Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 12:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45a2e67d395eef443287994a1dfd468d2107c2fbebaa0101f6560d88fbff6df0N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
45a2e67d395eef443287994a1dfd468d2107c2fbebaa0101f6560d88fbff6df0N.exe
-
Size
456KB
-
MD5
256a4658565fd533f22b9b7383f61b50
-
SHA1
943bf468293359bdd51af9f78eb08f929f376e58
-
SHA256
45a2e67d395eef443287994a1dfd468d2107c2fbebaa0101f6560d88fbff6df0
-
SHA512
368fbef64556328a6b436690b5bdd1733a2db2d19071587637408607f2868a1398a8399d907b22a7a9abac5c8cb9003f1684e5a52fba16f2d76eb313114bfc23
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRc:q7Tc2NYHUrAwfMp3CDRc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3148-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-799-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-988-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-992-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-1308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-1684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5076 jpvpd.exe 3120 xllfxxr.exe 3528 5tnhbh.exe 2700 ddpvp.exe 4924 vppjd.exe 2324 thnnhn.exe 4688 jvvpp.exe 2152 rlrlffl.exe 4856 hntnhb.exe 2924 vvjjp.exe 528 5jvpd.exe 3076 xxxlxxr.exe 1468 hbnhbb.exe 396 rlrlxrf.exe 4564 lfrfffl.exe 720 5jjdv.exe 4012 3xxrllf.exe 1740 5vvpj.exe 3436 hbhtbt.exe 4448 5vpjv.exe 3184 hnnhnh.exe 4488 tntttn.exe 4968 rxxrrrl.exe 4756 tbbbhb.exe 4680 jjjjd.exe 4116 fflflll.exe 1412 thnhbb.exe 5088 vppvj.exe 1984 tbnthb.exe 992 vppdp.exe 2412 lfxlfxl.exe 4844 vppvp.exe 1348 tnnbtn.exe 632 9dddp.exe 1516 dpjdj.exe 2676 xllxlfr.exe 2060 9hhtth.exe 1104 ddjdp.exe 4432 jpjvv.exe 4416 xffxrxr.exe 3796 thhthb.exe 5076 vvvjv.exe 3636 jddpj.exe 3528 fxlffxf.exe 2228 bbtbnb.exe 2700 bnhntb.exe 1264 jppjj.exe 4924 rrrlxrf.exe 2052 rfxrfxr.exe 1456 ttnnhh.exe 516 vppdp.exe 4864 lflfrrx.exe 4856 xlrfrlx.exe 2536 5bhtbt.exe 2136 pdjvd.exe 112 ppvjv.exe 3288 xflfffx.exe 440 1tnthb.exe 3156 hnhtbb.exe 1796 dppdv.exe 5040 5lrlxxr.exe 4624 bttnnn.exe 944 bttbnt.exe 4144 ddjvd.exe -
resource yara_rule behavioral2/memory/3148-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-872-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3148 wrote to memory of 5076 3148 45a2e67d395eef443287994a1dfd468d2107c2fbebaa0101f6560d88fbff6df0N.exe 83 PID 3148 wrote to memory of 5076 3148 45a2e67d395eef443287994a1dfd468d2107c2fbebaa0101f6560d88fbff6df0N.exe 83 PID 3148 wrote to memory of 5076 3148 45a2e67d395eef443287994a1dfd468d2107c2fbebaa0101f6560d88fbff6df0N.exe 83 PID 5076 wrote to memory of 3120 5076 jpvpd.exe 84 PID 5076 wrote to memory of 3120 5076 jpvpd.exe 84 PID 5076 wrote to memory of 3120 5076 jpvpd.exe 84 PID 3120 wrote to memory of 3528 3120 xllfxxr.exe 85 PID 3120 wrote to memory of 3528 3120 xllfxxr.exe 85 PID 3120 wrote to memory of 3528 3120 xllfxxr.exe 85 PID 3528 wrote to memory of 2700 3528 5tnhbh.exe 86 PID 3528 wrote to memory of 2700 3528 5tnhbh.exe 86 PID 3528 wrote to memory of 2700 3528 5tnhbh.exe 86 PID 2700 wrote to memory of 4924 2700 ddpvp.exe 87 PID 2700 wrote to memory of 4924 2700 ddpvp.exe 87 PID 2700 wrote to memory of 4924 2700 ddpvp.exe 87 PID 4924 wrote to memory of 2324 4924 vppjd.exe 88 PID 4924 wrote to memory of 2324 4924 vppjd.exe 88 PID 4924 wrote to memory of 2324 4924 vppjd.exe 88 PID 2324 wrote to memory of 4688 2324 thnnhn.exe 89 PID 2324 wrote to memory of 4688 2324 thnnhn.exe 89 PID 2324 wrote to memory of 4688 2324 thnnhn.exe 89 PID 4688 wrote to memory of 2152 4688 jvvpp.exe 90 PID 4688 wrote to memory of 2152 4688 jvvpp.exe 90 PID 4688 wrote to memory of 2152 4688 jvvpp.exe 90 PID 2152 wrote to memory of 4856 2152 rlrlffl.exe 91 PID 2152 wrote to memory of 4856 2152 rlrlffl.exe 91 PID 2152 wrote to memory of 4856 2152 rlrlffl.exe 91 PID 4856 wrote to memory of 2924 4856 hntnhb.exe 92 PID 4856 wrote to memory of 2924 4856 hntnhb.exe 92 PID 4856 wrote to memory of 2924 4856 hntnhb.exe 92 PID 2924 wrote to memory of 528 2924 vvjjp.exe 93 PID 2924 wrote to memory of 528 2924 vvjjp.exe 93 PID 2924 wrote to memory of 528 2924 vvjjp.exe 93 PID 528 wrote to memory of 3076 528 5jvpd.exe 94 PID 528 wrote to memory of 3076 528 5jvpd.exe 94 PID 528 wrote to memory of 3076 528 5jvpd.exe 94 PID 3076 wrote to memory of 1468 3076 xxxlxxr.exe 95 PID 3076 wrote to memory of 1468 3076 xxxlxxr.exe 95 PID 3076 wrote to memory of 1468 3076 xxxlxxr.exe 95 PID 1468 wrote to memory of 396 1468 hbnhbb.exe 96 PID 1468 wrote to memory of 396 1468 hbnhbb.exe 96 PID 1468 wrote to memory of 396 1468 hbnhbb.exe 96 PID 396 wrote to memory of 4564 396 rlrlxrf.exe 97 PID 396 wrote to memory of 4564 396 rlrlxrf.exe 97 PID 396 wrote to memory of 4564 396 rlrlxrf.exe 97 PID 4564 wrote to memory of 720 4564 lfrfffl.exe 98 PID 4564 wrote to memory of 720 4564 lfrfffl.exe 98 PID 4564 wrote to memory of 720 4564 lfrfffl.exe 98 PID 720 wrote to memory of 4012 720 5jjdv.exe 99 PID 720 wrote to memory of 4012 720 5jjdv.exe 99 PID 720 wrote to memory of 4012 720 5jjdv.exe 99 PID 4012 wrote to memory of 1740 4012 3xxrllf.exe 100 PID 4012 wrote to memory of 1740 4012 3xxrllf.exe 100 PID 4012 wrote to memory of 1740 4012 3xxrllf.exe 100 PID 1740 wrote to memory of 3436 1740 5vvpj.exe 101 PID 1740 wrote to memory of 3436 1740 5vvpj.exe 101 PID 1740 wrote to memory of 3436 1740 5vvpj.exe 101 PID 3436 wrote to memory of 4448 3436 hbhtbt.exe 102 PID 3436 wrote to memory of 4448 3436 hbhtbt.exe 102 PID 3436 wrote to memory of 4448 3436 hbhtbt.exe 102 PID 4448 wrote to memory of 3184 4448 5vpjv.exe 103 PID 4448 wrote to memory of 3184 4448 5vpjv.exe 103 PID 4448 wrote to memory of 3184 4448 5vpjv.exe 103 PID 3184 wrote to memory of 4488 3184 hnnhnh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\45a2e67d395eef443287994a1dfd468d2107c2fbebaa0101f6560d88fbff6df0N.exe"C:\Users\Admin\AppData\Local\Temp\45a2e67d395eef443287994a1dfd468d2107c2fbebaa0101f6560d88fbff6df0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\jpvpd.exec:\jpvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\xllfxxr.exec:\xllfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\5tnhbh.exec:\5tnhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\ddpvp.exec:\ddpvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vppjd.exec:\vppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\thnnhn.exec:\thnnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jvvpp.exec:\jvvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\rlrlffl.exec:\rlrlffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\hntnhb.exec:\hntnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\vvjjp.exec:\vvjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\5jvpd.exec:\5jvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\xxxlxxr.exec:\xxxlxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\hbnhbb.exec:\hbnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\rlrlxrf.exec:\rlrlxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\lfrfffl.exec:\lfrfffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\5jjdv.exec:\5jjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\3xxrllf.exec:\3xxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\5vvpj.exec:\5vvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\hbhtbt.exec:\hbhtbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\5vpjv.exec:\5vpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\hnnhnh.exec:\hnnhnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\tntttn.exec:\tntttn.exe23⤵
- Executes dropped EXE
PID:4488 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe24⤵
- Executes dropped EXE
PID:4968 -
\??\c:\tbbbhb.exec:\tbbbhb.exe25⤵
- Executes dropped EXE
PID:4756 -
\??\c:\jjjjd.exec:\jjjjd.exe26⤵
- Executes dropped EXE
PID:4680 -
\??\c:\fflflll.exec:\fflflll.exe27⤵
- Executes dropped EXE
PID:4116 -
\??\c:\thnhbb.exec:\thnhbb.exe28⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vppvj.exec:\vppvj.exe29⤵
- Executes dropped EXE
PID:5088 -
\??\c:\tbnthb.exec:\tbnthb.exe30⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vppdp.exec:\vppdp.exe31⤵
- Executes dropped EXE
PID:992 -
\??\c:\lfxlfxl.exec:\lfxlfxl.exe32⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vppvp.exec:\vppvp.exe33⤵
- Executes dropped EXE
PID:4844 -
\??\c:\tnnbtn.exec:\tnnbtn.exe34⤵
- Executes dropped EXE
PID:1348 -
\??\c:\9dddp.exec:\9dddp.exe35⤵
- Executes dropped EXE
PID:632 -
\??\c:\dpjdj.exec:\dpjdj.exe36⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xllxlfr.exec:\xllxlfr.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9hhtth.exec:\9hhtth.exe38⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddjdp.exec:\ddjdp.exe39⤵
- Executes dropped EXE
PID:1104 -
\??\c:\jpjvv.exec:\jpjvv.exe40⤵
- Executes dropped EXE
PID:4432 -
\??\c:\xffxrxr.exec:\xffxrxr.exe41⤵
- Executes dropped EXE
PID:4416 -
\??\c:\thhthb.exec:\thhthb.exe42⤵
- Executes dropped EXE
PID:3796 -
\??\c:\vvvjv.exec:\vvvjv.exe43⤵
- Executes dropped EXE
PID:5076 -
\??\c:\jddpj.exec:\jddpj.exe44⤵
- Executes dropped EXE
PID:3636 -
\??\c:\fxlffxf.exec:\fxlffxf.exe45⤵
- Executes dropped EXE
PID:3528 -
\??\c:\bbtbnb.exec:\bbtbnb.exe46⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bnhntb.exec:\bnhntb.exe47⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jppjj.exec:\jppjj.exe48⤵
- Executes dropped EXE
PID:1264 -
\??\c:\rrrlxrf.exec:\rrrlxrf.exe49⤵
- Executes dropped EXE
PID:4924 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe50⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ttnnhh.exec:\ttnnhh.exe51⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vppdp.exec:\vppdp.exe52⤵
- Executes dropped EXE
PID:516 -
\??\c:\lflfrrx.exec:\lflfrrx.exe53⤵
- Executes dropped EXE
PID:4864 -
\??\c:\xlrfrlx.exec:\xlrfrlx.exe54⤵
- Executes dropped EXE
PID:4856 -
\??\c:\5bhtbt.exec:\5bhtbt.exe55⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pdjvd.exec:\pdjvd.exe56⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ppvjv.exec:\ppvjv.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:112 -
\??\c:\xflfffx.exec:\xflfffx.exe58⤵
- Executes dropped EXE
PID:3288 -
\??\c:\1tnthb.exec:\1tnthb.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:440 -
\??\c:\hnhtbb.exec:\hnhtbb.exe60⤵
- Executes dropped EXE
PID:3156 -
\??\c:\dppdv.exec:\dppdv.exe61⤵
- Executes dropped EXE
PID:1796 -
\??\c:\5lrlxxr.exec:\5lrlxxr.exe62⤵
- Executes dropped EXE
PID:5040 -
\??\c:\bttnnn.exec:\bttnnn.exe63⤵
- Executes dropped EXE
PID:4624 -
\??\c:\bttbnt.exec:\bttbnt.exe64⤵
- Executes dropped EXE
PID:944 -
\??\c:\ddjvd.exec:\ddjvd.exe65⤵
- Executes dropped EXE
PID:4144 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe66⤵PID:4748
-
\??\c:\btttnn.exec:\btttnn.exe67⤵PID:4124
-
\??\c:\vpvdp.exec:\vpvdp.exe68⤵PID:2012
-
\??\c:\xrrfrrl.exec:\xrrfrrl.exe69⤵PID:2260
-
\??\c:\hnthnh.exec:\hnthnh.exe70⤵PID:4676
-
\??\c:\dvpdp.exec:\dvpdp.exe71⤵PID:2172
-
\??\c:\5djdj.exec:\5djdj.exe72⤵PID:1884
-
\??\c:\5llfxxr.exec:\5llfxxr.exe73⤵PID:2992
-
\??\c:\hnbtbb.exec:\hnbtbb.exe74⤵PID:4712
-
\??\c:\dddvv.exec:\dddvv.exe75⤵PID:4956
-
\??\c:\lrrflfx.exec:\lrrflfx.exe76⤵PID:2660
-
\??\c:\nttnbt.exec:\nttnbt.exe77⤵PID:3184
-
\??\c:\bbbntn.exec:\bbbntn.exe78⤵PID:4488
-
\??\c:\vppjd.exec:\vppjd.exe79⤵PID:3192
-
\??\c:\jvpdp.exec:\jvpdp.exe80⤵PID:760
-
\??\c:\xllxrlx.exec:\xllxrlx.exe81⤵PID:4260
-
\??\c:\ttbnbt.exec:\ttbnbt.exe82⤵PID:4680
-
\??\c:\ppjvj.exec:\ppjvj.exe83⤵PID:1304
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe84⤵PID:1000
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe85⤵PID:3396
-
\??\c:\ttbtnh.exec:\ttbtnh.exe86⤵PID:2472
-
\??\c:\pjpjv.exec:\pjpjv.exe87⤵PID:2480
-
\??\c:\dppjd.exec:\dppjd.exe88⤵PID:4304
-
\??\c:\frrlxxr.exec:\frrlxxr.exe89⤵PID:4932
-
\??\c:\thhthb.exec:\thhthb.exe90⤵PID:992
-
\??\c:\bnbbht.exec:\bnbbht.exe91⤵PID:1236
-
\??\c:\vppjd.exec:\vppjd.exe92⤵PID:1896
-
\??\c:\ffllllf.exec:\ffllllf.exe93⤵PID:1784
-
\??\c:\ttthth.exec:\ttthth.exe94⤵PID:4616
-
\??\c:\pdvvd.exec:\pdvvd.exe95⤵PID:2540
-
\??\c:\3jdvj.exec:\3jdvj.exe96⤵PID:4164
-
\??\c:\5frfrrl.exec:\5frfrrl.exe97⤵PID:1480
-
\??\c:\thntnh.exec:\thntnh.exe98⤵PID:4324
-
\??\c:\vjdvj.exec:\vjdvj.exe99⤵PID:4312
-
\??\c:\rfrflrf.exec:\rfrflrf.exe100⤵PID:4088
-
\??\c:\bnhbtb.exec:\bnhbtb.exe101⤵PID:4100
-
\??\c:\htbtbh.exec:\htbtbh.exe102⤵PID:3480
-
\??\c:\dvpjj.exec:\dvpjj.exe103⤵
- System Location Discovery: System Language Discovery
PID:1180 -
\??\c:\jdpdv.exec:\jdpdv.exe104⤵PID:3476
-
\??\c:\lxxxxlx.exec:\lxxxxlx.exe105⤵PID:1216
-
\??\c:\nbhtnn.exec:\nbhtnn.exe106⤵PID:3528
-
\??\c:\5dpjp.exec:\5dpjp.exe107⤵PID:2228
-
\??\c:\pvpvj.exec:\pvpvj.exe108⤵PID:4252
-
\??\c:\fllxfxf.exec:\fllxfxf.exe109⤵PID:1264
-
\??\c:\thnnhh.exec:\thnnhh.exe110⤵PID:2324
-
\??\c:\pjppj.exec:\pjppj.exe111⤵PID:1716
-
\??\c:\xlfrlxr.exec:\xlfrlxr.exe112⤵PID:5096
-
\??\c:\fxxxfxl.exec:\fxxxfxl.exe113⤵PID:2152
-
\??\c:\bhhbnh.exec:\bhhbnh.exe114⤵PID:4700
-
\??\c:\pppjv.exec:\pppjv.exe115⤵PID:1548
-
\??\c:\xlfffrr.exec:\xlfffrr.exe116⤵PID:4856
-
\??\c:\rffxrlf.exec:\rffxrlf.exe117⤵PID:3152
-
\??\c:\vddpj.exec:\vddpj.exe118⤵PID:3304
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe119⤵PID:1988
-
\??\c:\3rffllr.exec:\3rffllr.exe120⤵PID:3364
-
\??\c:\ttnntn.exec:\ttnntn.exe121⤵PID:3328
-
\??\c:\7ppdp.exec:\7ppdp.exe122⤵PID:788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-