Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7af618934a6c43ff4dd02ad7dc26bae62e1798f911af6cd4461c7b82ef196b4a.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7af618934a6c43ff4dd02ad7dc26bae62e1798f911af6cd4461c7b82ef196b4a.exe
-
Size
453KB
-
MD5
757a4f10a0a7a7ae7754584cfeafdd31
-
SHA1
9bfd662d28c3e242ad82388e0a481e7c93c917dc
-
SHA256
7af618934a6c43ff4dd02ad7dc26bae62e1798f911af6cd4461c7b82ef196b4a
-
SHA512
67134610eb6c35242bc891e795278d92698b36903200804b418e8c2b79bd32475b06e54a85c8717153fd9a87603f0803f7470574c2fcbad47d91c530ff0ddcc0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/828-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/828-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/592-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-871-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-1353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 828 fxxrlfx.exe 1076 dvjpd.exe 2284 dvpvp.exe 3392 flxrrrx.exe 2764 jdjdd.exe 1256 pjvvj.exe 2280 lflfllf.exe 1796 jvjdd.exe 1312 vdpvp.exe 116 xfrlfxx.exe 844 jjdpd.exe 4556 nttbtb.exe 4960 htbtnn.exe 4864 lxfxrrl.exe 4904 rllfxrr.exe 1688 htnhbb.exe 940 5llrfll.exe 4524 flxrlll.exe 1520 htnhnh.exe 2132 nhntnn.exe 3116 tnbhnb.exe 1124 thtnnn.exe 3220 vdpjd.exe 2920 jjddv.exe 1720 htbbtb.exe 2572 vdjjv.exe 1228 7djdv.exe 1816 tbnnnn.exe 3792 tntnht.exe 3344 jjppj.exe 3132 lrffxxr.exe 2656 vdjjp.exe 4280 fxlfxrl.exe 1448 3ntnbb.exe 3520 vjppj.exe 2932 xlxrfff.exe 4316 nhtnbb.exe 888 vpvpd.exe 4160 vdpjd.exe 3136 bhbbbh.exe 4832 vpjdv.exe 4320 rfllffr.exe 4388 7tbtnn.exe 2316 nthbtt.exe 1512 dvvvp.exe 828 llxrllr.exe 3424 hthhbb.exe 4416 vvjdv.exe 2284 xrrlfxx.exe 2832 hbhbbt.exe 1272 bthhbb.exe 2764 7djdd.exe 1264 rffxrrl.exe 2520 hhtttt.exe 592 nbnhhb.exe 3988 pjpjd.exe 3624 xrrlffl.exe 4220 fxxrfxl.exe 1312 hnbnhh.exe 2696 jvdvp.exe 2164 1fflxxf.exe 844 bhnnhn.exe 3012 7xlfxfx.exe 1328 fxffffl.exe -
resource yara_rule behavioral2/memory/828-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/828-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/592-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-663-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4156 wrote to memory of 828 4156 7af618934a6c43ff4dd02ad7dc26bae62e1798f911af6cd4461c7b82ef196b4a.exe 82 PID 4156 wrote to memory of 828 4156 7af618934a6c43ff4dd02ad7dc26bae62e1798f911af6cd4461c7b82ef196b4a.exe 82 PID 4156 wrote to memory of 828 4156 7af618934a6c43ff4dd02ad7dc26bae62e1798f911af6cd4461c7b82ef196b4a.exe 82 PID 828 wrote to memory of 1076 828 fxxrlfx.exe 83 PID 828 wrote to memory of 1076 828 fxxrlfx.exe 83 PID 828 wrote to memory of 1076 828 fxxrlfx.exe 83 PID 1076 wrote to memory of 2284 1076 dvjpd.exe 84 PID 1076 wrote to memory of 2284 1076 dvjpd.exe 84 PID 1076 wrote to memory of 2284 1076 dvjpd.exe 84 PID 2284 wrote to memory of 3392 2284 dvpvp.exe 85 PID 2284 wrote to memory of 3392 2284 dvpvp.exe 85 PID 2284 wrote to memory of 3392 2284 dvpvp.exe 85 PID 3392 wrote to memory of 2764 3392 flxrrrx.exe 86 PID 3392 wrote to memory of 2764 3392 flxrrrx.exe 86 PID 3392 wrote to memory of 2764 3392 flxrrrx.exe 86 PID 2764 wrote to memory of 1256 2764 jdjdd.exe 87 PID 2764 wrote to memory of 1256 2764 jdjdd.exe 87 PID 2764 wrote to memory of 1256 2764 jdjdd.exe 87 PID 1256 wrote to memory of 2280 1256 pjvvj.exe 88 PID 1256 wrote to memory of 2280 1256 pjvvj.exe 88 PID 1256 wrote to memory of 2280 1256 pjvvj.exe 88 PID 2280 wrote to memory of 1796 2280 lflfllf.exe 89 PID 2280 wrote to memory of 1796 2280 lflfllf.exe 89 PID 2280 wrote to memory of 1796 2280 lflfllf.exe 89 PID 1796 wrote to memory of 1312 1796 jvjdd.exe 90 PID 1796 wrote to memory of 1312 1796 jvjdd.exe 90 PID 1796 wrote to memory of 1312 1796 jvjdd.exe 90 PID 1312 wrote to memory of 116 1312 vdpvp.exe 91 PID 1312 wrote to memory of 116 1312 vdpvp.exe 91 PID 1312 wrote to memory of 116 1312 vdpvp.exe 91 PID 116 wrote to memory of 844 116 xfrlfxx.exe 92 PID 116 wrote to memory of 844 116 xfrlfxx.exe 92 PID 116 wrote to memory of 844 116 xfrlfxx.exe 92 PID 844 wrote to memory of 4556 844 jjdpd.exe 93 PID 844 wrote to memory of 4556 844 jjdpd.exe 93 PID 844 wrote to memory of 4556 844 jjdpd.exe 93 PID 4556 wrote to memory of 4960 4556 nttbtb.exe 94 PID 4556 wrote to memory of 4960 4556 nttbtb.exe 94 PID 4556 wrote to memory of 4960 4556 nttbtb.exe 94 PID 4960 wrote to memory of 4864 4960 htbtnn.exe 95 PID 4960 wrote to memory of 4864 4960 htbtnn.exe 95 PID 4960 wrote to memory of 4864 4960 htbtnn.exe 95 PID 4864 wrote to memory of 4904 4864 lxfxrrl.exe 96 PID 4864 wrote to memory of 4904 4864 lxfxrrl.exe 96 PID 4864 wrote to memory of 4904 4864 lxfxrrl.exe 96 PID 4904 wrote to memory of 1688 4904 rllfxrr.exe 97 PID 4904 wrote to memory of 1688 4904 rllfxrr.exe 97 PID 4904 wrote to memory of 1688 4904 rllfxrr.exe 97 PID 1688 wrote to memory of 940 1688 htnhbb.exe 98 PID 1688 wrote to memory of 940 1688 htnhbb.exe 98 PID 1688 wrote to memory of 940 1688 htnhbb.exe 98 PID 940 wrote to memory of 4524 940 5llrfll.exe 99 PID 940 wrote to memory of 4524 940 5llrfll.exe 99 PID 940 wrote to memory of 4524 940 5llrfll.exe 99 PID 4524 wrote to memory of 1520 4524 flxrlll.exe 100 PID 4524 wrote to memory of 1520 4524 flxrlll.exe 100 PID 4524 wrote to memory of 1520 4524 flxrlll.exe 100 PID 1520 wrote to memory of 2132 1520 htnhnh.exe 101 PID 1520 wrote to memory of 2132 1520 htnhnh.exe 101 PID 1520 wrote to memory of 2132 1520 htnhnh.exe 101 PID 2132 wrote to memory of 3116 2132 nhntnn.exe 102 PID 2132 wrote to memory of 3116 2132 nhntnn.exe 102 PID 2132 wrote to memory of 3116 2132 nhntnn.exe 102 PID 3116 wrote to memory of 1124 3116 tnbhnb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7af618934a6c43ff4dd02ad7dc26bae62e1798f911af6cd4461c7b82ef196b4a.exe"C:\Users\Admin\AppData\Local\Temp\7af618934a6c43ff4dd02ad7dc26bae62e1798f911af6cd4461c7b82ef196b4a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\dvjpd.exec:\dvjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\dvpvp.exec:\dvpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\flxrrrx.exec:\flxrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\jdjdd.exec:\jdjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\pjvvj.exec:\pjvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\lflfllf.exec:\lflfllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\jvjdd.exec:\jvjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\vdpvp.exec:\vdpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\xfrlfxx.exec:\xfrlfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\jjdpd.exec:\jjdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\nttbtb.exec:\nttbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\htbtnn.exec:\htbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\rllfxrr.exec:\rllfxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\htnhbb.exec:\htnhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\5llrfll.exec:\5llrfll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\flxrlll.exec:\flxrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\htnhnh.exec:\htnhnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\nhntnn.exec:\nhntnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\tnbhnb.exec:\tnbhnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\thtnnn.exec:\thtnnn.exe23⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vdpjd.exec:\vdpjd.exe24⤵
- Executes dropped EXE
PID:3220 -
\??\c:\jjddv.exec:\jjddv.exe25⤵
- Executes dropped EXE
PID:2920 -
\??\c:\htbbtb.exec:\htbbtb.exe26⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vdjjv.exec:\vdjjv.exe27⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7djdv.exec:\7djdv.exe28⤵
- Executes dropped EXE
PID:1228 -
\??\c:\tbnnnn.exec:\tbnnnn.exe29⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tntnht.exec:\tntnht.exe30⤵
- Executes dropped EXE
PID:3792 -
\??\c:\jjppj.exec:\jjppj.exe31⤵
- Executes dropped EXE
PID:3344 -
\??\c:\lrffxxr.exec:\lrffxxr.exe32⤵
- Executes dropped EXE
PID:3132 -
\??\c:\vdjjp.exec:\vdjjp.exe33⤵
- Executes dropped EXE
PID:2656 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe34⤵
- Executes dropped EXE
PID:4280 -
\??\c:\3ntnbb.exec:\3ntnbb.exe35⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vjppj.exec:\vjppj.exe36⤵
- Executes dropped EXE
PID:3520 -
\??\c:\xlxrfff.exec:\xlxrfff.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nhtnbb.exec:\nhtnbb.exe38⤵
- Executes dropped EXE
PID:4316 -
\??\c:\vpvpd.exec:\vpvpd.exe39⤵
- Executes dropped EXE
PID:888 -
\??\c:\vdpjd.exec:\vdpjd.exe40⤵
- Executes dropped EXE
PID:4160 -
\??\c:\bhbbbh.exec:\bhbbbh.exe41⤵
- Executes dropped EXE
PID:3136 -
\??\c:\vpjdv.exec:\vpjdv.exe42⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rfllffr.exec:\rfllffr.exe43⤵
- Executes dropped EXE
PID:4320 -
\??\c:\7tbtnn.exec:\7tbtnn.exe44⤵
- Executes dropped EXE
PID:4388 -
\??\c:\nthbtt.exec:\nthbtt.exe45⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dvvvp.exec:\dvvvp.exe46⤵
- Executes dropped EXE
PID:1512 -
\??\c:\llxrllr.exec:\llxrllr.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:828 -
\??\c:\hthhbb.exec:\hthhbb.exe48⤵
- Executes dropped EXE
PID:3424 -
\??\c:\vvjdv.exec:\vvjdv.exe49⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe50⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hbhbbt.exec:\hbhbbt.exe51⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bthhbb.exec:\bthhbb.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1272 -
\??\c:\7djdd.exec:\7djdd.exe53⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rffxrrl.exec:\rffxrrl.exe54⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hhtttt.exec:\hhtttt.exe55⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nbnhhb.exec:\nbnhhb.exe56⤵
- Executes dropped EXE
PID:592 -
\??\c:\pjpjd.exec:\pjpjd.exe57⤵
- Executes dropped EXE
PID:3988 -
\??\c:\xrrlffl.exec:\xrrlffl.exe58⤵
- Executes dropped EXE
PID:3624 -
\??\c:\fxxrfxl.exec:\fxxrfxl.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4220 -
\??\c:\hnbnhh.exec:\hnbnhh.exe60⤵
- Executes dropped EXE
PID:1312 -
\??\c:\jvdvp.exec:\jvdvp.exe61⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1fflxxf.exec:\1fflxxf.exe62⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bhnnhn.exec:\bhnnhn.exe63⤵
- Executes dropped EXE
PID:844 -
\??\c:\7xlfxfx.exec:\7xlfxfx.exe64⤵
- Executes dropped EXE
PID:3012 -
\??\c:\fxffffl.exec:\fxffffl.exe65⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nntnnn.exec:\nntnnn.exe66⤵PID:4864
-
\??\c:\dvjdj.exec:\dvjdj.exe67⤵PID:4308
-
\??\c:\lxlllff.exec:\lxlllff.exe68⤵PID:4004
-
\??\c:\bbhhhh.exec:\bbhhhh.exe69⤵PID:2004
-
\??\c:\vpppd.exec:\vpppd.exe70⤵PID:1872
-
\??\c:\rxlrrxx.exec:\rxlrrxx.exe71⤵PID:4100
-
\??\c:\fxflfrx.exec:\fxflfrx.exe72⤵PID:3124
-
\??\c:\tbhhhh.exec:\tbhhhh.exe73⤵PID:4696
-
\??\c:\ppppp.exec:\ppppp.exe74⤵PID:4968
-
\??\c:\rlrlllf.exec:\rlrlllf.exe75⤵PID:3680
-
\??\c:\nhtnhh.exec:\nhtnhh.exe76⤵PID:4368
-
\??\c:\bbnntn.exec:\bbnntn.exe77⤵PID:676
-
\??\c:\dpppd.exec:\dpppd.exe78⤵PID:1528
-
\??\c:\lflllrx.exec:\lflllrx.exe79⤵PID:5004
-
\??\c:\ththbh.exec:\ththbh.exe80⤵PID:1640
-
\??\c:\ppvvv.exec:\ppvvv.exe81⤵PID:1720
-
\??\c:\xflfxxr.exec:\xflfxxr.exe82⤵PID:1260
-
\??\c:\tthhbb.exec:\tthhbb.exe83⤵PID:2976
-
\??\c:\ddvdv.exec:\ddvdv.exe84⤵PID:1508
-
\??\c:\lrrlxff.exec:\lrrlxff.exe85⤵PID:4976
-
\??\c:\thtnhh.exec:\thtnhh.exe86⤵PID:2248
-
\??\c:\9ppvd.exec:\9ppvd.exe87⤵PID:4104
-
\??\c:\vpjjp.exec:\vpjjp.exe88⤵PID:2756
-
\??\c:\xfrfllr.exec:\xfrfllr.exe89⤵PID:4112
-
\??\c:\tnbbbb.exec:\tnbbbb.exe90⤵PID:3484
-
\??\c:\ddppv.exec:\ddppv.exe91⤵PID:2656
-
\??\c:\ddjjd.exec:\ddjjd.exe92⤵PID:1400
-
\??\c:\fxllxxf.exec:\fxllxxf.exe93⤵PID:4472
-
\??\c:\ttnhtt.exec:\ttnhtt.exe94⤵PID:3520
-
\??\c:\ddppj.exec:\ddppj.exe95⤵PID:1660
-
\??\c:\7xffxll.exec:\7xffxll.exe96⤵PID:4816
-
\??\c:\nbnntb.exec:\nbnntb.exe97⤵PID:4732
-
\??\c:\jvjjd.exec:\jvjjd.exe98⤵PID:3476
-
\??\c:\fflfxll.exec:\fflfxll.exe99⤵PID:584
-
\??\c:\xrxllll.exec:\xrxllll.exe100⤵PID:1752
-
\??\c:\1htttb.exec:\1htttb.exe101⤵PID:4728
-
\??\c:\jpjjv.exec:\jpjjv.exe102⤵PID:4372
-
\??\c:\3xlfllf.exec:\3xlfllf.exe103⤵PID:1784
-
\??\c:\nbntnn.exec:\nbntnn.exe104⤵PID:1960
-
\??\c:\jjddd.exec:\jjddd.exe105⤵PID:4156
-
\??\c:\jvppv.exec:\jvppv.exe106⤵PID:2296
-
\??\c:\5rxxfff.exec:\5rxxfff.exe107⤵PID:4528
-
\??\c:\hnbnth.exec:\hnbnth.exe108⤵PID:1372
-
\??\c:\jpvpp.exec:\jpvpp.exe109⤵PID:4980
-
\??\c:\jpdvd.exec:\jpdvd.exe110⤵PID:1584
-
\??\c:\fxxlffr.exec:\fxxlffr.exe111⤵PID:4008
-
\??\c:\9ntntt.exec:\9ntntt.exe112⤵PID:1876
-
\??\c:\pdpjv.exec:\pdpjv.exe113⤵PID:1108
-
\??\c:\frxrrrf.exec:\frxrrrf.exe114⤵PID:2488
-
\??\c:\hbhbtn.exec:\hbhbtn.exe115⤵PID:1948
-
\??\c:\tnbnnn.exec:\tnbnnn.exe116⤵PID:3164
-
\??\c:\jvjdv.exec:\jvjdv.exe117⤵PID:5116
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe118⤵PID:2260
-
\??\c:\hthhhh.exec:\hthhhh.exe119⤵PID:4428
-
\??\c:\vpjdv.exec:\vpjdv.exe120⤵PID:3600
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe121⤵PID:920
-
\??\c:\1bhbtt.exec:\1bhbtt.exe122⤵PID:3208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-