Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe
-
Size
456KB
-
MD5
99b19db190a700077b66f0fb212ca59f
-
SHA1
b0199d5796e89cec99ac5250e7d738b4a891ad54
-
SHA256
cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034
-
SHA512
23a2f8a595b669ebf0646aea5bcfda29f435ed07e4dea63db4ec532bec053f2c3c5a18b7e367e388ed3143562ca22cd1d08413778d414617df3fdb3f866e28c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRh:q7Tc2NYHUrAwfMp3CDRh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/5048-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/336-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-941-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-1874-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4608 lxfxrrl.exe 744 5bhhbb.exe 824 vddvv.exe 4044 lxflfff.exe 3608 bttnnh.exe 2500 ddjpj.exe 404 ppvpp.exe 3056 jpdvp.exe 3200 llfrrlr.exe 4436 9tbhhn.exe 544 ddvjp.exe 2360 5rfxxll.exe 2884 btnhbh.exe 4540 thbthh.exe 2372 rfxrlfr.exe 3596 nhtnnn.exe 2008 dvpjj.exe 2776 nttnbb.exe 2848 rlrlfff.exe 1520 hbbtnn.exe 5108 vvdvv.exe 2724 frflfff.exe 2464 rrllffx.exe 4876 vpddv.exe 1800 7xlllll.exe 4524 jvdvv.exe 216 1xxxxxr.exe 4532 ffrlfxr.exe 3580 btbbbb.exe 1328 hhtnbb.exe 1480 9ttttt.exe 5040 7pjjj.exe 3132 nbtnnb.exe 1348 9pdvp.exe 4848 7fffxxl.exe 3960 bhhttt.exe 4136 dvddv.exe 4776 3rxrllf.exe 4088 rlxrrll.exe 2812 hbttnn.exe 940 dpvpp.exe 3692 nhbbtt.exe 1584 vdpjj.exe 2228 ttbttb.exe 4604 pjdvd.exe 4828 fxfxllf.exe 548 hhhtnt.exe 4440 tbtbtt.exe 4432 vvvdd.exe 2484 rffxffx.exe 4620 bnhbtn.exe 396 9djdv.exe 2040 lxxlffx.exe 468 bbbhtn.exe 824 pvddv.exe 4788 fxrxffx.exe 3668 hbnhbb.exe 4472 9thnhh.exe 336 vvdvp.exe 4972 rxffllr.exe 4004 rxllfxx.exe 708 7bnhnt.exe 2496 1frxxff.exe 208 hnbtnn.exe -
resource yara_rule behavioral2/memory/5048-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/336-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-941-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5048 wrote to memory of 4608 5048 cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe 83 PID 5048 wrote to memory of 4608 5048 cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe 83 PID 5048 wrote to memory of 4608 5048 cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe 83 PID 4608 wrote to memory of 744 4608 lxfxrrl.exe 84 PID 4608 wrote to memory of 744 4608 lxfxrrl.exe 84 PID 4608 wrote to memory of 744 4608 lxfxrrl.exe 84 PID 744 wrote to memory of 824 744 5bhhbb.exe 85 PID 744 wrote to memory of 824 744 5bhhbb.exe 85 PID 744 wrote to memory of 824 744 5bhhbb.exe 85 PID 824 wrote to memory of 4044 824 vddvv.exe 86 PID 824 wrote to memory of 4044 824 vddvv.exe 86 PID 824 wrote to memory of 4044 824 vddvv.exe 86 PID 4044 wrote to memory of 3608 4044 lxflfff.exe 87 PID 4044 wrote to memory of 3608 4044 lxflfff.exe 87 PID 4044 wrote to memory of 3608 4044 lxflfff.exe 87 PID 3608 wrote to memory of 2500 3608 bttnnh.exe 88 PID 3608 wrote to memory of 2500 3608 bttnnh.exe 88 PID 3608 wrote to memory of 2500 3608 bttnnh.exe 88 PID 2500 wrote to memory of 404 2500 ddjpj.exe 89 PID 2500 wrote to memory of 404 2500 ddjpj.exe 89 PID 2500 wrote to memory of 404 2500 ddjpj.exe 89 PID 404 wrote to memory of 3056 404 ppvpp.exe 90 PID 404 wrote to memory of 3056 404 ppvpp.exe 90 PID 404 wrote to memory of 3056 404 ppvpp.exe 90 PID 3056 wrote to memory of 3200 3056 jpdvp.exe 91 PID 3056 wrote to memory of 3200 3056 jpdvp.exe 91 PID 3056 wrote to memory of 3200 3056 jpdvp.exe 91 PID 3200 wrote to memory of 4436 3200 llfrrlr.exe 92 PID 3200 wrote to memory of 4436 3200 llfrrlr.exe 92 PID 3200 wrote to memory of 4436 3200 llfrrlr.exe 92 PID 4436 wrote to memory of 544 4436 9tbhhn.exe 93 PID 4436 wrote to memory of 544 4436 9tbhhn.exe 93 PID 4436 wrote to memory of 544 4436 9tbhhn.exe 93 PID 544 wrote to memory of 2360 544 ddvjp.exe 94 PID 544 wrote to memory of 2360 544 ddvjp.exe 94 PID 544 wrote to memory of 2360 544 ddvjp.exe 94 PID 2360 wrote to memory of 2884 2360 5rfxxll.exe 95 PID 2360 wrote to memory of 2884 2360 5rfxxll.exe 95 PID 2360 wrote to memory of 2884 2360 5rfxxll.exe 95 PID 2884 wrote to memory of 4540 2884 btnhbh.exe 96 PID 2884 wrote to memory of 4540 2884 btnhbh.exe 96 PID 2884 wrote to memory of 4540 2884 btnhbh.exe 96 PID 4540 wrote to memory of 2372 4540 thbthh.exe 97 PID 4540 wrote to memory of 2372 4540 thbthh.exe 97 PID 4540 wrote to memory of 2372 4540 thbthh.exe 97 PID 2372 wrote to memory of 3596 2372 rfxrlfr.exe 98 PID 2372 wrote to memory of 3596 2372 rfxrlfr.exe 98 PID 2372 wrote to memory of 3596 2372 rfxrlfr.exe 98 PID 3596 wrote to memory of 2008 3596 nhtnnn.exe 99 PID 3596 wrote to memory of 2008 3596 nhtnnn.exe 99 PID 3596 wrote to memory of 2008 3596 nhtnnn.exe 99 PID 2008 wrote to memory of 2776 2008 dvpjj.exe 100 PID 2008 wrote to memory of 2776 2008 dvpjj.exe 100 PID 2008 wrote to memory of 2776 2008 dvpjj.exe 100 PID 2776 wrote to memory of 2848 2776 nttnbb.exe 101 PID 2776 wrote to memory of 2848 2776 nttnbb.exe 101 PID 2776 wrote to memory of 2848 2776 nttnbb.exe 101 PID 2848 wrote to memory of 1520 2848 rlrlfff.exe 102 PID 2848 wrote to memory of 1520 2848 rlrlfff.exe 102 PID 2848 wrote to memory of 1520 2848 rlrlfff.exe 102 PID 1520 wrote to memory of 5108 1520 hbbtnn.exe 103 PID 1520 wrote to memory of 5108 1520 hbbtnn.exe 103 PID 1520 wrote to memory of 5108 1520 hbbtnn.exe 103 PID 5108 wrote to memory of 2724 5108 vvdvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe"C:\Users\Admin\AppData\Local\Temp\cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\5bhhbb.exec:\5bhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\vddvv.exec:\vddvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\lxflfff.exec:\lxflfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\bttnnh.exec:\bttnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\ddjpj.exec:\ddjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\ppvpp.exec:\ppvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\jpdvp.exec:\jpdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\llfrrlr.exec:\llfrrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\9tbhhn.exec:\9tbhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\ddvjp.exec:\ddvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\5rfxxll.exec:\5rfxxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\btnhbh.exec:\btnhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\thbthh.exec:\thbthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\rfxrlfr.exec:\rfxrlfr.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\nhtnnn.exec:\nhtnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\dvpjj.exec:\dvpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\nttnbb.exec:\nttnbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rlrlfff.exec:\rlrlfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\hbbtnn.exec:\hbbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\vvdvv.exec:\vvdvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\frflfff.exec:\frflfff.exe23⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rrllffx.exec:\rrllffx.exe24⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vpddv.exec:\vpddv.exe25⤵
- Executes dropped EXE
PID:4876 -
\??\c:\7xlllll.exec:\7xlllll.exe26⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jvdvv.exec:\jvdvv.exe27⤵
- Executes dropped EXE
PID:4524 -
\??\c:\1xxxxxr.exec:\1xxxxxr.exe28⤵
- Executes dropped EXE
PID:216 -
\??\c:\ffrlfxr.exec:\ffrlfxr.exe29⤵
- Executes dropped EXE
PID:4532 -
\??\c:\btbbbb.exec:\btbbbb.exe30⤵
- Executes dropped EXE
PID:3580 -
\??\c:\hhtnbb.exec:\hhtnbb.exe31⤵
- Executes dropped EXE
PID:1328 -
\??\c:\9ttttt.exec:\9ttttt.exe32⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7pjjj.exec:\7pjjj.exe33⤵
- Executes dropped EXE
PID:5040 -
\??\c:\nbtnnb.exec:\nbtnnb.exe34⤵
- Executes dropped EXE
PID:3132 -
\??\c:\9pdvp.exec:\9pdvp.exe35⤵
- Executes dropped EXE
PID:1348 -
\??\c:\7fffxxl.exec:\7fffxxl.exe36⤵
- Executes dropped EXE
PID:4848 -
\??\c:\bhhttt.exec:\bhhttt.exe37⤵
- Executes dropped EXE
PID:3960 -
\??\c:\dvddv.exec:\dvddv.exe38⤵
- Executes dropped EXE
PID:4136 -
\??\c:\3rxrllf.exec:\3rxrllf.exe39⤵
- Executes dropped EXE
PID:4776 -
\??\c:\rlxrrll.exec:\rlxrrll.exe40⤵
- Executes dropped EXE
PID:4088 -
\??\c:\hbttnn.exec:\hbttnn.exe41⤵
- Executes dropped EXE
PID:2812 -
\??\c:\dpvpp.exec:\dpvpp.exe42⤵
- Executes dropped EXE
PID:940 -
\??\c:\nhbbtt.exec:\nhbbtt.exe43⤵
- Executes dropped EXE
PID:3692 -
\??\c:\vdpjj.exec:\vdpjj.exe44⤵
- Executes dropped EXE
PID:1584 -
\??\c:\ttbttb.exec:\ttbttb.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pjdvd.exec:\pjdvd.exe46⤵
- Executes dropped EXE
PID:4604 -
\??\c:\fxfxllf.exec:\fxfxllf.exe47⤵
- Executes dropped EXE
PID:4828 -
\??\c:\hhhtnt.exec:\hhhtnt.exe48⤵
- Executes dropped EXE
PID:548 -
\??\c:\tbtbtt.exec:\tbtbtt.exe49⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vvvdd.exec:\vvvdd.exe50⤵
- Executes dropped EXE
PID:4432 -
\??\c:\rffxffx.exec:\rffxffx.exe51⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bnhbtn.exec:\bnhbtn.exe52⤵
- Executes dropped EXE
PID:4620 -
\??\c:\9djdv.exec:\9djdv.exe53⤵
- Executes dropped EXE
PID:396 -
\??\c:\lxxlffx.exec:\lxxlffx.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bbbhtn.exec:\bbbhtn.exe55⤵
- Executes dropped EXE
PID:468 -
\??\c:\pvddv.exec:\pvddv.exe56⤵
- Executes dropped EXE
PID:824 -
\??\c:\fxrxffx.exec:\fxrxffx.exe57⤵
- Executes dropped EXE
PID:4788 -
\??\c:\hbnhbb.exec:\hbnhbb.exe58⤵
- Executes dropped EXE
PID:3668 -
\??\c:\9thnhh.exec:\9thnhh.exe59⤵
- Executes dropped EXE
PID:4472 -
\??\c:\vvdvp.exec:\vvdvp.exe60⤵
- Executes dropped EXE
PID:336 -
\??\c:\rxffllr.exec:\rxffllr.exe61⤵
- Executes dropped EXE
PID:4972 -
\??\c:\rxllfxx.exec:\rxllfxx.exe62⤵
- Executes dropped EXE
PID:4004 -
\??\c:\7bnhnt.exec:\7bnhnt.exe63⤵
- Executes dropped EXE
PID:708 -
\??\c:\1frxxff.exec:\1frxxff.exe64⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hnbtnn.exec:\hnbtnn.exe65⤵
- Executes dropped EXE
PID:208 -
\??\c:\vpvdv.exec:\vpvdv.exe66⤵PID:4968
-
\??\c:\5jjjd.exec:\5jjjd.exe67⤵PID:3712
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe68⤵PID:2472
-
\??\c:\hbbtnt.exec:\hbbtnt.exe69⤵PID:3480
-
\??\c:\hhbtnb.exec:\hhbtnb.exe70⤵PID:2328
-
\??\c:\pjvvj.exec:\pjvvj.exe71⤵PID:2700
-
\??\c:\xrrrllr.exec:\xrrrllr.exe72⤵PID:4692
-
\??\c:\1hhhbh.exec:\1hhhbh.exe73⤵PID:212
-
\??\c:\3vddv.exec:\3vddv.exe74⤵PID:2652
-
\??\c:\1rrlllf.exec:\1rrlllf.exe75⤵PID:4560
-
\??\c:\5fxlxxr.exec:\5fxlxxr.exe76⤵PID:2352
-
\??\c:\htbhhh.exec:\htbhhh.exe77⤵PID:1196
-
\??\c:\1dvpd.exec:\1dvpd.exe78⤵PID:3080
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe79⤵PID:1896
-
\??\c:\nntnbt.exec:\nntnbt.exe80⤵PID:1204
-
\??\c:\pjppp.exec:\pjppp.exe81⤵PID:2236
-
\??\c:\3lrrflf.exec:\3lrrflf.exe82⤵PID:2912
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe83⤵PID:4192
-
\??\c:\nthbhb.exec:\nthbhb.exe84⤵PID:1588
-
\??\c:\dvvpv.exec:\dvvpv.exe85⤵
- System Location Discovery: System Language Discovery
PID:5044 -
\??\c:\rlrrlll.exec:\rlrrlll.exe86⤵PID:3104
-
\??\c:\hnbhbb.exec:\hnbhbb.exe87⤵PID:2924
-
\??\c:\vvjjd.exec:\vvjjd.exe88⤵PID:2892
-
\??\c:\xrxrllf.exec:\xrxrllf.exe89⤵PID:3020
-
\??\c:\7xrlflf.exec:\7xrlflf.exe90⤵PID:4740
-
\??\c:\5hbbbh.exec:\5hbbbh.exe91⤵PID:5068
-
\??\c:\pjvvp.exec:\pjvvp.exe92⤵PID:1944
-
\??\c:\9rrlfff.exec:\9rrlfff.exe93⤵PID:1432
-
\??\c:\hnttnn.exec:\hnttnn.exe94⤵PID:872
-
\??\c:\nnbttn.exec:\nnbttn.exe95⤵PID:4736
-
\??\c:\ddjjj.exec:\ddjjj.exe96⤵PID:3672
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe97⤵PID:4992
-
\??\c:\hhnhhb.exec:\hhnhhb.exe98⤵PID:364
-
\??\c:\vpdvp.exec:\vpdvp.exe99⤵PID:3452
-
\??\c:\3llfxxr.exec:\3llfxxr.exe100⤵PID:1776
-
\??\c:\rrflffl.exec:\rrflffl.exe101⤵PID:2968
-
\??\c:\tnbtnn.exec:\tnbtnn.exe102⤵PID:3112
-
\??\c:\pdvvp.exec:\pdvvp.exe103⤵PID:1280
-
\??\c:\lffxrrl.exec:\lffxrrl.exe104⤵PID:4536
-
\??\c:\rrrrlfx.exec:\rrrrlfx.exe105⤵PID:1400
-
\??\c:\hnnnhh.exec:\hnnnhh.exe106⤵PID:3832
-
\??\c:\7vddd.exec:\7vddd.exe107⤵PID:3188
-
\??\c:\vpddv.exec:\vpddv.exe108⤵PID:4840
-
\??\c:\lflffll.exec:\lflffll.exe109⤵PID:3000
-
\??\c:\9nhhht.exec:\9nhhht.exe110⤵PID:1292
-
\??\c:\pdpjd.exec:\pdpjd.exe111⤵PID:3908
-
\??\c:\jvjdd.exec:\jvjdd.exe112⤵PID:4760
-
\??\c:\rrffffl.exec:\rrffffl.exe113⤵PID:4488
-
\??\c:\hntnnt.exec:\hntnnt.exe114⤵PID:4152
-
\??\c:\hbnhnn.exec:\hbnhnn.exe115⤵PID:832
-
\??\c:\jjvvv.exec:\jjvvv.exe116⤵PID:2992
-
\??\c:\fxfrlll.exec:\fxfrlll.exe117⤵PID:2096
-
\??\c:\ffrlffx.exec:\ffrlffx.exe118⤵PID:444
-
\??\c:\tntthh.exec:\tntthh.exe119⤵PID:4128
-
\??\c:\ddjjd.exec:\ddjjd.exe120⤵PID:4924
-
\??\c:\rlrlllr.exec:\rlrlllr.exe121⤵PID:824
-
\??\c:\xlffffx.exec:\xlffffx.exe122⤵PID:3340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-