Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2025, 14:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
130601ab31c89119cb5c7133cadf0c371fc50839352f5fab8f4d39bf85203f79.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
- Target 130601ab31c89119cb5c7133cadf0c371fc50839352f5fab8f4d39bf85203f79.exe
- Size 454KB
- Sample250108-rn77xawjdk
- SHA256 130601ab31c89119cb5c7133cadf0c371fc50839352f5fab8f4d39bf85203f79
- MD5 9b3056a2a8cf67efb0af37e3774876e8
- SHA1 70529436ddfcc19dec4d76f86d942e72ae8bb4ff
- SHA512 d87b2f3d14a3ba51c12426e61ba98d49147c37ef472fcfdbe7c7596e46de361f37d4ca703a73f892ad7da1acc7b6a931d4315eb2a65fe1c611cfc1bf63ffaab0
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/412-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/780-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-888-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-1582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3584 vpjpj.exe 4908 7flfxxr.exe 2756 7hnhbh.exe 3760 dvpjd.exe 2092 jpdvv.exe 704 rxlffff.exe 368 bthbbt.exe 4460 hhhhbn.exe 1916 7rxrrrx.exe 4956 hnbtbb.exe 4904 dvpvp.exe 2160 lrxfxrf.exe 2752 hhbbbb.exe 2156 hhttbn.exe 1600 vvvpd.exe 2956 nbhttt.exe 4576 tttnhb.exe 2468 rfxlrll.exe 4716 tbttnb.exe 856 5pppp.exe 5040 vpdvp.exe 1356 jvpjd.exe 1048 3rrrlrr.exe 1812 xrfxxrl.exe 4772 jpdvp.exe 4504 hthbbb.exe 3536 1bbtnn.exe 4764 fxlffff.exe 4416 jpdpd.exe 2900 hbbhbh.exe 440 rlrlllr.exe 3264 lxfxxxx.exe 3580 fxllrrf.exe 3944 9ttnht.exe 3596 vjjdv.exe 4484 9bnhbb.exe 4512 bntntn.exe 780 xxxrlxl.exe 2988 hthhbb.exe 4380 vpvpp.exe 3228 1llffll.exe 2400 hthbtt.exe 1420 9vvpj.exe 1480 xlrxrrr.exe 2440 nhnbnh.exe 4836 btbnnh.exe 3248 7vpdp.exe 3276 rfrlxlf.exe 4352 5hbthh.exe 4868 nnbtnn.exe 5080 pjpjv.exe 3584 9xxrrlx.exe 4984 htbnbt.exe 3780 dvjdv.exe 3648 rrrllfl.exe 1352 hhhbtt.exe 116 9tbtbt.exe 2724 vvvvp.exe 2984 frrlxfx.exe 3380 1hhbbb.exe 5016 1btnnh.exe 368 vpjdd.exe 4272 xxfxrll.exe 4072 nbthbt.exe -
resource yara_rule behavioral2/memory/412-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/780-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-650-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 3584 412 130601ab31c89119cb5c7133cadf0c371fc50839352f5fab8f4d39bf85203f79.exe 83 PID 412 wrote to memory of 3584 412 130601ab31c89119cb5c7133cadf0c371fc50839352f5fab8f4d39bf85203f79.exe 83 PID 412 wrote to memory of 3584 412 130601ab31c89119cb5c7133cadf0c371fc50839352f5fab8f4d39bf85203f79.exe 83 PID 3584 wrote to memory of 4908 3584 vpjpj.exe 84 PID 3584 wrote to memory of 4908 3584 vpjpj.exe 84 PID 3584 wrote to memory of 4908 3584 vpjpj.exe 84 PID 4908 wrote to memory of 2756 4908 7flfxxr.exe 85 PID 4908 wrote to memory of 2756 4908 7flfxxr.exe 85 PID 4908 wrote to memory of 2756 4908 7flfxxr.exe 85 PID 2756 wrote to memory of 3760 2756 7hnhbh.exe 86 PID 2756 wrote to memory of 3760 2756 7hnhbh.exe 86 PID 2756 wrote to memory of 3760 2756 7hnhbh.exe 86 PID 3760 wrote to memory of 2092 3760 dvpjd.exe 87 PID 3760 wrote to memory of 2092 3760 dvpjd.exe 87 PID 3760 wrote to memory of 2092 3760 dvpjd.exe 87 PID 2092 wrote to memory of 704 2092 jpdvv.exe 88 PID 2092 wrote to memory of 704 2092 jpdvv.exe 88 PID 2092 wrote to memory of 704 2092 jpdvv.exe 88 PID 704 wrote to memory of 368 704 rxlffff.exe 89 PID 704 wrote to memory of 368 704 rxlffff.exe 89 PID 704 wrote to memory of 368 704 rxlffff.exe 89 PID 368 wrote to memory of 4460 368 bthbbt.exe 90 PID 368 wrote to memory of 4460 368 bthbbt.exe 90 PID 368 wrote to memory of 4460 368 bthbbt.exe 90 PID 4460 wrote to memory of 1916 4460 hhhhbn.exe 91 PID 4460 wrote to memory of 1916 4460 hhhhbn.exe 91 PID 4460 wrote to memory of 1916 4460 hhhhbn.exe 91 PID 1916 wrote to memory of 4956 1916 7rxrrrx.exe 92 PID 1916 wrote to memory of 4956 1916 7rxrrrx.exe 92 PID 1916 wrote to memory of 4956 1916 7rxrrrx.exe 92 PID 4956 wrote to memory of 4904 4956 hnbtbb.exe 93 PID 4956 wrote to memory of 4904 4956 hnbtbb.exe 93 PID 4956 wrote to memory of 4904 4956 hnbtbb.exe 93 PID 4904 wrote to memory of 2160 4904 dvpvp.exe 94 PID 4904 wrote to memory of 2160 4904 dvpvp.exe 94 PID 4904 wrote to memory of 2160 4904 dvpvp.exe 94 PID 2160 wrote to memory of 2752 2160 lrxfxrf.exe 95 PID 2160 wrote to memory of 2752 2160 lrxfxrf.exe 95 PID 2160 wrote to memory of 2752 2160 lrxfxrf.exe 95 PID 2752 wrote to memory of 2156 2752 hhbbbb.exe 96 PID 2752 wrote to memory of 2156 2752 hhbbbb.exe 96 PID 2752 wrote to memory of 2156 2752 hhbbbb.exe 96 PID 2156 wrote to memory of 1600 2156 hhttbn.exe 97 PID 2156 wrote to memory of 1600 2156 hhttbn.exe 97 PID 2156 wrote to memory of 1600 2156 hhttbn.exe 97 PID 1600 wrote to memory of 2956 1600 vvvpd.exe 98 PID 1600 wrote to memory of 2956 1600 vvvpd.exe 98 PID 1600 wrote to memory of 2956 1600 vvvpd.exe 98 PID 2956 wrote to memory of 4576 2956 nbhttt.exe 99 PID 2956 wrote to memory of 4576 2956 nbhttt.exe 99 PID 2956 wrote to memory of 4576 2956 nbhttt.exe 99 PID 4576 wrote to memory of 2468 4576 tttnhb.exe 100 PID 4576 wrote to memory of 2468 4576 tttnhb.exe 100 PID 4576 wrote to memory of 2468 4576 tttnhb.exe 100 PID 2468 wrote to memory of 4716 2468 rfxlrll.exe 101 PID 2468 wrote to memory of 4716 2468 rfxlrll.exe 101 PID 2468 wrote to memory of 4716 2468 rfxlrll.exe 101 PID 4716 wrote to memory of 856 4716 tbttnb.exe 102 PID 4716 wrote to memory of 856 4716 tbttnb.exe 102 PID 4716 wrote to memory of 856 4716 tbttnb.exe 102 PID 856 wrote to memory of 5040 856 5pppp.exe 103 PID 856 wrote to memory of 5040 856 5pppp.exe 103 PID 856 wrote to memory of 5040 856 5pppp.exe 103 PID 5040 wrote to memory of 1356 5040 vpdvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\130601ab31c89119cb5c7133cadf0c371fc50839352f5fab8f4d39bf85203f79.exe"C:\Users\Admin\AppData\Local\Temp\130601ab31c89119cb5c7133cadf0c371fc50839352f5fab8f4d39bf85203f79.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\vpjpj.exec:\vpjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\7flfxxr.exec:\7flfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\7hnhbh.exec:\7hnhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\dvpjd.exec:\dvpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\jpdvv.exec:\jpdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\rxlffff.exec:\rxlffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\bthbbt.exec:\bthbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\hhhhbn.exec:\hhhhbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\7rxrrrx.exec:\7rxrrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\hnbtbb.exec:\hnbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\dvpvp.exec:\dvpvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\lrxfxrf.exec:\lrxfxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\hhbbbb.exec:\hhbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hhttbn.exec:\hhttbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\vvvpd.exec:\vvvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\nbhttt.exec:\nbhttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\tttnhb.exec:\tttnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\rfxlrll.exec:\rfxlrll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\tbttnb.exec:\tbttnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\5pppp.exec:\5pppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\vpdvp.exec:\vpdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\jvpjd.exec:\jvpjd.exe23⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3rrrlrr.exec:\3rrrlrr.exe24⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xrfxxrl.exec:\xrfxxrl.exe25⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jpdvp.exec:\jpdvp.exe26⤵
- Executes dropped EXE
PID:4772 -
\??\c:\hthbbb.exec:\hthbbb.exe27⤵
- Executes dropped EXE
PID:4504 -
\??\c:\1bbtnn.exec:\1bbtnn.exe28⤵
- Executes dropped EXE
PID:3536 -
\??\c:\fxlffff.exec:\fxlffff.exe29⤵
- Executes dropped EXE
PID:4764 -
\??\c:\jpdpd.exec:\jpdpd.exe30⤵
- Executes dropped EXE
PID:4416 -
\??\c:\hbbhbh.exec:\hbbhbh.exe31⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rlrlllr.exec:\rlrlllr.exe32⤵
- Executes dropped EXE
PID:440 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe33⤵
- Executes dropped EXE
PID:3264 -
\??\c:\fxllrrf.exec:\fxllrrf.exe34⤵
- Executes dropped EXE
PID:3580 -
\??\c:\9ttnht.exec:\9ttnht.exe35⤵
- Executes dropped EXE
PID:3944 -
\??\c:\vjjdv.exec:\vjjdv.exe36⤵
- Executes dropped EXE
PID:3596 -
\??\c:\9bnhbb.exec:\9bnhbb.exe37⤵
- Executes dropped EXE
PID:4484 -
\??\c:\bntntn.exec:\bntntn.exe38⤵
- Executes dropped EXE
PID:4512 -
\??\c:\xxxrlxl.exec:\xxxrlxl.exe39⤵
- Executes dropped EXE
PID:780 -
\??\c:\hthhbb.exec:\hthhbb.exe40⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vpvpp.exec:\vpvpp.exe41⤵
- Executes dropped EXE
PID:4380 -
\??\c:\1llffll.exec:\1llffll.exe42⤵
- Executes dropped EXE
PID:3228 -
\??\c:\hthbtt.exec:\hthbtt.exe43⤵
- Executes dropped EXE
PID:2400 -
\??\c:\9vvpj.exec:\9vvpj.exe44⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xlrxrrr.exec:\xlrxrrr.exe45⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nhnbnh.exec:\nhnbnh.exe46⤵
- Executes dropped EXE
PID:2440 -
\??\c:\btbnnh.exec:\btbnnh.exe47⤵
- Executes dropped EXE
PID:4836 -
\??\c:\7vpdp.exec:\7vpdp.exe48⤵
- Executes dropped EXE
PID:3248 -
\??\c:\rfrlxlf.exec:\rfrlxlf.exe49⤵
- Executes dropped EXE
PID:3276 -
\??\c:\5hbthh.exec:\5hbthh.exe50⤵
- Executes dropped EXE
PID:4352 -
\??\c:\nnbtnn.exec:\nnbtnn.exe51⤵
- Executes dropped EXE
PID:4868 -
\??\c:\pjpjv.exec:\pjpjv.exe52⤵
- Executes dropped EXE
PID:5080 -
\??\c:\9xxrrlx.exec:\9xxrrlx.exe53⤵
- Executes dropped EXE
PID:3584 -
\??\c:\htbnbt.exec:\htbnbt.exe54⤵
- Executes dropped EXE
PID:4984 -
\??\c:\dvjdv.exec:\dvjdv.exe55⤵
- Executes dropped EXE
PID:3780 -
\??\c:\rrrllfl.exec:\rrrllfl.exe56⤵
- Executes dropped EXE
PID:3648 -
\??\c:\hhhbtt.exec:\hhhbtt.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1352 -
\??\c:\9tbtbt.exec:\9tbtbt.exe58⤵
- Executes dropped EXE
PID:116 -
\??\c:\vvvvp.exec:\vvvvp.exe59⤵
- Executes dropped EXE
PID:2724 -
\??\c:\frrlxfx.exec:\frrlxfx.exe60⤵
- Executes dropped EXE
PID:2984 -
\??\c:\1hhbbb.exec:\1hhbbb.exe61⤵
- Executes dropped EXE
PID:3380 -
\??\c:\1btnnh.exec:\1btnnh.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5016 -
\??\c:\vpjdd.exec:\vpjdd.exe63⤵
- Executes dropped EXE
PID:368 -
\??\c:\xxfxrll.exec:\xxfxrll.exe64⤵
- Executes dropped EXE
PID:4272 -
\??\c:\nbthbt.exec:\nbthbt.exe65⤵
- Executes dropped EXE
PID:4072 -
\??\c:\3bnhtt.exec:\3bnhtt.exe66⤵PID:1916
-
\??\c:\1ddvp.exec:\1ddvp.exe67⤵PID:3436
-
\??\c:\xrrxlff.exec:\xrrxlff.exe68⤵PID:2176
-
\??\c:\3hbtnh.exec:\3hbtnh.exe69⤵PID:3956
-
\??\c:\ppjvj.exec:\ppjvj.exe70⤵PID:3296
-
\??\c:\pddpd.exec:\pddpd.exe71⤵PID:1188
-
\??\c:\5xxlllf.exec:\5xxlllf.exe72⤵PID:3868
-
\??\c:\7tthbb.exec:\7tthbb.exe73⤵PID:2904
-
\??\c:\dvpdv.exec:\dvpdv.exe74⤵PID:1924
-
\??\c:\ddddv.exec:\ddddv.exe75⤵PID:4112
-
\??\c:\7rrlrll.exec:\7rrlrll.exe76⤵PID:2768
-
\??\c:\hbhbhb.exec:\hbhbhb.exe77⤵PID:4192
-
\??\c:\vjjdp.exec:\vjjdp.exe78⤵PID:3196
-
\??\c:\7rxrlll.exec:\7rxrlll.exe79⤵PID:1728
-
\??\c:\xllfxxx.exec:\xllfxxx.exe80⤵PID:1696
-
\??\c:\hhhbbb.exec:\hhhbbb.exe81⤵PID:2436
-
\??\c:\pjjdv.exec:\pjjdv.exe82⤵PID:1564
-
\??\c:\3dppj.exec:\3dppj.exe83⤵PID:2960
-
\??\c:\frxrrlf.exec:\frxrrlf.exe84⤵PID:4128
-
\??\c:\hhbtnn.exec:\hhbtnn.exe85⤵PID:1776
-
\??\c:\1bbhhh.exec:\1bbhhh.exe86⤵PID:4260
-
\??\c:\7pppp.exec:\7pppp.exe87⤵PID:4480
-
\??\c:\rllfxrr.exec:\rllfxrr.exe88⤵PID:2972
-
\??\c:\ttbttn.exec:\ttbttn.exe89⤵PID:4692
-
\??\c:\tnnbtt.exec:\tnnbtt.exe90⤵PID:3536
-
\??\c:\3jdvj.exec:\3jdvj.exe91⤵PID:4652
-
\??\c:\lflrlff.exec:\lflrlff.exe92⤵PID:3352
-
\??\c:\tbbthb.exec:\tbbthb.exe93⤵PID:1160
-
\??\c:\nbhbtb.exec:\nbhbtb.exe94⤵PID:4384
-
\??\c:\9pddd.exec:\9pddd.exe95⤵PID:924
-
\??\c:\lxffxxx.exec:\lxffxxx.exe96⤵PID:1488
-
\??\c:\bbhbtn.exec:\bbhbtn.exe97⤵PID:1720
-
\??\c:\thhhbb.exec:\thhhbb.exe98⤵PID:1596
-
\??\c:\vdjjp.exec:\vdjjp.exe99⤵PID:3828
-
\??\c:\5xlfffx.exec:\5xlfffx.exe100⤵PID:2136
-
\??\c:\7hnhbt.exec:\7hnhbt.exe101⤵PID:4584
-
\??\c:\vpjdv.exec:\vpjdv.exe102⤵PID:964
-
\??\c:\rxlxrrl.exec:\rxlxrrl.exe103⤵PID:4648
-
\??\c:\lxrllfl.exec:\lxrllfl.exe104⤵PID:4324
-
\??\c:\bhttnn.exec:\bhttnn.exe105⤵PID:2988
-
\??\c:\jddvp.exec:\jddvp.exe106⤵PID:4544
-
\??\c:\fxxrxxl.exec:\fxxrxxl.exe107⤵PID:3640
-
\??\c:\lrfxrrx.exec:\lrfxrrx.exe108⤵PID:216
-
\??\c:\1tthhh.exec:\1tthhh.exe109⤵PID:3900
-
\??\c:\vpvpj.exec:\vpvpj.exe110⤵PID:4224
-
\??\c:\rxffllr.exec:\rxffllr.exe111⤵PID:1460
-
\??\c:\htbthb.exec:\htbthb.exe112⤵PID:1912
-
\??\c:\nnhhhh.exec:\nnhhhh.exe113⤵PID:1028
-
\??\c:\pdvvv.exec:\pdvvv.exe114⤵PID:1484
-
\??\c:\pppjd.exec:\pppjd.exe115⤵PID:4348
-
\??\c:\frrlllf.exec:\frrlllf.exe116⤵PID:4604
-
\??\c:\5ntbbh.exec:\5ntbbh.exe117⤵PID:2212
-
\??\c:\vdjdv.exec:\vdjdv.exe118⤵PID:3516
-
\??\c:\ffrlllr.exec:\ffrlllr.exe119⤵PID:4992
-
\??\c:\7nntnh.exec:\7nntnh.exe120⤵PID:4168
-
\??\c:\jjddv.exec:\jjddv.exe121⤵PID:3036
-
\??\c:\vdjjj.exec:\vdjjj.exe122⤵PID:1092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-