Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe
-
Size
452KB
-
MD5
8a6602ec10ed9cfb6af6a56271242100
-
SHA1
f57d7cccb3f2a7f54b5632059f322b60ee43ee6e
-
SHA256
ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0
-
SHA512
5c78b34777afd24861b2223267efd6c26ec2c7347b123c49edbbdd0bf096c538247af0fbefbb06a74ee6af1df3097b0d034a79fc5992ea8d559331a38f2c1cb5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1188-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-1250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2344 bnnhtt.exe 456 dvdpv.exe 3648 llfxxll.exe 3224 fxlflfx.exe 3488 vjjdv.exe 3668 rrrfrfx.exe 1556 xxflrlr.exe 3092 rxffxrx.exe 5108 hbbttt.exe 3328 vpvpp.exe 4572 tnbttb.exe 4388 3tnhhn.exe 1264 tnhnhb.exe 3472 nnnhhh.exe 776 dpdvp.exe 4444 ffxxrrr.exe 3040 nbhbtn.exe 3820 vjpjd.exe 1452 ntttnn.exe 3812 pddvj.exe 1156 pjjdj.exe 4700 lfxxlxf.exe 532 rlllffx.exe 732 pvjjp.exe 3148 thbthb.exe 1424 djjdv.exe 3504 jdjdv.exe 2824 5nbbnh.exe 3184 hhhtnb.exe 2204 rrrfxrl.exe 1084 1ddjd.exe 4480 5tnbnh.exe 4804 ntthbt.exe 3204 jdddv.exe 1624 5flfrrf.exe 2012 nbbtnh.exe 3064 lffxrrx.exe 1040 hnnnhb.exe 1668 vpvpv.exe 3492 1rllflf.exe 4048 ttbtbb.exe 3136 jjjpj.exe 3616 xxxllff.exe 4344 nhhbbt.exe 2088 jjdvp.exe 1060 tbtnhh.exe 3024 vpjdp.exe 2020 fflfrrl.exe 2972 lfxrrlf.exe 1188 tthbtt.exe 1952 jdjdd.exe 2244 fflfrrf.exe 3648 bthbtn.exe 1564 vvjjj.exe 4996 xfxrfrl.exe 3224 3xrxrfx.exe 3020 bbbtnn.exe 4640 jjddd.exe 2096 9xrrffx.exe 440 thnhbn.exe 4320 hbbttt.exe 2912 vvpjj.exe 3092 lfflfxr.exe 628 nbbnhn.exe -
resource yara_rule behavioral2/memory/1188-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-693-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1188 wrote to memory of 2344 1188 ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe 83 PID 1188 wrote to memory of 2344 1188 ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe 83 PID 1188 wrote to memory of 2344 1188 ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe 83 PID 2344 wrote to memory of 456 2344 bnnhtt.exe 84 PID 2344 wrote to memory of 456 2344 bnnhtt.exe 84 PID 2344 wrote to memory of 456 2344 bnnhtt.exe 84 PID 456 wrote to memory of 3648 456 dvdpv.exe 85 PID 456 wrote to memory of 3648 456 dvdpv.exe 85 PID 456 wrote to memory of 3648 456 dvdpv.exe 85 PID 3648 wrote to memory of 3224 3648 llfxxll.exe 86 PID 3648 wrote to memory of 3224 3648 llfxxll.exe 86 PID 3648 wrote to memory of 3224 3648 llfxxll.exe 86 PID 3224 wrote to memory of 3488 3224 fxlflfx.exe 87 PID 3224 wrote to memory of 3488 3224 fxlflfx.exe 87 PID 3224 wrote to memory of 3488 3224 fxlflfx.exe 87 PID 3488 wrote to memory of 3668 3488 vjjdv.exe 88 PID 3488 wrote to memory of 3668 3488 vjjdv.exe 88 PID 3488 wrote to memory of 3668 3488 vjjdv.exe 88 PID 3668 wrote to memory of 1556 3668 rrrfrfx.exe 89 PID 3668 wrote to memory of 1556 3668 rrrfrfx.exe 89 PID 3668 wrote to memory of 1556 3668 rrrfrfx.exe 89 PID 1556 wrote to memory of 3092 1556 xxflrlr.exe 90 PID 1556 wrote to memory of 3092 1556 xxflrlr.exe 90 PID 1556 wrote to memory of 3092 1556 xxflrlr.exe 90 PID 3092 wrote to memory of 5108 3092 rxffxrx.exe 91 PID 3092 wrote to memory of 5108 3092 rxffxrx.exe 91 PID 3092 wrote to memory of 5108 3092 rxffxrx.exe 91 PID 5108 wrote to memory of 3328 5108 hbbttt.exe 92 PID 5108 wrote to memory of 3328 5108 hbbttt.exe 92 PID 5108 wrote to memory of 3328 5108 hbbttt.exe 92 PID 3328 wrote to memory of 4572 3328 vpvpp.exe 93 PID 3328 wrote to memory of 4572 3328 vpvpp.exe 93 PID 3328 wrote to memory of 4572 3328 vpvpp.exe 93 PID 4572 wrote to memory of 4388 4572 tnbttb.exe 94 PID 4572 wrote to memory of 4388 4572 tnbttb.exe 94 PID 4572 wrote to memory of 4388 4572 tnbttb.exe 94 PID 4388 wrote to memory of 1264 4388 3tnhhn.exe 95 PID 4388 wrote to memory of 1264 4388 3tnhhn.exe 95 PID 4388 wrote to memory of 1264 4388 3tnhhn.exe 95 PID 1264 wrote to memory of 3472 1264 tnhnhb.exe 96 PID 1264 wrote to memory of 3472 1264 tnhnhb.exe 96 PID 1264 wrote to memory of 3472 1264 tnhnhb.exe 96 PID 3472 wrote to memory of 776 3472 nnnhhh.exe 97 PID 3472 wrote to memory of 776 3472 nnnhhh.exe 97 PID 3472 wrote to memory of 776 3472 nnnhhh.exe 97 PID 776 wrote to memory of 4444 776 dpdvp.exe 98 PID 776 wrote to memory of 4444 776 dpdvp.exe 98 PID 776 wrote to memory of 4444 776 dpdvp.exe 98 PID 4444 wrote to memory of 3040 4444 ffxxrrr.exe 99 PID 4444 wrote to memory of 3040 4444 ffxxrrr.exe 99 PID 4444 wrote to memory of 3040 4444 ffxxrrr.exe 99 PID 3040 wrote to memory of 3820 3040 nbhbtn.exe 100 PID 3040 wrote to memory of 3820 3040 nbhbtn.exe 100 PID 3040 wrote to memory of 3820 3040 nbhbtn.exe 100 PID 3820 wrote to memory of 1452 3820 vjpjd.exe 101 PID 3820 wrote to memory of 1452 3820 vjpjd.exe 101 PID 3820 wrote to memory of 1452 3820 vjpjd.exe 101 PID 1452 wrote to memory of 3812 1452 ntttnn.exe 102 PID 1452 wrote to memory of 3812 1452 ntttnn.exe 102 PID 1452 wrote to memory of 3812 1452 ntttnn.exe 102 PID 3812 wrote to memory of 1156 3812 pddvj.exe 103 PID 3812 wrote to memory of 1156 3812 pddvj.exe 103 PID 3812 wrote to memory of 1156 3812 pddvj.exe 103 PID 1156 wrote to memory of 4700 1156 pjjdj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe"C:\Users\Admin\AppData\Local\Temp\ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\bnnhtt.exec:\bnnhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\dvdpv.exec:\dvdpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\llfxxll.exec:\llfxxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\fxlflfx.exec:\fxlflfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\vjjdv.exec:\vjjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\rrrfrfx.exec:\rrrfrfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\xxflrlr.exec:\xxflrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\rxffxrx.exec:\rxffxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\hbbttt.exec:\hbbttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\vpvpp.exec:\vpvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\tnbttb.exec:\tnbttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\3tnhhn.exec:\3tnhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\tnhnhb.exec:\tnhnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\nnnhhh.exec:\nnnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\dpdvp.exec:\dpdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\nbhbtn.exec:\nbhbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\vjpjd.exec:\vjpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\ntttnn.exec:\ntttnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\pddvj.exec:\pddvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\pjjdj.exec:\pjjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\lfxxlxf.exec:\lfxxlxf.exe23⤵
- Executes dropped EXE
PID:4700 -
\??\c:\rlllffx.exec:\rlllffx.exe24⤵
- Executes dropped EXE
PID:532 -
\??\c:\pvjjp.exec:\pvjjp.exe25⤵
- Executes dropped EXE
PID:732 -
\??\c:\thbthb.exec:\thbthb.exe26⤵
- Executes dropped EXE
PID:3148 -
\??\c:\djjdv.exec:\djjdv.exe27⤵
- Executes dropped EXE
PID:1424 -
\??\c:\jdjdv.exec:\jdjdv.exe28⤵
- Executes dropped EXE
PID:3504 -
\??\c:\5nbbnh.exec:\5nbbnh.exe29⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hhhtnb.exec:\hhhtnb.exe30⤵
- Executes dropped EXE
PID:3184 -
\??\c:\rrrfxrl.exec:\rrrfxrl.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1ddjd.exec:\1ddjd.exe32⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5tnbnh.exec:\5tnbnh.exe33⤵
- Executes dropped EXE
PID:4480 -
\??\c:\ntthbt.exec:\ntthbt.exe34⤵
- Executes dropped EXE
PID:4804 -
\??\c:\jdddv.exec:\jdddv.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3204 -
\??\c:\5flfrrf.exec:\5flfrrf.exe36⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nbbtnh.exec:\nbbtnh.exe37⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lffxrrx.exec:\lffxrrx.exe38⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hnnnhb.exec:\hnnnhb.exe39⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vpvpv.exec:\vpvpv.exe40⤵
- Executes dropped EXE
PID:1668 -
\??\c:\1rllflf.exec:\1rllflf.exe41⤵
- Executes dropped EXE
PID:3492 -
\??\c:\ttbtbb.exec:\ttbtbb.exe42⤵
- Executes dropped EXE
PID:4048 -
\??\c:\jjjpj.exec:\jjjpj.exe43⤵
- Executes dropped EXE
PID:3136 -
\??\c:\xxxllff.exec:\xxxllff.exe44⤵
- Executes dropped EXE
PID:3616 -
\??\c:\nhhbbt.exec:\nhhbbt.exe45⤵
- Executes dropped EXE
PID:4344 -
\??\c:\jjdvp.exec:\jjdvp.exe46⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tbtnhh.exec:\tbtnhh.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1060 -
\??\c:\vpjdp.exec:\vpjdp.exe48⤵
- Executes dropped EXE
PID:3024 -
\??\c:\fflfrrl.exec:\fflfrrl.exe49⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lfxrrlf.exec:\lfxrrlf.exe50⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tthbtt.exec:\tthbtt.exe51⤵
- Executes dropped EXE
PID:1188 -
\??\c:\jdjdd.exec:\jdjdd.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\fflfrrf.exec:\fflfrrf.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2244 -
\??\c:\bthbtn.exec:\bthbtn.exe54⤵
- Executes dropped EXE
PID:3648 -
\??\c:\vvjjj.exec:\vvjjj.exe55⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xfxrfrl.exec:\xfxrfrl.exe56⤵
- Executes dropped EXE
PID:4996 -
\??\c:\3xrxrfx.exec:\3xrxrfx.exe57⤵
- Executes dropped EXE
PID:3224 -
\??\c:\bbbtnn.exec:\bbbtnn.exe58⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jjddd.exec:\jjddd.exe59⤵
- Executes dropped EXE
PID:4640 -
\??\c:\9xrrffx.exec:\9xrrffx.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\thnhbn.exec:\thnhbn.exe61⤵
- Executes dropped EXE
PID:440 -
\??\c:\hbbttt.exec:\hbbttt.exe62⤵
- Executes dropped EXE
PID:4320 -
\??\c:\vvpjj.exec:\vvpjj.exe63⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lfflfxr.exec:\lfflfxr.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3092 -
\??\c:\nbbnhn.exec:\nbbnhn.exe65⤵
- Executes dropped EXE
PID:628 -
\??\c:\ttbnhb.exec:\ttbnhb.exe66⤵PID:3608
-
\??\c:\vpjdv.exec:\vpjdv.exe67⤵PID:4100
-
\??\c:\3rrlffx.exec:\3rrlffx.exe68⤵PID:5056
-
\??\c:\bthbht.exec:\bthbht.exe69⤵PID:1280
-
\??\c:\vpjjd.exec:\vpjjd.exe70⤵PID:2252
-
\??\c:\vjjjv.exec:\vjjjv.exe71⤵PID:3948
-
\??\c:\lffxrlf.exec:\lffxrlf.exe72⤵PID:4940
-
\??\c:\9nnhbn.exec:\9nnhbn.exe73⤵PID:2264
-
\??\c:\bhhtnn.exec:\bhhtnn.exe74⤵PID:3240
-
\??\c:\3vdvd.exec:\3vdvd.exe75⤵PID:1512
-
\??\c:\3rxlfxx.exec:\3rxlfxx.exe76⤵PID:712
-
\??\c:\btnbbt.exec:\btnbbt.exe77⤵PID:4960
-
\??\c:\vjpjd.exec:\vjpjd.exe78⤵PID:3812
-
\??\c:\lrrlrrr.exec:\lrrlrrr.exe79⤵PID:4396
-
\??\c:\hbtnhh.exec:\hbtnhh.exe80⤵PID:4924
-
\??\c:\jddvv.exec:\jddvv.exe81⤵PID:4928
-
\??\c:\1ddvj.exec:\1ddvj.exe82⤵PID:1336
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe83⤵PID:3068
-
\??\c:\1ntnhn.exec:\1ntnhn.exe84⤵PID:2644
-
\??\c:\pvvdv.exec:\pvvdv.exe85⤵
- System Location Discovery: System Language Discovery
PID:772 -
\??\c:\flxrllf.exec:\flxrllf.exe86⤵PID:4872
-
\??\c:\1bttnn.exec:\1bttnn.exe87⤵PID:1664
-
\??\c:\vdddp.exec:\vdddp.exe88⤵PID:4888
-
\??\c:\lffffxr.exec:\lffffxr.exe89⤵PID:3936
-
\??\c:\tnnhtt.exec:\tnnhtt.exe90⤵PID:5008
-
\??\c:\bbhbnt.exec:\bbhbnt.exe91⤵PID:512
-
\??\c:\pvdpj.exec:\pvdpj.exe92⤵PID:2708
-
\??\c:\xlllfff.exec:\xlllfff.exe93⤵PID:1372
-
\??\c:\thnhtt.exec:\thnhtt.exe94⤵PID:2304
-
\??\c:\jppjv.exec:\jppjv.exe95⤵PID:5112
-
\??\c:\lxxrrlr.exec:\lxxrrlr.exe96⤵PID:2784
-
\??\c:\rrlffxl.exec:\rrlffxl.exe97⤵PID:920
-
\??\c:\hbbttt.exec:\hbbttt.exe98⤵PID:5080
-
\??\c:\7dppv.exec:\7dppv.exe99⤵PID:2836
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe100⤵PID:4844
-
\??\c:\bnnbtn.exec:\bnnbtn.exe101⤵PID:2732
-
\??\c:\dpddp.exec:\dpddp.exe102⤵PID:4028
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe103⤵PID:3344
-
\??\c:\bttbtb.exec:\bttbtb.exe104⤵PID:3428
-
\??\c:\jddvp.exec:\jddvp.exe105⤵PID:4336
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe106⤵PID:4452
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe107⤵PID:2596
-
\??\c:\tnhbtt.exec:\tnhbtt.exe108⤵PID:2344
-
\??\c:\3dvjd.exec:\3dvjd.exe109⤵PID:3632
-
\??\c:\xfrfrlx.exec:\xfrfrlx.exe110⤵PID:456
-
\??\c:\5bthbt.exec:\5bthbt.exe111⤵PID:3252
-
\??\c:\3nhbtn.exec:\3nhbtn.exe112⤵PID:3508
-
\??\c:\jdpjv.exec:\jdpjv.exe113⤵PID:4472
-
\??\c:\xflfxff.exec:\xflfxff.exe114⤵PID:1728
-
\??\c:\7ntbtt.exec:\7ntbtt.exe115⤵PID:1756
-
\??\c:\ttbtnb.exec:\ttbtnb.exe116⤵PID:4384
-
\??\c:\dddpj.exec:\dddpj.exe117⤵PID:2896
-
\??\c:\rllrfrr.exec:\rllrfrr.exe118⤵PID:1900
-
\??\c:\7ttnhh.exec:\7ttnhh.exe119⤵PID:5100
-
\??\c:\tnhbnb.exec:\tnhbnb.exe120⤵PID:1104
-
\??\c:\dvpjv.exec:\dvpjv.exe121⤵PID:4272
-
\??\c:\jjpjv.exec:\jjpjv.exe122⤵
- System Location Discovery: System Language Discovery
PID:3092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-