Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe
-
Size
454KB
-
MD5
fb40289f8b0b561d943119de8d348710
-
SHA1
d174ce3006947689c7103aee59c9438c4732e5fc
-
SHA256
73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79
-
SHA512
721aa17d2a9c79bd77db8753cab4b8eaebcd7ded4c3ca86e209ba6631b08844964aa0160b1d1d9b11a5d76514e44ed848ceb90bd467d1059afe8601ad1e61fbf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4792-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/576-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/476-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-1286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-1699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2588 vdjvp.exe 2244 5hnbbb.exe 2952 5ppdv.exe 1308 7rfrfxl.exe 996 tnhthb.exe 1148 7dvpd.exe 576 htbnht.exe 4308 lrlxflr.exe 4892 pdddp.exe 1076 httthb.exe 3512 9jpjv.exe 4516 vvdpj.exe 1824 fxrlfxl.exe 4636 pdvjd.exe 2908 xrfrxxf.exe 2636 vjjvp.exe 3680 flrfrlf.exe 2384 5nnbth.exe 2308 vdjdd.exe 1640 tntntn.exe 4048 frrlfxr.exe 2940 dvdvj.exe 1480 ppvvj.exe 860 jdjdd.exe 1628 fllfrlf.exe 1708 thnbbt.exe 1584 7hbnhh.exe 4452 hhnbtn.exe 4544 fxxrfxr.exe 1168 llrfrlf.exe 3692 3nthtn.exe 4056 rllfxxr.exe 296 7htthh.exe 4108 7jpjv.exe 456 xlfffxl.exe 3320 btbtbt.exe 1240 vppdv.exe 1112 xlrfrlf.exe 2832 btnhbt.exe 1236 5bthbb.exe 3536 dppjv.exe 3620 fxfxrlf.exe 1264 btnhhn.exe 2776 nbbtnh.exe 2640 vdjdp.exe 4532 bhnhtt.exe 4732 hbhbtb.exe 3980 pddvj.exe 3876 fxlfxrr.exe 1276 lxfrffr.exe 4736 tbhbnh.exe 3368 dvvvp.exe 4408 xlflfxl.exe 3064 9lxrllx.exe 1288 nhnnhh.exe 972 7dvjd.exe 476 9ffxfxr.exe 1760 9thhbb.exe 2724 jvdvp.exe 3208 vdjdp.exe 4968 fffrffx.exe 704 tbbbtt.exe 932 djpjj.exe 2780 xxffxrl.exe -
resource yara_rule behavioral2/memory/4792-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/576-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/476-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-643-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4792 wrote to memory of 2588 4792 73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe 82 PID 4792 wrote to memory of 2588 4792 73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe 82 PID 4792 wrote to memory of 2588 4792 73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe 82 PID 2588 wrote to memory of 2244 2588 vdjvp.exe 83 PID 2588 wrote to memory of 2244 2588 vdjvp.exe 83 PID 2588 wrote to memory of 2244 2588 vdjvp.exe 83 PID 2244 wrote to memory of 2952 2244 5hnbbb.exe 84 PID 2244 wrote to memory of 2952 2244 5hnbbb.exe 84 PID 2244 wrote to memory of 2952 2244 5hnbbb.exe 84 PID 2952 wrote to memory of 1308 2952 5ppdv.exe 85 PID 2952 wrote to memory of 1308 2952 5ppdv.exe 85 PID 2952 wrote to memory of 1308 2952 5ppdv.exe 85 PID 1308 wrote to memory of 996 1308 7rfrfxl.exe 86 PID 1308 wrote to memory of 996 1308 7rfrfxl.exe 86 PID 1308 wrote to memory of 996 1308 7rfrfxl.exe 86 PID 996 wrote to memory of 1148 996 tnhthb.exe 87 PID 996 wrote to memory of 1148 996 tnhthb.exe 87 PID 996 wrote to memory of 1148 996 tnhthb.exe 87 PID 1148 wrote to memory of 576 1148 7dvpd.exe 88 PID 1148 wrote to memory of 576 1148 7dvpd.exe 88 PID 1148 wrote to memory of 576 1148 7dvpd.exe 88 PID 576 wrote to memory of 4308 576 htbnht.exe 89 PID 576 wrote to memory of 4308 576 htbnht.exe 89 PID 576 wrote to memory of 4308 576 htbnht.exe 89 PID 4308 wrote to memory of 4892 4308 lrlxflr.exe 90 PID 4308 wrote to memory of 4892 4308 lrlxflr.exe 90 PID 4308 wrote to memory of 4892 4308 lrlxflr.exe 90 PID 4892 wrote to memory of 1076 4892 pdddp.exe 91 PID 4892 wrote to memory of 1076 4892 pdddp.exe 91 PID 4892 wrote to memory of 1076 4892 pdddp.exe 91 PID 1076 wrote to memory of 3512 1076 httthb.exe 92 PID 1076 wrote to memory of 3512 1076 httthb.exe 92 PID 1076 wrote to memory of 3512 1076 httthb.exe 92 PID 3512 wrote to memory of 4516 3512 9jpjv.exe 93 PID 3512 wrote to memory of 4516 3512 9jpjv.exe 93 PID 3512 wrote to memory of 4516 3512 9jpjv.exe 93 PID 4516 wrote to memory of 1824 4516 vvdpj.exe 94 PID 4516 wrote to memory of 1824 4516 vvdpj.exe 94 PID 4516 wrote to memory of 1824 4516 vvdpj.exe 94 PID 1824 wrote to memory of 4636 1824 fxrlfxl.exe 95 PID 1824 wrote to memory of 4636 1824 fxrlfxl.exe 95 PID 1824 wrote to memory of 4636 1824 fxrlfxl.exe 95 PID 4636 wrote to memory of 2908 4636 pdvjd.exe 96 PID 4636 wrote to memory of 2908 4636 pdvjd.exe 96 PID 4636 wrote to memory of 2908 4636 pdvjd.exe 96 PID 2908 wrote to memory of 2636 2908 xrfrxxf.exe 97 PID 2908 wrote to memory of 2636 2908 xrfrxxf.exe 97 PID 2908 wrote to memory of 2636 2908 xrfrxxf.exe 97 PID 2636 wrote to memory of 3680 2636 vjjvp.exe 98 PID 2636 wrote to memory of 3680 2636 vjjvp.exe 98 PID 2636 wrote to memory of 3680 2636 vjjvp.exe 98 PID 3680 wrote to memory of 2384 3680 flrfrlf.exe 99 PID 3680 wrote to memory of 2384 3680 flrfrlf.exe 99 PID 3680 wrote to memory of 2384 3680 flrfrlf.exe 99 PID 2384 wrote to memory of 2308 2384 5nnbth.exe 100 PID 2384 wrote to memory of 2308 2384 5nnbth.exe 100 PID 2384 wrote to memory of 2308 2384 5nnbth.exe 100 PID 2308 wrote to memory of 1640 2308 vdjdd.exe 101 PID 2308 wrote to memory of 1640 2308 vdjdd.exe 101 PID 2308 wrote to memory of 1640 2308 vdjdd.exe 101 PID 1640 wrote to memory of 4048 1640 tntntn.exe 102 PID 1640 wrote to memory of 4048 1640 tntntn.exe 102 PID 1640 wrote to memory of 4048 1640 tntntn.exe 102 PID 4048 wrote to memory of 2940 4048 frrlfxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe"C:\Users\Admin\AppData\Local\Temp\73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\vdjvp.exec:\vdjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\5hnbbb.exec:\5hnbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\5ppdv.exec:\5ppdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\7rfrfxl.exec:\7rfrfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\tnhthb.exec:\tnhthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\7dvpd.exec:\7dvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\htbnht.exec:\htbnht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\lrlxflr.exec:\lrlxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\pdddp.exec:\pdddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\httthb.exec:\httthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\9jpjv.exec:\9jpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\vvdpj.exec:\vvdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\fxrlfxl.exec:\fxrlfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\pdvjd.exec:\pdvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\xrfrxxf.exec:\xrfrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vjjvp.exec:\vjjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\flrfrlf.exec:\flrfrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\5nnbth.exec:\5nnbth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vdjdd.exec:\vdjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\tntntn.exec:\tntntn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\frrlfxr.exec:\frrlfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\dvdvj.exec:\dvdvj.exe23⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ppvvj.exec:\ppvvj.exe24⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jdjdd.exec:\jdjdd.exe25⤵
- Executes dropped EXE
PID:860 -
\??\c:\fllfrlf.exec:\fllfrlf.exe26⤵
- Executes dropped EXE
PID:1628 -
\??\c:\thnbbt.exec:\thnbbt.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7hbnhh.exec:\7hbnhh.exe28⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hhnbtn.exec:\hhnbtn.exe29⤵
- Executes dropped EXE
PID:4452 -
\??\c:\fxxrfxr.exec:\fxxrfxr.exe30⤵
- Executes dropped EXE
PID:4544 -
\??\c:\llrfrlf.exec:\llrfrlf.exe31⤵
- Executes dropped EXE
PID:1168 -
\??\c:\3nthtn.exec:\3nthtn.exe32⤵
- Executes dropped EXE
PID:3692 -
\??\c:\rllfxxr.exec:\rllfxxr.exe33⤵
- Executes dropped EXE
PID:4056 -
\??\c:\7htthh.exec:\7htthh.exe34⤵
- Executes dropped EXE
PID:296 -
\??\c:\7jpjv.exec:\7jpjv.exe35⤵
- Executes dropped EXE
PID:4108 -
\??\c:\xlfffxl.exec:\xlfffxl.exe36⤵
- Executes dropped EXE
PID:456 -
\??\c:\btbtbt.exec:\btbtbt.exe37⤵
- Executes dropped EXE
PID:3320 -
\??\c:\vppdv.exec:\vppdv.exe38⤵
- Executes dropped EXE
PID:1240 -
\??\c:\xlrfrlf.exec:\xlrfrlf.exe39⤵
- Executes dropped EXE
PID:1112 -
\??\c:\btnhbt.exec:\btnhbt.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5bthbb.exec:\5bthbb.exe41⤵
- Executes dropped EXE
PID:1236 -
\??\c:\dppjv.exec:\dppjv.exe42⤵
- Executes dropped EXE
PID:3536 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe43⤵
- Executes dropped EXE
PID:3620 -
\??\c:\btnhhn.exec:\btnhhn.exe44⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nbbtnh.exec:\nbbtnh.exe45⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vdjdp.exec:\vdjdp.exe46⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bhnhtt.exec:\bhnhtt.exe47⤵
- Executes dropped EXE
PID:4532 -
\??\c:\hbhbtb.exec:\hbhbtb.exe48⤵
- Executes dropped EXE
PID:4732 -
\??\c:\pddvj.exec:\pddvj.exe49⤵
- Executes dropped EXE
PID:3980 -
\??\c:\fxlfxrr.exec:\fxlfxrr.exe50⤵
- Executes dropped EXE
PID:3876 -
\??\c:\lxfrffr.exec:\lxfrffr.exe51⤵
- Executes dropped EXE
PID:1276 -
\??\c:\tbhbnh.exec:\tbhbnh.exe52⤵
- Executes dropped EXE
PID:4736 -
\??\c:\dvvvp.exec:\dvvvp.exe53⤵
- Executes dropped EXE
PID:3368 -
\??\c:\xlflfxl.exec:\xlflfxl.exe54⤵
- Executes dropped EXE
PID:4408 -
\??\c:\9lxrllx.exec:\9lxrllx.exe55⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nhnnhh.exec:\nhnnhh.exe56⤵
- Executes dropped EXE
PID:1288 -
\??\c:\7dvjd.exec:\7dvjd.exe57⤵
- Executes dropped EXE
PID:972 -
\??\c:\9ffxfxr.exec:\9ffxfxr.exe58⤵
- Executes dropped EXE
PID:476 -
\??\c:\9thhbb.exec:\9thhbb.exe59⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jvdvp.exec:\jvdvp.exe60⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vdjdp.exec:\vdjdp.exe61⤵
- Executes dropped EXE
PID:3208 -
\??\c:\fffrffx.exec:\fffrffx.exe62⤵
- Executes dropped EXE
PID:4968 -
\??\c:\tbbbtt.exec:\tbbbtt.exe63⤵
- Executes dropped EXE
PID:704 -
\??\c:\djpjj.exec:\djpjj.exe64⤵
- Executes dropped EXE
PID:932 -
\??\c:\xxffxrl.exec:\xxffxrl.exe65⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vpjdv.exec:\vpjdv.exe66⤵PID:1992
-
\??\c:\jvvjv.exec:\jvvjv.exe67⤵PID:1832
-
\??\c:\xxfxlfr.exec:\xxfxlfr.exe68⤵PID:536
-
\??\c:\bbhbnb.exec:\bbhbnb.exe69⤵PID:3936
-
\??\c:\5hnbth.exec:\5hnbth.exe70⤵PID:4296
-
\??\c:\ppvvv.exec:\ppvvv.exe71⤵PID:960
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe72⤵PID:4520
-
\??\c:\3tnhbn.exec:\3tnhbn.exe73⤵PID:356
-
\??\c:\7vvpj.exec:\7vvpj.exe74⤵PID:1884
-
\??\c:\vpvjd.exec:\vpvjd.exe75⤵PID:4232
-
\??\c:\5xlfrrl.exec:\5xlfrrl.exe76⤵PID:2972
-
\??\c:\nbhbnh.exec:\nbhbnh.exe77⤵PID:1104
-
\??\c:\7pvpp.exec:\7pvpp.exe78⤵PID:3300
-
\??\c:\9rfxrrx.exec:\9rfxrrx.exe79⤵PID:2692
-
\??\c:\3nnbtn.exec:\3nnbtn.exe80⤵PID:1480
-
\??\c:\pdpdv.exec:\pdpdv.exe81⤵
- System Location Discovery: System Language Discovery
PID:4972 -
\??\c:\dvvjv.exec:\dvvjv.exe82⤵PID:1476
-
\??\c:\9fxlxrl.exec:\9fxlxrl.exe83⤵PID:1628
-
\??\c:\htthbt.exec:\htthbt.exe84⤵PID:1708
-
\??\c:\vdvpj.exec:\vdvpj.exe85⤵PID:1692
-
\??\c:\pvdpj.exec:\pvdpj.exe86⤵PID:2684
-
\??\c:\3lffrrr.exec:\3lffrrr.exe87⤵PID:4204
-
\??\c:\nhhbtn.exec:\nhhbtn.exe88⤵PID:4716
-
\??\c:\3vvpp.exec:\3vvpp.exe89⤵PID:1168
-
\??\c:\xflfrrl.exec:\xflfrrl.exe90⤵PID:4064
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe91⤵PID:5000
-
\??\c:\bttnhb.exec:\bttnhb.exe92⤵PID:2512
-
\??\c:\vvdvp.exec:\vvdvp.exe93⤵PID:1196
-
\??\c:\pppjd.exec:\pppjd.exe94⤵PID:1808
-
\??\c:\xflfxrl.exec:\xflfxrl.exe95⤵PID:1272
-
\??\c:\bhnhtn.exec:\bhnhtn.exe96⤵PID:4956
-
\??\c:\9vpvj.exec:\9vpvj.exe97⤵PID:1312
-
\??\c:\xlxxllr.exec:\xlxxllr.exe98⤵PID:2008
-
\??\c:\ttnhnn.exec:\ttnhnn.exe99⤵PID:2832
-
\??\c:\bbbbtn.exec:\bbbbtn.exe100⤵PID:3824
-
\??\c:\pjpdv.exec:\pjpdv.exe101⤵PID:4752
-
\??\c:\3xrfllf.exec:\3xrfllf.exe102⤵PID:3620
-
\??\c:\fxfxfxr.exec:\fxfxfxr.exe103⤵PID:2432
-
\??\c:\tnnhnh.exec:\tnnhnh.exe104⤵PID:3760
-
\??\c:\jddvj.exec:\jddvj.exe105⤵PID:4540
-
\??\c:\3flxxfx.exec:\3flxxfx.exe106⤵PID:4928
-
\??\c:\hhbttn.exec:\hhbttn.exe107⤵PID:1092
-
\??\c:\bttnnh.exec:\bttnnh.exe108⤵PID:4460
-
\??\c:\dvdvv.exec:\dvdvv.exe109⤵PID:3060
-
\??\c:\lxxxrxr.exec:\lxxxrxr.exe110⤵PID:2244
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe111⤵PID:1752
-
\??\c:\9ttnhh.exec:\9ttnhh.exe112⤵PID:2188
-
\??\c:\9dpjd.exec:\9dpjd.exe113⤵PID:1308
-
\??\c:\1lffrlf.exec:\1lffrlf.exe114⤵PID:2092
-
\??\c:\xrrlflf.exec:\xrrlflf.exe115⤵PID:4344
-
\??\c:\bnttnt.exec:\bnttnt.exe116⤵PID:1148
-
\??\c:\djjpj.exec:\djjpj.exe117⤵PID:972
-
\??\c:\frflxlf.exec:\frflxlf.exe118⤵PID:3484
-
\??\c:\5llxrrl.exec:\5llxrrl.exe119⤵PID:4144
-
\??\c:\tntntn.exec:\tntntn.exe120⤵PID:4528
-
\??\c:\pvjdp.exec:\pvjdp.exe121⤵PID:3208
-
\??\c:\rrlxrlf.exec:\rrlxrlf.exe122⤵PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-