Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 09:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe
-
Size
454KB
-
MD5
7e7a0ce49f0ebe34135869685452ac80
-
SHA1
56c44d6a9b5a0f81765d7b126d27039e935b8b05
-
SHA256
0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34
-
SHA512
7e2c43e91f862be6d8bca504d59590c180599524baf13daf835acbad4e2d1af35f5893cfd980a320e91c2257ecd2124acd2f72d626dfe05a0ac4f02e745fe872
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1i:q7Tc2NYHUrAwfMp3CD1i
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4616-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/904-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/180-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-819-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-842-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-990-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-1448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4632 rlfxxrl.exe 1992 pdddv.exe 1488 nttnhb.exe 2728 bntnbb.exe 3280 xxlflff.exe 3492 bbhbtt.exe 3288 ntnnhh.exe 4944 jvjvj.exe 3412 xllffrr.exe 3324 hbhhbb.exe 1392 vppvd.exe 1340 fxrxlll.exe 2344 5llxrlf.exe 1816 llrfxrl.exe 1068 rlxxxxf.exe 4492 nnbbhh.exe 5008 djpjd.exe 4024 xffffff.exe 1700 dpjvv.exe 2232 xrxxrrr.exe 4440 5fxrxrl.exe 3812 jvjjp.exe 2100 vppjv.exe 2260 rllllrl.exe 5060 5ppjj.exe 2800 fxffxff.exe 904 fxrllxx.exe 2020 tthbnn.exe 2396 9hnhnh.exe 3912 vddpp.exe 1312 pdddv.exe 708 1dpjj.exe 4240 1tnhtt.exe 4360 vdjdv.exe 4792 9fxxrrx.exe 4404 ntbthh.exe 2976 tnbnnt.exe 4588 7vpjd.exe 2384 llxfxff.exe 3220 nhttnn.exe 3304 hhbbhn.exe 2324 jdjdv.exe 3012 9lrrlll.exe 1224 5xrlxxf.exe 3852 hhbthh.exe 4644 hbnntb.exe 4904 pjjdp.exe 3236 ffxxlll.exe 1532 9nttnt.exe 1636 vppjj.exe 3364 pdvpj.exe 2832 xlrrlll.exe 2472 hbnhht.exe 1468 vpvpd.exe 1296 rrxxrxx.exe 948 btbbtt.exe 180 bnbtnn.exe 1992 ddjdp.exe 3336 lfllffr.exe 1984 tbtthh.exe 868 7dvpd.exe 2300 pvjdd.exe 688 9fxxxxx.exe 228 bbnhtn.exe -
resource yara_rule behavioral2/memory/4616-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/904-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/180-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-842-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 4632 4616 0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe 82 PID 4616 wrote to memory of 4632 4616 0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe 82 PID 4616 wrote to memory of 4632 4616 0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe 82 PID 4632 wrote to memory of 1992 4632 rlfxxrl.exe 83 PID 4632 wrote to memory of 1992 4632 rlfxxrl.exe 83 PID 4632 wrote to memory of 1992 4632 rlfxxrl.exe 83 PID 1992 wrote to memory of 1488 1992 pdddv.exe 84 PID 1992 wrote to memory of 1488 1992 pdddv.exe 84 PID 1992 wrote to memory of 1488 1992 pdddv.exe 84 PID 1488 wrote to memory of 2728 1488 nttnhb.exe 85 PID 1488 wrote to memory of 2728 1488 nttnhb.exe 85 PID 1488 wrote to memory of 2728 1488 nttnhb.exe 85 PID 2728 wrote to memory of 3280 2728 bntnbb.exe 86 PID 2728 wrote to memory of 3280 2728 bntnbb.exe 86 PID 2728 wrote to memory of 3280 2728 bntnbb.exe 86 PID 3280 wrote to memory of 3492 3280 xxlflff.exe 87 PID 3280 wrote to memory of 3492 3280 xxlflff.exe 87 PID 3280 wrote to memory of 3492 3280 xxlflff.exe 87 PID 3492 wrote to memory of 3288 3492 bbhbtt.exe 88 PID 3492 wrote to memory of 3288 3492 bbhbtt.exe 88 PID 3492 wrote to memory of 3288 3492 bbhbtt.exe 88 PID 3288 wrote to memory of 4944 3288 ntnnhh.exe 89 PID 3288 wrote to memory of 4944 3288 ntnnhh.exe 89 PID 3288 wrote to memory of 4944 3288 ntnnhh.exe 89 PID 4944 wrote to memory of 3412 4944 jvjvj.exe 90 PID 4944 wrote to memory of 3412 4944 jvjvj.exe 90 PID 4944 wrote to memory of 3412 4944 jvjvj.exe 90 PID 3412 wrote to memory of 3324 3412 xllffrr.exe 91 PID 3412 wrote to memory of 3324 3412 xllffrr.exe 91 PID 3412 wrote to memory of 3324 3412 xllffrr.exe 91 PID 3324 wrote to memory of 1392 3324 hbhhbb.exe 92 PID 3324 wrote to memory of 1392 3324 hbhhbb.exe 92 PID 3324 wrote to memory of 1392 3324 hbhhbb.exe 92 PID 1392 wrote to memory of 1340 1392 vppvd.exe 93 PID 1392 wrote to memory of 1340 1392 vppvd.exe 93 PID 1392 wrote to memory of 1340 1392 vppvd.exe 93 PID 1340 wrote to memory of 2344 1340 fxrxlll.exe 94 PID 1340 wrote to memory of 2344 1340 fxrxlll.exe 94 PID 1340 wrote to memory of 2344 1340 fxrxlll.exe 94 PID 2344 wrote to memory of 1816 2344 5llxrlf.exe 95 PID 2344 wrote to memory of 1816 2344 5llxrlf.exe 95 PID 2344 wrote to memory of 1816 2344 5llxrlf.exe 95 PID 1816 wrote to memory of 1068 1816 llrfxrl.exe 96 PID 1816 wrote to memory of 1068 1816 llrfxrl.exe 96 PID 1816 wrote to memory of 1068 1816 llrfxrl.exe 96 PID 1068 wrote to memory of 4492 1068 rlxxxxf.exe 97 PID 1068 wrote to memory of 4492 1068 rlxxxxf.exe 97 PID 1068 wrote to memory of 4492 1068 rlxxxxf.exe 97 PID 4492 wrote to memory of 5008 4492 nnbbhh.exe 98 PID 4492 wrote to memory of 5008 4492 nnbbhh.exe 98 PID 4492 wrote to memory of 5008 4492 nnbbhh.exe 98 PID 5008 wrote to memory of 4024 5008 djpjd.exe 99 PID 5008 wrote to memory of 4024 5008 djpjd.exe 99 PID 5008 wrote to memory of 4024 5008 djpjd.exe 99 PID 4024 wrote to memory of 1700 4024 xffffff.exe 100 PID 4024 wrote to memory of 1700 4024 xffffff.exe 100 PID 4024 wrote to memory of 1700 4024 xffffff.exe 100 PID 1700 wrote to memory of 2232 1700 dpjvv.exe 101 PID 1700 wrote to memory of 2232 1700 dpjvv.exe 101 PID 1700 wrote to memory of 2232 1700 dpjvv.exe 101 PID 2232 wrote to memory of 4440 2232 xrxxrrr.exe 102 PID 2232 wrote to memory of 4440 2232 xrxxrrr.exe 102 PID 2232 wrote to memory of 4440 2232 xrxxrrr.exe 102 PID 4440 wrote to memory of 3812 4440 5fxrxrl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe"C:\Users\Admin\AppData\Local\Temp\0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\rlfxxrl.exec:\rlfxxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\pdddv.exec:\pdddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\nttnhb.exec:\nttnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\bntnbb.exec:\bntnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xxlflff.exec:\xxlflff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\bbhbtt.exec:\bbhbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\ntnnhh.exec:\ntnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\jvjvj.exec:\jvjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\xllffrr.exec:\xllffrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\hbhhbb.exec:\hbhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\vppvd.exec:\vppvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\fxrxlll.exec:\fxrxlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\5llxrlf.exec:\5llxrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\llrfxrl.exec:\llrfxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\nnbbhh.exec:\nnbbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\djpjd.exec:\djpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\xffffff.exec:\xffffff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\dpjvv.exec:\dpjvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\5fxrxrl.exec:\5fxrxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\jvjjp.exec:\jvjjp.exe23⤵
- Executes dropped EXE
PID:3812 -
\??\c:\vppjv.exec:\vppjv.exe24⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rllllrl.exec:\rllllrl.exe25⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5ppjj.exec:\5ppjj.exe26⤵
- Executes dropped EXE
PID:5060 -
\??\c:\fxffxff.exec:\fxffxff.exe27⤵
- Executes dropped EXE
PID:2800 -
\??\c:\fxrllxx.exec:\fxrllxx.exe28⤵
- Executes dropped EXE
PID:904 -
\??\c:\tthbnn.exec:\tthbnn.exe29⤵
- Executes dropped EXE
PID:2020 -
\??\c:\9hnhnh.exec:\9hnhnh.exe30⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vddpp.exec:\vddpp.exe31⤵
- Executes dropped EXE
PID:3912 -
\??\c:\pdddv.exec:\pdddv.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1312 -
\??\c:\1dpjj.exec:\1dpjj.exe33⤵
- Executes dropped EXE
PID:708 -
\??\c:\1tnhtt.exec:\1tnhtt.exe34⤵
- Executes dropped EXE
PID:4240 -
\??\c:\vdjdv.exec:\vdjdv.exe35⤵
- Executes dropped EXE
PID:4360 -
\??\c:\9fxxrrx.exec:\9fxxrrx.exe36⤵
- Executes dropped EXE
PID:4792 -
\??\c:\ntbthh.exec:\ntbthh.exe37⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tnbnnt.exec:\tnbnnt.exe38⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7vpjd.exec:\7vpjd.exe39⤵
- Executes dropped EXE
PID:4588 -
\??\c:\llxfxff.exec:\llxfxff.exe40⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nhttnn.exec:\nhttnn.exe41⤵
- Executes dropped EXE
PID:3220 -
\??\c:\hhbbhn.exec:\hhbbhn.exe42⤵
- Executes dropped EXE
PID:3304 -
\??\c:\jdjdv.exec:\jdjdv.exe43⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9lrrlll.exec:\9lrrlll.exe44⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5xrlxxf.exec:\5xrlxxf.exe45⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hhbthh.exec:\hhbthh.exe46⤵
- Executes dropped EXE
PID:3852 -
\??\c:\hbnntb.exec:\hbnntb.exe47⤵
- Executes dropped EXE
PID:4644 -
\??\c:\pjjdp.exec:\pjjdp.exe48⤵
- Executes dropped EXE
PID:4904 -
\??\c:\ffxxlll.exec:\ffxxlll.exe49⤵
- Executes dropped EXE
PID:3236 -
\??\c:\9nttnt.exec:\9nttnt.exe50⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vppjj.exec:\vppjj.exe51⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pdvpj.exec:\pdvpj.exe52⤵
- Executes dropped EXE
PID:3364 -
\??\c:\xlrrlll.exec:\xlrrlll.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hbnhht.exec:\hbnhht.exe54⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vpvpd.exec:\vpvpd.exe55⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vpddv.exec:\vpddv.exe56⤵PID:4348
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe57⤵
- Executes dropped EXE
PID:1296 -
\??\c:\btbbtt.exec:\btbbtt.exe58⤵
- Executes dropped EXE
PID:948 -
\??\c:\bnbtnn.exec:\bnbtnn.exe59⤵
- Executes dropped EXE
PID:180 -
\??\c:\ddjdp.exec:\ddjdp.exe60⤵
- Executes dropped EXE
PID:1992 -
\??\c:\lfllffr.exec:\lfllffr.exe61⤵
- Executes dropped EXE
PID:3336 -
\??\c:\tbtthh.exec:\tbtthh.exe62⤵
- Executes dropped EXE
PID:1984 -
\??\c:\7dvpd.exec:\7dvpd.exe63⤵
- Executes dropped EXE
PID:868 -
\??\c:\pvjdd.exec:\pvjdd.exe64⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9fxxxxx.exec:\9fxxxxx.exe65⤵
- Executes dropped EXE
PID:688 -
\??\c:\bbnhtn.exec:\bbnhtn.exe66⤵
- Executes dropped EXE
PID:228 -
\??\c:\dvvdp.exec:\dvvdp.exe67⤵PID:840
-
\??\c:\rrrlxff.exec:\rrrlxff.exe68⤵PID:1668
-
\??\c:\btthbt.exec:\btthbt.exe69⤵PID:1456
-
\??\c:\vvpdv.exec:\vvpdv.exe70⤵PID:4704
-
\??\c:\9jjpj.exec:\9jjpj.exe71⤵PID:2796
-
\??\c:\flrrrrx.exec:\flrrrrx.exe72⤵PID:3756
-
\??\c:\rfrllll.exec:\rfrllll.exe73⤵PID:4444
-
\??\c:\nnbtbt.exec:\nnbtbt.exe74⤵
- System Location Discovery: System Language Discovery
PID:2836 -
\??\c:\3vvvp.exec:\3vvvp.exe75⤵PID:1828
-
\??\c:\fxlxlxl.exec:\fxlxlxl.exe76⤵PID:2108
-
\??\c:\flffxff.exec:\flffxff.exe77⤵PID:3884
-
\??\c:\hhnnhh.exec:\hhnnhh.exe78⤵PID:2036
-
\??\c:\ddjvd.exec:\ddjvd.exe79⤵PID:2488
-
\??\c:\llrlxrr.exec:\llrlxrr.exe80⤵PID:1068
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe81⤵PID:4372
-
\??\c:\nnbbbh.exec:\nnbbbh.exe82⤵PID:5008
-
\??\c:\jdddd.exec:\jdddd.exe83⤵PID:844
-
\??\c:\jvddp.exec:\jvddp.exe84⤵PID:3156
-
\??\c:\rfrrflf.exec:\rfrrflf.exe85⤵PID:4728
-
\??\c:\rrxrrrx.exec:\rrxrrrx.exe86⤵PID:672
-
\??\c:\bnntnh.exec:\bnntnh.exe87⤵PID:372
-
\??\c:\jdvvv.exec:\jdvvv.exe88⤵PID:4428
-
\??\c:\rlxrfff.exec:\rlxrfff.exe89⤵PID:2000
-
\??\c:\3ntnbb.exec:\3ntnbb.exe90⤵PID:1432
-
\??\c:\9djdd.exec:\9djdd.exe91⤵PID:2284
-
\??\c:\vpjjp.exec:\vpjjp.exe92⤵PID:3208
-
\??\c:\xxlffff.exec:\xxlffff.exe93⤵PID:2912
-
\??\c:\ntnnhn.exec:\ntnnhn.exe94⤵PID:2956
-
\??\c:\hbbbbb.exec:\hbbbbb.exe95⤵PID:4860
-
\??\c:\jjppv.exec:\jjppv.exe96⤵PID:4856
-
\??\c:\fllfrrf.exec:\fllfrrf.exe97⤵PID:1768
-
\??\c:\7xllflf.exec:\7xllflf.exe98⤵PID:2004
-
\??\c:\hnhbht.exec:\hnhbht.exe99⤵PID:2396
-
\??\c:\jdjdj.exec:\jdjdj.exe100⤵PID:4296
-
\??\c:\rllffxr.exec:\rllffxr.exe101⤵PID:1236
-
\??\c:\nhhbtn.exec:\nhhbtn.exe102⤵PID:3940
-
\??\c:\5tbbbb.exec:\5tbbbb.exe103⤵PID:1012
-
\??\c:\pvjdd.exec:\pvjdd.exe104⤵PID:3752
-
\??\c:\ffrxxxx.exec:\ffrxxxx.exe105⤵PID:4360
-
\??\c:\9tbnnn.exec:\9tbnnn.exe106⤵PID:4792
-
\??\c:\jdjjd.exec:\jdjjd.exe107⤵PID:4404
-
\??\c:\jdjpj.exec:\jdjpj.exe108⤵PID:4600
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe109⤵PID:396
-
\??\c:\thnbtn.exec:\thnbtn.exe110⤵PID:4396
-
\??\c:\bttthh.exec:\bttthh.exe111⤵PID:3340
-
\??\c:\dvdvp.exec:\dvdvp.exe112⤵PID:2200
-
\??\c:\lflxrfx.exec:\lflxrfx.exe113⤵PID:4876
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe114⤵PID:316
-
\??\c:\nnttnt.exec:\nnttnt.exe115⤵PID:4084
-
\??\c:\jdpjd.exec:\jdpjd.exe116⤵PID:4624
-
\??\c:\lffxllf.exec:\lffxllf.exe117⤵PID:1268
-
\??\c:\flxxrxl.exec:\flxxrxl.exe118⤵PID:4904
-
\??\c:\nhbtbt.exec:\nhbtbt.exe119⤵PID:3972
-
\??\c:\5ddvv.exec:\5ddvv.exe120⤵PID:696
-
\??\c:\xrfrfxf.exec:\xrfrfxf.exe121⤵PID:3684
-
\??\c:\rfrlfll.exec:\rfrlfll.exe122⤵PID:3648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-