Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 08:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db96dcc94674281c3f7e3f382e8b993d939848e6dbb2afe06565d30e8e14349c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
db96dcc94674281c3f7e3f382e8b993d939848e6dbb2afe06565d30e8e14349c.exe
-
Size
454KB
-
MD5
25d3694aea83a1f1c0d74f3f172d78cf
-
SHA1
e024bef825fc3a8585c2fc399ebfbdfa51241b3f
-
SHA256
db96dcc94674281c3f7e3f382e8b993d939848e6dbb2afe06565d30e8e14349c
-
SHA512
347b6bce39c10a36accac39f60be87f42806fb87e4e45136be01c59d068666ab70d65458d1daf45f2fb46c79c164cae617dfff71f062d879a57ababa88d6fa40
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/5064-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2348 7llffrx.exe 4620 jvvvp.exe 2028 fxfxffl.exe 2264 hhbbbn.exe 1692 hbbbbn.exe 3356 jvjvp.exe 2892 nhhhbb.exe 2484 rrxxxxx.exe 216 vdjdj.exe 868 frxrxxx.exe 3796 flffxrl.exe 4688 5bnntt.exe 2620 ttnnhn.exe 4936 ttbtnt.exe 2948 hnttbb.exe 2884 lllllxr.exe 4684 vppjj.exe 1376 frrlffx.exe 4560 7ntnbb.exe 1212 1vjjd.exe 3524 3dppv.exe 5044 tntnhn.exe 3396 pjddv.exe 1724 9ffxrrl.exe 3868 lllffff.exe 808 djppv.exe 1356 5pdvp.exe 3580 xllfxrl.exe 4692 jpvvd.exe 2860 fflllrx.exe 4564 tbbbbt.exe 1472 1flflrx.exe 400 1bttnn.exe 2516 jjddd.exe 1792 flflfrl.exe 1188 hnhtnn.exe 2364 9bhhnn.exe 2392 jjjdv.exe 2128 rfrfffx.exe 3156 7vppv.exe 4716 ffffxll.exe 536 rfffxxr.exe 3028 5dpjv.exe 1536 vvvpp.exe 3536 xrxrlrl.exe 2896 tntnhh.exe 4812 vpdvp.exe 3316 xfxrlff.exe 4960 bttnhn.exe 1932 ppppd.exe 1780 9vpjv.exe 4380 rrlrlff.exe 3644 nhnnht.exe 2304 bnhbtt.exe 3356 dvddv.exe 2216 fflfxxr.exe 1824 hhbhbb.exe 804 hbttnn.exe 3056 ppvvv.exe 3452 ddddd.exe 3540 xxllllf.exe 3612 hbbnnt.exe 4924 ddvpp.exe 4120 rfxlxlx.exe -
resource yara_rule behavioral2/memory/5064-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-587-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrlxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 2348 5064 db96dcc94674281c3f7e3f382e8b993d939848e6dbb2afe06565d30e8e14349c.exe 83 PID 5064 wrote to memory of 2348 5064 db96dcc94674281c3f7e3f382e8b993d939848e6dbb2afe06565d30e8e14349c.exe 83 PID 5064 wrote to memory of 2348 5064 db96dcc94674281c3f7e3f382e8b993d939848e6dbb2afe06565d30e8e14349c.exe 83 PID 2348 wrote to memory of 4620 2348 7llffrx.exe 84 PID 2348 wrote to memory of 4620 2348 7llffrx.exe 84 PID 2348 wrote to memory of 4620 2348 7llffrx.exe 84 PID 4620 wrote to memory of 2028 4620 jvvvp.exe 85 PID 4620 wrote to memory of 2028 4620 jvvvp.exe 85 PID 4620 wrote to memory of 2028 4620 jvvvp.exe 85 PID 2028 wrote to memory of 2264 2028 fxfxffl.exe 86 PID 2028 wrote to memory of 2264 2028 fxfxffl.exe 86 PID 2028 wrote to memory of 2264 2028 fxfxffl.exe 86 PID 2264 wrote to memory of 1692 2264 hhbbbn.exe 87 PID 2264 wrote to memory of 1692 2264 hhbbbn.exe 87 PID 2264 wrote to memory of 1692 2264 hhbbbn.exe 87 PID 1692 wrote to memory of 3356 1692 hbbbbn.exe 88 PID 1692 wrote to memory of 3356 1692 hbbbbn.exe 88 PID 1692 wrote to memory of 3356 1692 hbbbbn.exe 88 PID 3356 wrote to memory of 2892 3356 jvjvp.exe 89 PID 3356 wrote to memory of 2892 3356 jvjvp.exe 89 PID 3356 wrote to memory of 2892 3356 jvjvp.exe 89 PID 2892 wrote to memory of 2484 2892 nhhhbb.exe 90 PID 2892 wrote to memory of 2484 2892 nhhhbb.exe 90 PID 2892 wrote to memory of 2484 2892 nhhhbb.exe 90 PID 2484 wrote to memory of 216 2484 rrxxxxx.exe 91 PID 2484 wrote to memory of 216 2484 rrxxxxx.exe 91 PID 2484 wrote to memory of 216 2484 rrxxxxx.exe 91 PID 216 wrote to memory of 868 216 vdjdj.exe 92 PID 216 wrote to memory of 868 216 vdjdj.exe 92 PID 216 wrote to memory of 868 216 vdjdj.exe 92 PID 868 wrote to memory of 3796 868 frxrxxx.exe 93 PID 868 wrote to memory of 3796 868 frxrxxx.exe 93 PID 868 wrote to memory of 3796 868 frxrxxx.exe 93 PID 3796 wrote to memory of 4688 3796 flffxrl.exe 94 PID 3796 wrote to memory of 4688 3796 flffxrl.exe 94 PID 3796 wrote to memory of 4688 3796 flffxrl.exe 94 PID 4688 wrote to memory of 2620 4688 5bnntt.exe 95 PID 4688 wrote to memory of 2620 4688 5bnntt.exe 95 PID 4688 wrote to memory of 2620 4688 5bnntt.exe 95 PID 2620 wrote to memory of 4936 2620 ttnnhn.exe 96 PID 2620 wrote to memory of 4936 2620 ttnnhn.exe 96 PID 2620 wrote to memory of 4936 2620 ttnnhn.exe 96 PID 4936 wrote to memory of 2948 4936 ttbtnt.exe 97 PID 4936 wrote to memory of 2948 4936 ttbtnt.exe 97 PID 4936 wrote to memory of 2948 4936 ttbtnt.exe 97 PID 2948 wrote to memory of 2884 2948 hnttbb.exe 98 PID 2948 wrote to memory of 2884 2948 hnttbb.exe 98 PID 2948 wrote to memory of 2884 2948 hnttbb.exe 98 PID 2884 wrote to memory of 4684 2884 lllllxr.exe 99 PID 2884 wrote to memory of 4684 2884 lllllxr.exe 99 PID 2884 wrote to memory of 4684 2884 lllllxr.exe 99 PID 4684 wrote to memory of 1376 4684 vppjj.exe 100 PID 4684 wrote to memory of 1376 4684 vppjj.exe 100 PID 4684 wrote to memory of 1376 4684 vppjj.exe 100 PID 1376 wrote to memory of 4560 1376 frrlffx.exe 101 PID 1376 wrote to memory of 4560 1376 frrlffx.exe 101 PID 1376 wrote to memory of 4560 1376 frrlffx.exe 101 PID 4560 wrote to memory of 1212 4560 7ntnbb.exe 102 PID 4560 wrote to memory of 1212 4560 7ntnbb.exe 102 PID 4560 wrote to memory of 1212 4560 7ntnbb.exe 102 PID 1212 wrote to memory of 3524 1212 1vjjd.exe 103 PID 1212 wrote to memory of 3524 1212 1vjjd.exe 103 PID 1212 wrote to memory of 3524 1212 1vjjd.exe 103 PID 3524 wrote to memory of 5044 3524 3dppv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\db96dcc94674281c3f7e3f382e8b993d939848e6dbb2afe06565d30e8e14349c.exe"C:\Users\Admin\AppData\Local\Temp\db96dcc94674281c3f7e3f382e8b993d939848e6dbb2afe06565d30e8e14349c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\7llffrx.exec:\7llffrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\jvvvp.exec:\jvvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\fxfxffl.exec:\fxfxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\hhbbbn.exec:\hhbbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hbbbbn.exec:\hbbbbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\jvjvp.exec:\jvjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\nhhhbb.exec:\nhhhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\vdjdj.exec:\vdjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\frxrxxx.exec:\frxrxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\flffxrl.exec:\flffxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\5bnntt.exec:\5bnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\ttnnhn.exec:\ttnnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ttbtnt.exec:\ttbtnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\hnttbb.exec:\hnttbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\lllllxr.exec:\lllllxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\vppjj.exec:\vppjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\frrlffx.exec:\frrlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\7ntnbb.exec:\7ntnbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\1vjjd.exec:\1vjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\3dppv.exec:\3dppv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\tntnhn.exec:\tntnhn.exe23⤵
- Executes dropped EXE
PID:5044 -
\??\c:\pjddv.exec:\pjddv.exe24⤵
- Executes dropped EXE
PID:3396 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe25⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lllffff.exec:\lllffff.exe26⤵
- Executes dropped EXE
PID:3868 -
\??\c:\djppv.exec:\djppv.exe27⤵
- Executes dropped EXE
PID:808 -
\??\c:\5pdvp.exec:\5pdvp.exe28⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xllfxrl.exec:\xllfxrl.exe29⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jpvvd.exec:\jpvvd.exe30⤵
- Executes dropped EXE
PID:4692 -
\??\c:\fflllrx.exec:\fflllrx.exe31⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tbbbbt.exec:\tbbbbt.exe32⤵
- Executes dropped EXE
PID:4564 -
\??\c:\1flflrx.exec:\1flflrx.exe33⤵
- Executes dropped EXE
PID:1472 -
\??\c:\1bttnn.exec:\1bttnn.exe34⤵
- Executes dropped EXE
PID:400 -
\??\c:\jjddd.exec:\jjddd.exe35⤵
- Executes dropped EXE
PID:2516 -
\??\c:\flflfrl.exec:\flflfrl.exe36⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hnhtnn.exec:\hnhtnn.exe37⤵
- Executes dropped EXE
PID:1188 -
\??\c:\9bhhnn.exec:\9bhhnn.exe38⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jjjdv.exec:\jjjdv.exe39⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rfrfffx.exec:\rfrfffx.exe40⤵
- Executes dropped EXE
PID:2128 -
\??\c:\7vppv.exec:\7vppv.exe41⤵
- Executes dropped EXE
PID:3156 -
\??\c:\ffffxll.exec:\ffffxll.exe42⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rfffxxr.exec:\rfffxxr.exe43⤵
- Executes dropped EXE
PID:536 -
\??\c:\5dpjv.exec:\5dpjv.exe44⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vvvpp.exec:\vvvpp.exe45⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe46⤵
- Executes dropped EXE
PID:3536 -
\??\c:\tntnhh.exec:\tntnhh.exe47⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hthbtn.exec:\hthbtn.exe48⤵PID:1900
-
\??\c:\vpdvp.exec:\vpdvp.exe49⤵
- Executes dropped EXE
PID:4812 -
\??\c:\xfxrlff.exec:\xfxrlff.exe50⤵
- Executes dropped EXE
PID:3316 -
\??\c:\bttnhn.exec:\bttnhn.exe51⤵
- Executes dropped EXE
PID:4960 -
\??\c:\ppppd.exec:\ppppd.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1932 -
\??\c:\9vpjv.exec:\9vpjv.exe53⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rrlrlff.exec:\rrlrlff.exe54⤵
- Executes dropped EXE
PID:4380 -
\??\c:\nhnnht.exec:\nhnnht.exe55⤵
- Executes dropped EXE
PID:3644 -
\??\c:\bnhbtt.exec:\bnhbtt.exe56⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dvddv.exec:\dvddv.exe57⤵
- Executes dropped EXE
PID:3356 -
\??\c:\fflfxxr.exec:\fflfxxr.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hhbhbb.exec:\hhbhbb.exe59⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hbttnn.exec:\hbttnn.exe60⤵
- Executes dropped EXE
PID:804 -
\??\c:\ppvvv.exec:\ppvvv.exe61⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ddddd.exec:\ddddd.exe62⤵
- Executes dropped EXE
PID:3452 -
\??\c:\xxllllf.exec:\xxllllf.exe63⤵
- Executes dropped EXE
PID:3540 -
\??\c:\hbbnnt.exec:\hbbnnt.exe64⤵
- Executes dropped EXE
PID:3612 -
\??\c:\ddvpp.exec:\ddvpp.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4924 -
\??\c:\rfxlxlx.exec:\rfxlxlx.exe66⤵
- Executes dropped EXE
PID:4120 -
\??\c:\bbhhbb.exec:\bbhhbb.exe67⤵PID:3308
-
\??\c:\7vjjd.exec:\7vjjd.exe68⤵PID:2280
-
\??\c:\vdjdp.exec:\vdjdp.exe69⤵PID:420
-
\??\c:\frxrffr.exec:\frxrffr.exe70⤵PID:1800
-
\??\c:\btnhbt.exec:\btnhbt.exe71⤵PID:4440
-
\??\c:\jjppv.exec:\jjppv.exe72⤵PID:100
-
\??\c:\frlxlfx.exec:\frlxlfx.exe73⤵PID:4444
-
\??\c:\lllffxf.exec:\lllffxf.exe74⤵PID:1140
-
\??\c:\thnbnh.exec:\thnbnh.exe75⤵PID:2100
-
\??\c:\1dvvj.exec:\1dvvj.exe76⤵PID:1940
-
\??\c:\flrrlxr.exec:\flrrlxr.exe77⤵PID:3620
-
\??\c:\ffxfxlf.exec:\ffxfxlf.exe78⤵PID:4004
-
\??\c:\tththb.exec:\tththb.exe79⤵PID:5084
-
\??\c:\jddpj.exec:\jddpj.exe80⤵PID:2672
-
\??\c:\5rxlxlx.exec:\5rxlxlx.exe81⤵PID:3568
-
\??\c:\bbnhbt.exec:\bbnhbt.exe82⤵PID:1928
-
\??\c:\dvpjd.exec:\dvpjd.exe83⤵PID:3564
-
\??\c:\vpdpj.exec:\vpdpj.exe84⤵PID:4368
-
\??\c:\xxxllfr.exec:\xxxllfr.exe85⤵PID:4772
-
\??\c:\hbthtn.exec:\hbthtn.exe86⤵PID:4432
-
\??\c:\vvvpv.exec:\vvvpv.exe87⤵PID:1956
-
\??\c:\lrflxrl.exec:\lrflxrl.exe88⤵PID:4436
-
\??\c:\nhbntn.exec:\nhbntn.exe89⤵PID:4920
-
\??\c:\btbbtn.exec:\btbbtn.exe90⤵PID:4308
-
\??\c:\9vvjv.exec:\9vvjv.exe91⤵PID:2284
-
\??\c:\xxlrffx.exec:\xxlrffx.exe92⤵PID:1696
-
\??\c:\9tnbtt.exec:\9tnbtt.exe93⤵PID:4256
-
\??\c:\jpvvp.exec:\jpvvp.exe94⤵PID:3128
-
\??\c:\fxlfrlx.exec:\fxlfrlx.exe95⤵PID:4832
-
\??\c:\lflxlxf.exec:\lflxlxf.exe96⤵PID:2660
-
\??\c:\hhhtnh.exec:\hhhtnh.exe97⤵PID:5012
-
\??\c:\vppjd.exec:\vppjd.exe98⤵PID:4880
-
\??\c:\ppvpv.exec:\ppvpv.exe99⤵PID:4612
-
\??\c:\rxrrxxf.exec:\rxrrxxf.exe100⤵PID:3120
-
\??\c:\9btnbt.exec:\9btnbt.exe101⤵PID:4008
-
\??\c:\ppjjd.exec:\ppjjd.exe102⤵PID:764
-
\??\c:\1fxrfxl.exec:\1fxrfxl.exe103⤵PID:632
-
\??\c:\9nhthn.exec:\9nhthn.exe104⤵PID:1388
-
\??\c:\3pjdp.exec:\3pjdp.exe105⤵PID:3124
-
\??\c:\pppjd.exec:\pppjd.exe106⤵PID:3352
-
\??\c:\flrrrrx.exec:\flrrrrx.exe107⤵PID:2352
-
\??\c:\ntnntt.exec:\ntnntt.exe108⤵PID:4480
-
\??\c:\bbbtbb.exec:\bbbtbb.exe109⤵PID:456
-
\??\c:\1ddvv.exec:\1ddvv.exe110⤵PID:1764
-
\??\c:\9flxfff.exec:\9flxfff.exe111⤵PID:2064
-
\??\c:\lrlrlrl.exec:\lrlrlrl.exe112⤵PID:4816
-
\??\c:\hntttn.exec:\hntttn.exe113⤵PID:2264
-
\??\c:\dppjv.exec:\dppjv.exe114⤵PID:3560
-
\??\c:\3xfxxxr.exec:\3xfxxxr.exe115⤵PID:2820
-
\??\c:\nttnbt.exec:\nttnbt.exe116⤵PID:2828
-
\??\c:\bbbbtn.exec:\bbbbtn.exe117⤵PID:4648
-
\??\c:\pdjjd.exec:\pdjjd.exe118⤵PID:4756
-
\??\c:\rrrlffx.exec:\rrrlffx.exe119⤵PID:3888
-
\??\c:\rrlxrlf.exec:\rrlxrlf.exe120⤵PID:3740
-
\??\c:\hhnhnn.exec:\hhnhnn.exe121⤵PID:804
-
\??\c:\vpvpv.exec:\vpvpv.exe122⤵PID:3712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-