.exec:\xfxfxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\9nthhh.exec:\9nthhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\7frlxxr.exec:\7frlxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\nttnhb.exec:\nttnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\1jddv.exec:\1jddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\xlfrlxr.exec:\xlfrlxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\jdpjv.exec:\jdpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\xflfffx.exec:\xflfffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\7rfxrxl.exec:\7rfxrxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\pvdpj.exec:\pvdpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\fxfxflf.exec:\fxfxflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\pvvjv.exec:\pvvjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\vpjjd.exec:\vpjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\1hhthb.exec:\1hhthb.exe23⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pvvpd.exec:\pvvpd.exe24⤵
- Executes dropped EXE
PID:2068 -
\??\c:\3jdpd.exec:\3jdpd.exe25⤵
- Executes dropped EXE
PID:916 -
\??\c:\7fxlxlf.exec:\7fxlxlf.exe26⤵
- Executes dropped EXE
PID:3112 -
\??\c:\1tnbhb.exec:\1tnbhb.exe27⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7llxllx.exec:\7llxllx.exe28⤵
- Executes dropped EXE
PID:5100 -
\??\c:\tbbnbt.exec:\tbbnbt.exe29⤵
- Executes dropped EXE
PID:3076 -
\??\c:\pdpdp.exec:\pdpdp.exe30⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ntthtn.exec:\ntthtn.exe31⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xrxrrlf.exec:\xrxrrlf.exe32⤵
- Executes dropped EXE
PID:4716 -
\??\c:\vpjdp.exec:\vpjdp.exe33⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nhtntn.exec:\nhtntn.exe34⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vdppp.exec:\vdppp.exe35⤵
- Executes dropped EXE
PID:3664 -
\??\c:\ffrfxxr.exec:\ffrfxxr.exe36⤵
- Executes dropped EXE
PID:4000 -
\??\c:\tntntn.exec:\tntntn.exe37⤵
- Executes dropped EXE
PID:4800 -
\??\c:\3thbnn.exec:\3thbnn.exe38⤵
- Executes dropped EXE
PID:3220 -
\??\c:\pdjpd.exec:\pdjpd.exe39⤵
- Executes dropped EXE
PID:3644 -
\??\c:\5rrfrlr.exec:\5rrfrlr.exe40⤵
- Executes dropped EXE
PID:3508 -
\??\c:\btbttt.exec:\btbttt.exe41⤵
- Executes dropped EXE
PID:60 -
\??\c:\vppdp.exec:\vppdp.exe42⤵
- Executes dropped EXE
PID:3680 -
\??\c:\pddjd.exec:\pddjd.exe43⤵
- Executes dropped EXE
PID:4368 -
\??\c:\lxxllfl.exec:\lxxllfl.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hththh.exec:\hththh.exe45⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jdvpj.exec:\jdvpj.exe46⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vppjv.exec:\vppjv.exe47⤵
- Executes dropped EXE
PID:4372 -
\??\c:\fxrlffx.exec:\fxrlffx.exe48⤵
- Executes dropped EXE
PID:4360 -
\??\c:\btbbhh.exec:\btbbhh.exe49⤵
- Executes dropped EXE
PID:4912 -
\??\c:\pddvj.exec:\pddvj.exe50⤵
- Executes dropped EXE
PID:4100 -
\??\c:\djjvp.exec:\djjvp.exe51⤵
- Executes dropped EXE
PID:4496 -
\??\c:\xrlffff.exec:\xrlffff.exe52⤵
- Executes dropped EXE
PID:4144 -
\??\c:\tnnbtn.exec:\tnnbtn.exe53⤵
- Executes dropped EXE
PID:3768 -
\??\c:\vjjdp.exec:\vjjdp.exe54⤵
- Executes dropped EXE
PID:4768 -
\??\c:\1xxrllf.exec:\1xxrllf.exe55⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7nbtnh.exec:\7nbtnh.exe56⤵
- Executes dropped EXE
PID:3212 -
\??\c:\dvdvv.exec:\dvdvv.exe57⤵
- Executes dropped EXE
PID:4808 -
\??\c:\rxxrlll.exec:\rxxrlll.exe58⤵
- Executes dropped EXE
PID:3688 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe59⤵
- Executes dropped EXE
PID:4812 -
\??\c:\thnbtn.exec:\thnbtn.exe60⤵
- Executes dropped EXE
PID:232 -
\??\c:\nhbthb.exec:\nhbthb.exe61⤵
- Executes dropped EXE
PID:4084 -
\??\c:\ddjjd.exec:\ddjjd.exe62⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ffrlrrx.exec:\ffrlrrx.exe63⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dpdpv.exec:\dpdpv.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\frrrlff.exec:\frrrlff.exe65⤵
- Executes dropped EXE
PID:100 -
\??\c:\rllfxrl.exec:\rllfxrl.exe66⤵PID:4168
-
\??\c:\htthth.exec:\htthth.exe67⤵PID:4296
-
\??\c:\djpjd.exec:\djpjd.exe68⤵PID:3712
-
\??\c:\rrrllff.exec:\rrrllff.exe69⤵PID:4804
-
\??\c:\nnnhtt.exec:\nnnhtt.exe70⤵PID:2640
-
\??\c:\vjpjd.exec:\vjpjd.exe71⤵PID:4844
-
\??\c:\rrrlxrl.exec:\rrrlxrl.exe72⤵PID:4516
-
\??\c:\5bbtnn.exec:\5bbtnn.exe73⤵
- System Location Discovery: System Language Discovery
PID:4972 -
\??\c:\pddvv.exec:\pddvv.exe74⤵PID:3900
-
\??\c:\3rrlfxx.exec:\3rrlfxx.exe75⤵PID:1560
-
\??\c:\hbhbbb.exec:\hbhbbb.exe76⤵PID:1492
-
\??\c:\jpvpd.exec:\jpvpd.exe77⤵PID:4864
-
\??\c:\pjdvj.exec:\pjdvj.exe78⤵PID:3776
-
\??\c:\llrfrlf.exec:\llrfrlf.exe79⤵PID:3976
-
\??\c:\bhnhbt.exec:\bhnhbt.exe80⤵PID:1604
-
\??\c:\7hbnhb.exec:\7hbnhb.exe81⤵PID:2068
-
\??\c:\3jpdd.exec:\3jpdd.exe82⤵PID:4008
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe83⤵PID:2428
-
\??\c:\htbnbt.exec:\htbnbt.exe84⤵PID:3496
-
\??\c:\jvvpd.exec:\jvvpd.exe85⤵PID:1400
-
\??\c:\lxfrllf.exec:\lxfrllf.exe86⤵PID:1804
-
\??\c:\bbnbhb.exec:\bbnbhb.exe87⤵PID:3076
-
\??\c:\bnbtnt.exec:\bnbtnt.exe88⤵PID:3756
-
\??\c:\pddvj.exec:\pddvj.exe89⤵PID:1692
-
\??\c:\rffxrlf.exec:\rffxrlf.exe90⤵PID:4400
-
\??\c:\btnbtn.exec:\btnbtn.exe91⤵PID:2840
-
\??\c:\9vpdp.exec:\9vpdp.exe92⤵PID:2164
-
\??\c:\xrllfxr.exec:\xrllfxr.exe93⤵PID:4868
-
\??\c:\fxrlrll.exec:\fxrlrll.exe94⤵PID:2392
-
\??\c:\htbnbt.exec:\htbnbt.exe95⤵PID:4896
-
\??\c:\vjppd.exec:\vjppd.exe96⤵PID:4560
-
\??\c:\xffrfxl.exec:\xffrfxl.exe97⤵PID:1368
-
\??\c:\fxrlflf.exec:\fxrlflf.exe98⤵PID:1660
-
\??\c:\jppjd.exec:\jppjd.exe99⤵PID:416
-
\??\c:\rxffrrf.exec:\rxffrrf.exe100⤵PID:1148
-
\??\c:\flrfxrl.exec:\flrfxrl.exe101⤵PID:2276
-
\??\c:\nhbbbb.exec:\nhbbbb.exe102⤵PID:1516
-
\??\c:\pvdjv.exec:\pvdjv.exe103⤵PID:4280
-
\??\c:\vpvpp.exec:\vpvpp.exe104⤵PID:3500
-
\??\c:\7xrfxxx.exec:\7xrfxxx.exe105⤵PID:3600
-
\??\c:\httnhh.exec:\httnhh.exe106⤵PID:4420
-
\??\c:\ttbhnt.exec:\ttbhnt.exe107⤵PID:3952
-
\??\c:\vvdvp.exec:\vvdvp.exe108⤵PID:5056
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe109⤵PID:408
-
\??\c:\nbnhtt.exec:\nbnhtt.exe110⤵PID:2328
-
\??\c:\thnbtt.exec:\thnbtt.exe111⤵PID:2248
-
\??\c:\3jvdv.exec:\3jvdv.exe112⤵PID:3048
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe113⤵PID:4640
-
\??\c:\xrfxffr.exec:\xrfxffr.exe114⤵PID:2376
-
\??\c:\bbhbtt.exec:\bbhbtt.exe115⤵
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\jdpjv.exec:\jdpjv.exe116⤵PID:3212
-
\??\c:\xllxlfx.exec:\xllxlfx.exe117⤵PID:3816
-
\??\c:\1rrlffx.exec:\1rrlffx.exe118⤵PID:1304
-
\??\c:\hbbtnn.exec:\hbbtnn.exe119⤵PID:4812
-
\??\c:\vvddj.exec:\vvddj.exe120⤵PID:232
-
\??\c:\7xfrffr.exec:\7xfrffr.exe121⤵PID:644
-
\??\c:\nhhthb.exec:\nhhthb.exe122⤵PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-