Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 09:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe
-
Size
454KB
-
MD5
028354d76bfca5b4d8452fd7dad45001
-
SHA1
7f5a15adf340040e323df9c4e43360861f3c5200
-
SHA256
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d
-
SHA512
ce6edfa4d27a6dc8a054b093bb97afceb40da0b01913efff223e5305094cc920f4ec3f9b807eb1458c5c417b01965e7043385aaac8a3b827440dfd2314a2ffa1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4020-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-967-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-1770-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2112 rxxrrfx.exe 4784 ddppv.exe 3984 vjdvp.exe 1916 5tbthh.exe 4692 lrflrrr.exe 4052 5bhhbh.exe 4220 pdvjj.exe 3528 lfllfrl.exe 1492 frfffrx.exe 4592 fxfrllf.exe 232 3vvvv.exe 2636 flxrrxx.exe 100 lflfffx.exe 1340 1pdjv.exe 3156 xffffxr.exe 228 rflxfxx.exe 2724 bbntnn.exe 2312 vvdvv.exe 3192 bbhttn.exe 2008 fflxflx.exe 3512 bhhttn.exe 1448 pvjpv.exe 3116 rlrlffl.exe 4032 vvddp.exe 1280 frxrxrx.exe 4184 jdppv.exe 4060 xrxrrrl.exe 1168 nnttbn.exe 1044 ffrllrl.exe 3540 nhtbnt.exe 3836 fxrrlrr.exe 2688 nthbtt.exe 1256 jpjjv.exe 816 xfxrllx.exe 3668 ppppp.exe 5004 rrxxrxx.exe 2160 7thhhh.exe 3392 xfrlffx.exe 4516 dpvpp.exe 4304 hnhttn.exe 2404 bthbbt.exe 1796 1pjjj.exe 1936 xrfxfxf.exe 1404 nthnnn.exe 5096 pvddv.exe 5116 9fxxrrl.exe 3176 tnnhnn.exe 4728 nhnhbb.exe 3912 jdppj.exe 1676 7llfxfx.exe 1992 ntbhtb.exe 4824 jvjjv.exe 3020 xrxxffx.exe 4884 ntbbtn.exe 4732 dvdvp.exe 556 9dpjd.exe 4880 rffflrr.exe 408 fxffffl.exe 2072 htbbbb.exe 1092 3jvpv.exe 2104 rxfrlrl.exe 4716 jvpdp.exe 848 hbtbhn.exe 1812 pjpjp.exe -
resource yara_rule behavioral2/memory/4020-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-559-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4020 wrote to memory of 2112 4020 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 83 PID 4020 wrote to memory of 2112 4020 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 83 PID 4020 wrote to memory of 2112 4020 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 83 PID 2112 wrote to memory of 4784 2112 rxxrrfx.exe 84 PID 2112 wrote to memory of 4784 2112 rxxrrfx.exe 84 PID 2112 wrote to memory of 4784 2112 rxxrrfx.exe 84 PID 4784 wrote to memory of 3984 4784 ddppv.exe 85 PID 4784 wrote to memory of 3984 4784 ddppv.exe 85 PID 4784 wrote to memory of 3984 4784 ddppv.exe 85 PID 3984 wrote to memory of 1916 3984 vjdvp.exe 86 PID 3984 wrote to memory of 1916 3984 vjdvp.exe 86 PID 3984 wrote to memory of 1916 3984 vjdvp.exe 86 PID 1916 wrote to memory of 4692 1916 5tbthh.exe 87 PID 1916 wrote to memory of 4692 1916 5tbthh.exe 87 PID 1916 wrote to memory of 4692 1916 5tbthh.exe 87 PID 4692 wrote to memory of 4052 4692 lrflrrr.exe 88 PID 4692 wrote to memory of 4052 4692 lrflrrr.exe 88 PID 4692 wrote to memory of 4052 4692 lrflrrr.exe 88 PID 4052 wrote to memory of 4220 4052 5bhhbh.exe 89 PID 4052 wrote to memory of 4220 4052 5bhhbh.exe 89 PID 4052 wrote to memory of 4220 4052 5bhhbh.exe 89 PID 4220 wrote to memory of 3528 4220 pdvjj.exe 90 PID 4220 wrote to memory of 3528 4220 pdvjj.exe 90 PID 4220 wrote to memory of 3528 4220 pdvjj.exe 90 PID 3528 wrote to memory of 1492 3528 lfllfrl.exe 91 PID 3528 wrote to memory of 1492 3528 lfllfrl.exe 91 PID 3528 wrote to memory of 1492 3528 lfllfrl.exe 91 PID 1492 wrote to memory of 4592 1492 frfffrx.exe 92 PID 1492 wrote to memory of 4592 1492 frfffrx.exe 92 PID 1492 wrote to memory of 4592 1492 frfffrx.exe 92 PID 4592 wrote to memory of 232 4592 fxfrllf.exe 93 PID 4592 wrote to memory of 232 4592 fxfrllf.exe 93 PID 4592 wrote to memory of 232 4592 fxfrllf.exe 93 PID 232 wrote to memory of 2636 232 3vvvv.exe 94 PID 232 wrote to memory of 2636 232 3vvvv.exe 94 PID 232 wrote to memory of 2636 232 3vvvv.exe 94 PID 2636 wrote to memory of 100 2636 flxrrxx.exe 95 PID 2636 wrote to memory of 100 2636 flxrrxx.exe 95 PID 2636 wrote to memory of 100 2636 flxrrxx.exe 95 PID 100 wrote to memory of 1340 100 lflfffx.exe 96 PID 100 wrote to memory of 1340 100 lflfffx.exe 96 PID 100 wrote to memory of 1340 100 lflfffx.exe 96 PID 1340 wrote to memory of 3156 1340 1pdjv.exe 97 PID 1340 wrote to memory of 3156 1340 1pdjv.exe 97 PID 1340 wrote to memory of 3156 1340 1pdjv.exe 97 PID 3156 wrote to memory of 228 3156 xffffxr.exe 98 PID 3156 wrote to memory of 228 3156 xffffxr.exe 98 PID 3156 wrote to memory of 228 3156 xffffxr.exe 98 PID 228 wrote to memory of 2724 228 rflxfxx.exe 99 PID 228 wrote to memory of 2724 228 rflxfxx.exe 99 PID 228 wrote to memory of 2724 228 rflxfxx.exe 99 PID 2724 wrote to memory of 2312 2724 bbntnn.exe 100 PID 2724 wrote to memory of 2312 2724 bbntnn.exe 100 PID 2724 wrote to memory of 2312 2724 bbntnn.exe 100 PID 2312 wrote to memory of 3192 2312 vvdvv.exe 101 PID 2312 wrote to memory of 3192 2312 vvdvv.exe 101 PID 2312 wrote to memory of 3192 2312 vvdvv.exe 101 PID 3192 wrote to memory of 2008 3192 bbhttn.exe 102 PID 3192 wrote to memory of 2008 3192 bbhttn.exe 102 PID 3192 wrote to memory of 2008 3192 bbhttn.exe 102 PID 2008 wrote to memory of 3512 2008 fflxflx.exe 103 PID 2008 wrote to memory of 3512 2008 fflxflx.exe 103 PID 2008 wrote to memory of 3512 2008 fflxflx.exe 103 PID 3512 wrote to memory of 1448 3512 bhhttn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe"C:\Users\Admin\AppData\Local\Temp\b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\rxxrrfx.exec:\rxxrrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\ddppv.exec:\ddppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\vjdvp.exec:\vjdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\5tbthh.exec:\5tbthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\lrflrrr.exec:\lrflrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\5bhhbh.exec:\5bhhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\pdvjj.exec:\pdvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\lfllfrl.exec:\lfllfrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\frfffrx.exec:\frfffrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\fxfrllf.exec:\fxfrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\3vvvv.exec:\3vvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\flxrrxx.exec:\flxrrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lflfffx.exec:\lflfffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\1pdjv.exec:\1pdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\xffffxr.exec:\xffffxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\rflxfxx.exec:\rflxfxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\bbntnn.exec:\bbntnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\vvdvv.exec:\vvdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\bbhttn.exec:\bbhttn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\fflxflx.exec:\fflxflx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\bhhttn.exec:\bhhttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\pvjpv.exec:\pvjpv.exe23⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rlrlffl.exec:\rlrlffl.exe24⤵
- Executes dropped EXE
PID:3116 -
\??\c:\vvddp.exec:\vvddp.exe25⤵
- Executes dropped EXE
PID:4032 -
\??\c:\frxrxrx.exec:\frxrxrx.exe26⤵
- Executes dropped EXE
PID:1280 -
\??\c:\jdppv.exec:\jdppv.exe27⤵
- Executes dropped EXE
PID:4184 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe28⤵
- Executes dropped EXE
PID:4060 -
\??\c:\nnttbn.exec:\nnttbn.exe29⤵
- Executes dropped EXE
PID:1168 -
\??\c:\ffrllrl.exec:\ffrllrl.exe30⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nhtbnt.exec:\nhtbnt.exe31⤵
- Executes dropped EXE
PID:3540 -
\??\c:\fxrrlrr.exec:\fxrrlrr.exe32⤵
- Executes dropped EXE
PID:3836 -
\??\c:\nthbtt.exec:\nthbtt.exe33⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jpjjv.exec:\jpjjv.exe34⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xfxrllx.exec:\xfxrllx.exe35⤵
- Executes dropped EXE
PID:816 -
\??\c:\ppppp.exec:\ppppp.exe36⤵
- Executes dropped EXE
PID:3668 -
\??\c:\rrxxrxx.exec:\rrxxrxx.exe37⤵
- Executes dropped EXE
PID:5004 -
\??\c:\7thhhh.exec:\7thhhh.exe38⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xfrlffx.exec:\xfrlffx.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3392 -
\??\c:\dpvpp.exec:\dpvpp.exe40⤵
- Executes dropped EXE
PID:4516 -
\??\c:\hnhttn.exec:\hnhttn.exe41⤵
- Executes dropped EXE
PID:4304 -
\??\c:\bthbbt.exec:\bthbbt.exe42⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1pjjj.exec:\1pjjj.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe44⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nthnnn.exec:\nthnnn.exe45⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pvddv.exec:\pvddv.exe46⤵
- Executes dropped EXE
PID:5096 -
\??\c:\9fxxrrl.exec:\9fxxrrl.exe47⤵
- Executes dropped EXE
PID:5116 -
\??\c:\tnnhnn.exec:\tnnhnn.exe48⤵
- Executes dropped EXE
PID:3176 -
\??\c:\nhnhbb.exec:\nhnhbb.exe49⤵
- Executes dropped EXE
PID:4728 -
\??\c:\jdppj.exec:\jdppj.exe50⤵
- Executes dropped EXE
PID:3912 -
\??\c:\7llfxfx.exec:\7llfxfx.exe51⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ntbhtb.exec:\ntbhtb.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jvjjv.exec:\jvjjv.exe53⤵
- Executes dropped EXE
PID:4824 -
\??\c:\xrxxffx.exec:\xrxxffx.exe54⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ntbbtn.exec:\ntbbtn.exe55⤵
- Executes dropped EXE
PID:4884 -
\??\c:\dvdvp.exec:\dvdvp.exe56⤵
- Executes dropped EXE
PID:4732 -
\??\c:\9dpjd.exec:\9dpjd.exe57⤵
- Executes dropped EXE
PID:556 -
\??\c:\rffflrr.exec:\rffflrr.exe58⤵
- Executes dropped EXE
PID:4880 -
\??\c:\fxffffl.exec:\fxffffl.exe59⤵
- Executes dropped EXE
PID:408 -
\??\c:\htbbbb.exec:\htbbbb.exe60⤵
- Executes dropped EXE
PID:2072 -
\??\c:\3jvpv.exec:\3jvpv.exe61⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rxfrlrl.exec:\rxfrlrl.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jvpdp.exec:\jvpdp.exe63⤵
- Executes dropped EXE
PID:4716 -
\??\c:\hbtbhn.exec:\hbtbhn.exe64⤵
- Executes dropped EXE
PID:848 -
\??\c:\pjpjp.exec:\pjpjp.exe65⤵
- Executes dropped EXE
PID:1812 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe66⤵PID:3036
-
\??\c:\5thhnn.exec:\5thhnn.exe67⤵PID:4000
-
\??\c:\7ppjv.exec:\7ppjv.exe68⤵PID:4984
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe69⤵PID:2260
-
\??\c:\tbbhhh.exec:\tbbhhh.exe70⤵PID:4280
-
\??\c:\pjvvv.exec:\pjvvv.exe71⤵PID:3904
-
\??\c:\xlrlrxr.exec:\xlrlrxr.exe72⤵PID:2712
-
\??\c:\nthhhn.exec:\nthhhn.exe73⤵PID:4300
-
\??\c:\vpjjp.exec:\vpjjp.exe74⤵PID:2312
-
\??\c:\lxllrfx.exec:\lxllrfx.exe75⤵PID:3192
-
\??\c:\3thbhh.exec:\3thbhh.exe76⤵PID:740
-
\??\c:\jdjdv.exec:\jdjdv.exe77⤵PID:1768
-
\??\c:\rllffxx.exec:\rllffxx.exe78⤵PID:3788
-
\??\c:\bhbttn.exec:\bhbttn.exe79⤵PID:4460
-
\??\c:\llxxlll.exec:\llxxlll.exe80⤵PID:3116
-
\??\c:\nhhhbn.exec:\nhhhbn.exe81⤵PID:4580
-
\??\c:\vjvvj.exec:\vjvvj.exe82⤵PID:2576
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe83⤵PID:1900
-
\??\c:\xxlrrfl.exec:\xxlrrfl.exe84⤵PID:1668
-
\??\c:\bbbhbh.exec:\bbbhbh.exe85⤵PID:2692
-
\??\c:\9jvpj.exec:\9jvpj.exe86⤵PID:2788
-
\??\c:\fxffrrr.exec:\fxffrrr.exe87⤵PID:1612
-
\??\c:\nbbbnb.exec:\nbbbnb.exe88⤵PID:4364
-
\??\c:\hhbbtt.exec:\hhbbtt.exe89⤵PID:3988
-
\??\c:\7pddd.exec:\7pddd.exe90⤵PID:2204
-
\??\c:\5fxxfxl.exec:\5fxxfxl.exe91⤵PID:2436
-
\??\c:\hhttnb.exec:\hhttnb.exe92⤵PID:2716
-
\??\c:\jvvpp.exec:\jvvpp.exe93⤵PID:1472
-
\??\c:\dvpjd.exec:\dvpjd.exe94⤵PID:1772
-
\??\c:\9rffxxr.exec:\9rffxxr.exe95⤵PID:4996
-
\??\c:\ntbnhh.exec:\ntbnhh.exe96⤵PID:5004
-
\??\c:\djddj.exec:\djddj.exe97⤵PID:2220
-
\??\c:\lffxrrl.exec:\lffxrrl.exe98⤵PID:5104
-
\??\c:\bthhbh.exec:\bthhbh.exe99⤵PID:3636
-
\??\c:\pjpjj.exec:\pjpjj.exe100⤵PID:1608
-
\??\c:\llxxrrr.exec:\llxxrrr.exe101⤵PID:4492
-
\??\c:\hnhbtt.exec:\hnhbtt.exe102⤵PID:2616
-
\??\c:\tnntht.exec:\tnntht.exe103⤵PID:3616
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe104⤵PID:1332
-
\??\c:\rflrlxl.exec:\rflrlxl.exe105⤵PID:2428
-
\??\c:\jdvpp.exec:\jdvpp.exe106⤵PID:4852
-
\??\c:\rlllxxx.exec:\rlllxxx.exe107⤵PID:2548
-
\??\c:\llrlrrf.exec:\llrlrrf.exe108⤵PID:1088
-
\??\c:\bnbhnn.exec:\bnbhnn.exe109⤵PID:2900
-
\??\c:\vdppv.exec:\vdppv.exe110⤵PID:2708
-
\??\c:\xffxrlf.exec:\xffxrlf.exe111⤵PID:2656
-
\??\c:\nbbtbb.exec:\nbbtbb.exe112⤵PID:392
-
\??\c:\dvjdv.exec:\dvjdv.exe113⤵PID:2264
-
\??\c:\frrlfff.exec:\frrlfff.exe114⤵PID:4432
-
\??\c:\ttnhtn.exec:\ttnhtn.exe115⤵PID:412
-
\??\c:\vdddp.exec:\vdddp.exe116⤵PID:3628
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe117⤵PID:2920
-
\??\c:\9httnt.exec:\9httnt.exe118⤵PID:4508
-
\??\c:\djvjj.exec:\djvjj.exe119⤵PID:3424
-
\??\c:\lrflxfx.exec:\lrflxfx.exe120⤵PID:556
-
\??\c:\hhbntb.exec:\hhbntb.exe121⤵PID:2036
-
\??\c:\vjpvp.exec:\vjpvp.exe122⤵PID:1156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-