Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 22:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3dbced3221fd43e81f7fe5103cbf6f4fb3a28a137c55275234dfee09f4423938.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
3dbced3221fd43e81f7fe5103cbf6f4fb3a28a137c55275234dfee09f4423938.exe
-
Size
454KB
-
MD5
c4de27a9dd77f91a056bffe49b4c3f03
-
SHA1
b5641ffbc832eb12f73f2f41730e8781c3c36410
-
SHA256
3dbced3221fd43e81f7fe5103cbf6f4fb3a28a137c55275234dfee09f4423938
-
SHA512
647fd098a54ddcca897285e9b2c5f9ef9d2bc892b7e47f0310b892ce7b61edb5c568740cd7f8bc658f98ac6b1df3895cef9ec97738330874d7e00dd78b487397
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeQ:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1524-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/984-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/660-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/504-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/504-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-985-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-1022-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-1083-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-1210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-1419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1124 xfxfrlx.exe 3720 pvvjd.exe 3464 rrrlxxr.exe 4288 jdpvd.exe 4116 ppddd.exe 4004 hnbbbh.exe 1600 9nnbhb.exe 2304 ddjdj.exe 396 httbht.exe 4368 rlflrxf.exe 3688 5nhtnt.exe 3936 rffffxf.exe 5048 ttnhtn.exe 3360 frrlfrl.exe 1572 nbtnhb.exe 1840 3xffxxx.exe 3240 7jvpd.exe 2132 xrlflfx.exe 4796 ttbntn.exe 1208 5ddvp.exe 1660 bhhthb.exe 4240 lfrlxxr.exe 2356 ttbtbb.exe 4428 djppd.exe 3068 vjdvj.exe 1952 3xrlrlf.exe 3004 vpjpv.exe 3552 7fxlfff.exe 1708 pdvjp.exe 1464 nbhtnb.exe 2248 dpjdp.exe 4984 frfrlxr.exe 1712 nbtnbn.exe 1596 5djpd.exe 648 flfxrlf.exe 3496 hhhhbt.exe 4588 ppvjd.exe 5064 jvpdd.exe 3400 llrfrlx.exe 440 htnhbt.exe 4312 bhhhbt.exe 1932 9vpjp.exe 4324 frlxlfx.exe 1212 hbttnh.exe 1052 3bbttn.exe 984 vddvj.exe 2032 xlrlxff.exe 4300 9nthbt.exe 4280 ppjdv.exe 5044 dpjdp.exe 1124 5rrrlrl.exe 4608 btbttn.exe 1312 vdjvj.exe 492 pjdpj.exe 3520 xlxlrlf.exe 4812 hbhthb.exe 760 vjjdp.exe 4656 vvdpd.exe 4992 llrxffl.exe 716 hnbttn.exe 2284 ddvjd.exe 3600 lrllfxr.exe 3032 1llfrlx.exe 3524 nbnthb.exe -
resource yara_rule behavioral2/memory/1524-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/984-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/660-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/504-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/504-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-954-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-985-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-1022-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 1124 1524 3dbced3221fd43e81f7fe5103cbf6f4fb3a28a137c55275234dfee09f4423938.exe 84 PID 1524 wrote to memory of 1124 1524 3dbced3221fd43e81f7fe5103cbf6f4fb3a28a137c55275234dfee09f4423938.exe 84 PID 1524 wrote to memory of 1124 1524 3dbced3221fd43e81f7fe5103cbf6f4fb3a28a137c55275234dfee09f4423938.exe 84 PID 1124 wrote to memory of 3720 1124 xfxfrlx.exe 85 PID 1124 wrote to memory of 3720 1124 xfxfrlx.exe 85 PID 1124 wrote to memory of 3720 1124 xfxfrlx.exe 85 PID 3720 wrote to memory of 3464 3720 pvvjd.exe 86 PID 3720 wrote to memory of 3464 3720 pvvjd.exe 86 PID 3720 wrote to memory of 3464 3720 pvvjd.exe 86 PID 3464 wrote to memory of 4288 3464 rrrlxxr.exe 87 PID 3464 wrote to memory of 4288 3464 rrrlxxr.exe 87 PID 3464 wrote to memory of 4288 3464 rrrlxxr.exe 87 PID 4288 wrote to memory of 4116 4288 jdpvd.exe 88 PID 4288 wrote to memory of 4116 4288 jdpvd.exe 88 PID 4288 wrote to memory of 4116 4288 jdpvd.exe 88 PID 4116 wrote to memory of 4004 4116 ppddd.exe 89 PID 4116 wrote to memory of 4004 4116 ppddd.exe 89 PID 4116 wrote to memory of 4004 4116 ppddd.exe 89 PID 4004 wrote to memory of 1600 4004 hnbbbh.exe 90 PID 4004 wrote to memory of 1600 4004 hnbbbh.exe 90 PID 4004 wrote to memory of 1600 4004 hnbbbh.exe 90 PID 1600 wrote to memory of 2304 1600 9nnbhb.exe 91 PID 1600 wrote to memory of 2304 1600 9nnbhb.exe 91 PID 1600 wrote to memory of 2304 1600 9nnbhb.exe 91 PID 2304 wrote to memory of 396 2304 ddjdj.exe 92 PID 2304 wrote to memory of 396 2304 ddjdj.exe 92 PID 2304 wrote to memory of 396 2304 ddjdj.exe 92 PID 396 wrote to memory of 4368 396 httbht.exe 93 PID 396 wrote to memory of 4368 396 httbht.exe 93 PID 396 wrote to memory of 4368 396 httbht.exe 93 PID 4368 wrote to memory of 3688 4368 rlflrxf.exe 94 PID 4368 wrote to memory of 3688 4368 rlflrxf.exe 94 PID 4368 wrote to memory of 3688 4368 rlflrxf.exe 94 PID 3688 wrote to memory of 3936 3688 5nhtnt.exe 95 PID 3688 wrote to memory of 3936 3688 5nhtnt.exe 95 PID 3688 wrote to memory of 3936 3688 5nhtnt.exe 95 PID 3936 wrote to memory of 5048 3936 rffffxf.exe 96 PID 3936 wrote to memory of 5048 3936 rffffxf.exe 96 PID 3936 wrote to memory of 5048 3936 rffffxf.exe 96 PID 5048 wrote to memory of 3360 5048 ttnhtn.exe 97 PID 5048 wrote to memory of 3360 5048 ttnhtn.exe 97 PID 5048 wrote to memory of 3360 5048 ttnhtn.exe 97 PID 3360 wrote to memory of 1572 3360 frrlfrl.exe 98 PID 3360 wrote to memory of 1572 3360 frrlfrl.exe 98 PID 3360 wrote to memory of 1572 3360 frrlfrl.exe 98 PID 1572 wrote to memory of 1840 1572 nbtnhb.exe 99 PID 1572 wrote to memory of 1840 1572 nbtnhb.exe 99 PID 1572 wrote to memory of 1840 1572 nbtnhb.exe 99 PID 1840 wrote to memory of 3240 1840 3xffxxx.exe 100 PID 1840 wrote to memory of 3240 1840 3xffxxx.exe 100 PID 1840 wrote to memory of 3240 1840 3xffxxx.exe 100 PID 3240 wrote to memory of 2132 3240 7jvpd.exe 101 PID 3240 wrote to memory of 2132 3240 7jvpd.exe 101 PID 3240 wrote to memory of 2132 3240 7jvpd.exe 101 PID 2132 wrote to memory of 4796 2132 xrlflfx.exe 102 PID 2132 wrote to memory of 4796 2132 xrlflfx.exe 102 PID 2132 wrote to memory of 4796 2132 xrlflfx.exe 102 PID 4796 wrote to memory of 1208 4796 ttbntn.exe 103 PID 4796 wrote to memory of 1208 4796 ttbntn.exe 103 PID 4796 wrote to memory of 1208 4796 ttbntn.exe 103 PID 1208 wrote to memory of 1660 1208 5ddvp.exe 104 PID 1208 wrote to memory of 1660 1208 5ddvp.exe 104 PID 1208 wrote to memory of 1660 1208 5ddvp.exe 104 PID 1660 wrote to memory of 4240 1660 bhhthb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dbced3221fd43e81f7fe5103cbf6f4fb3a28a137c55275234dfee09f4423938.exe"C:\Users\Admin\AppData\Local\Temp\3dbced3221fd43e81f7fe5103cbf6f4fb3a28a137c55275234dfee09f4423938.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\xfxfrlx.exec:\xfxfrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\pvvjd.exec:\pvvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\rrrlxxr.exec:\rrrlxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\jdpvd.exec:\jdpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\ppddd.exec:\ppddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\hnbbbh.exec:\hnbbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\9nnbhb.exec:\9nnbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\ddjdj.exec:\ddjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\httbht.exec:\httbht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\rlflrxf.exec:\rlflrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\5nhtnt.exec:\5nhtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\rffffxf.exec:\rffffxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\ttnhtn.exec:\ttnhtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\frrlfrl.exec:\frrlfrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\nbtnhb.exec:\nbtnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\3xffxxx.exec:\3xffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\7jvpd.exec:\7jvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\xrlflfx.exec:\xrlflfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\ttbntn.exec:\ttbntn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\5ddvp.exec:\5ddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\bhhthb.exec:\bhhthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe23⤵
- Executes dropped EXE
PID:4240 -
\??\c:\ttbtbb.exec:\ttbtbb.exe24⤵
- Executes dropped EXE
PID:2356 -
\??\c:\djppd.exec:\djppd.exe25⤵
- Executes dropped EXE
PID:4428 -
\??\c:\vjdvj.exec:\vjdvj.exe26⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3xrlrlf.exec:\3xrlrlf.exe27⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vpjpv.exec:\vpjpv.exe28⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7fxlfff.exec:\7fxlfff.exe29⤵
- Executes dropped EXE
PID:3552 -
\??\c:\pdvjp.exec:\pdvjp.exe30⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nbhtnb.exec:\nbhtnb.exe31⤵
- Executes dropped EXE
PID:1464 -
\??\c:\dpjdp.exec:\dpjdp.exe32⤵
- Executes dropped EXE
PID:2248 -
\??\c:\frfrlxr.exec:\frfrlxr.exe33⤵
- Executes dropped EXE
PID:4984 -
\??\c:\nbtnbn.exec:\nbtnbn.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5djpd.exec:\5djpd.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\flfxrlf.exec:\flfxrlf.exe36⤵
- Executes dropped EXE
PID:648 -
\??\c:\hhhhbt.exec:\hhhhbt.exe37⤵
- Executes dropped EXE
PID:3496 -
\??\c:\ppvjd.exec:\ppvjd.exe38⤵
- Executes dropped EXE
PID:4588 -
\??\c:\jvpdd.exec:\jvpdd.exe39⤵
- Executes dropped EXE
PID:5064 -
\??\c:\llrfrlx.exec:\llrfrlx.exe40⤵
- Executes dropped EXE
PID:3400 -
\??\c:\htnhbt.exec:\htnhbt.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:440 -
\??\c:\bhhhbt.exec:\bhhhbt.exe42⤵
- Executes dropped EXE
PID:4312 -
\??\c:\9vpjp.exec:\9vpjp.exe43⤵
- Executes dropped EXE
PID:1932 -
\??\c:\frlxlfx.exec:\frlxlfx.exe44⤵
- Executes dropped EXE
PID:4324 -
\??\c:\hbttnh.exec:\hbttnh.exe45⤵
- Executes dropped EXE
PID:1212 -
\??\c:\3bbttn.exec:\3bbttn.exe46⤵
- Executes dropped EXE
PID:1052 -
\??\c:\vddvj.exec:\vddvj.exe47⤵
- Executes dropped EXE
PID:984 -
\??\c:\xlrlxff.exec:\xlrlxff.exe48⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9nthbt.exec:\9nthbt.exe49⤵
- Executes dropped EXE
PID:4300 -
\??\c:\ppjdv.exec:\ppjdv.exe50⤵
- Executes dropped EXE
PID:4280 -
\??\c:\dpjdp.exec:\dpjdp.exe51⤵
- Executes dropped EXE
PID:5044 -
\??\c:\5rrrlrl.exec:\5rrrlrl.exe52⤵
- Executes dropped EXE
PID:1124 -
\??\c:\btbttn.exec:\btbttn.exe53⤵
- Executes dropped EXE
PID:4608 -
\??\c:\vdjvj.exec:\vdjvj.exe54⤵
- Executes dropped EXE
PID:1312 -
\??\c:\pjdpj.exec:\pjdpj.exe55⤵
- Executes dropped EXE
PID:492 -
\??\c:\xlxlrlf.exec:\xlxlrlf.exe56⤵
- Executes dropped EXE
PID:3520 -
\??\c:\hbhthb.exec:\hbhthb.exe57⤵
- Executes dropped EXE
PID:4812 -
\??\c:\vjjdp.exec:\vjjdp.exe58⤵
- Executes dropped EXE
PID:760 -
\??\c:\vvdpd.exec:\vvdpd.exe59⤵
- Executes dropped EXE
PID:4656 -
\??\c:\llrxffl.exec:\llrxffl.exe60⤵
- Executes dropped EXE
PID:4992 -
\??\c:\hnbttn.exec:\hnbttn.exe61⤵
- Executes dropped EXE
PID:716 -
\??\c:\ddvjd.exec:\ddvjd.exe62⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lrllfxr.exec:\lrllfxr.exe63⤵
- Executes dropped EXE
PID:3600 -
\??\c:\1llfrlx.exec:\1llfrlx.exe64⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nbnthb.exec:\nbnthb.exe65⤵
- Executes dropped EXE
PID:3524 -
\??\c:\lffxlfx.exec:\lffxlfx.exe66⤵PID:2792
-
\??\c:\lffxlfl.exec:\lffxlfl.exe67⤵PID:2420
-
\??\c:\bbhhbt.exec:\bbhhbt.exe68⤵PID:4776
-
\??\c:\djpvj.exec:\djpvj.exe69⤵PID:376
-
\??\c:\fxrfxfr.exec:\fxrfxfr.exe70⤵PID:5060
-
\??\c:\lffxrfx.exec:\lffxrfx.exe71⤵PID:660
-
\??\c:\tnhtnh.exec:\tnhtnh.exe72⤵PID:4908
-
\??\c:\djvpj.exec:\djvpj.exe73⤵PID:3848
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe74⤵PID:1572
-
\??\c:\5lrfxxl.exec:\5lrfxxl.exe75⤵PID:3216
-
\??\c:\9ntnbb.exec:\9ntnbb.exe76⤵PID:4900
-
\??\c:\jvvjd.exec:\jvvjd.exe77⤵PID:3872
-
\??\c:\jvjvv.exec:\jvjvv.exe78⤵PID:4796
-
\??\c:\frxlrlr.exec:\frxlrlr.exe79⤵PID:936
-
\??\c:\5hhbtn.exec:\5hhbtn.exe80⤵PID:4600
-
\??\c:\tnhhtn.exec:\tnhhtn.exe81⤵PID:504
-
\??\c:\pjpjp.exec:\pjpjp.exe82⤵PID:2856
-
\??\c:\frxlxxr.exec:\frxlxxr.exe83⤵PID:2356
-
\??\c:\htbthb.exec:\htbthb.exe84⤵PID:404
-
\??\c:\dpvpp.exec:\dpvpp.exe85⤵PID:4428
-
\??\c:\3dvjd.exec:\3dvjd.exe86⤵PID:3452
-
\??\c:\frxfrlx.exec:\frxfrlx.exe87⤵PID:2740
-
\??\c:\btbthn.exec:\btbthn.exe88⤵PID:3856
-
\??\c:\dvjpp.exec:\dvjpp.exe89⤵PID:2448
-
\??\c:\xlxfrlr.exec:\xlxfrlr.exe90⤵PID:4540
-
\??\c:\1bbbtn.exec:\1bbbtn.exe91⤵PID:4468
-
\??\c:\1nnhbt.exec:\1nnhbt.exe92⤵PID:232
-
\??\c:\vjdvv.exec:\vjdvv.exe93⤵PID:4364
-
\??\c:\xllxlfx.exec:\xllxlfx.exe94⤵PID:4488
-
\??\c:\nhhbnh.exec:\nhhbnh.exe95⤵PID:1804
-
\??\c:\1vdvd.exec:\1vdvd.exe96⤵PID:3780
-
\??\c:\djpdv.exec:\djpdv.exe97⤵PID:3484
-
\??\c:\xllxllf.exec:\xllxllf.exe98⤵PID:5036
-
\??\c:\hbthbt.exec:\hbthbt.exe99⤵PID:5076
-
\??\c:\jjdvp.exec:\jjdvp.exe100⤵PID:4404
-
\??\c:\fxxlxrl.exec:\fxxlxrl.exe101⤵PID:3132
-
\??\c:\hthhtt.exec:\hthhtt.exe102⤵PID:2912
-
\??\c:\pdvpd.exec:\pdvpd.exe103⤵PID:4664
-
\??\c:\xrlfrrr.exec:\xrlfrrr.exe104⤵PID:440
-
\??\c:\9tbnbb.exec:\9tbnbb.exe105⤵PID:1296
-
\??\c:\tntnnn.exec:\tntnnn.exe106⤵PID:536
-
\??\c:\dpvvp.exec:\dpvvp.exe107⤵PID:1848
-
\??\c:\dpdpd.exec:\dpdpd.exe108⤵PID:5000
-
\??\c:\3flxxrr.exec:\3flxxrr.exe109⤵PID:2232
-
\??\c:\hhtbtn.exec:\hhtbtn.exe110⤵PID:2704
-
\??\c:\ppjdv.exec:\ppjdv.exe111⤵PID:880
-
\??\c:\dvvpd.exec:\dvvpd.exe112⤵PID:1808
-
\??\c:\xfrfxrf.exec:\xfrfxrf.exe113⤵PID:1912
-
\??\c:\thbtnh.exec:\thbtnh.exe114⤵PID:4220
-
\??\c:\vpjdv.exec:\vpjdv.exe115⤵PID:3616
-
\??\c:\ppjpj.exec:\ppjpj.exe116⤵PID:3720
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe117⤵PID:4492
-
\??\c:\tntnbb.exec:\tntnbb.exe118⤵PID:1144
-
\??\c:\hhnbnt.exec:\hhnbnt.exe119⤵PID:2728
-
\??\c:\ddjdv.exec:\ddjdv.exe120⤵PID:1556
-
\??\c:\5xfxxxl.exec:\5xfxxxl.exe121⤵PID:4212
-
\??\c:\3rfxrlf.exec:\3rfxrlf.exe122⤵PID:4476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-