Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2025 06:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5e7cc4b959ef512125b41a057ffdb940613236b1766094f0fa1ec61714b289bN.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e5e7cc4b959ef512125b41a057ffdb940613236b1766094f0fa1ec61714b289bN.exe
-
Size
454KB
-
MD5
fefc45d097dda0a4afd8ac48f977ea30
-
SHA1
39ba2a0bc81893a034e7671ed6a3f7742c6bb888
-
SHA256
e5e7cc4b959ef512125b41a057ffdb940613236b1766094f0fa1ec61714b289b
-
SHA512
bd0a1a28d6c86a61b8d739edd0ec63d8096b99d4001dd65ea3ab9abeb5f32b6c012fe8431386b7f52ff91b12f9b501bf36b0ed04b7b9b620686d11d4e4cec9e3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3316-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/900-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/332-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-802-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-827-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-946-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-953-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-1095-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-1168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-1223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-1302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-1360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-1815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2948 pvvjv.exe 4328 tbtnhh.exe 1072 dppdd.exe 4876 frrlllf.exe 2112 flrfxrl.exe 3148 tthbhb.exe 3644 lflxrlf.exe 2732 nbtnhh.exe 2276 7rlfrrl.exe 2212 dvvpd.exe 4892 rffxxxf.exe 1988 jpdvj.exe 4912 dvvvv.exe 3328 rllxrrl.exe 5080 tnnhbb.exe 1544 pvvpp.exe 3432 lllrlfl.exe 3804 jdppv.exe 4732 xfllffx.exe 1880 llrlfxx.exe 3428 1llfrrf.exe 368 lxffrxl.exe 3752 flfxllf.exe 384 bbttnn.exe 4396 lfffrxl.exe 1524 dvdvp.exe 1016 pvdvp.exe 1700 xllxxxl.exe 3632 nntnhb.exe 2952 lfffrrl.exe 3712 7hnhnn.exe 1108 vdppd.exe 2492 fxxfxxr.exe 4836 frxfxxr.exe 900 htbbtt.exe 2068 dvjvd.exe 4740 1hnthb.exe 4216 pvpjp.exe 5096 fflrxrl.exe 3920 btttnn.exe 3092 1tbtnh.exe 3140 dddjd.exe 456 fxxxrrl.exe 3800 nhbtnh.exe 3676 9jjdp.exe 4504 5rlfxxr.exe 5032 7ttnhh.exe 3416 httnhh.exe 4532 3ddvp.exe 5020 llfxrlx.exe 5116 rlfxrlf.exe 4272 nnnhhh.exe 4476 vpjjd.exe 388 llxlrxf.exe 3452 xlrrlfl.exe 4136 hhtntt.exe 376 dvjdv.exe 3844 dvddp.exe 4948 flxrlfx.exe 1688 hnnnht.exe 2324 3vvjd.exe 1516 jvdjp.exe 2036 3llxlrl.exe 2336 htnbtn.exe -
resource yara_rule behavioral2/memory/3316-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-1095-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-1168-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3316 wrote to memory of 2948 3316 e5e7cc4b959ef512125b41a057ffdb940613236b1766094f0fa1ec61714b289bN.exe 82 PID 3316 wrote to memory of 2948 3316 e5e7cc4b959ef512125b41a057ffdb940613236b1766094f0fa1ec61714b289bN.exe 82 PID 3316 wrote to memory of 2948 3316 e5e7cc4b959ef512125b41a057ffdb940613236b1766094f0fa1ec61714b289bN.exe 82 PID 2948 wrote to memory of 4328 2948 pvvjv.exe 83 PID 2948 wrote to memory of 4328 2948 pvvjv.exe 83 PID 2948 wrote to memory of 4328 2948 pvvjv.exe 83 PID 4328 wrote to memory of 1072 4328 tbtnhh.exe 84 PID 4328 wrote to memory of 1072 4328 tbtnhh.exe 84 PID 4328 wrote to memory of 1072 4328 tbtnhh.exe 84 PID 1072 wrote to memory of 4876 1072 dppdd.exe 85 PID 1072 wrote to memory of 4876 1072 dppdd.exe 85 PID 1072 wrote to memory of 4876 1072 dppdd.exe 85 PID 4876 wrote to memory of 2112 4876 frrlllf.exe 86 PID 4876 wrote to memory of 2112 4876 frrlllf.exe 86 PID 4876 wrote to memory of 2112 4876 frrlllf.exe 86 PID 2112 wrote to memory of 3148 2112 flrfxrl.exe 87 PID 2112 wrote to memory of 3148 2112 flrfxrl.exe 87 PID 2112 wrote to memory of 3148 2112 flrfxrl.exe 87 PID 3148 wrote to memory of 3644 3148 tthbhb.exe 88 PID 3148 wrote to memory of 3644 3148 tthbhb.exe 88 PID 3148 wrote to memory of 3644 3148 tthbhb.exe 88 PID 3644 wrote to memory of 2732 3644 lflxrlf.exe 89 PID 3644 wrote to memory of 2732 3644 lflxrlf.exe 89 PID 3644 wrote to memory of 2732 3644 lflxrlf.exe 89 PID 2732 wrote to memory of 2276 2732 nbtnhh.exe 90 PID 2732 wrote to memory of 2276 2732 nbtnhh.exe 90 PID 2732 wrote to memory of 2276 2732 nbtnhh.exe 90 PID 2276 wrote to memory of 2212 2276 7rlfrrl.exe 91 PID 2276 wrote to memory of 2212 2276 7rlfrrl.exe 91 PID 2276 wrote to memory of 2212 2276 7rlfrrl.exe 91 PID 2212 wrote to memory of 4892 2212 dvvpd.exe 92 PID 2212 wrote to memory of 4892 2212 dvvpd.exe 92 PID 2212 wrote to memory of 4892 2212 dvvpd.exe 92 PID 4892 wrote to memory of 1988 4892 rffxxxf.exe 93 PID 4892 wrote to memory of 1988 4892 rffxxxf.exe 93 PID 4892 wrote to memory of 1988 4892 rffxxxf.exe 93 PID 1988 wrote to memory of 4912 1988 jpdvj.exe 94 PID 1988 wrote to memory of 4912 1988 jpdvj.exe 94 PID 1988 wrote to memory of 4912 1988 jpdvj.exe 94 PID 4912 wrote to memory of 3328 4912 dvvvv.exe 95 PID 4912 wrote to memory of 3328 4912 dvvvv.exe 95 PID 4912 wrote to memory of 3328 4912 dvvvv.exe 95 PID 3328 wrote to memory of 5080 3328 rllxrrl.exe 96 PID 3328 wrote to memory of 5080 3328 rllxrrl.exe 96 PID 3328 wrote to memory of 5080 3328 rllxrrl.exe 96 PID 5080 wrote to memory of 1544 5080 tnnhbb.exe 97 PID 5080 wrote to memory of 1544 5080 tnnhbb.exe 97 PID 5080 wrote to memory of 1544 5080 tnnhbb.exe 97 PID 1544 wrote to memory of 3432 1544 pvvpp.exe 98 PID 1544 wrote to memory of 3432 1544 pvvpp.exe 98 PID 1544 wrote to memory of 3432 1544 pvvpp.exe 98 PID 3432 wrote to memory of 3804 3432 lllrlfl.exe 99 PID 3432 wrote to memory of 3804 3432 lllrlfl.exe 99 PID 3432 wrote to memory of 3804 3432 lllrlfl.exe 99 PID 3804 wrote to memory of 4732 3804 jdppv.exe 100 PID 3804 wrote to memory of 4732 3804 jdppv.exe 100 PID 3804 wrote to memory of 4732 3804 jdppv.exe 100 PID 4732 wrote to memory of 1880 4732 xfllffx.exe 101 PID 4732 wrote to memory of 1880 4732 xfllffx.exe 101 PID 4732 wrote to memory of 1880 4732 xfllffx.exe 101 PID 1880 wrote to memory of 3428 1880 llrlfxx.exe 102 PID 1880 wrote to memory of 3428 1880 llrlfxx.exe 102 PID 1880 wrote to memory of 3428 1880 llrlfxx.exe 102 PID 3428 wrote to memory of 368 3428 1llfrrf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5e7cc4b959ef512125b41a057ffdb940613236b1766094f0fa1ec61714b289bN.exe"C:\Users\Admin\AppData\Local\Temp\e5e7cc4b959ef512125b41a057ffdb940613236b1766094f0fa1ec61714b289bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\pvvjv.exec:\pvvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\tbtnhh.exec:\tbtnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\dppdd.exec:\dppdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\frrlllf.exec:\frrlllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\flrfxrl.exec:\flrfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\tthbhb.exec:\tthbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\lflxrlf.exec:\lflxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\nbtnhh.exec:\nbtnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\7rlfrrl.exec:\7rlfrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\dvvpd.exec:\dvvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\rffxxxf.exec:\rffxxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\jpdvj.exec:\jpdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\dvvvv.exec:\dvvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\rllxrrl.exec:\rllxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\tnnhbb.exec:\tnnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\pvvpp.exec:\pvvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\lllrlfl.exec:\lllrlfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\jdppv.exec:\jdppv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\xfllffx.exec:\xfllffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\llrlfxx.exec:\llrlfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\1llfrrf.exec:\1llfrrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\lxffrxl.exec:\lxffrxl.exe23⤵
- Executes dropped EXE
PID:368 -
\??\c:\flfxllf.exec:\flfxllf.exe24⤵
- Executes dropped EXE
PID:3752 -
\??\c:\bbttnn.exec:\bbttnn.exe25⤵
- Executes dropped EXE
PID:384 -
\??\c:\lfffrxl.exec:\lfffrxl.exe26⤵
- Executes dropped EXE
PID:4396 -
\??\c:\dvdvp.exec:\dvdvp.exe27⤵
- Executes dropped EXE
PID:1524 -
\??\c:\pvdvp.exec:\pvdvp.exe28⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xllxxxl.exec:\xllxxxl.exe29⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nntnhb.exec:\nntnhb.exe30⤵
- Executes dropped EXE
PID:3632 -
\??\c:\lfffrrl.exec:\lfffrrl.exe31⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7hnhnn.exec:\7hnhnn.exe32⤵
- Executes dropped EXE
PID:3712 -
\??\c:\vdppd.exec:\vdppd.exe33⤵
- Executes dropped EXE
PID:1108 -
\??\c:\fxxfxxr.exec:\fxxfxxr.exe34⤵
- Executes dropped EXE
PID:2492 -
\??\c:\frxfxxr.exec:\frxfxxr.exe35⤵
- Executes dropped EXE
PID:4836 -
\??\c:\htbbtt.exec:\htbbtt.exe36⤵
- Executes dropped EXE
PID:900 -
\??\c:\dvjvd.exec:\dvjvd.exe37⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1hnthb.exec:\1hnthb.exe38⤵
- Executes dropped EXE
PID:4740 -
\??\c:\pvpjp.exec:\pvpjp.exe39⤵
- Executes dropped EXE
PID:4216 -
\??\c:\fflrxrl.exec:\fflrxrl.exe40⤵
- Executes dropped EXE
PID:5096 -
\??\c:\btttnn.exec:\btttnn.exe41⤵
- Executes dropped EXE
PID:3920 -
\??\c:\1tbtnh.exec:\1tbtnh.exe42⤵
- Executes dropped EXE
PID:3092 -
\??\c:\dddjd.exec:\dddjd.exe43⤵
- Executes dropped EXE
PID:3140 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe44⤵
- Executes dropped EXE
PID:456 -
\??\c:\nhbtnh.exec:\nhbtnh.exe45⤵
- Executes dropped EXE
PID:3800 -
\??\c:\9jjdp.exec:\9jjdp.exe46⤵
- Executes dropped EXE
PID:3676 -
\??\c:\5rlfxxr.exec:\5rlfxxr.exe47⤵
- Executes dropped EXE
PID:4504 -
\??\c:\7ttnhh.exec:\7ttnhh.exe48⤵
- Executes dropped EXE
PID:5032 -
\??\c:\httnhh.exec:\httnhh.exe49⤵
- Executes dropped EXE
PID:3416 -
\??\c:\3ddvp.exec:\3ddvp.exe50⤵
- Executes dropped EXE
PID:4532 -
\??\c:\llfxrlx.exec:\llfxrlx.exe51⤵
- Executes dropped EXE
PID:5020 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe52⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nnnhhh.exec:\nnnhhh.exe53⤵
- Executes dropped EXE
PID:4272 -
\??\c:\vpjjd.exec:\vpjjd.exe54⤵
- Executes dropped EXE
PID:4476 -
\??\c:\llxlrxf.exec:\llxlrxf.exe55⤵
- Executes dropped EXE
PID:388 -
\??\c:\xlrrlfl.exec:\xlrrlfl.exe56⤵
- Executes dropped EXE
PID:3452 -
\??\c:\hhtntt.exec:\hhtntt.exe57⤵
- Executes dropped EXE
PID:4136 -
\??\c:\dvjdv.exec:\dvjdv.exe58⤵
- Executes dropped EXE
PID:376 -
\??\c:\dvddp.exec:\dvddp.exe59⤵
- Executes dropped EXE
PID:3844 -
\??\c:\flxrlfx.exec:\flxrlfx.exe60⤵
- Executes dropped EXE
PID:4948 -
\??\c:\hnnnht.exec:\hnnnht.exe61⤵
- Executes dropped EXE
PID:1688 -
\??\c:\3vvjd.exec:\3vvjd.exe62⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jvdjp.exec:\jvdjp.exe63⤵
- Executes dropped EXE
PID:1516 -
\??\c:\3llxlrl.exec:\3llxlrl.exe64⤵
- Executes dropped EXE
PID:2036 -
\??\c:\htnbtn.exec:\htnbtn.exe65⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vppjd.exec:\vppjd.exe66⤵PID:2732
-
\??\c:\fflffrl.exec:\fflffrl.exe67⤵PID:2276
-
\??\c:\hntnbt.exec:\hntnbt.exe68⤵PID:1452
-
\??\c:\jjjvv.exec:\jjjvv.exe69⤵PID:2872
-
\??\c:\djdvj.exec:\djdvj.exe70⤵PID:4204
-
\??\c:\5xrfxxr.exec:\5xrfxxr.exe71⤵PID:4076
-
\??\c:\bnnhtt.exec:\bnnhtt.exe72⤵PID:1988
-
\??\c:\lfrlfll.exec:\lfrlfll.exe73⤵PID:4960
-
\??\c:\lxrlrlf.exec:\lxrlrlf.exe74⤵PID:116
-
\??\c:\hhttbh.exec:\hhttbh.exe75⤵PID:1204
-
\??\c:\7tnhhn.exec:\7tnhhn.exe76⤵PID:5080
-
\??\c:\pjjdv.exec:\pjjdv.exe77⤵PID:2528
-
\??\c:\rllffxr.exec:\rllffxr.exe78⤵PID:3036
-
\??\c:\9nhnnt.exec:\9nhnnt.exe79⤵PID:380
-
\??\c:\pjpvv.exec:\pjpvv.exe80⤵PID:2108
-
\??\c:\xrxrllf.exec:\xrxrllf.exe81⤵PID:4544
-
\??\c:\lflfffx.exec:\lflfffx.exe82⤵PID:1756
-
\??\c:\hbbbtt.exec:\hbbbtt.exe83⤵PID:228
-
\??\c:\vjvpp.exec:\vjvpp.exe84⤵PID:2240
-
\??\c:\rlrlflf.exec:\rlrlflf.exe85⤵PID:4304
-
\??\c:\bbnbbt.exec:\bbnbbt.exe86⤵PID:4044
-
\??\c:\hbbbth.exec:\hbbbth.exe87⤵PID:4408
-
\??\c:\vjppj.exec:\vjppj.exe88⤵PID:2784
-
\??\c:\rxffrrl.exec:\rxffrrl.exe89⤵PID:1748
-
\??\c:\7nnhhh.exec:\7nnhhh.exe90⤵PID:1524
-
\??\c:\hthbtn.exec:\hthbtn.exe91⤵PID:1996
-
\??\c:\pdpjd.exec:\pdpjd.exe92⤵PID:1700
-
\??\c:\7lrrxxl.exec:\7lrrxxl.exe93⤵PID:3132
-
\??\c:\rfffxxx.exec:\rfffxxx.exe94⤵PID:2836
-
\??\c:\hnthhn.exec:\hnthhn.exe95⤵PID:636
-
\??\c:\vjppj.exec:\vjppj.exe96⤵PID:3032
-
\??\c:\xllrlff.exec:\xllrlff.exe97⤵PID:648
-
\??\c:\7llfxxr.exec:\7llfxxr.exe98⤵PID:3904
-
\??\c:\ttnhhb.exec:\ttnhhb.exe99⤵PID:4740
-
\??\c:\5dvpj.exec:\5dvpj.exe100⤵PID:2060
-
\??\c:\5xxlffx.exec:\5xxlffx.exe101⤵PID:4576
-
\??\c:\fffxxrl.exec:\fffxxrl.exe102⤵
- System Location Discovery: System Language Discovery
PID:4548 -
\??\c:\tbbbtb.exec:\tbbbtb.exe103⤵PID:332
-
\??\c:\ppdpj.exec:\ppdpj.exe104⤵PID:2912
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe105⤵PID:3660
-
\??\c:\9hnhbb.exec:\9hnhbb.exe106⤵PID:2268
-
\??\c:\dpdvv.exec:\dpdvv.exe107⤵PID:2680
-
\??\c:\xxxfxrl.exec:\xxxfxrl.exe108⤵PID:1820
-
\??\c:\tnhbtn.exec:\tnhbtn.exe109⤵PID:264
-
\??\c:\dpdpd.exec:\dpdpd.exe110⤵PID:4208
-
\??\c:\xrrllff.exec:\xrrllff.exe111⤵PID:4600
-
\??\c:\rflffrl.exec:\rflffrl.exe112⤵PID:5116
-
\??\c:\thnthb.exec:\thnthb.exe113⤵PID:4508
-
\??\c:\9jvpv.exec:\9jvpv.exe114⤵PID:4316
-
\??\c:\9frlflf.exec:\9frlflf.exe115⤵PID:3980
-
\??\c:\flrrlll.exec:\flrrlll.exe116⤵PID:4784
-
\??\c:\nhhbnh.exec:\nhhbnh.exe117⤵PID:2404
-
\??\c:\vdjdp.exec:\vdjdp.exe118⤵PID:3624
-
\??\c:\1rrlrrl.exec:\1rrlrrl.exe119⤵PID:1684
-
\??\c:\rllffxx.exec:\rllffxx.exe120⤵PID:3456
-
\??\c:\ttbtbt.exec:\ttbtbt.exe121⤵PID:2688
-
\??\c:\7pjdp.exec:\7pjdp.exe122⤵PID:400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-