Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 09:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f4fa29200c65440a32f6e0998d47b7eea7a70dccc7d69d6002c67d7365cc074.exe
Resource
win7-20241023-en
7 signatures
120 seconds
General
-
Target
8f4fa29200c65440a32f6e0998d47b7eea7a70dccc7d69d6002c67d7365cc074.exe
-
Size
456KB
-
MD5
d658d7a0f530660440f550031e5983cf
-
SHA1
a0399dffba47bee2c109f985154c9c0e5355411a
-
SHA256
8f4fa29200c65440a32f6e0998d47b7eea7a70dccc7d69d6002c67d7365cc074
-
SHA512
7612c677b7747599550e11803bc9cfe6b09773ce18d2b4d713c008669a9ec7735a509ef9b27f6d36634819528f4d4f3b3506f6be34077368dabe4f08e55309f6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRn:q7Tc2NYHUrAwfMp3CDRn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4944-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-821-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-916-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-1145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-1905-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2404 ppvpp.exe 1204 9xxlfff.exe 1996 nttbth.exe 4820 9ffxrfl.exe 4136 9btnhh.exe 4596 lxxfxxx.exe 3268 9hbttt.exe 2780 ffrrflr.exe 396 rlrxxrx.exe 4108 ntnnbn.exe 3204 5vddd.exe 3520 xfrxlxx.exe 3464 5nbbhh.exe 3620 frxxrxx.exe 4976 9dppv.exe 3220 nhhhhh.exe 112 vjpjj.exe 1404 xrxrxxr.exe 2496 frxrlff.exe 4840 pjvvv.exe 3656 nhhnhb.exe 4380 lrrrrrf.exe 1148 jdjdv.exe 1648 xxlfrfr.exe 4880 ddjpv.exe 3988 lxllfll.exe 460 tttttb.exe 1112 fllfxxr.exe 4764 hnttnn.exe 4496 bttthn.exe 1376 fxrrffr.exe 400 tnttth.exe 4932 7vdjp.exe 3976 lrxxxxl.exe 4328 bhtnhb.exe 876 ddjjj.exe 2520 flfxxll.exe 4128 thtntt.exe 5072 rxrlrrx.exe 2556 jdjdd.exe 3740 vvvvj.exe 2152 lfrfffx.exe 412 5bnhtt.exe 2552 5dvjd.exe 1472 lxffxlf.exe 2640 tntbbh.exe 2928 1jppj.exe 1836 fxlfflx.exe 2220 llrrxxf.exe 1416 nnhhnt.exe 1560 jjvvp.exe 4668 9lrrlrr.exe 3420 lrxrlll.exe 4936 tntttt.exe 4864 3ddpp.exe 3732 htthbt.exe 2044 jvjjj.exe 1944 lrxxxxx.exe 4748 3bhhbn.exe 4924 pvppd.exe 4452 dpdvj.exe 2740 3ffxlll.exe 2544 nbhnht.exe 4428 nhnnnn.exe -
resource yara_rule behavioral2/memory/4944-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-916-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 2404 4944 8f4fa29200c65440a32f6e0998d47b7eea7a70dccc7d69d6002c67d7365cc074.exe 83 PID 4944 wrote to memory of 2404 4944 8f4fa29200c65440a32f6e0998d47b7eea7a70dccc7d69d6002c67d7365cc074.exe 83 PID 4944 wrote to memory of 2404 4944 8f4fa29200c65440a32f6e0998d47b7eea7a70dccc7d69d6002c67d7365cc074.exe 83 PID 2404 wrote to memory of 1204 2404 ppvpp.exe 84 PID 2404 wrote to memory of 1204 2404 ppvpp.exe 84 PID 2404 wrote to memory of 1204 2404 ppvpp.exe 84 PID 1204 wrote to memory of 1996 1204 9xxlfff.exe 85 PID 1204 wrote to memory of 1996 1204 9xxlfff.exe 85 PID 1204 wrote to memory of 1996 1204 9xxlfff.exe 85 PID 1996 wrote to memory of 4820 1996 nttbth.exe 86 PID 1996 wrote to memory of 4820 1996 nttbth.exe 86 PID 1996 wrote to memory of 4820 1996 nttbth.exe 86 PID 4820 wrote to memory of 4136 4820 9ffxrfl.exe 87 PID 4820 wrote to memory of 4136 4820 9ffxrfl.exe 87 PID 4820 wrote to memory of 4136 4820 9ffxrfl.exe 87 PID 4136 wrote to memory of 4596 4136 9btnhh.exe 88 PID 4136 wrote to memory of 4596 4136 9btnhh.exe 88 PID 4136 wrote to memory of 4596 4136 9btnhh.exe 88 PID 4596 wrote to memory of 3268 4596 lxxfxxx.exe 89 PID 4596 wrote to memory of 3268 4596 lxxfxxx.exe 89 PID 4596 wrote to memory of 3268 4596 lxxfxxx.exe 89 PID 3268 wrote to memory of 2780 3268 9hbttt.exe 90 PID 3268 wrote to memory of 2780 3268 9hbttt.exe 90 PID 3268 wrote to memory of 2780 3268 9hbttt.exe 90 PID 2780 wrote to memory of 396 2780 ffrrflr.exe 91 PID 2780 wrote to memory of 396 2780 ffrrflr.exe 91 PID 2780 wrote to memory of 396 2780 ffrrflr.exe 91 PID 396 wrote to memory of 4108 396 rlrxxrx.exe 92 PID 396 wrote to memory of 4108 396 rlrxxrx.exe 92 PID 396 wrote to memory of 4108 396 rlrxxrx.exe 92 PID 4108 wrote to memory of 3204 4108 ntnnbn.exe 93 PID 4108 wrote to memory of 3204 4108 ntnnbn.exe 93 PID 4108 wrote to memory of 3204 4108 ntnnbn.exe 93 PID 3204 wrote to memory of 3520 3204 5vddd.exe 94 PID 3204 wrote to memory of 3520 3204 5vddd.exe 94 PID 3204 wrote to memory of 3520 3204 5vddd.exe 94 PID 3520 wrote to memory of 3464 3520 xfrxlxx.exe 95 PID 3520 wrote to memory of 3464 3520 xfrxlxx.exe 95 PID 3520 wrote to memory of 3464 3520 xfrxlxx.exe 95 PID 3464 wrote to memory of 3620 3464 5nbbhh.exe 96 PID 3464 wrote to memory of 3620 3464 5nbbhh.exe 96 PID 3464 wrote to memory of 3620 3464 5nbbhh.exe 96 PID 3620 wrote to memory of 4976 3620 frxxrxx.exe 97 PID 3620 wrote to memory of 4976 3620 frxxrxx.exe 97 PID 3620 wrote to memory of 4976 3620 frxxrxx.exe 97 PID 4976 wrote to memory of 3220 4976 9dppv.exe 98 PID 4976 wrote to memory of 3220 4976 9dppv.exe 98 PID 4976 wrote to memory of 3220 4976 9dppv.exe 98 PID 3220 wrote to memory of 112 3220 nhhhhh.exe 99 PID 3220 wrote to memory of 112 3220 nhhhhh.exe 99 PID 3220 wrote to memory of 112 3220 nhhhhh.exe 99 PID 112 wrote to memory of 1404 112 vjpjj.exe 100 PID 112 wrote to memory of 1404 112 vjpjj.exe 100 PID 112 wrote to memory of 1404 112 vjpjj.exe 100 PID 1404 wrote to memory of 2496 1404 xrxrxxr.exe 101 PID 1404 wrote to memory of 2496 1404 xrxrxxr.exe 101 PID 1404 wrote to memory of 2496 1404 xrxrxxr.exe 101 PID 2496 wrote to memory of 4840 2496 frxrlff.exe 102 PID 2496 wrote to memory of 4840 2496 frxrlff.exe 102 PID 2496 wrote to memory of 4840 2496 frxrlff.exe 102 PID 4840 wrote to memory of 3656 4840 pjvvv.exe 103 PID 4840 wrote to memory of 3656 4840 pjvvv.exe 103 PID 4840 wrote to memory of 3656 4840 pjvvv.exe 103 PID 3656 wrote to memory of 4380 3656 nhhnhb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f4fa29200c65440a32f6e0998d47b7eea7a70dccc7d69d6002c67d7365cc074.exe"C:\Users\Admin\AppData\Local\Temp\8f4fa29200c65440a32f6e0998d47b7eea7a70dccc7d69d6002c67d7365cc074.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\ppvpp.exec:\ppvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\9xxlfff.exec:\9xxlfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\nttbth.exec:\nttbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\9ffxrfl.exec:\9ffxrfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\9btnhh.exec:\9btnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\lxxfxxx.exec:\lxxfxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\9hbttt.exec:\9hbttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\ffrrflr.exec:\ffrrflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rlrxxrx.exec:\rlrxxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\ntnnbn.exec:\ntnnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\5vddd.exec:\5vddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\xfrxlxx.exec:\xfrxlxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\5nbbhh.exec:\5nbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\frxxrxx.exec:\frxxrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\9dppv.exec:\9dppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\nhhhhh.exec:\nhhhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\vjpjj.exec:\vjpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\xrxrxxr.exec:\xrxrxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\frxrlff.exec:\frxrlff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\pjvvv.exec:\pjvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\nhhnhb.exec:\nhhnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\lrrrrrf.exec:\lrrrrrf.exe23⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jdjdv.exec:\jdjdv.exe24⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xxlfrfr.exec:\xxlfrfr.exe25⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ddjpv.exec:\ddjpv.exe26⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lxllfll.exec:\lxllfll.exe27⤵
- Executes dropped EXE
PID:3988 -
\??\c:\tttttb.exec:\tttttb.exe28⤵
- Executes dropped EXE
PID:460 -
\??\c:\fllfxxr.exec:\fllfxxr.exe29⤵
- Executes dropped EXE
PID:1112 -
\??\c:\hnttnn.exec:\hnttnn.exe30⤵
- Executes dropped EXE
PID:4764 -
\??\c:\bttthn.exec:\bttthn.exe31⤵
- Executes dropped EXE
PID:4496 -
\??\c:\fxrrffr.exec:\fxrrffr.exe32⤵
- Executes dropped EXE
PID:1376 -
\??\c:\tnttth.exec:\tnttth.exe33⤵
- Executes dropped EXE
PID:400 -
\??\c:\7vdjp.exec:\7vdjp.exe34⤵
- Executes dropped EXE
PID:4932 -
\??\c:\lrxxxxl.exec:\lrxxxxl.exe35⤵
- Executes dropped EXE
PID:3976 -
\??\c:\bhtnhb.exec:\bhtnhb.exe36⤵
- Executes dropped EXE
PID:4328 -
\??\c:\ddjjj.exec:\ddjjj.exe37⤵
- Executes dropped EXE
PID:876 -
\??\c:\flfxxll.exec:\flfxxll.exe38⤵
- Executes dropped EXE
PID:2520 -
\??\c:\thtntt.exec:\thtntt.exe39⤵
- Executes dropped EXE
PID:4128 -
\??\c:\rxrlrrx.exec:\rxrlrrx.exe40⤵
- Executes dropped EXE
PID:5072 -
\??\c:\jdjdd.exec:\jdjdd.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vvvvj.exec:\vvvvj.exe42⤵
- Executes dropped EXE
PID:3740 -
\??\c:\lfrfffx.exec:\lfrfffx.exe43⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5bnhtt.exec:\5bnhtt.exe44⤵
- Executes dropped EXE
PID:412 -
\??\c:\5dvjd.exec:\5dvjd.exe45⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lxffxlf.exec:\lxffxlf.exe46⤵
- Executes dropped EXE
PID:1472 -
\??\c:\tntbbh.exec:\tntbbh.exe47⤵
- Executes dropped EXE
PID:2640 -
\??\c:\1jppj.exec:\1jppj.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fxlfflx.exec:\fxlfflx.exe49⤵
- Executes dropped EXE
PID:1836 -
\??\c:\llrrxxf.exec:\llrrxxf.exe50⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nnhhnt.exec:\nnhhnt.exe51⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jjvvp.exec:\jjvvp.exe52⤵
- Executes dropped EXE
PID:1560 -
\??\c:\9lrrlrr.exec:\9lrrlrr.exe53⤵
- Executes dropped EXE
PID:4668 -
\??\c:\lrxrlll.exec:\lrxrlll.exe54⤵
- Executes dropped EXE
PID:3420 -
\??\c:\tntttt.exec:\tntttt.exe55⤵
- Executes dropped EXE
PID:4936 -
\??\c:\3ddpp.exec:\3ddpp.exe56⤵
- Executes dropped EXE
PID:4864 -
\??\c:\htthbt.exec:\htthbt.exe57⤵
- Executes dropped EXE
PID:3732 -
\??\c:\jvjjj.exec:\jvjjj.exe58⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lrxxxxx.exec:\lrxxxxx.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3bhhbn.exec:\3bhhbn.exe60⤵
- Executes dropped EXE
PID:4748 -
\??\c:\pvppd.exec:\pvppd.exe61⤵
- Executes dropped EXE
PID:4924 -
\??\c:\dpdvj.exec:\dpdvj.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4452 -
\??\c:\3ffxlll.exec:\3ffxlll.exe63⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nbhnht.exec:\nbhnht.exe64⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhnnnn.exec:\nhnnnn.exe65⤵
- Executes dropped EXE
PID:4428 -
\??\c:\jjjpv.exec:\jjjpv.exe66⤵PID:4592
-
\??\c:\5ffxrrl.exec:\5ffxrrl.exe67⤵PID:3964
-
\??\c:\nhbtbb.exec:\nhbtbb.exe68⤵PID:1652
-
\??\c:\jpvvj.exec:\jpvvj.exe69⤵PID:4992
-
\??\c:\vpjpj.exec:\vpjpj.exe70⤵PID:3816
-
\??\c:\fxlflll.exec:\fxlflll.exe71⤵PID:3704
-
\??\c:\thbtnn.exec:\thbtnn.exe72⤵PID:8
-
\??\c:\hnhtnh.exec:\hnhtnh.exe73⤵PID:112
-
\??\c:\1jddv.exec:\1jddv.exe74⤵PID:2080
-
\??\c:\rxxrrxx.exec:\rxxrrxx.exe75⤵PID:1548
-
\??\c:\thnhbh.exec:\thnhbh.exe76⤵PID:60
-
\??\c:\vdppp.exec:\vdppp.exe77⤵PID:4724
-
\??\c:\flrllrr.exec:\flrllrr.exe78⤵PID:1900
-
\??\c:\ttbhnb.exec:\ttbhnb.exe79⤵PID:3092
-
\??\c:\dpjvj.exec:\dpjvj.exe80⤵PID:1616
-
\??\c:\llrllrr.exec:\llrllrr.exe81⤵PID:940
-
\??\c:\hntthh.exec:\hntthh.exe82⤵PID:1864
-
\??\c:\nthbtb.exec:\nthbtb.exe83⤵PID:1408
-
\??\c:\dvjjj.exec:\dvjjj.exe84⤵PID:1648
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe85⤵PID:2876
-
\??\c:\nttttt.exec:\nttttt.exe86⤵PID:3952
-
\??\c:\jjppp.exec:\jjppp.exe87⤵PID:2336
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe88⤵PID:4468
-
\??\c:\htbbbb.exec:\htbbbb.exe89⤵PID:4560
-
\??\c:\ttbntb.exec:\ttbntb.exe90⤵PID:4956
-
\??\c:\jvddd.exec:\jvddd.exe91⤵PID:1972
-
\??\c:\lxlfxff.exec:\lxlfxff.exe92⤵PID:768
-
\??\c:\thtnnn.exec:\thtnnn.exe93⤵PID:4504
-
\??\c:\nthhbh.exec:\nthhbh.exe94⤵PID:1556
-
\??\c:\1dpdv.exec:\1dpdv.exe95⤵PID:3792
-
\??\c:\rllrrrl.exec:\rllrrrl.exe96⤵PID:4932
-
\??\c:\nhnnnn.exec:\nhnnnn.exe97⤵PID:2584
-
\??\c:\ppppv.exec:\ppppv.exe98⤵PID:3812
-
\??\c:\fxffxxf.exec:\fxffxxf.exe99⤵PID:2752
-
\??\c:\tbtnhn.exec:\tbtnhn.exe100⤵PID:4124
-
\??\c:\7jdvv.exec:\7jdvv.exe101⤵PID:2372
-
\??\c:\1pvvv.exec:\1pvvv.exe102⤵PID:2684
-
\??\c:\xxfxxfl.exec:\xxfxxfl.exe103⤵PID:3756
-
\??\c:\nhbbbb.exec:\nhbbbb.exe104⤵PID:4104
-
\??\c:\vjpvj.exec:\vjpvj.exe105⤵
- System Location Discovery: System Language Discovery
PID:3216 -
\??\c:\jvpdd.exec:\jvpdd.exe106⤵PID:3776
-
\??\c:\9rrrrrr.exec:\9rrrrrr.exe107⤵PID:452
-
\??\c:\ttbbtt.exec:\ttbbtt.exe108⤵PID:4964
-
\??\c:\bbnnnn.exec:\bbnnnn.exe109⤵PID:3796
-
\??\c:\dvjjj.exec:\dvjjj.exe110⤵PID:4400
-
\??\c:\1lfllrx.exec:\1lfllrx.exe111⤵PID:1636
-
\??\c:\nbhbbb.exec:\nbhbbb.exe112⤵PID:1836
-
\??\c:\vvvvp.exec:\vvvvp.exe113⤵PID:4780
-
\??\c:\lfrrlll.exec:\lfrrlll.exe114⤵PID:3240
-
\??\c:\ntbtht.exec:\ntbtht.exe115⤵PID:212
-
\??\c:\vvdvv.exec:\vvdvv.exe116⤵PID:2908
-
\??\c:\xlffxfl.exec:\xlffxfl.exe117⤵PID:2760
-
\??\c:\ttnntt.exec:\ttnntt.exe118⤵PID:208
-
\??\c:\bthbtb.exec:\bthbtb.exe119⤵PID:1600
-
\??\c:\ddpjp.exec:\ddpjp.exe120⤵PID:1496
-
\??\c:\llllxll.exec:\llllxll.exe121⤵PID:1912
-
\??\c:\llllfxf.exec:\llllfxf.exe122⤵PID:1876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-