Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f42406c6f30147baad8dee599a5ed613f0a195b0625c968485e48f51892c5461.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
f42406c6f30147baad8dee599a5ed613f0a195b0625c968485e48f51892c5461.exe
-
Size
454KB
-
MD5
9a46602fbf01bc3c9f8d301780dd10d1
-
SHA1
3f3289fd6620b3e850dda89fb7a658d27a440e95
-
SHA256
f42406c6f30147baad8dee599a5ed613f0a195b0625c968485e48f51892c5461
-
SHA512
c01ef2a53b70849f4410956f387b375f8f8a585103f5b2631ccee73d24c260ac57a02c709bc3b9fb25dc18fb20b7863574f6ffe3ccd25b5a1a22489aa32da658
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4600-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-1007-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-1047-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-1093-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4316 dpvpd.exe 1896 jdjpp.exe 4832 hhhhbb.exe 4544 fxxfxxl.exe 3284 jdjdp.exe 3996 hnbhbb.exe 4184 jjppp.exe 1380 jjvpv.exe 4676 1frlxxx.exe 2728 ntbtnh.exe 2476 xfrlfff.exe 1564 rllffxx.exe 3472 dpdvd.exe 4112 rxlfrxx.exe 2040 bbhhtt.exe 1816 vvvdp.exe 4008 nnntnn.exe 876 jjvvp.exe 1228 vjvpp.exe 3224 flxxlxr.exe 1688 1ppvp.exe 2416 ffrxrrl.exe 3928 pjvvp.exe 4588 frlfffx.exe 4580 hbnhbb.exe 4400 xlrlllf.exe 3916 hhnnhh.exe 4936 bbbbnn.exe 1012 pdjdv.exe 2896 flxrflf.exe 2132 bnhhhh.exe 1116 ffrrffl.exe 3644 3pjjd.exe 1396 llfxffr.exe 4576 nbhhbb.exe 3416 3dppd.exe 1036 pvjdv.exe 3108 lrfxrrl.exe 3312 1bbbtb.exe 2120 vpvpj.exe 3796 9ppjd.exe 1124 llrlrrr.exe 3876 nthtbb.exe 4528 pjvdd.exe 1020 fxrlllr.exe 4436 3tbttt.exe 3124 1ttbtn.exe 884 jpvdj.exe 1332 lflfrrr.exe 1048 rlffflr.exe 5096 5hhbbn.exe 1924 pjppj.exe 968 rllfxxr.exe 3996 7tttnn.exe 1596 pjpjv.exe 860 1xxxflf.exe 3096 9nnnnn.exe 1188 bbbbhn.exe 3724 pppjv.exe 4968 jdjjj.exe 4108 xlrrfff.exe 816 hhnhbn.exe 3744 hbbthh.exe 3260 jjjdd.exe -
resource yara_rule behavioral2/memory/4600-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-769-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9httbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpdp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4600 wrote to memory of 4316 4600 f42406c6f30147baad8dee599a5ed613f0a195b0625c968485e48f51892c5461.exe 82 PID 4600 wrote to memory of 4316 4600 f42406c6f30147baad8dee599a5ed613f0a195b0625c968485e48f51892c5461.exe 82 PID 4600 wrote to memory of 4316 4600 f42406c6f30147baad8dee599a5ed613f0a195b0625c968485e48f51892c5461.exe 82 PID 4316 wrote to memory of 1896 4316 dpvpd.exe 83 PID 4316 wrote to memory of 1896 4316 dpvpd.exe 83 PID 4316 wrote to memory of 1896 4316 dpvpd.exe 83 PID 1896 wrote to memory of 4832 1896 jdjpp.exe 84 PID 1896 wrote to memory of 4832 1896 jdjpp.exe 84 PID 1896 wrote to memory of 4832 1896 jdjpp.exe 84 PID 4832 wrote to memory of 4544 4832 hhhhbb.exe 85 PID 4832 wrote to memory of 4544 4832 hhhhbb.exe 85 PID 4832 wrote to memory of 4544 4832 hhhhbb.exe 85 PID 4544 wrote to memory of 3284 4544 fxxfxxl.exe 86 PID 4544 wrote to memory of 3284 4544 fxxfxxl.exe 86 PID 4544 wrote to memory of 3284 4544 fxxfxxl.exe 86 PID 3284 wrote to memory of 3996 3284 jdjdp.exe 87 PID 3284 wrote to memory of 3996 3284 jdjdp.exe 87 PID 3284 wrote to memory of 3996 3284 jdjdp.exe 87 PID 3996 wrote to memory of 4184 3996 hnbhbb.exe 88 PID 3996 wrote to memory of 4184 3996 hnbhbb.exe 88 PID 3996 wrote to memory of 4184 3996 hnbhbb.exe 88 PID 4184 wrote to memory of 1380 4184 jjppp.exe 89 PID 4184 wrote to memory of 1380 4184 jjppp.exe 89 PID 4184 wrote to memory of 1380 4184 jjppp.exe 89 PID 1380 wrote to memory of 4676 1380 jjvpv.exe 90 PID 1380 wrote to memory of 4676 1380 jjvpv.exe 90 PID 1380 wrote to memory of 4676 1380 jjvpv.exe 90 PID 4676 wrote to memory of 2728 4676 1frlxxx.exe 91 PID 4676 wrote to memory of 2728 4676 1frlxxx.exe 91 PID 4676 wrote to memory of 2728 4676 1frlxxx.exe 91 PID 2728 wrote to memory of 2476 2728 ntbtnh.exe 92 PID 2728 wrote to memory of 2476 2728 ntbtnh.exe 92 PID 2728 wrote to memory of 2476 2728 ntbtnh.exe 92 PID 2476 wrote to memory of 1564 2476 xfrlfff.exe 93 PID 2476 wrote to memory of 1564 2476 xfrlfff.exe 93 PID 2476 wrote to memory of 1564 2476 xfrlfff.exe 93 PID 1564 wrote to memory of 3472 1564 rllffxx.exe 94 PID 1564 wrote to memory of 3472 1564 rllffxx.exe 94 PID 1564 wrote to memory of 3472 1564 rllffxx.exe 94 PID 3472 wrote to memory of 4112 3472 dpdvd.exe 95 PID 3472 wrote to memory of 4112 3472 dpdvd.exe 95 PID 3472 wrote to memory of 4112 3472 dpdvd.exe 95 PID 4112 wrote to memory of 2040 4112 rxlfrxx.exe 96 PID 4112 wrote to memory of 2040 4112 rxlfrxx.exe 96 PID 4112 wrote to memory of 2040 4112 rxlfrxx.exe 96 PID 2040 wrote to memory of 1816 2040 bbhhtt.exe 97 PID 2040 wrote to memory of 1816 2040 bbhhtt.exe 97 PID 2040 wrote to memory of 1816 2040 bbhhtt.exe 97 PID 1816 wrote to memory of 4008 1816 vvvdp.exe 98 PID 1816 wrote to memory of 4008 1816 vvvdp.exe 98 PID 1816 wrote to memory of 4008 1816 vvvdp.exe 98 PID 4008 wrote to memory of 876 4008 nnntnn.exe 99 PID 4008 wrote to memory of 876 4008 nnntnn.exe 99 PID 4008 wrote to memory of 876 4008 nnntnn.exe 99 PID 876 wrote to memory of 1228 876 jjvvp.exe 100 PID 876 wrote to memory of 1228 876 jjvvp.exe 100 PID 876 wrote to memory of 1228 876 jjvvp.exe 100 PID 1228 wrote to memory of 3224 1228 vjvpp.exe 101 PID 1228 wrote to memory of 3224 1228 vjvpp.exe 101 PID 1228 wrote to memory of 3224 1228 vjvpp.exe 101 PID 3224 wrote to memory of 1688 3224 flxxlxr.exe 102 PID 3224 wrote to memory of 1688 3224 flxxlxr.exe 102 PID 3224 wrote to memory of 1688 3224 flxxlxr.exe 102 PID 1688 wrote to memory of 2416 1688 1ppvp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f42406c6f30147baad8dee599a5ed613f0a195b0625c968485e48f51892c5461.exe"C:\Users\Admin\AppData\Local\Temp\f42406c6f30147baad8dee599a5ed613f0a195b0625c968485e48f51892c5461.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\dpvpd.exec:\dpvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\jdjpp.exec:\jdjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\hhhhbb.exec:\hhhhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\fxxfxxl.exec:\fxxfxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\jdjdp.exec:\jdjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\hnbhbb.exec:\hnbhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\jjppp.exec:\jjppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\jjvpv.exec:\jjvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\1frlxxx.exec:\1frlxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\ntbtnh.exec:\ntbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xfrlfff.exec:\xfrlfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rllffxx.exec:\rllffxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\dpdvd.exec:\dpdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\rxlfrxx.exec:\rxlfrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\bbhhtt.exec:\bbhhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\vvvdp.exec:\vvvdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\nnntnn.exec:\nnntnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\jjvvp.exec:\jjvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\vjvpp.exec:\vjvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\flxxlxr.exec:\flxxlxr.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\1ppvp.exec:\1ppvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\ffrxrrl.exec:\ffrxrrl.exe23⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pjvvp.exec:\pjvvp.exe24⤵
- Executes dropped EXE
PID:3928 -
\??\c:\frlfffx.exec:\frlfffx.exe25⤵
- Executes dropped EXE
PID:4588 -
\??\c:\hbnhbb.exec:\hbnhbb.exe26⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xlrlllf.exec:\xlrlllf.exe27⤵
- Executes dropped EXE
PID:4400 -
\??\c:\hhnnhh.exec:\hhnnhh.exe28⤵
- Executes dropped EXE
PID:3916 -
\??\c:\bbbbnn.exec:\bbbbnn.exe29⤵
- Executes dropped EXE
PID:4936 -
\??\c:\pdjdv.exec:\pdjdv.exe30⤵
- Executes dropped EXE
PID:1012 -
\??\c:\flxrflf.exec:\flxrflf.exe31⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bnhhhh.exec:\bnhhhh.exe32⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ffrrffl.exec:\ffrrffl.exe33⤵
- Executes dropped EXE
PID:1116 -
\??\c:\3pjjd.exec:\3pjjd.exe34⤵
- Executes dropped EXE
PID:3644 -
\??\c:\llfxffr.exec:\llfxffr.exe35⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nbhhbb.exec:\nbhhbb.exe36⤵
- Executes dropped EXE
PID:4576 -
\??\c:\3dppd.exec:\3dppd.exe37⤵
- Executes dropped EXE
PID:3416 -
\??\c:\pvjdv.exec:\pvjdv.exe38⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe39⤵
- Executes dropped EXE
PID:3108 -
\??\c:\1bbbtb.exec:\1bbbtb.exe40⤵
- Executes dropped EXE
PID:3312 -
\??\c:\vpvpj.exec:\vpvpj.exe41⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9ppjd.exec:\9ppjd.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3796 -
\??\c:\llrlrrr.exec:\llrlrrr.exe43⤵
- Executes dropped EXE
PID:1124 -
\??\c:\nthtbb.exec:\nthtbb.exe44⤵
- Executes dropped EXE
PID:3876 -
\??\c:\pjvdd.exec:\pjvdd.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4528 -
\??\c:\fxrlllr.exec:\fxrlllr.exe46⤵
- Executes dropped EXE
PID:1020 -
\??\c:\3tbttt.exec:\3tbttt.exe47⤵
- Executes dropped EXE
PID:4436 -
\??\c:\1ttbtn.exec:\1ttbtn.exe48⤵
- Executes dropped EXE
PID:3124 -
\??\c:\jpvdj.exec:\jpvdj.exe49⤵
- Executes dropped EXE
PID:884 -
\??\c:\lflfrrr.exec:\lflfrrr.exe50⤵
- Executes dropped EXE
PID:1332 -
\??\c:\rlffflr.exec:\rlffflr.exe51⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5hhbbn.exec:\5hhbbn.exe52⤵
- Executes dropped EXE
PID:5096 -
\??\c:\pjppj.exec:\pjppj.exe53⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rllfxxr.exec:\rllfxxr.exe54⤵
- Executes dropped EXE
PID:968 -
\??\c:\7tttnn.exec:\7tttnn.exe55⤵
- Executes dropped EXE
PID:3996 -
\??\c:\pjpjv.exec:\pjpjv.exe56⤵
- Executes dropped EXE
PID:1596 -
\??\c:\1xxxflf.exec:\1xxxflf.exe57⤵
- Executes dropped EXE
PID:860 -
\??\c:\9nnnnn.exec:\9nnnnn.exe58⤵
- Executes dropped EXE
PID:3096 -
\??\c:\bbbbhn.exec:\bbbbhn.exe59⤵
- Executes dropped EXE
PID:1188 -
\??\c:\pppjv.exec:\pppjv.exe60⤵
- Executes dropped EXE
PID:3724 -
\??\c:\jdjjj.exec:\jdjjj.exe61⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xlrrfff.exec:\xlrrfff.exe62⤵
- Executes dropped EXE
PID:4108 -
\??\c:\hhnhbn.exec:\hhnhbn.exe63⤵
- Executes dropped EXE
PID:816 -
\??\c:\hbbthh.exec:\hbbthh.exe64⤵
- Executes dropped EXE
PID:3744 -
\??\c:\jjjdd.exec:\jjjdd.exe65⤵
- Executes dropped EXE
PID:3260 -
\??\c:\9ffxxxf.exec:\9ffxxxf.exe66⤵PID:2136
-
\??\c:\5tttnn.exec:\5tttnn.exe67⤵PID:3080
-
\??\c:\btbhbb.exec:\btbhbb.exe68⤵PID:3280
-
\??\c:\vvdvj.exec:\vvdvj.exe69⤵PID:384
-
\??\c:\flfrlfx.exec:\flfrlfx.exe70⤵PID:3020
-
\??\c:\ththth.exec:\ththth.exe71⤵PID:4444
-
\??\c:\pjjvj.exec:\pjjvj.exe72⤵PID:3656
-
\??\c:\vvjvj.exec:\vvjvj.exe73⤵PID:3940
-
\??\c:\bnhbnn.exec:\bnhbnn.exe74⤵PID:2024
-
\??\c:\nbnhbb.exec:\nbnhbb.exe75⤵PID:4372
-
\??\c:\1jjdv.exec:\1jjdv.exe76⤵PID:1480
-
\??\c:\frrfrlf.exec:\frrfrlf.exe77⤵PID:4244
-
\??\c:\nnhthh.exec:\nnhthh.exe78⤵PID:1688
-
\??\c:\jdjjj.exec:\jdjjj.exe79⤵PID:8
-
\??\c:\3fxlxrf.exec:\3fxlxrf.exe80⤵PID:2364
-
\??\c:\nhhbtn.exec:\nhhbtn.exe81⤵
- System Location Discovery: System Language Discovery
PID:3684 -
\??\c:\jvdvd.exec:\jvdvd.exe82⤵PID:1532
-
\??\c:\jppjd.exec:\jppjd.exe83⤵PID:1824
-
\??\c:\9ffxrrl.exec:\9ffxrrl.exe84⤵PID:3504
-
\??\c:\tbhbtn.exec:\tbhbtn.exe85⤵PID:2420
-
\??\c:\3vpvp.exec:\3vpvp.exe86⤵PID:4948
-
\??\c:\xrllxfr.exec:\xrllxfr.exe87⤵PID:1400
-
\??\c:\5nthtb.exec:\5nthtb.exe88⤵PID:1040
-
\??\c:\1nnhtt.exec:\1nnhtt.exe89⤵PID:4288
-
\??\c:\pppjd.exec:\pppjd.exe90⤵PID:2004
-
\??\c:\9lrfxrf.exec:\9lrfxrf.exe91⤵PID:4756
-
\??\c:\rflffxx.exec:\rflffxx.exe92⤵PID:4884
-
\??\c:\hnnbtt.exec:\hnnbtt.exe93⤵PID:1616
-
\??\c:\vjppp.exec:\vjppp.exe94⤵PID:3680
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe95⤵PID:3468
-
\??\c:\lrxrfxr.exec:\lrxrfxr.exe96⤵PID:4668
-
\??\c:\nnhbbt.exec:\nnhbbt.exe97⤵PID:4176
-
\??\c:\7ppjp.exec:\7ppjp.exe98⤵PID:2672
-
\??\c:\rlxrllr.exec:\rlxrllr.exe99⤵PID:4944
-
\??\c:\7tbttt.exec:\7tbttt.exe100⤵PID:1316
-
\??\c:\bhnbbt.exec:\bhnbbt.exe101⤵PID:1488
-
\??\c:\vjvpj.exec:\vjvpj.exe102⤵PID:3796
-
\??\c:\frlfrrl.exec:\frlfrrl.exe103⤵PID:1124
-
\??\c:\bnnhtn.exec:\bnnhtn.exe104⤵PID:3876
-
\??\c:\5tbtnh.exec:\5tbtnh.exe105⤵PID:2428
-
\??\c:\9vvpj.exec:\9vvpj.exe106⤵PID:2224
-
\??\c:\3ffrfxl.exec:\3ffrfxl.exe107⤵PID:4548
-
\??\c:\ttttnn.exec:\ttttnn.exe108⤵
- System Location Discovery: System Language Discovery
PID:3268 -
\??\c:\pddpd.exec:\pddpd.exe109⤵PID:4540
-
\??\c:\3xlflrx.exec:\3xlflrx.exe110⤵PID:1460
-
\??\c:\lxfxfrr.exec:\lxfxfrr.exe111⤵PID:3748
-
\??\c:\nnnhhh.exec:\nnnhhh.exe112⤵PID:3180
-
\??\c:\5vvvv.exec:\5vvvv.exe113⤵PID:2980
-
\??\c:\lrxrlrr.exec:\lrxrlrr.exe114⤵PID:968
-
\??\c:\xlxlxxr.exec:\xlxlxxr.exe115⤵PID:3880
-
\??\c:\hhnhhh.exec:\hhnhhh.exe116⤵PID:1596
-
\??\c:\jvjdv.exec:\jvjdv.exe117⤵PID:2596
-
\??\c:\rflfxrl.exec:\rflfxrl.exe118⤵PID:852
-
\??\c:\rlxrfrl.exec:\rlxrfrl.exe119⤵PID:1188
-
\??\c:\btbbtb.exec:\btbbtb.exe120⤵PID:2680
-
\??\c:\jjjjv.exec:\jjjjv.exe121⤵PID:2620
-
\??\c:\xlrlrrl.exec:\xlrlrrl.exe122⤵PID:2736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-