Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 08:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe
-
Size
454KB
-
MD5
f11d5654c326478a439c2b20c069dfb0
-
SHA1
4ed8727d0bd0188e6792c7ec0d2d2cb03b81f826
-
SHA256
f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39
-
SHA512
c23e1cb4a9ca8bb36f1838f6ea93434cca7bdda0a949a490c3307be8ef10d182a28a79a93a6c0b4ee357c50c5cdcbb6fde825c5e8d655c2ffe99fe1dc0f8ff47
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe2:q7Tc2NYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1436-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-776-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-1172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-1192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-1205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-1815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 220 jjdvv.exe 1576 ppvpv.exe 3088 jjppj.exe 5084 xrxxffx.exe 3316 nbnnnn.exe 2168 vpvpj.exe 2636 fflllrr.exe 2084 3fffxxr.exe 852 lrrrrff.exe 5056 jvddd.exe 4900 hhhnhn.exe 3060 xrlllfx.exe 848 fllflrl.exe 2460 5llfxxr.exe 2208 tbntnh.exe 4932 xrfxrlf.exe 3916 httnbn.exe 2368 pvdvv.exe 2660 3lfrlll.exe 3876 bbnhbb.exe 2428 vvpjj.exe 3140 flffxxr.exe 2412 rflxrrf.exe 5048 bnhbnn.exe 1964 lfrlxxl.exe 5016 jdjdj.exe 3224 bbtnnn.exe 4928 lrxflxf.exe 3392 fflfrlf.exe 2712 hhbnhb.exe 3676 bnnhtn.exe 3972 vvdjd.exe 4860 ddppj.exe 3180 frrrfxr.exe 1464 frlxrlx.exe 3816 thhhhh.exe 2828 5pjdv.exe 1536 rlfxlfr.exe 1472 9nbthh.exe 1868 pvvpd.exe 4440 ppjdp.exe 2440 rrlfxxr.exe 1380 nbbnhb.exe 4264 7ddvp.exe 3476 jpddv.exe 4332 rxrfxrf.exe 3012 nthhbn.exe 3760 5pdvp.exe 4752 lfxrrrl.exe 440 bhhttb.exe 2020 ttbtnn.exe 624 5vdvp.exe 2080 frxlfxr.exe 228 nhtnnn.exe 2156 jdjvp.exe 964 rfllfxr.exe 3872 tttnnn.exe 3060 ntnbtn.exe 792 pdvdv.exe 2804 vvvjp.exe 1852 rxffxxr.exe 2600 1httnt.exe 3860 pdvjp.exe 3808 jpjdp.exe -
resource yara_rule behavioral2/memory/1436-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-813-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1436 wrote to memory of 220 1436 f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe 83 PID 1436 wrote to memory of 220 1436 f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe 83 PID 1436 wrote to memory of 220 1436 f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe 83 PID 220 wrote to memory of 1576 220 jjdvv.exe 84 PID 220 wrote to memory of 1576 220 jjdvv.exe 84 PID 220 wrote to memory of 1576 220 jjdvv.exe 84 PID 1576 wrote to memory of 3088 1576 ppvpv.exe 85 PID 1576 wrote to memory of 3088 1576 ppvpv.exe 85 PID 1576 wrote to memory of 3088 1576 ppvpv.exe 85 PID 3088 wrote to memory of 5084 3088 jjppj.exe 86 PID 3088 wrote to memory of 5084 3088 jjppj.exe 86 PID 3088 wrote to memory of 5084 3088 jjppj.exe 86 PID 5084 wrote to memory of 3316 5084 xrxxffx.exe 87 PID 5084 wrote to memory of 3316 5084 xrxxffx.exe 87 PID 5084 wrote to memory of 3316 5084 xrxxffx.exe 87 PID 3316 wrote to memory of 2168 3316 nbnnnn.exe 88 PID 3316 wrote to memory of 2168 3316 nbnnnn.exe 88 PID 3316 wrote to memory of 2168 3316 nbnnnn.exe 88 PID 2168 wrote to memory of 2636 2168 vpvpj.exe 89 PID 2168 wrote to memory of 2636 2168 vpvpj.exe 89 PID 2168 wrote to memory of 2636 2168 vpvpj.exe 89 PID 2636 wrote to memory of 2084 2636 fflllrr.exe 90 PID 2636 wrote to memory of 2084 2636 fflllrr.exe 90 PID 2636 wrote to memory of 2084 2636 fflllrr.exe 90 PID 2084 wrote to memory of 852 2084 3fffxxr.exe 91 PID 2084 wrote to memory of 852 2084 3fffxxr.exe 91 PID 2084 wrote to memory of 852 2084 3fffxxr.exe 91 PID 852 wrote to memory of 5056 852 lrrrrff.exe 92 PID 852 wrote to memory of 5056 852 lrrrrff.exe 92 PID 852 wrote to memory of 5056 852 lrrrrff.exe 92 PID 5056 wrote to memory of 4900 5056 jvddd.exe 93 PID 5056 wrote to memory of 4900 5056 jvddd.exe 93 PID 5056 wrote to memory of 4900 5056 jvddd.exe 93 PID 4900 wrote to memory of 3060 4900 hhhnhn.exe 94 PID 4900 wrote to memory of 3060 4900 hhhnhn.exe 94 PID 4900 wrote to memory of 3060 4900 hhhnhn.exe 94 PID 3060 wrote to memory of 848 3060 xrlllfx.exe 95 PID 3060 wrote to memory of 848 3060 xrlllfx.exe 95 PID 3060 wrote to memory of 848 3060 xrlllfx.exe 95 PID 848 wrote to memory of 2460 848 fllflrl.exe 96 PID 848 wrote to memory of 2460 848 fllflrl.exe 96 PID 848 wrote to memory of 2460 848 fllflrl.exe 96 PID 2460 wrote to memory of 2208 2460 5llfxxr.exe 97 PID 2460 wrote to memory of 2208 2460 5llfxxr.exe 97 PID 2460 wrote to memory of 2208 2460 5llfxxr.exe 97 PID 2208 wrote to memory of 4932 2208 tbntnh.exe 98 PID 2208 wrote to memory of 4932 2208 tbntnh.exe 98 PID 2208 wrote to memory of 4932 2208 tbntnh.exe 98 PID 4932 wrote to memory of 3916 4932 xrfxrlf.exe 99 PID 4932 wrote to memory of 3916 4932 xrfxrlf.exe 99 PID 4932 wrote to memory of 3916 4932 xrfxrlf.exe 99 PID 3916 wrote to memory of 2368 3916 httnbn.exe 100 PID 3916 wrote to memory of 2368 3916 httnbn.exe 100 PID 3916 wrote to memory of 2368 3916 httnbn.exe 100 PID 2368 wrote to memory of 2660 2368 pvdvv.exe 101 PID 2368 wrote to memory of 2660 2368 pvdvv.exe 101 PID 2368 wrote to memory of 2660 2368 pvdvv.exe 101 PID 2660 wrote to memory of 3876 2660 3lfrlll.exe 102 PID 2660 wrote to memory of 3876 2660 3lfrlll.exe 102 PID 2660 wrote to memory of 3876 2660 3lfrlll.exe 102 PID 3876 wrote to memory of 2428 3876 bbnhbb.exe 103 PID 3876 wrote to memory of 2428 3876 bbnhbb.exe 103 PID 3876 wrote to memory of 2428 3876 bbnhbb.exe 103 PID 2428 wrote to memory of 3140 2428 vvpjj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe"C:\Users\Admin\AppData\Local\Temp\f562bf2bc634bbaf95b47c26e3447271f400aabffb73f45ebc9a4dd65c53ab39N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\jjdvv.exec:\jjdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\ppvpv.exec:\ppvpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\jjppj.exec:\jjppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\xrxxffx.exec:\xrxxffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\nbnnnn.exec:\nbnnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\vpvpj.exec:\vpvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\fflllrr.exec:\fflllrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3fffxxr.exec:\3fffxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\lrrrrff.exec:\lrrrrff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\jvddd.exec:\jvddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\hhhnhn.exec:\hhhnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\xrlllfx.exec:\xrlllfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\fllflrl.exec:\fllflrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\5llfxxr.exec:\5llfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\tbntnh.exec:\tbntnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\httnbn.exec:\httnbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\pvdvv.exec:\pvdvv.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\3lfrlll.exec:\3lfrlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bbnhbb.exec:\bbnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\vvpjj.exec:\vvpjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\flffxxr.exec:\flffxxr.exe23⤵
- Executes dropped EXE
PID:3140 -
\??\c:\rflxrrf.exec:\rflxrrf.exe24⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bnhbnn.exec:\bnhbnn.exe25⤵
- Executes dropped EXE
PID:5048 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe26⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jdjdj.exec:\jdjdj.exe27⤵
- Executes dropped EXE
PID:5016 -
\??\c:\bbtnnn.exec:\bbtnnn.exe28⤵
- Executes dropped EXE
PID:3224 -
\??\c:\lrxflxf.exec:\lrxflxf.exe29⤵
- Executes dropped EXE
PID:4928 -
\??\c:\fflfrlf.exec:\fflfrlf.exe30⤵
- Executes dropped EXE
PID:3392 -
\??\c:\hhbnhb.exec:\hhbnhb.exe31⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bnnhtn.exec:\bnnhtn.exe32⤵
- Executes dropped EXE
PID:3676 -
\??\c:\vvdjd.exec:\vvdjd.exe33⤵
- Executes dropped EXE
PID:3972 -
\??\c:\ddppj.exec:\ddppj.exe34⤵
- Executes dropped EXE
PID:4860 -
\??\c:\frrrfxr.exec:\frrrfxr.exe35⤵
- Executes dropped EXE
PID:3180 -
\??\c:\frlxrlx.exec:\frlxrlx.exe36⤵
- Executes dropped EXE
PID:1464 -
\??\c:\thhhhh.exec:\thhhhh.exe37⤵
- Executes dropped EXE
PID:3816 -
\??\c:\5pjdv.exec:\5pjdv.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe39⤵
- Executes dropped EXE
PID:1536 -
\??\c:\9nbthh.exec:\9nbthh.exe40⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pvvpd.exec:\pvvpd.exe41⤵
- Executes dropped EXE
PID:1868 -
\??\c:\ppjdp.exec:\ppjdp.exe42⤵
- Executes dropped EXE
PID:4440 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nbbnhb.exec:\nbbnhb.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\7ddvp.exec:\7ddvp.exe45⤵
- Executes dropped EXE
PID:4264 -
\??\c:\jpddv.exec:\jpddv.exe46⤵
- Executes dropped EXE
PID:3476 -
\??\c:\rxrfxrf.exec:\rxrfxrf.exe47⤵
- Executes dropped EXE
PID:4332 -
\??\c:\nthhbn.exec:\nthhbn.exe48⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5pdvp.exec:\5pdvp.exe49⤵
- Executes dropped EXE
PID:3760 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe50⤵
- Executes dropped EXE
PID:4752 -
\??\c:\bhhttb.exec:\bhhttb.exe51⤵
- Executes dropped EXE
PID:440 -
\??\c:\ttbtnn.exec:\ttbtnn.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5vdvp.exec:\5vdvp.exe53⤵
- Executes dropped EXE
PID:624 -
\??\c:\frxlfxr.exec:\frxlfxr.exe54⤵
- Executes dropped EXE
PID:2080 -
\??\c:\nhtnnn.exec:\nhtnnn.exe55⤵
- Executes dropped EXE
PID:228 -
\??\c:\jdjvp.exec:\jdjvp.exe56⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rfllfxr.exec:\rfllfxr.exe57⤵
- Executes dropped EXE
PID:964 -
\??\c:\tttnnn.exec:\tttnnn.exe58⤵
- Executes dropped EXE
PID:3872 -
\??\c:\ntnbtn.exec:\ntnbtn.exe59⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pdvdv.exec:\pdvdv.exe60⤵
- Executes dropped EXE
PID:792 -
\??\c:\vvvjp.exec:\vvvjp.exe61⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rxffxxr.exec:\rxffxxr.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\1httnt.exec:\1httnt.exe63⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pdvjp.exec:\pdvjp.exe64⤵
- Executes dropped EXE
PID:3860 -
\??\c:\jpjdp.exec:\jpjdp.exe65⤵
- Executes dropped EXE
PID:3808 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe66⤵PID:4088
-
\??\c:\tnhbtt.exec:\tnhbtt.exe67⤵PID:1532
-
\??\c:\jjpdj.exec:\jjpdj.exe68⤵PID:4872
-
\??\c:\lxflxxf.exec:\lxflxxf.exe69⤵PID:4380
-
\??\c:\9xxrffx.exec:\9xxrffx.exe70⤵PID:4300
-
\??\c:\ppjpj.exec:\ppjpj.exe71⤵PID:2608
-
\??\c:\xxlrflf.exec:\xxlrflf.exe72⤵PID:4476
-
\??\c:\thnhtt.exec:\thnhtt.exe73⤵PID:1948
-
\??\c:\dvjvd.exec:\dvjvd.exe74⤵PID:2936
-
\??\c:\xfrrxxx.exec:\xfrrxxx.exe75⤵PID:1728
-
\??\c:\nhbtnt.exec:\nhbtnt.exe76⤵PID:4136
-
\??\c:\bnbttt.exec:\bnbttt.exe77⤵PID:3464
-
\??\c:\pjjjj.exec:\pjjjj.exe78⤵PID:3500
-
\??\c:\fffflrr.exec:\fffflrr.exe79⤵PID:3596
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe80⤵PID:4808
-
\??\c:\5nhhhn.exec:\5nhhhn.exe81⤵PID:2488
-
\??\c:\pdddv.exec:\pdddv.exe82⤵PID:3708
-
\??\c:\rllllxr.exec:\rllllxr.exe83⤵PID:2712
-
\??\c:\1rlflll.exec:\1rlflll.exe84⤵PID:2100
-
\??\c:\bbhttn.exec:\bbhttn.exe85⤵PID:3300
-
\??\c:\ddpjj.exec:\ddpjj.exe86⤵PID:4880
-
\??\c:\1lllffr.exec:\1lllffr.exe87⤵PID:4268
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe88⤵PID:4832
-
\??\c:\vjjdv.exec:\vjjdv.exe89⤵PID:4624
-
\??\c:\xllxrlf.exec:\xllxrlf.exe90⤵PID:2876
-
\??\c:\bhbthh.exec:\bhbthh.exe91⤵PID:64
-
\??\c:\nbbbbb.exec:\nbbbbb.exe92⤵PID:2316
-
\??\c:\vjddd.exec:\vjddd.exe93⤵PID:3044
-
\??\c:\5rfxfff.exec:\5rfxfff.exe94⤵PID:1524
-
\??\c:\tnhbhh.exec:\tnhbhh.exe95⤵PID:548
-
\??\c:\1jdvj.exec:\1jdvj.exe96⤵PID:4428
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe97⤵PID:4132
-
\??\c:\bnhtht.exec:\bnhtht.exe98⤵PID:4660
-
\??\c:\bhttht.exec:\bhttht.exe99⤵PID:4324
-
\??\c:\pppjd.exec:\pppjd.exe100⤵PID:2992
-
\??\c:\flffxxr.exec:\flffxxr.exe101⤵PID:4444
-
\??\c:\5rrrllf.exec:\5rrrllf.exe102⤵PID:4264
-
\??\c:\tnbbbb.exec:\tnbbbb.exe103⤵PID:3476
-
\??\c:\9jjdv.exec:\9jjdv.exe104⤵PID:4332
-
\??\c:\rrxfxfx.exec:\rrxfxfx.exe105⤵PID:4620
-
\??\c:\tnnbnh.exec:\tnnbnh.exe106⤵PID:2168
-
\??\c:\jddvp.exec:\jddvp.exe107⤵
- System Location Discovery: System Language Discovery
PID:456 -
\??\c:\vdppv.exec:\vdppv.exe108⤵
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\fxlrlll.exec:\fxlrlll.exe109⤵PID:4504
-
\??\c:\bhnhbt.exec:\bhnhbt.exe110⤵PID:1052
-
\??\c:\bbbttt.exec:\bbbttt.exe111⤵PID:2084
-
\??\c:\1dppv.exec:\1dppv.exe112⤵PID:4776
-
\??\c:\llrrllf.exec:\llrrllf.exe113⤵PID:4420
-
\??\c:\flrrffl.exec:\flrrffl.exe114⤵PID:4248
-
\??\c:\btnhhb.exec:\btnhhb.exe115⤵PID:3960
-
\??\c:\djpjp.exec:\djpjp.exe116⤵PID:4900
-
\??\c:\dvjjj.exec:\dvjjj.exe117⤵PID:4780
-
\??\c:\5fxrffr.exec:\5fxrffr.exe118⤵PID:512
-
\??\c:\nhhbbb.exec:\nhhbbb.exe119⤵PID:848
-
\??\c:\pvvvv.exec:\pvvvv.exe120⤵PID:2928
-
\??\c:\vpvvv.exec:\vpvvv.exe121⤵PID:2296
-
\??\c:\lfxxxll.exec:\lfxxxll.exe122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-