Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b0979f38d5d52131cf30311517781a7908f47da6e38bdd5c6daacba66caab82N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8b0979f38d5d52131cf30311517781a7908f47da6e38bdd5c6daacba66caab82N.exe
-
Size
455KB
-
MD5
15eedcebfe285625a31cdcaea7118ce0
-
SHA1
02d324c73da1207bdd11d73cea98c0c5fba4a040
-
SHA256
8b0979f38d5d52131cf30311517781a7908f47da6e38bdd5c6daacba66caab82
-
SHA512
989a346d803abc1518d5af44aa7e652de20983569f4d7af5cd1cad0e099167aefafc9e5d6ac65d1830affbb86a373b53934338f1badaf023785e8c12c541c9f5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/948-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/264-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-904-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-1033-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4480 lrrlxxr.exe 4532 pddpd.exe 1312 nttnhb.exe 2480 vppjd.exe 4880 htbnnh.exe 2508 9jvpj.exe 2184 jjddp.exe 716 bttntn.exe 3784 fllfxxr.exe 4256 vjdvp.exe 4932 xfxffxr.exe 4312 jvddp.exe 1984 thhbtt.exe 264 hbttnn.exe 3928 xlxrlxr.exe 4472 lrfrlxr.exe 2564 5xlfxfl.exe 3704 9xxrxrl.exe 1528 5vdvv.exe 1108 rllffxx.exe 1488 dvvpd.exe 1368 nhhbhh.exe 748 jpvpj.exe 4224 fxxrxxf.exe 2532 hhbtbb.exe 4048 tbbthb.exe 3008 jpvpj.exe 3476 3bhtbn.exe 4456 lxrlflf.exe 4188 3bnbhb.exe 4008 fxxrlrr.exe 2448 pdjdv.exe 3304 nnhnbb.exe 3508 1ntthh.exe 4808 vppdv.exe 3356 fxfxfxx.exe 4560 hnbtnn.exe 3140 bbhbtn.exe 316 dvdvp.exe 1416 1ffxxxr.exe 2612 bttnhn.exe 932 nbbbnh.exe 4228 jjdpj.exe 3336 rrxrxrx.exe 1636 hbbnhb.exe 3740 jdvpj.exe 1060 rllfxxr.exe 4304 fxxrrrl.exe 2496 bnbtbb.exe 5084 pjjvp.exe 4480 lffxrlf.exe 1564 thbttn.exe 1844 vpvpj.exe 2588 7lllllf.exe 4892 5xxxrrr.exe 2808 bbtnnh.exe 4800 ddpjj.exe 4596 xflxrfx.exe 2508 ttbhhn.exe 2200 tbtnhb.exe 2592 5vpjd.exe 3756 5rrlxrl.exe 2348 thhbbb.exe 992 9ddvp.exe -
resource yara_rule behavioral2/memory/948-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/264-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-772-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 948 wrote to memory of 4480 948 8b0979f38d5d52131cf30311517781a7908f47da6e38bdd5c6daacba66caab82N.exe 82 PID 948 wrote to memory of 4480 948 8b0979f38d5d52131cf30311517781a7908f47da6e38bdd5c6daacba66caab82N.exe 82 PID 948 wrote to memory of 4480 948 8b0979f38d5d52131cf30311517781a7908f47da6e38bdd5c6daacba66caab82N.exe 82 PID 4480 wrote to memory of 4532 4480 lrrlxxr.exe 83 PID 4480 wrote to memory of 4532 4480 lrrlxxr.exe 83 PID 4480 wrote to memory of 4532 4480 lrrlxxr.exe 83 PID 4532 wrote to memory of 1312 4532 pddpd.exe 84 PID 4532 wrote to memory of 1312 4532 pddpd.exe 84 PID 4532 wrote to memory of 1312 4532 pddpd.exe 84 PID 1312 wrote to memory of 2480 1312 nttnhb.exe 85 PID 1312 wrote to memory of 2480 1312 nttnhb.exe 85 PID 1312 wrote to memory of 2480 1312 nttnhb.exe 85 PID 2480 wrote to memory of 4880 2480 vppjd.exe 86 PID 2480 wrote to memory of 4880 2480 vppjd.exe 86 PID 2480 wrote to memory of 4880 2480 vppjd.exe 86 PID 4880 wrote to memory of 2508 4880 htbnnh.exe 87 PID 4880 wrote to memory of 2508 4880 htbnnh.exe 87 PID 4880 wrote to memory of 2508 4880 htbnnh.exe 87 PID 2508 wrote to memory of 2184 2508 9jvpj.exe 88 PID 2508 wrote to memory of 2184 2508 9jvpj.exe 88 PID 2508 wrote to memory of 2184 2508 9jvpj.exe 88 PID 2184 wrote to memory of 716 2184 jjddp.exe 89 PID 2184 wrote to memory of 716 2184 jjddp.exe 89 PID 2184 wrote to memory of 716 2184 jjddp.exe 89 PID 716 wrote to memory of 3784 716 bttntn.exe 90 PID 716 wrote to memory of 3784 716 bttntn.exe 90 PID 716 wrote to memory of 3784 716 bttntn.exe 90 PID 3784 wrote to memory of 4256 3784 fllfxxr.exe 91 PID 3784 wrote to memory of 4256 3784 fllfxxr.exe 91 PID 3784 wrote to memory of 4256 3784 fllfxxr.exe 91 PID 4256 wrote to memory of 4932 4256 vjdvp.exe 92 PID 4256 wrote to memory of 4932 4256 vjdvp.exe 92 PID 4256 wrote to memory of 4932 4256 vjdvp.exe 92 PID 4932 wrote to memory of 4312 4932 xfxffxr.exe 93 PID 4932 wrote to memory of 4312 4932 xfxffxr.exe 93 PID 4932 wrote to memory of 4312 4932 xfxffxr.exe 93 PID 4312 wrote to memory of 1984 4312 jvddp.exe 94 PID 4312 wrote to memory of 1984 4312 jvddp.exe 94 PID 4312 wrote to memory of 1984 4312 jvddp.exe 94 PID 1984 wrote to memory of 264 1984 thhbtt.exe 95 PID 1984 wrote to memory of 264 1984 thhbtt.exe 95 PID 1984 wrote to memory of 264 1984 thhbtt.exe 95 PID 264 wrote to memory of 3928 264 hbttnn.exe 96 PID 264 wrote to memory of 3928 264 hbttnn.exe 96 PID 264 wrote to memory of 3928 264 hbttnn.exe 96 PID 3928 wrote to memory of 4472 3928 xlxrlxr.exe 97 PID 3928 wrote to memory of 4472 3928 xlxrlxr.exe 97 PID 3928 wrote to memory of 4472 3928 xlxrlxr.exe 97 PID 4472 wrote to memory of 2564 4472 lrfrlxr.exe 98 PID 4472 wrote to memory of 2564 4472 lrfrlxr.exe 98 PID 4472 wrote to memory of 2564 4472 lrfrlxr.exe 98 PID 2564 wrote to memory of 3704 2564 5xlfxfl.exe 99 PID 2564 wrote to memory of 3704 2564 5xlfxfl.exe 99 PID 2564 wrote to memory of 3704 2564 5xlfxfl.exe 99 PID 3704 wrote to memory of 1528 3704 9xxrxrl.exe 100 PID 3704 wrote to memory of 1528 3704 9xxrxrl.exe 100 PID 3704 wrote to memory of 1528 3704 9xxrxrl.exe 100 PID 1528 wrote to memory of 1108 1528 5vdvv.exe 101 PID 1528 wrote to memory of 1108 1528 5vdvv.exe 101 PID 1528 wrote to memory of 1108 1528 5vdvv.exe 101 PID 1108 wrote to memory of 1488 1108 rllffxx.exe 102 PID 1108 wrote to memory of 1488 1108 rllffxx.exe 102 PID 1108 wrote to memory of 1488 1108 rllffxx.exe 102 PID 1488 wrote to memory of 1368 1488 dvvpd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b0979f38d5d52131cf30311517781a7908f47da6e38bdd5c6daacba66caab82N.exe"C:\Users\Admin\AppData\Local\Temp\8b0979f38d5d52131cf30311517781a7908f47da6e38bdd5c6daacba66caab82N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\lrrlxxr.exec:\lrrlxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\pddpd.exec:\pddpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\nttnhb.exec:\nttnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\vppjd.exec:\vppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\htbnnh.exec:\htbnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\9jvpj.exec:\9jvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\jjddp.exec:\jjddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\bttntn.exec:\bttntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\fllfxxr.exec:\fllfxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\vjdvp.exec:\vjdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\xfxffxr.exec:\xfxffxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\jvddp.exec:\jvddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\thhbtt.exec:\thhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\hbttnn.exec:\hbttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\xlxrlxr.exec:\xlxrlxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\lrfrlxr.exec:\lrfrlxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\5xlfxfl.exec:\5xlfxfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\9xxrxrl.exec:\9xxrxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\5vdvv.exec:\5vdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\rllffxx.exec:\rllffxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\dvvpd.exec:\dvvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\nhhbhh.exec:\nhhbhh.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\jpvpj.exec:\jpvpj.exe24⤵
- Executes dropped EXE
PID:748 -
\??\c:\fxxrxxf.exec:\fxxrxxf.exe25⤵
- Executes dropped EXE
PID:4224 -
\??\c:\hhbtbb.exec:\hhbtbb.exe26⤵
- Executes dropped EXE
PID:2532 -
\??\c:\tbbthb.exec:\tbbthb.exe27⤵
- Executes dropped EXE
PID:4048 -
\??\c:\jpvpj.exec:\jpvpj.exe28⤵
- Executes dropped EXE
PID:3008 -
\??\c:\3bhtbn.exec:\3bhtbn.exe29⤵
- Executes dropped EXE
PID:3476 -
\??\c:\lxrlflf.exec:\lxrlflf.exe30⤵
- Executes dropped EXE
PID:4456 -
\??\c:\3bnbhb.exec:\3bnbhb.exe31⤵
- Executes dropped EXE
PID:4188 -
\??\c:\fxxrlrr.exec:\fxxrlrr.exe32⤵
- Executes dropped EXE
PID:4008 -
\??\c:\pdjdv.exec:\pdjdv.exe33⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nnhnbb.exec:\nnhnbb.exe34⤵
- Executes dropped EXE
PID:3304 -
\??\c:\1ntthh.exec:\1ntthh.exe35⤵
- Executes dropped EXE
PID:3508 -
\??\c:\vppdv.exec:\vppdv.exe36⤵
- Executes dropped EXE
PID:4808 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe37⤵
- Executes dropped EXE
PID:3356 -
\??\c:\hnbtnn.exec:\hnbtnn.exe38⤵
- Executes dropped EXE
PID:4560 -
\??\c:\bbhbtn.exec:\bbhbtn.exe39⤵
- Executes dropped EXE
PID:3140 -
\??\c:\dvdvp.exec:\dvdvp.exe40⤵
- Executes dropped EXE
PID:316 -
\??\c:\1ffxxxr.exec:\1ffxxxr.exe41⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bttnhn.exec:\bttnhn.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nbbbnh.exec:\nbbbnh.exe43⤵
- Executes dropped EXE
PID:932 -
\??\c:\jjdpj.exec:\jjdpj.exe44⤵
- Executes dropped EXE
PID:4228 -
\??\c:\rrxrxrx.exec:\rrxrxrx.exe45⤵
- Executes dropped EXE
PID:3336 -
\??\c:\hbbnhb.exec:\hbbnhb.exe46⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jdvpj.exec:\jdvpj.exe47⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rllfxxr.exec:\rllfxxr.exe48⤵
- Executes dropped EXE
PID:1060 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe49⤵
- Executes dropped EXE
PID:4304 -
\??\c:\bnbtbb.exec:\bnbtbb.exe50⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pjjvp.exec:\pjjvp.exe51⤵
- Executes dropped EXE
PID:5084 -
\??\c:\lffxrlf.exec:\lffxrlf.exe52⤵
- Executes dropped EXE
PID:4480 -
\??\c:\thbttn.exec:\thbttn.exe53⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vpvpj.exec:\vpvpj.exe54⤵
- Executes dropped EXE
PID:1844 -
\??\c:\7lllllf.exec:\7lllllf.exe55⤵
- Executes dropped EXE
PID:2588 -
\??\c:\5xxxrrr.exec:\5xxxrrr.exe56⤵
- Executes dropped EXE
PID:4892 -
\??\c:\bbtnnh.exec:\bbtnnh.exe57⤵
- Executes dropped EXE
PID:2808 -
\??\c:\ddpjj.exec:\ddpjj.exe58⤵
- Executes dropped EXE
PID:4800 -
\??\c:\xflxrfx.exec:\xflxrfx.exe59⤵
- Executes dropped EXE
PID:4596 -
\??\c:\ttbhhn.exec:\ttbhhn.exe60⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tbtnhb.exec:\tbtnhb.exe61⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5vpjd.exec:\5vpjd.exe62⤵
- Executes dropped EXE
PID:2592 -
\??\c:\5rrlxrl.exec:\5rrlxrl.exe63⤵
- Executes dropped EXE
PID:3756 -
\??\c:\thhbbb.exec:\thhbbb.exe64⤵
- Executes dropped EXE
PID:2348 -
\??\c:\9ddvp.exec:\9ddvp.exe65⤵
- Executes dropped EXE
PID:992 -
\??\c:\lxrfrfr.exec:\lxrfrfr.exe66⤵PID:2028
-
\??\c:\xrlxfxl.exec:\xrlxfxl.exe67⤵PID:4804
-
\??\c:\btbtnh.exec:\btbtnh.exe68⤵PID:2836
-
\??\c:\vvpjd.exec:\vvpjd.exe69⤵PID:4568
-
\??\c:\fxrfxrr.exec:\fxrfxrr.exe70⤵PID:5064
-
\??\c:\9hhtnn.exec:\9hhtnn.exe71⤵PID:184
-
\??\c:\dppjv.exec:\dppjv.exe72⤵PID:320
-
\??\c:\pdjvj.exec:\pdjvj.exe73⤵PID:216
-
\??\c:\3rrlffr.exec:\3rrlffr.exe74⤵PID:2476
-
\??\c:\nbhbnt.exec:\nbhbnt.exe75⤵PID:532
-
\??\c:\vvdvj.exec:\vvdvj.exe76⤵PID:5032
-
\??\c:\frxlffx.exec:\frxlffx.exe77⤵PID:4076
-
\??\c:\bhnhhb.exec:\bhnhhb.exe78⤵PID:3444
-
\??\c:\tbnbnn.exec:\tbnbnn.exe79⤵PID:956
-
\??\c:\vvpjj.exec:\vvpjj.exe80⤵PID:3068
-
\??\c:\xflffxx.exec:\xflffxx.exe81⤵PID:2912
-
\??\c:\nbbbtn.exec:\nbbbtn.exe82⤵PID:2316
-
\??\c:\jvvpp.exec:\jvvpp.exe83⤵PID:2820
-
\??\c:\dvdvj.exec:\dvdvj.exe84⤵PID:2596
-
\??\c:\lfllrrx.exec:\lfllrrx.exe85⤵
- System Location Discovery: System Language Discovery
PID:1892 -
\??\c:\bbnhhh.exec:\bbnhhh.exe86⤵PID:3832
-
\??\c:\pdppj.exec:\pdppj.exe87⤵PID:4852
-
\??\c:\5rrlfrl.exec:\5rrlfrl.exe88⤵PID:3768
-
\??\c:\bbhbnn.exec:\bbhbnn.exe89⤵PID:4452
-
\??\c:\ntnhbb.exec:\ntnhbb.exe90⤵PID:5028
-
\??\c:\7pppj.exec:\7pppj.exe91⤵PID:3544
-
\??\c:\xrrfrrf.exec:\xrrfrrf.exe92⤵PID:1928
-
\??\c:\tntnhb.exec:\tntnhb.exe93⤵PID:4700
-
\??\c:\vjvpj.exec:\vjvpj.exe94⤵PID:3028
-
\??\c:\xflfrlf.exec:\xflfrlf.exe95⤵PID:4956
-
\??\c:\lrllfxr.exec:\lrllfxr.exe96⤵PID:1732
-
\??\c:\nbnhhh.exec:\nbnhhh.exe97⤵PID:3588
-
\??\c:\vvjdd.exec:\vvjdd.exe98⤵PID:3280
-
\??\c:\llfxffl.exec:\llfxffl.exe99⤵PID:2284
-
\??\c:\nhhnhh.exec:\nhhnhh.exe100⤵PID:1736
-
\??\c:\dddvp.exec:\dddvp.exe101⤵PID:3216
-
\??\c:\rfffxrl.exec:\rfffxrl.exe102⤵PID:616
-
\??\c:\nbbttt.exec:\nbbttt.exe103⤵PID:408
-
\??\c:\nhbnth.exec:\nhbnth.exe104⤵PID:3240
-
\??\c:\jjvjv.exec:\jjvjv.exe105⤵PID:1416
-
\??\c:\xrllrrx.exec:\xrllrrx.exe106⤵PID:2612
-
\??\c:\ntntht.exec:\ntntht.exe107⤵PID:4856
-
\??\c:\hntnhh.exec:\hntnhh.exe108⤵PID:3580
-
\??\c:\jdppp.exec:\jdppp.exe109⤵PID:3624
-
\??\c:\5flfrrl.exec:\5flfrrl.exe110⤵PID:1356
-
\??\c:\bnbbtt.exec:\bnbbtt.exe111⤵PID:3740
-
\??\c:\vpvdv.exec:\vpvdv.exe112⤵PID:4284
-
\??\c:\ppvpp.exec:\ppvpp.exe113⤵PID:548
-
\??\c:\xlrxrlf.exec:\xlrxrlf.exe114⤵PID:4940
-
\??\c:\dpjdp.exec:\dpjdp.exe115⤵PID:3400
-
\??\c:\ffrlflf.exec:\ffrlflf.exe116⤵PID:1580
-
\??\c:\btttnt.exec:\btttnt.exe117⤵PID:3500
-
\??\c:\jvdvv.exec:\jvdvv.exe118⤵PID:1844
-
\??\c:\9jddd.exec:\9jddd.exe119⤵PID:2480
-
\??\c:\frxlffr.exec:\frxlffr.exe120⤵PID:4892
-
\??\c:\thnhnt.exec:\thnhnt.exe121⤵PID:3252
-
\??\c:\pjjdv.exec:\pjjdv.exe122⤵PID:4800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-