Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9249381bfaa8f8856f06388a8db14234512558c9a0030a1caf4c56b091b7e306N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9249381bfaa8f8856f06388a8db14234512558c9a0030a1caf4c56b091b7e306N.exe
-
Size
453KB
-
MD5
b8d68ab533baaaef268c8a983ddf6850
-
SHA1
a9aa1b9abc23e23c59da8c52b4ca3b8376eab8aa
-
SHA256
9249381bfaa8f8856f06388a8db14234512558c9a0030a1caf4c56b091b7e306
-
SHA512
5a5c5fdbbb0af209641777c7c46b9c5efa506b12051d811122eb036579bf0f4ce957403aa2efe37085abfd9cb4a1624197c14248feb038ece82d255bbdca56e8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4524-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-1361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-1573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-1801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4920 826048.exe 2888 228820.exe 3360 vvvpj.exe 4032 xlxfrfr.exe 2424 htttnn.exe 4340 008464.exe 1144 044488.exe 2948 82260.exe 4084 88000.exe 2472 frllffx.exe 1652 s0606.exe 3656 dppvp.exe 4732 s2460.exe 4716 9pppd.exe 2896 3ntntt.exe 404 hbthtn.exe 4132 nhhbth.exe 3664 xrxrrxr.exe 4948 thhhbb.exe 2536 dvpjj.exe 5056 444804.exe 3960 4404220.exe 3704 rxlxrlf.exe 4660 fffrllx.exe 4556 xlxllff.exe 4176 nhtnbt.exe 1540 284604.exe 4584 82826.exe 3692 284264.exe 4816 fxlfllr.exe 4440 82884.exe 1972 s0648.exe 1616 66660.exe 2672 60060.exe 3108 i626048.exe 1932 2604482.exe 4456 fxfxrrl.exe 4520 e24826.exe 4872 xffxrll.exe 3164 lxfxrll.exe 1200 djvjd.exe 3036 086884.exe 1720 ppdvv.exe 544 88684.exe 2808 fxxrrlf.exe 2800 1vdvp.exe 1872 00222.exe 4428 ppdvp.exe 3332 ppvjp.exe 1244 2622262.exe 4920 jddvd.exe 2848 s8484.exe 2796 fffxrlx.exe 2632 1jvpp.exe 3616 224444.exe 2816 006004.exe 4576 80844.exe 3056 42000.exe 1196 tbtbtt.exe 2224 lrr0226.exe 4844 0202008.exe 1180 u882882.exe 1656 pjddv.exe 2472 426488.exe -
resource yara_rule behavioral2/memory/4524-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-731-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 206020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28860.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8800488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0408226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60646.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 484226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6048004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 406088.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rllffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6664860.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 868682.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48064.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 4920 4524 9249381bfaa8f8856f06388a8db14234512558c9a0030a1caf4c56b091b7e306N.exe 83 PID 4524 wrote to memory of 4920 4524 9249381bfaa8f8856f06388a8db14234512558c9a0030a1caf4c56b091b7e306N.exe 83 PID 4524 wrote to memory of 4920 4524 9249381bfaa8f8856f06388a8db14234512558c9a0030a1caf4c56b091b7e306N.exe 83 PID 4920 wrote to memory of 2888 4920 826048.exe 84 PID 4920 wrote to memory of 2888 4920 826048.exe 84 PID 4920 wrote to memory of 2888 4920 826048.exe 84 PID 2888 wrote to memory of 3360 2888 228820.exe 85 PID 2888 wrote to memory of 3360 2888 228820.exe 85 PID 2888 wrote to memory of 3360 2888 228820.exe 85 PID 3360 wrote to memory of 4032 3360 vvvpj.exe 86 PID 3360 wrote to memory of 4032 3360 vvvpj.exe 86 PID 3360 wrote to memory of 4032 3360 vvvpj.exe 86 PID 4032 wrote to memory of 2424 4032 xlxfrfr.exe 87 PID 4032 wrote to memory of 2424 4032 xlxfrfr.exe 87 PID 4032 wrote to memory of 2424 4032 xlxfrfr.exe 87 PID 2424 wrote to memory of 4340 2424 htttnn.exe 88 PID 2424 wrote to memory of 4340 2424 htttnn.exe 88 PID 2424 wrote to memory of 4340 2424 htttnn.exe 88 PID 4340 wrote to memory of 1144 4340 008464.exe 89 PID 4340 wrote to memory of 1144 4340 008464.exe 89 PID 4340 wrote to memory of 1144 4340 008464.exe 89 PID 1144 wrote to memory of 2948 1144 044488.exe 90 PID 1144 wrote to memory of 2948 1144 044488.exe 90 PID 1144 wrote to memory of 2948 1144 044488.exe 90 PID 2948 wrote to memory of 4084 2948 82260.exe 91 PID 2948 wrote to memory of 4084 2948 82260.exe 91 PID 2948 wrote to memory of 4084 2948 82260.exe 91 PID 4084 wrote to memory of 2472 4084 88000.exe 92 PID 4084 wrote to memory of 2472 4084 88000.exe 92 PID 4084 wrote to memory of 2472 4084 88000.exe 92 PID 2472 wrote to memory of 1652 2472 frllffx.exe 93 PID 2472 wrote to memory of 1652 2472 frllffx.exe 93 PID 2472 wrote to memory of 1652 2472 frllffx.exe 93 PID 1652 wrote to memory of 3656 1652 s0606.exe 94 PID 1652 wrote to memory of 3656 1652 s0606.exe 94 PID 1652 wrote to memory of 3656 1652 s0606.exe 94 PID 3656 wrote to memory of 4732 3656 dppvp.exe 95 PID 3656 wrote to memory of 4732 3656 dppvp.exe 95 PID 3656 wrote to memory of 4732 3656 dppvp.exe 95 PID 4732 wrote to memory of 4716 4732 s2460.exe 96 PID 4732 wrote to memory of 4716 4732 s2460.exe 96 PID 4732 wrote to memory of 4716 4732 s2460.exe 96 PID 4716 wrote to memory of 2896 4716 9pppd.exe 97 PID 4716 wrote to memory of 2896 4716 9pppd.exe 97 PID 4716 wrote to memory of 2896 4716 9pppd.exe 97 PID 2896 wrote to memory of 404 2896 3ntntt.exe 98 PID 2896 wrote to memory of 404 2896 3ntntt.exe 98 PID 2896 wrote to memory of 404 2896 3ntntt.exe 98 PID 404 wrote to memory of 4132 404 hbthtn.exe 99 PID 404 wrote to memory of 4132 404 hbthtn.exe 99 PID 404 wrote to memory of 4132 404 hbthtn.exe 99 PID 4132 wrote to memory of 3664 4132 nhhbth.exe 100 PID 4132 wrote to memory of 3664 4132 nhhbth.exe 100 PID 4132 wrote to memory of 3664 4132 nhhbth.exe 100 PID 3664 wrote to memory of 4948 3664 xrxrrxr.exe 101 PID 3664 wrote to memory of 4948 3664 xrxrrxr.exe 101 PID 3664 wrote to memory of 4948 3664 xrxrrxr.exe 101 PID 4948 wrote to memory of 2536 4948 thhhbb.exe 102 PID 4948 wrote to memory of 2536 4948 thhhbb.exe 102 PID 4948 wrote to memory of 2536 4948 thhhbb.exe 102 PID 2536 wrote to memory of 5056 2536 dvpjj.exe 103 PID 2536 wrote to memory of 5056 2536 dvpjj.exe 103 PID 2536 wrote to memory of 5056 2536 dvpjj.exe 103 PID 5056 wrote to memory of 3960 5056 444804.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9249381bfaa8f8856f06388a8db14234512558c9a0030a1caf4c56b091b7e306N.exe"C:\Users\Admin\AppData\Local\Temp\9249381bfaa8f8856f06388a8db14234512558c9a0030a1caf4c56b091b7e306N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\826048.exec:\826048.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\228820.exec:\228820.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vvvpj.exec:\vvvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\xlxfrfr.exec:\xlxfrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\htttnn.exec:\htttnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\008464.exec:\008464.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\044488.exec:\044488.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\82260.exec:\82260.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\88000.exec:\88000.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\frllffx.exec:\frllffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\s0606.exec:\s0606.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\dppvp.exec:\dppvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\s2460.exec:\s2460.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\9pppd.exec:\9pppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\3ntntt.exec:\3ntntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hbthtn.exec:\hbthtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\nhhbth.exec:\nhhbth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\xrxrrxr.exec:\xrxrrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\thhhbb.exec:\thhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\dvpjj.exec:\dvpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\444804.exec:\444804.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\4404220.exec:\4404220.exe23⤵
- Executes dropped EXE
PID:3960 -
\??\c:\rxlxrlf.exec:\rxlxrlf.exe24⤵
- Executes dropped EXE
PID:3704 -
\??\c:\fffrllx.exec:\fffrllx.exe25⤵
- Executes dropped EXE
PID:4660 -
\??\c:\xlxllff.exec:\xlxllff.exe26⤵
- Executes dropped EXE
PID:4556 -
\??\c:\nhtnbt.exec:\nhtnbt.exe27⤵
- Executes dropped EXE
PID:4176 -
\??\c:\284604.exec:\284604.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\82826.exec:\82826.exe29⤵
- Executes dropped EXE
PID:4584 -
\??\c:\284264.exec:\284264.exe30⤵
- Executes dropped EXE
PID:3692 -
\??\c:\fxlfllr.exec:\fxlfllr.exe31⤵
- Executes dropped EXE
PID:4816 -
\??\c:\82884.exec:\82884.exe32⤵
- Executes dropped EXE
PID:4440 -
\??\c:\s0648.exec:\s0648.exe33⤵
- Executes dropped EXE
PID:1972 -
\??\c:\66660.exec:\66660.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\60060.exec:\60060.exe35⤵
- Executes dropped EXE
PID:2672 -
\??\c:\i626048.exec:\i626048.exe36⤵
- Executes dropped EXE
PID:3108 -
\??\c:\2604482.exec:\2604482.exe37⤵
- Executes dropped EXE
PID:1932 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe38⤵
- Executes dropped EXE
PID:4456 -
\??\c:\e24826.exec:\e24826.exe39⤵
- Executes dropped EXE
PID:4520 -
\??\c:\xffxrll.exec:\xffxrll.exe40⤵
- Executes dropped EXE
PID:4872 -
\??\c:\lxfxrll.exec:\lxfxrll.exe41⤵
- Executes dropped EXE
PID:3164 -
\??\c:\djvjd.exec:\djvjd.exe42⤵
- Executes dropped EXE
PID:1200 -
\??\c:\086884.exec:\086884.exe43⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ppdvv.exec:\ppdvv.exe44⤵
- Executes dropped EXE
PID:1720 -
\??\c:\88684.exec:\88684.exe45⤵
- Executes dropped EXE
PID:544 -
\??\c:\fxxrrlf.exec:\fxxrrlf.exe46⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1vdvp.exec:\1vdvp.exe47⤵
- Executes dropped EXE
PID:2800 -
\??\c:\00222.exec:\00222.exe48⤵
- Executes dropped EXE
PID:1872 -
\??\c:\ppdvp.exec:\ppdvp.exe49⤵
- Executes dropped EXE
PID:4428 -
\??\c:\ppvjp.exec:\ppvjp.exe50⤵
- Executes dropped EXE
PID:3332 -
\??\c:\2622262.exec:\2622262.exe51⤵
- Executes dropped EXE
PID:1244 -
\??\c:\jddvd.exec:\jddvd.exe52⤵
- Executes dropped EXE
PID:4920 -
\??\c:\s8484.exec:\s8484.exe53⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fffxrlx.exec:\fffxrlx.exe54⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1jvpp.exec:\1jvpp.exe55⤵
- Executes dropped EXE
PID:2632 -
\??\c:\224444.exec:\224444.exe56⤵
- Executes dropped EXE
PID:3616 -
\??\c:\006004.exec:\006004.exe57⤵
- Executes dropped EXE
PID:2816 -
\??\c:\80844.exec:\80844.exe58⤵
- Executes dropped EXE
PID:4576 -
\??\c:\42000.exec:\42000.exe59⤵
- Executes dropped EXE
PID:3056 -
\??\c:\tbtbtt.exec:\tbtbtt.exe60⤵
- Executes dropped EXE
PID:1196 -
\??\c:\lrr0226.exec:\lrr0226.exe61⤵
- Executes dropped EXE
PID:2224 -
\??\c:\0202008.exec:\0202008.exe62⤵
- Executes dropped EXE
PID:4844 -
\??\c:\u882882.exec:\u882882.exe63⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pjddv.exec:\pjddv.exe64⤵
- Executes dropped EXE
PID:1656 -
\??\c:\426488.exec:\426488.exe65⤵
- Executes dropped EXE
PID:2472 -
\??\c:\k22666.exec:\k22666.exe66⤵PID:2160
-
\??\c:\6660482.exec:\6660482.exe67⤵PID:5060
-
\??\c:\6266660.exec:\6266660.exe68⤵PID:744
-
\??\c:\jpvpp.exec:\jpvpp.exe69⤵PID:376
-
\??\c:\9ffxxxx.exec:\9ffxxxx.exe70⤵PID:3716
-
\??\c:\24044.exec:\24044.exe71⤵PID:2164
-
\??\c:\1hhhhh.exec:\1hhhhh.exe72⤵PID:2528
-
\??\c:\844202.exec:\844202.exe73⤵PID:4544
-
\??\c:\3pdpd.exec:\3pdpd.exe74⤵PID:404
-
\??\c:\84864.exec:\84864.exe75⤵PID:2448
-
\??\c:\llxrfxl.exec:\llxrfxl.exe76⤵PID:5088
-
\??\c:\2288226.exec:\2288226.exe77⤵PID:3120
-
\??\c:\08486.exec:\08486.exe78⤵PID:4380
-
\??\c:\6248260.exec:\6248260.exe79⤵PID:3272
-
\??\c:\5frfrlx.exec:\5frfrlx.exe80⤵PID:5036
-
\??\c:\8424826.exec:\8424826.exe81⤵PID:5056
-
\??\c:\662648.exec:\662648.exe82⤵PID:2812
-
\??\c:\tntnbb.exec:\tntnbb.exe83⤵PID:2112
-
\??\c:\w68200.exec:\w68200.exe84⤵PID:1532
-
\??\c:\062088.exec:\062088.exe85⤵PID:3576
-
\??\c:\44048.exec:\44048.exe86⤵PID:2180
-
\??\c:\2868668.exec:\2868668.exe87⤵PID:940
-
\??\c:\62000.exec:\62000.exe88⤵PID:4552
-
\??\c:\5nhhbh.exec:\5nhhbh.exe89⤵
- System Location Discovery: System Language Discovery
PID:3552 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe90⤵PID:928
-
\??\c:\rfxrlxr.exec:\rfxrlxr.exe91⤵PID:3692
-
\??\c:\hnthtn.exec:\hnthtn.exe92⤵PID:1636
-
\??\c:\q02486.exec:\q02486.exe93⤵PID:4160
-
\??\c:\nbnhhh.exec:\nbnhhh.exe94⤵PID:416
-
\??\c:\vpvjd.exec:\vpvjd.exe95⤵PID:2044
-
\??\c:\fffrlxr.exec:\fffrlxr.exe96⤵PID:1960
-
\??\c:\8660860.exec:\8660860.exe97⤵PID:4480
-
\??\c:\86668.exec:\86668.exe98⤵PID:2040
-
\??\c:\4264264.exec:\4264264.exe99⤵PID:3964
-
\??\c:\4048660.exec:\4048660.exe100⤵PID:4452
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe101⤵PID:3676
-
\??\c:\lllxlfx.exec:\lllxlfx.exe102⤵PID:4520
-
\??\c:\rrxxrlx.exec:\rrxxrlx.exe103⤵PID:4488
-
\??\c:\042682.exec:\042682.exe104⤵PID:3000
-
\??\c:\ttttnt.exec:\ttttnt.exe105⤵PID:4980
-
\??\c:\ddjvj.exec:\ddjvj.exe106⤵PID:1156
-
\??\c:\0068620.exec:\0068620.exe107⤵PID:960
-
\??\c:\hnnbhb.exec:\hnnbhb.exe108⤵PID:3096
-
\??\c:\826600.exec:\826600.exe109⤵PID:4944
-
\??\c:\jjjvj.exec:\jjjvj.exe110⤵PID:1400
-
\??\c:\2448226.exec:\2448226.exe111⤵PID:4424
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe112⤵PID:1520
-
\??\c:\llxrrrl.exec:\llxrrrl.exe113⤵PID:1744
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe114⤵PID:460
-
\??\c:\5lxrffr.exec:\5lxrffr.exe115⤵PID:380
-
\??\c:\9vvpj.exec:\9vvpj.exe116⤵PID:1968
-
\??\c:\vdjdv.exec:\vdjdv.exe117⤵PID:3968
-
\??\c:\bbhhbh.exec:\bbhhbh.exe118⤵PID:4032
-
\??\c:\xrrxfxl.exec:\xrrxfxl.exe119⤵PID:1780
-
\??\c:\680000.exec:\680000.exe120⤵PID:4080
-
\??\c:\9jvvv.exec:\9jvvv.exe121⤵PID:1748
-
\??\c:\0026228.exec:\0026228.exe122⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-