Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 02:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe
-
Size
453KB
-
MD5
56645632e67dd45d19bf781e03d02b68
-
SHA1
717b373ce0a11375938c6bf259c215367c1545b6
-
SHA256
ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9
-
SHA512
50278056e362a69b60d6751db26452bc9facaf5900a229ab3977ade41a3c62f9c7562870b22b1e43bf23461a99b4ab01d2859dd9e97509a9cd8dae540f69c013
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1M:q7Tc2NYHUrAwfMp3CD1M
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4944-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-797-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1800 xflllrr.exe 4772 dpdvv.exe 3168 bbttnt.exe 4416 pddvp.exe 4040 7vpjd.exe 100 hhnhhh.exe 2100 vjjdv.exe 4748 nhhbnn.exe 3028 dpvvd.exe 1424 thtnbt.exe 3644 xrffffx.exe 3640 jjdvj.exe 2384 lfxxxll.exe 228 vpvvv.exe 640 llrfrrl.exe 956 ttbbbb.exe 8 ppdvp.exe 3940 fffxrlf.exe 3136 htnhbt.exe 4192 djdjv.exe 2652 llrlfxr.exe 4928 xflfxxl.exe 1148 hbtnhh.exe 3232 xrfxrrl.exe 2764 bnbtnn.exe 1708 dvdpj.exe 1832 fxrlxxr.exe 4796 lffxrlf.exe 3760 9tnhbb.exe 464 ttnnhh.exe 4832 jddvv.exe 4868 pdvpj.exe 3156 3rxfxxr.exe 1744 fxlfrrf.exe 3812 hhnhtn.exe 4848 pdjdj.exe 3608 nhhhhh.exe 4408 vpppd.exe 3752 nthbhn.exe 2412 1bbnhb.exe 3932 llrrxrx.exe 4460 tbhbtn.exe 2092 pjdvp.exe 2852 xxrxlxl.exe 1256 9hhbbt.exe 3796 dvvdv.exe 4340 frfxlfx.exe 868 hbtnhh.exe 4824 9pdvp.exe 1576 1lrlflf.exe 4772 hnnbht.exe 4820 dppjd.exe 4680 fxrllfx.exe 4416 nnbttt.exe 1764 5vvpj.exe 452 pdpvj.exe 1944 rlxrlrr.exe 1140 htbthb.exe 1948 hbhbbt.exe 2708 7ppjp.exe 2156 lxlfxxr.exe 3284 nhttnn.exe 4592 1ppjd.exe 1288 7xfxrrr.exe -
resource yara_rule behavioral2/memory/4944-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-679-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 1800 4944 ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe 83 PID 4944 wrote to memory of 1800 4944 ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe 83 PID 4944 wrote to memory of 1800 4944 ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe 83 PID 1800 wrote to memory of 4772 1800 xflllrr.exe 84 PID 1800 wrote to memory of 4772 1800 xflllrr.exe 84 PID 1800 wrote to memory of 4772 1800 xflllrr.exe 84 PID 4772 wrote to memory of 3168 4772 dpdvv.exe 85 PID 4772 wrote to memory of 3168 4772 dpdvv.exe 85 PID 4772 wrote to memory of 3168 4772 dpdvv.exe 85 PID 3168 wrote to memory of 4416 3168 bbttnt.exe 86 PID 3168 wrote to memory of 4416 3168 bbttnt.exe 86 PID 3168 wrote to memory of 4416 3168 bbttnt.exe 86 PID 4416 wrote to memory of 4040 4416 pddvp.exe 87 PID 4416 wrote to memory of 4040 4416 pddvp.exe 87 PID 4416 wrote to memory of 4040 4416 pddvp.exe 87 PID 4040 wrote to memory of 100 4040 7vpjd.exe 88 PID 4040 wrote to memory of 100 4040 7vpjd.exe 88 PID 4040 wrote to memory of 100 4040 7vpjd.exe 88 PID 100 wrote to memory of 2100 100 hhnhhh.exe 89 PID 100 wrote to memory of 2100 100 hhnhhh.exe 89 PID 100 wrote to memory of 2100 100 hhnhhh.exe 89 PID 2100 wrote to memory of 4748 2100 vjjdv.exe 90 PID 2100 wrote to memory of 4748 2100 vjjdv.exe 90 PID 2100 wrote to memory of 4748 2100 vjjdv.exe 90 PID 4748 wrote to memory of 3028 4748 nhhbnn.exe 91 PID 4748 wrote to memory of 3028 4748 nhhbnn.exe 91 PID 4748 wrote to memory of 3028 4748 nhhbnn.exe 91 PID 3028 wrote to memory of 1424 3028 dpvvd.exe 92 PID 3028 wrote to memory of 1424 3028 dpvvd.exe 92 PID 3028 wrote to memory of 1424 3028 dpvvd.exe 92 PID 1424 wrote to memory of 3644 1424 thtnbt.exe 93 PID 1424 wrote to memory of 3644 1424 thtnbt.exe 93 PID 1424 wrote to memory of 3644 1424 thtnbt.exe 93 PID 3644 wrote to memory of 3640 3644 xrffffx.exe 94 PID 3644 wrote to memory of 3640 3644 xrffffx.exe 94 PID 3644 wrote to memory of 3640 3644 xrffffx.exe 94 PID 3640 wrote to memory of 2384 3640 jjdvj.exe 95 PID 3640 wrote to memory of 2384 3640 jjdvj.exe 95 PID 3640 wrote to memory of 2384 3640 jjdvj.exe 95 PID 2384 wrote to memory of 228 2384 lfxxxll.exe 96 PID 2384 wrote to memory of 228 2384 lfxxxll.exe 96 PID 2384 wrote to memory of 228 2384 lfxxxll.exe 96 PID 228 wrote to memory of 640 228 vpvvv.exe 97 PID 228 wrote to memory of 640 228 vpvvv.exe 97 PID 228 wrote to memory of 640 228 vpvvv.exe 97 PID 640 wrote to memory of 956 640 llrfrrl.exe 98 PID 640 wrote to memory of 956 640 llrfrrl.exe 98 PID 640 wrote to memory of 956 640 llrfrrl.exe 98 PID 956 wrote to memory of 8 956 ttbbbb.exe 99 PID 956 wrote to memory of 8 956 ttbbbb.exe 99 PID 956 wrote to memory of 8 956 ttbbbb.exe 99 PID 8 wrote to memory of 3940 8 ppdvp.exe 100 PID 8 wrote to memory of 3940 8 ppdvp.exe 100 PID 8 wrote to memory of 3940 8 ppdvp.exe 100 PID 3940 wrote to memory of 3136 3940 fffxrlf.exe 101 PID 3940 wrote to memory of 3136 3940 fffxrlf.exe 101 PID 3940 wrote to memory of 3136 3940 fffxrlf.exe 101 PID 3136 wrote to memory of 4192 3136 htnhbt.exe 102 PID 3136 wrote to memory of 4192 3136 htnhbt.exe 102 PID 3136 wrote to memory of 4192 3136 htnhbt.exe 102 PID 4192 wrote to memory of 2652 4192 djdjv.exe 103 PID 4192 wrote to memory of 2652 4192 djdjv.exe 103 PID 4192 wrote to memory of 2652 4192 djdjv.exe 103 PID 2652 wrote to memory of 4928 2652 llrlfxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe"C:\Users\Admin\AppData\Local\Temp\ac6383cd2cd37d09249253a62ba687a8d465d0ae33f53a37a508b9b4b62a14d9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\xflllrr.exec:\xflllrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\dpdvv.exec:\dpdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\bbttnt.exec:\bbttnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\pddvp.exec:\pddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\7vpjd.exec:\7vpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\hhnhhh.exec:\hhnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\vjjdv.exec:\vjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\nhhbnn.exec:\nhhbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\dpvvd.exec:\dpvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\thtnbt.exec:\thtnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\xrffffx.exec:\xrffffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\jjdvj.exec:\jjdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\lfxxxll.exec:\lfxxxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vpvvv.exec:\vpvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\llrfrrl.exec:\llrfrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\ttbbbb.exec:\ttbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\ppdvp.exec:\ppdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\fffxrlf.exec:\fffxrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\htnhbt.exec:\htnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\djdjv.exec:\djdjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\llrlfxr.exec:\llrlfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xflfxxl.exec:\xflfxxl.exe23⤵
- Executes dropped EXE
PID:4928 -
\??\c:\hbtnhh.exec:\hbtnhh.exe24⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe25⤵
- Executes dropped EXE
PID:3232 -
\??\c:\bnbtnn.exec:\bnbtnn.exe26⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvdpj.exec:\dvdpj.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe28⤵
- Executes dropped EXE
PID:1832 -
\??\c:\lffxrlf.exec:\lffxrlf.exe29⤵
- Executes dropped EXE
PID:4796 -
\??\c:\9tnhbb.exec:\9tnhbb.exe30⤵
- Executes dropped EXE
PID:3760 -
\??\c:\ttnnhh.exec:\ttnnhh.exe31⤵
- Executes dropped EXE
PID:464 -
\??\c:\jddvv.exec:\jddvv.exe32⤵
- Executes dropped EXE
PID:4832 -
\??\c:\pdvpj.exec:\pdvpj.exe33⤵
- Executes dropped EXE
PID:4868 -
\??\c:\3rxfxxr.exec:\3rxfxxr.exe34⤵
- Executes dropped EXE
PID:3156 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe35⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hhnhtn.exec:\hhnhtn.exe36⤵
- Executes dropped EXE
PID:3812 -
\??\c:\pdjdj.exec:\pdjdj.exe37⤵
- Executes dropped EXE
PID:4848 -
\??\c:\nhhhhh.exec:\nhhhhh.exe38⤵
- Executes dropped EXE
PID:3608 -
\??\c:\vpppd.exec:\vpppd.exe39⤵
- Executes dropped EXE
PID:4408 -
\??\c:\nthbhn.exec:\nthbhn.exe40⤵
- Executes dropped EXE
PID:3752 -
\??\c:\1bbnhb.exec:\1bbnhb.exe41⤵
- Executes dropped EXE
PID:2412 -
\??\c:\llrrxrx.exec:\llrrxrx.exe42⤵
- Executes dropped EXE
PID:3932 -
\??\c:\tbhbtn.exec:\tbhbtn.exe43⤵
- Executes dropped EXE
PID:4460 -
\??\c:\pjdvp.exec:\pjdvp.exe44⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe45⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9hhbbt.exec:\9hhbbt.exe46⤵
- Executes dropped EXE
PID:1256 -
\??\c:\dvvdv.exec:\dvvdv.exe47⤵
- Executes dropped EXE
PID:3796 -
\??\c:\frfxlfx.exec:\frfxlfx.exe48⤵
- Executes dropped EXE
PID:4340 -
\??\c:\hbtnhh.exec:\hbtnhh.exe49⤵
- Executes dropped EXE
PID:868 -
\??\c:\5nnbtn.exec:\5nnbtn.exe50⤵PID:4100
-
\??\c:\9pdvp.exec:\9pdvp.exe51⤵
- Executes dropped EXE
PID:4824 -
\??\c:\1lrlflf.exec:\1lrlflf.exe52⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hnnbht.exec:\hnnbht.exe53⤵
- Executes dropped EXE
PID:4772 -
\??\c:\dppjd.exec:\dppjd.exe54⤵
- Executes dropped EXE
PID:4820 -
\??\c:\fxrllfx.exec:\fxrllfx.exe55⤵
- Executes dropped EXE
PID:4680 -
\??\c:\nnbttt.exec:\nnbttt.exe56⤵
- Executes dropped EXE
PID:4416 -
\??\c:\5vvpj.exec:\5vvpj.exe57⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pdpvj.exec:\pdpvj.exe58⤵
- Executes dropped EXE
PID:452 -
\??\c:\rlxrlrr.exec:\rlxrlrr.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\htbthb.exec:\htbthb.exe60⤵
- Executes dropped EXE
PID:1140 -
\??\c:\hbhbbt.exec:\hbhbbt.exe61⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7ppjp.exec:\7ppjp.exe62⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe63⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nhttnn.exec:\nhttnn.exe64⤵
- Executes dropped EXE
PID:3284 -
\??\c:\1ppjd.exec:\1ppjd.exe65⤵
- Executes dropped EXE
PID:4592 -
\??\c:\7xfxrrr.exec:\7xfxrrr.exe66⤵
- Executes dropped EXE
PID:1288 -
\??\c:\nhbttn.exec:\nhbttn.exe67⤵PID:2544
-
\??\c:\hhhtbt.exec:\hhhtbt.exe68⤵PID:2376
-
\??\c:\jpvjv.exec:\jpvjv.exe69⤵PID:4992
-
\??\c:\frxlrfl.exec:\frxlrfl.exe70⤵PID:3488
-
\??\c:\nnhnth.exec:\nnhnth.exe71⤵PID:1084
-
\??\c:\bhnbbt.exec:\bhnbbt.exe72⤵PID:4976
-
\??\c:\jjdpp.exec:\jjdpp.exe73⤵PID:3228
-
\??\c:\1xxrlll.exec:\1xxrlll.exe74⤵PID:3188
-
\??\c:\nhhbbt.exec:\nhhbbt.exe75⤵PID:4192
-
\??\c:\jdpvd.exec:\jdpvd.exe76⤵PID:1672
-
\??\c:\ddpvj.exec:\ddpvj.exe77⤵PID:1028
-
\??\c:\rxfxllf.exec:\rxfxllf.exe78⤵PID:1604
-
\??\c:\nttnnn.exec:\nttnnn.exe79⤵PID:3656
-
\??\c:\jvdvv.exec:\jvdvv.exe80⤵PID:3092
-
\??\c:\xlrlxfx.exec:\xlrlxfx.exe81⤵PID:1484
-
\??\c:\lfxlfxr.exec:\lfxlfxr.exe82⤵PID:1408
-
\??\c:\5hbnhb.exec:\5hbnhb.exe83⤵PID:2876
-
\??\c:\dvdjd.exec:\dvdjd.exe84⤵PID:3664
-
\??\c:\rxllfff.exec:\rxllfff.exe85⤵PID:1708
-
\??\c:\xrlfffx.exec:\xrlfffx.exe86⤵PID:5036
-
\??\c:\bhnnnt.exec:\bhnnnt.exe87⤵PID:1456
-
\??\c:\jvjdd.exec:\jvjdd.exe88⤵PID:4796
-
\??\c:\fxrrlll.exec:\fxrrlll.exe89⤵PID:4884
-
\??\c:\1nhtnh.exec:\1nhtnh.exe90⤵PID:4504
-
\??\c:\bbnnnn.exec:\bbnnnn.exe91⤵PID:2944
-
\??\c:\jppjj.exec:\jppjj.exe92⤵PID:1556
-
\??\c:\rrlxrfx.exec:\rrlxrfx.exe93⤵PID:3792
-
\??\c:\hnthhh.exec:\hnthhh.exe94⤵PID:2108
-
\??\c:\5ddvv.exec:\5ddvv.exe95⤵PID:3152
-
\??\c:\pjjvd.exec:\pjjvd.exe96⤵PID:1744
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe97⤵PID:3788
-
\??\c:\hnnhbt.exec:\hnnhbt.exe98⤵PID:1164
-
\??\c:\djvpj.exec:\djvpj.exe99⤵PID:4564
-
\??\c:\lrlllfx.exec:\lrlllfx.exe100⤵PID:5072
-
\??\c:\lrffffl.exec:\lrffffl.exe101⤵PID:2556
-
\??\c:\bhtnhh.exec:\bhtnhh.exe102⤵PID:3740
-
\??\c:\jdjjj.exec:\jdjjj.exe103⤵PID:2624
-
\??\c:\flfrlff.exec:\flfrlff.exe104⤵PID:2180
-
\??\c:\tnhbnn.exec:\tnhbnn.exe105⤵PID:4964
-
\??\c:\bbbbnn.exec:\bbbbnn.exe106⤵PID:3208
-
\??\c:\vpjdd.exec:\vpjdd.exe107⤵PID:1964
-
\??\c:\xrxfxxx.exec:\xrxfxxx.exe108⤵PID:3372
-
\??\c:\nbhhbt.exec:\nbhhbt.exe109⤵PID:2008
-
\??\c:\dvdpp.exec:\dvdpp.exe110⤵PID:2404
-
\??\c:\vvpjp.exec:\vvpjp.exe111⤵PID:3292
-
\??\c:\rflffll.exec:\rflffll.exe112⤵PID:1996
-
\??\c:\btnnhh.exec:\btnnhh.exe113⤵PID:220
-
\??\c:\7htnhh.exec:\7htnhh.exe114⤵PID:4136
-
\??\c:\9pjdp.exec:\9pjdp.exe115⤵PID:4864
-
\??\c:\ffrlxfr.exec:\ffrlxfr.exe116⤵PID:2760
-
\??\c:\hhtttt.exec:\hhtttt.exe117⤵PID:3044
-
\??\c:\vpppj.exec:\vpppj.exe118⤵PID:4456
-
\??\c:\djvpj.exec:\djvpj.exe119⤵PID:100
-
\??\c:\lrlfffl.exec:\lrlfffl.exe120⤵PID:4424
-
\??\c:\nbthbb.exec:\nbthbb.exe121⤵PID:2780
-
\??\c:\djjvp.exec:\djjvp.exe122⤵PID:3380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-