Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 04:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
523837ddc1960fc86949e0583d00e2417464bd07c5cd5f47a8e55facd5f007b2N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
523837ddc1960fc86949e0583d00e2417464bd07c5cd5f47a8e55facd5f007b2N.exe
-
Size
453KB
-
MD5
2bd19230c57fec9220ce7811e7d0b120
-
SHA1
7368cde3edd34eef42f275f378538ab098ccf829
-
SHA256
523837ddc1960fc86949e0583d00e2417464bd07c5cd5f47a8e55facd5f007b2
-
SHA512
c1011791e2c3b35bfb4186a36bc468aad8a4d1fba64581ad4e62b641ba02fb4dbec2a3a66be01b012c19da17b0084878fdede0ccaaa2c434e5ce9cdebaa13d37
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3732-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-906-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-1372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-1613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3732 jddvv.exe 2036 fxflllf.exe 636 1hbtnn.exe 3040 rlxrrrx.exe 3168 5ttnhh.exe 4664 lxfxxrl.exe 1504 vjjdd.exe 1068 nntbtn.exe 1644 vpjjd.exe 1904 hbhbtn.exe 1948 pdjdd.exe 3456 lfxxrxr.exe 1228 hbbbth.exe 4136 ddjjj.exe 1540 ffffrrl.exe 2392 pppjd.exe 5092 rxfxrll.exe 1800 bhnhbt.exe 2012 dvpjd.exe 1056 frxrrrl.exe 1536 lxxrlff.exe 4856 djjjj.exe 4516 jjdvv.exe 2520 5ffxrlf.exe 1016 rflxrrf.exe 2296 fxllfrl.exe 3788 thbhbb.exe 4788 nbbthb.exe 2624 5fflffl.exe 684 5btttn.exe 3964 rrllffx.exe 3548 btthbt.exe 3156 fxfxxxx.exe 4508 tnnhhb.exe 5004 dvvvp.exe 4920 rlffllf.exe 400 fxxrffr.exe 1204 9nbtnn.exe 3216 dpvpj.exe 3836 1fxrfxr.exe 2212 xxrfxrf.exe 2912 nntnbb.exe 2548 vjpdd.exe 1252 fflrrrr.exe 2848 bnbttn.exe 4592 dpdvv.exe 4792 fxlflll.exe 3112 5htnhb.exe 3632 hnbtbb.exe 4448 5pvdp.exe 1460 xrrfrlx.exe 5020 3nnbtn.exe 4132 1ppdp.exe 1464 9frxxxx.exe 3092 5fffxxf.exe 636 nhbtnb.exe 3224 7vvpd.exe 3040 frxllff.exe 3480 ntbnhb.exe 2412 pvjvp.exe 4424 htnbhb.exe 1812 1bnnbb.exe 1660 jvvjd.exe 232 5fxrllr.exe -
resource yara_rule behavioral2/memory/3732-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-853-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 3732 3952 523837ddc1960fc86949e0583d00e2417464bd07c5cd5f47a8e55facd5f007b2N.exe 82 PID 3952 wrote to memory of 3732 3952 523837ddc1960fc86949e0583d00e2417464bd07c5cd5f47a8e55facd5f007b2N.exe 82 PID 3952 wrote to memory of 3732 3952 523837ddc1960fc86949e0583d00e2417464bd07c5cd5f47a8e55facd5f007b2N.exe 82 PID 3732 wrote to memory of 2036 3732 jddvv.exe 83 PID 3732 wrote to memory of 2036 3732 jddvv.exe 83 PID 3732 wrote to memory of 2036 3732 jddvv.exe 83 PID 2036 wrote to memory of 636 2036 fxflllf.exe 84 PID 2036 wrote to memory of 636 2036 fxflllf.exe 84 PID 2036 wrote to memory of 636 2036 fxflllf.exe 84 PID 636 wrote to memory of 3040 636 1hbtnn.exe 85 PID 636 wrote to memory of 3040 636 1hbtnn.exe 85 PID 636 wrote to memory of 3040 636 1hbtnn.exe 85 PID 3040 wrote to memory of 3168 3040 rlxrrrx.exe 86 PID 3040 wrote to memory of 3168 3040 rlxrrrx.exe 86 PID 3040 wrote to memory of 3168 3040 rlxrrrx.exe 86 PID 3168 wrote to memory of 4664 3168 5ttnhh.exe 87 PID 3168 wrote to memory of 4664 3168 5ttnhh.exe 87 PID 3168 wrote to memory of 4664 3168 5ttnhh.exe 87 PID 4664 wrote to memory of 1504 4664 lxfxxrl.exe 88 PID 4664 wrote to memory of 1504 4664 lxfxxrl.exe 88 PID 4664 wrote to memory of 1504 4664 lxfxxrl.exe 88 PID 1504 wrote to memory of 1068 1504 vjjdd.exe 89 PID 1504 wrote to memory of 1068 1504 vjjdd.exe 89 PID 1504 wrote to memory of 1068 1504 vjjdd.exe 89 PID 1068 wrote to memory of 1644 1068 nntbtn.exe 90 PID 1068 wrote to memory of 1644 1068 nntbtn.exe 90 PID 1068 wrote to memory of 1644 1068 nntbtn.exe 90 PID 1644 wrote to memory of 1904 1644 vpjjd.exe 91 PID 1644 wrote to memory of 1904 1644 vpjjd.exe 91 PID 1644 wrote to memory of 1904 1644 vpjjd.exe 91 PID 1904 wrote to memory of 1948 1904 hbhbtn.exe 92 PID 1904 wrote to memory of 1948 1904 hbhbtn.exe 92 PID 1904 wrote to memory of 1948 1904 hbhbtn.exe 92 PID 1948 wrote to memory of 3456 1948 pdjdd.exe 93 PID 1948 wrote to memory of 3456 1948 pdjdd.exe 93 PID 1948 wrote to memory of 3456 1948 pdjdd.exe 93 PID 3456 wrote to memory of 1228 3456 lfxxrxr.exe 94 PID 3456 wrote to memory of 1228 3456 lfxxrxr.exe 94 PID 3456 wrote to memory of 1228 3456 lfxxrxr.exe 94 PID 1228 wrote to memory of 4136 1228 hbbbth.exe 95 PID 1228 wrote to memory of 4136 1228 hbbbth.exe 95 PID 1228 wrote to memory of 4136 1228 hbbbth.exe 95 PID 4136 wrote to memory of 1540 4136 ddjjj.exe 96 PID 4136 wrote to memory of 1540 4136 ddjjj.exe 96 PID 4136 wrote to memory of 1540 4136 ddjjj.exe 96 PID 1540 wrote to memory of 2392 1540 ffffrrl.exe 97 PID 1540 wrote to memory of 2392 1540 ffffrrl.exe 97 PID 1540 wrote to memory of 2392 1540 ffffrrl.exe 97 PID 2392 wrote to memory of 5092 2392 pppjd.exe 98 PID 2392 wrote to memory of 5092 2392 pppjd.exe 98 PID 2392 wrote to memory of 5092 2392 pppjd.exe 98 PID 5092 wrote to memory of 1800 5092 rxfxrll.exe 99 PID 5092 wrote to memory of 1800 5092 rxfxrll.exe 99 PID 5092 wrote to memory of 1800 5092 rxfxrll.exe 99 PID 1800 wrote to memory of 2012 1800 bhnhbt.exe 100 PID 1800 wrote to memory of 2012 1800 bhnhbt.exe 100 PID 1800 wrote to memory of 2012 1800 bhnhbt.exe 100 PID 2012 wrote to memory of 1056 2012 dvpjd.exe 101 PID 2012 wrote to memory of 1056 2012 dvpjd.exe 101 PID 2012 wrote to memory of 1056 2012 dvpjd.exe 101 PID 1056 wrote to memory of 1536 1056 frxrrrl.exe 102 PID 1056 wrote to memory of 1536 1056 frxrrrl.exe 102 PID 1056 wrote to memory of 1536 1056 frxrrrl.exe 102 PID 1536 wrote to memory of 4856 1536 lxxrlff.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\523837ddc1960fc86949e0583d00e2417464bd07c5cd5f47a8e55facd5f007b2N.exe"C:\Users\Admin\AppData\Local\Temp\523837ddc1960fc86949e0583d00e2417464bd07c5cd5f47a8e55facd5f007b2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\jddvv.exec:\jddvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\fxflllf.exec:\fxflllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\1hbtnn.exec:\1hbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\5ttnhh.exec:\5ttnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\lxfxxrl.exec:\lxfxxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\vjjdd.exec:\vjjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\nntbtn.exec:\nntbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\vpjjd.exec:\vpjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\hbhbtn.exec:\hbhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\pdjdd.exec:\pdjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\lfxxrxr.exec:\lfxxrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\hbbbth.exec:\hbbbth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\ddjjj.exec:\ddjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\ffffrrl.exec:\ffffrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\pppjd.exec:\pppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\rxfxrll.exec:\rxfxrll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\bhnhbt.exec:\bhnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\dvpjd.exec:\dvpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\frxrrrl.exec:\frxrrrl.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\lxxrlff.exec:\lxxrlff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\djjjj.exec:\djjjj.exe23⤵
- Executes dropped EXE
PID:4856 -
\??\c:\jjdvv.exec:\jjdvv.exe24⤵
- Executes dropped EXE
PID:4516 -
\??\c:\5ffxrlf.exec:\5ffxrlf.exe25⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rflxrrf.exec:\rflxrrf.exe26⤵
- Executes dropped EXE
PID:1016 -
\??\c:\fxllfrl.exec:\fxllfrl.exe27⤵
- Executes dropped EXE
PID:2296 -
\??\c:\thbhbb.exec:\thbhbb.exe28⤵
- Executes dropped EXE
PID:3788 -
\??\c:\nbbthb.exec:\nbbthb.exe29⤵
- Executes dropped EXE
PID:4788 -
\??\c:\5fflffl.exec:\5fflffl.exe30⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5btttn.exec:\5btttn.exe31⤵
- Executes dropped EXE
PID:684 -
\??\c:\rrllffx.exec:\rrllffx.exe32⤵
- Executes dropped EXE
PID:3964 -
\??\c:\btthbt.exec:\btthbt.exe33⤵
- Executes dropped EXE
PID:3548 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe34⤵
- Executes dropped EXE
PID:3156 -
\??\c:\tnnhhb.exec:\tnnhhb.exe35⤵
- Executes dropped EXE
PID:4508 -
\??\c:\dvvvp.exec:\dvvvp.exe36⤵
- Executes dropped EXE
PID:5004 -
\??\c:\rlffllf.exec:\rlffllf.exe37⤵
- Executes dropped EXE
PID:4920 -
\??\c:\fxxrffr.exec:\fxxrffr.exe38⤵
- Executes dropped EXE
PID:400 -
\??\c:\9nbtnn.exec:\9nbtnn.exe39⤵
- Executes dropped EXE
PID:1204 -
\??\c:\dpvpj.exec:\dpvpj.exe40⤵
- Executes dropped EXE
PID:3216 -
\??\c:\1fxrfxr.exec:\1fxrfxr.exe41⤵
- Executes dropped EXE
PID:3836 -
\??\c:\xxrfxrf.exec:\xxrfxrf.exe42⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nntnbb.exec:\nntnbb.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vjpdd.exec:\vjpdd.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\fflrrrr.exec:\fflrrrr.exe45⤵
- Executes dropped EXE
PID:1252 -
\??\c:\bnbttn.exec:\bnbttn.exe46⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dpdvv.exec:\dpdvv.exe47⤵
- Executes dropped EXE
PID:4592 -
\??\c:\fxlflll.exec:\fxlflll.exe48⤵
- Executes dropped EXE
PID:4792 -
\??\c:\5htnhb.exec:\5htnhb.exe49⤵
- Executes dropped EXE
PID:3112 -
\??\c:\hnbtbb.exec:\hnbtbb.exe50⤵
- Executes dropped EXE
PID:3632 -
\??\c:\5pvdp.exec:\5pvdp.exe51⤵
- Executes dropped EXE
PID:4448 -
\??\c:\xrrfrlx.exec:\xrrfrlx.exe52⤵
- Executes dropped EXE
PID:1460 -
\??\c:\3nnbtn.exec:\3nnbtn.exe53⤵
- Executes dropped EXE
PID:5020 -
\??\c:\1ppdp.exec:\1ppdp.exe54⤵
- Executes dropped EXE
PID:4132 -
\??\c:\9frxxxx.exec:\9frxxxx.exe55⤵
- Executes dropped EXE
PID:1464 -
\??\c:\5fffxxf.exec:\5fffxxf.exe56⤵
- Executes dropped EXE
PID:3092 -
\??\c:\nhbtnb.exec:\nhbtnb.exe57⤵
- Executes dropped EXE
PID:636 -
\??\c:\7vvpd.exec:\7vvpd.exe58⤵
- Executes dropped EXE
PID:3224 -
\??\c:\frxllff.exec:\frxllff.exe59⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ntbnhb.exec:\ntbnhb.exe60⤵
- Executes dropped EXE
PID:3480 -
\??\c:\pvjvp.exec:\pvjvp.exe61⤵
- Executes dropped EXE
PID:2412 -
\??\c:\htnbhb.exec:\htnbhb.exe62⤵
- Executes dropped EXE
PID:4424 -
\??\c:\1bnnbb.exec:\1bnnbb.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jvvjd.exec:\jvvjd.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\5fxrllr.exec:\5fxrllr.exe65⤵
- Executes dropped EXE
PID:232 -
\??\c:\tbbttn.exec:\tbbttn.exe66⤵PID:2152
-
\??\c:\pjpjd.exec:\pjpjd.exe67⤵PID:4568
-
\??\c:\vpvpj.exec:\vpvpj.exe68⤵PID:4852
-
\??\c:\lffxlff.exec:\lffxlff.exe69⤵PID:4668
-
\??\c:\9tntnt.exec:\9tntnt.exe70⤵PID:4000
-
\??\c:\vdjdv.exec:\vdjdv.exe71⤵PID:1872
-
\??\c:\1rxlflx.exec:\1rxlflx.exe72⤵
- System Location Discovery: System Language Discovery
PID:4736 -
\??\c:\nhbbhh.exec:\nhbbhh.exe73⤵PID:1108
-
\??\c:\pjpdv.exec:\pjpdv.exe74⤵PID:3976
-
\??\c:\rflfxxr.exec:\rflfxxr.exe75⤵PID:4548
-
\??\c:\flxlfxr.exec:\flxlfxr.exe76⤵PID:1928
-
\??\c:\tbtntt.exec:\tbtntt.exe77⤵PID:4916
-
\??\c:\vvdvd.exec:\vvdvd.exe78⤵PID:5016
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe79⤵PID:2012
-
\??\c:\htbtbt.exec:\htbtbt.exe80⤵PID:4364
-
\??\c:\jpddp.exec:\jpddp.exe81⤵PID:4580
-
\??\c:\jddvd.exec:\jddvd.exe82⤵
- System Location Discovery: System Language Discovery
PID:2228 -
\??\c:\flrlrlr.exec:\flrlrlr.exe83⤵PID:2204
-
\??\c:\bhtnnt.exec:\bhtnnt.exe84⤵PID:3900
-
\??\c:\dpvpp.exec:\dpvpp.exe85⤵PID:2468
-
\??\c:\7rrlllr.exec:\7rrlllr.exe86⤵PID:764
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe87⤵PID:1424
-
\??\c:\hhhbtn.exec:\hhhbtn.exe88⤵PID:8
-
\??\c:\pjvjj.exec:\pjvjj.exe89⤵PID:4872
-
\??\c:\7rlxrlf.exec:\7rlxrlf.exe90⤵PID:1076
-
\??\c:\1bbtnh.exec:\1bbtnh.exe91⤵PID:1752
-
\??\c:\9vdvj.exec:\9vdvj.exe92⤵PID:2604
-
\??\c:\jpvpj.exec:\jpvpj.exe93⤵PID:2160
-
\??\c:\rffxrlf.exec:\rffxrlf.exe94⤵PID:396
-
\??\c:\nbhbtn.exec:\nbhbtn.exe95⤵PID:5068
-
\??\c:\thhbtn.exec:\thhbtn.exe96⤵PID:4684
-
\??\c:\3pjvp.exec:\3pjvp.exe97⤵PID:4008
-
\??\c:\frrllfl.exec:\frrllfl.exe98⤵PID:4272
-
\??\c:\nbhhbt.exec:\nbhhbt.exe99⤵PID:2888
-
\??\c:\pddpp.exec:\pddpp.exe100⤵PID:5104
-
\??\c:\3dvpj.exec:\3dvpj.exe101⤵PID:4784
-
\??\c:\5ffxrrl.exec:\5ffxrrl.exe102⤵PID:4948
-
\??\c:\tbhhbb.exec:\tbhhbb.exe103⤵PID:4268
-
\??\c:\vpvvd.exec:\vpvvd.exe104⤵PID:4796
-
\??\c:\djvdv.exec:\djvdv.exe105⤵PID:3248
-
\??\c:\lxxrffx.exec:\lxxrffx.exe106⤵PID:4604
-
\??\c:\9bhtnh.exec:\9bhtnh.exe107⤵PID:3664
-
\??\c:\pdpjj.exec:\pdpjj.exe108⤵PID:4912
-
\??\c:\dvdvp.exec:\dvdvp.exe109⤵PID:116
-
\??\c:\9ttttt.exec:\9ttttt.exe110⤵PID:4688
-
\??\c:\bhbtnb.exec:\bhbtnb.exe111⤵PID:4220
-
\??\c:\pjvpv.exec:\pjvpv.exe112⤵PID:1792
-
\??\c:\lfxrffx.exec:\lfxrffx.exe113⤵PID:4444
-
\??\c:\7bnhtn.exec:\7bnhtn.exe114⤵PID:4512
-
\??\c:\pdjvp.exec:\pdjvp.exe115⤵PID:2304
-
\??\c:\pdjjp.exec:\pdjjp.exe116⤵PID:2992
-
\??\c:\rrrfrrr.exec:\rrrfrrr.exe117⤵PID:3732
-
\??\c:\frlfrll.exec:\frlfrll.exe118⤵PID:1868
-
\??\c:\bnnhbb.exec:\bnnhbb.exe119⤵PID:4492
-
\??\c:\pjjdv.exec:\pjjdv.exe120⤵PID:1464
-
\??\c:\xxfxrrx.exec:\xxfxrrx.exe121⤵PID:3888
-
\??\c:\hhnnnh.exec:\hhnnnh.exe122⤵PID:4104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-