Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:09
Behavioral task
behavioral1
Sample
ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe
-
Size
333KB
-
MD5
5560b06ed88e8eab8580e6f15f3bbfa4
-
SHA1
304b9969365e67677750eac0113e9daeea911e29
-
SHA256
ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7
-
SHA512
7157de49f9ade7353b3486c488f650a7ad64178817fdcfb0770ad6ced4a50cf8f01dae2241283b06242621f007cdbef2f9674907cd2ff417a3f3945e8fc36e6d
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeT:R4wFHoSHYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4368-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2212-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1756-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1504-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2896-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/776-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-637-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-904-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5100 rrflffx.exe 4412 dvpjd.exe 1584 bhbnnn.exe 1012 1jdpv.exe 1424 vpvpv.exe 2212 llxrrll.exe 4944 dvddv.exe 4420 pdpjj.exe 4664 llxxxxx.exe 948 ddvpd.exe 2360 hhbbnt.exe 1928 dpvvp.exe 1756 xxxrrlr.exe 4980 vvvpj.exe 100 xrrlffx.exe 4540 flffffx.exe 5108 pdjdd.exe 3292 xlxllll.exe 3116 7tbtht.exe 2620 3nnbth.exe 2848 lfffxxr.exe 5116 frxrrrr.exe 4992 xxxrllf.exe 1324 pvjjd.exe 4968 xllxxlr.exe 2908 ppppp.exe 4128 flxxlxr.exe 3820 lrrrrrl.exe 4640 nbhhbt.exe 1504 flrrlxx.exe 2896 hbbtbt.exe 1508 tthhnn.exe 4872 dpvdv.exe 4672 1nnnhh.exe 1896 nnhnnn.exe 1764 pjpjj.exe 2472 3rllrxf.exe 3992 dvjjd.exe 3676 pdppp.exe 3784 xrrlffx.exe 4716 bhnnhh.exe 1120 jjjvp.exe 4756 fxxxxrr.exe 1488 bbbntn.exe 1916 dpddj.exe 3536 vpvpd.exe 2844 fffxrrl.exe 2648 fxllfff.exe 1728 thtttt.exe 1836 pdppj.exe 1468 pjpjd.exe 624 7rlfrrf.exe 220 bhntnn.exe 1760 1vvjv.exe 2764 lrlxlll.exe 1444 bttnhh.exe 4560 vjjdv.exe 5100 7rlfxrl.exe 1332 htbtnn.exe 2512 pvvjv.exe 2268 jjvpp.exe 2028 xxxrlrl.exe 2768 7hbttt.exe 1524 ppdpd.exe -
resource yara_rule behavioral2/memory/4368-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4368-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b57-3.dat upx behavioral2/files/0x0008000000023bf9-8.dat upx behavioral2/memory/5100-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4412-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bfa-12.dat upx behavioral2/files/0x0008000000023bfb-18.dat upx behavioral2/memory/1584-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c00-23.dat upx behavioral2/memory/1424-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c01-27.dat upx behavioral2/files/0x0008000000023c02-32.dat upx behavioral2/memory/4944-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2212-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c14-38.dat upx behavioral2/memory/4420-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4420-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c1a-44.dat upx behavioral2/files/0x0008000000023c1b-48.dat upx behavioral2/files/0x0008000000023c1c-52.dat upx behavioral2/files/0x0008000000023c1d-56.dat upx behavioral2/memory/1928-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2360-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c1e-62.dat upx behavioral2/files/0x0016000000023c35-72.dat upx behavioral2/memory/100-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bf6-78.dat upx behavioral2/memory/4540-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4980-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023c34-68.dat upx behavioral2/memory/1756-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4540-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c3f-89.dat upx behavioral2/files/0x0008000000023c4b-94.dat upx behavioral2/memory/3116-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3292-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5108-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c3b-83.dat upx behavioral2/files/0x0008000000023c4c-98.dat upx behavioral2/files/0x0008000000023c4d-104.dat upx behavioral2/memory/2620-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c4e-107.dat upx behavioral2/files/0x0008000000023c4f-111.dat upx behavioral2/memory/5116-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c50-116.dat upx behavioral2/memory/4992-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1324-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c51-122.dat upx behavioral2/files/0x0008000000023c52-126.dat upx behavioral2/files/0x0008000000023c53-130.dat upx behavioral2/memory/2908-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c54-135.dat upx behavioral2/files/0x0008000000023c55-139.dat upx behavioral2/memory/3820-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c5e-144.dat upx behavioral2/memory/1504-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c5f-148.dat upx behavioral2/files/0x0007000000023c60-152.dat upx behavioral2/memory/2896-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1508-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4672-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1896-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3676-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4368 wrote to memory of 5100 4368 ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe 82 PID 4368 wrote to memory of 5100 4368 ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe 82 PID 4368 wrote to memory of 5100 4368 ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe 82 PID 5100 wrote to memory of 4412 5100 rrflffx.exe 83 PID 5100 wrote to memory of 4412 5100 rrflffx.exe 83 PID 5100 wrote to memory of 4412 5100 rrflffx.exe 83 PID 4412 wrote to memory of 1584 4412 dvpjd.exe 84 PID 4412 wrote to memory of 1584 4412 dvpjd.exe 84 PID 4412 wrote to memory of 1584 4412 dvpjd.exe 84 PID 1584 wrote to memory of 1012 1584 bhbnnn.exe 85 PID 1584 wrote to memory of 1012 1584 bhbnnn.exe 85 PID 1584 wrote to memory of 1012 1584 bhbnnn.exe 85 PID 1012 wrote to memory of 1424 1012 1jdpv.exe 86 PID 1012 wrote to memory of 1424 1012 1jdpv.exe 86 PID 1012 wrote to memory of 1424 1012 1jdpv.exe 86 PID 1424 wrote to memory of 2212 1424 vpvpv.exe 87 PID 1424 wrote to memory of 2212 1424 vpvpv.exe 87 PID 1424 wrote to memory of 2212 1424 vpvpv.exe 87 PID 2212 wrote to memory of 4944 2212 llxrrll.exe 88 PID 2212 wrote to memory of 4944 2212 llxrrll.exe 88 PID 2212 wrote to memory of 4944 2212 llxrrll.exe 88 PID 4944 wrote to memory of 4420 4944 dvddv.exe 89 PID 4944 wrote to memory of 4420 4944 dvddv.exe 89 PID 4944 wrote to memory of 4420 4944 dvddv.exe 89 PID 4420 wrote to memory of 4664 4420 pdpjj.exe 90 PID 4420 wrote to memory of 4664 4420 pdpjj.exe 90 PID 4420 wrote to memory of 4664 4420 pdpjj.exe 90 PID 4664 wrote to memory of 948 4664 llxxxxx.exe 91 PID 4664 wrote to memory of 948 4664 llxxxxx.exe 91 PID 4664 wrote to memory of 948 4664 llxxxxx.exe 91 PID 948 wrote to memory of 2360 948 ddvpd.exe 92 PID 948 wrote to memory of 2360 948 ddvpd.exe 92 PID 948 wrote to memory of 2360 948 ddvpd.exe 92 PID 2360 wrote to memory of 1928 2360 hhbbnt.exe 93 PID 2360 wrote to memory of 1928 2360 hhbbnt.exe 93 PID 2360 wrote to memory of 1928 2360 hhbbnt.exe 93 PID 1928 wrote to memory of 1756 1928 dpvvp.exe 94 PID 1928 wrote to memory of 1756 1928 dpvvp.exe 94 PID 1928 wrote to memory of 1756 1928 dpvvp.exe 94 PID 1756 wrote to memory of 4980 1756 xxxrrlr.exe 95 PID 1756 wrote to memory of 4980 1756 xxxrrlr.exe 95 PID 1756 wrote to memory of 4980 1756 xxxrrlr.exe 95 PID 4980 wrote to memory of 100 4980 vvvpj.exe 96 PID 4980 wrote to memory of 100 4980 vvvpj.exe 96 PID 4980 wrote to memory of 100 4980 vvvpj.exe 96 PID 100 wrote to memory of 4540 100 xrrlffx.exe 97 PID 100 wrote to memory of 4540 100 xrrlffx.exe 97 PID 100 wrote to memory of 4540 100 xrrlffx.exe 97 PID 4540 wrote to memory of 5108 4540 flffffx.exe 98 PID 4540 wrote to memory of 5108 4540 flffffx.exe 98 PID 4540 wrote to memory of 5108 4540 flffffx.exe 98 PID 5108 wrote to memory of 3292 5108 pdjdd.exe 99 PID 5108 wrote to memory of 3292 5108 pdjdd.exe 99 PID 5108 wrote to memory of 3292 5108 pdjdd.exe 99 PID 3292 wrote to memory of 3116 3292 xlxllll.exe 100 PID 3292 wrote to memory of 3116 3292 xlxllll.exe 100 PID 3292 wrote to memory of 3116 3292 xlxllll.exe 100 PID 3116 wrote to memory of 2620 3116 7tbtht.exe 101 PID 3116 wrote to memory of 2620 3116 7tbtht.exe 101 PID 3116 wrote to memory of 2620 3116 7tbtht.exe 101 PID 2620 wrote to memory of 2848 2620 3nnbth.exe 102 PID 2620 wrote to memory of 2848 2620 3nnbth.exe 102 PID 2620 wrote to memory of 2848 2620 3nnbth.exe 102 PID 2848 wrote to memory of 5116 2848 lfffxxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe"C:\Users\Admin\AppData\Local\Temp\ae32caeb40eedd5b3d7c728bb834647f8626da9cd67fa004bed7dcd7c6385fc7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\rrflffx.exec:\rrflffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\dvpjd.exec:\dvpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\bhbnnn.exec:\bhbnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\1jdpv.exec:\1jdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\vpvpv.exec:\vpvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\llxrrll.exec:\llxrrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\dvddv.exec:\dvddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\pdpjj.exec:\pdpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\llxxxxx.exec:\llxxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\ddvpd.exec:\ddvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\hhbbnt.exec:\hhbbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\dpvvp.exec:\dpvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\xxxrrlr.exec:\xxxrrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\vvvpj.exec:\vvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\xrrlffx.exec:\xrrlffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\flffffx.exec:\flffffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\pdjdd.exec:\pdjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\xlxllll.exec:\xlxllll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\7tbtht.exec:\7tbtht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\3nnbth.exec:\3nnbth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lfffxxr.exec:\lfffxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\frxrrrr.exec:\frxrrrr.exe23⤵
- Executes dropped EXE
PID:5116 -
\??\c:\xxxrllf.exec:\xxxrllf.exe24⤵
- Executes dropped EXE
PID:4992 -
\??\c:\pvjjd.exec:\pvjjd.exe25⤵
- Executes dropped EXE
PID:1324 -
\??\c:\xllxxlr.exec:\xllxxlr.exe26⤵
- Executes dropped EXE
PID:4968 -
\??\c:\ppppp.exec:\ppppp.exe27⤵
- Executes dropped EXE
PID:2908 -
\??\c:\flxxlxr.exec:\flxxlxr.exe28⤵
- Executes dropped EXE
PID:4128 -
\??\c:\lrrrrrl.exec:\lrrrrrl.exe29⤵
- Executes dropped EXE
PID:3820 -
\??\c:\nbhhbt.exec:\nbhhbt.exe30⤵
- Executes dropped EXE
PID:4640 -
\??\c:\flrrlxx.exec:\flrrlxx.exe31⤵
- Executes dropped EXE
PID:1504 -
\??\c:\hbbtbt.exec:\hbbtbt.exe32⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tthhnn.exec:\tthhnn.exe33⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dpvdv.exec:\dpvdv.exe34⤵
- Executes dropped EXE
PID:4872 -
\??\c:\1nnnhh.exec:\1nnnhh.exe35⤵
- Executes dropped EXE
PID:4672 -
\??\c:\nnhnnn.exec:\nnhnnn.exe36⤵
- Executes dropped EXE
PID:1896 -
\??\c:\pjpjj.exec:\pjpjj.exe37⤵
- Executes dropped EXE
PID:1764 -
\??\c:\3rllrxf.exec:\3rllrxf.exe38⤵
- Executes dropped EXE
PID:2472 -
\??\c:\dvjjd.exec:\dvjjd.exe39⤵
- Executes dropped EXE
PID:3992 -
\??\c:\pdppp.exec:\pdppp.exe40⤵
- Executes dropped EXE
PID:3676 -
\??\c:\xrrlffx.exec:\xrrlffx.exe41⤵
- Executes dropped EXE
PID:3784 -
\??\c:\bhnnhh.exec:\bhnnhh.exe42⤵
- Executes dropped EXE
PID:4716 -
\??\c:\jjjvp.exec:\jjjvp.exe43⤵
- Executes dropped EXE
PID:1120 -
\??\c:\fxxxxrr.exec:\fxxxxrr.exe44⤵
- Executes dropped EXE
PID:4756 -
\??\c:\bbbntn.exec:\bbbntn.exe45⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dpddj.exec:\dpddj.exe46⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vpvpd.exec:\vpvpd.exe47⤵
- Executes dropped EXE
PID:3536 -
\??\c:\fffxrrl.exec:\fffxrrl.exe48⤵
- Executes dropped EXE
PID:2844 -
\??\c:\fxllfff.exec:\fxllfff.exe49⤵
- Executes dropped EXE
PID:2648 -
\??\c:\thtttt.exec:\thtttt.exe50⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pdppj.exec:\pdppj.exe51⤵
- Executes dropped EXE
PID:1836 -
\??\c:\pjpjd.exec:\pjpjd.exe52⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7rlfrrf.exec:\7rlfrrf.exe53⤵
- Executes dropped EXE
PID:624 -
\??\c:\bhntnn.exec:\bhntnn.exe54⤵
- Executes dropped EXE
PID:220 -
\??\c:\1vvjv.exec:\1vvjv.exe55⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lrlxlll.exec:\lrlxlll.exe56⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lfxrllx.exec:\lfxrllx.exe57⤵PID:2316
-
\??\c:\bttnhh.exec:\bttnhh.exe58⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vjjdv.exec:\vjjdv.exe59⤵
- Executes dropped EXE
PID:4560 -
\??\c:\7rlfxrl.exec:\7rlfxrl.exe60⤵
- Executes dropped EXE
PID:5100 -
\??\c:\htbtnn.exec:\htbtnn.exe61⤵
- Executes dropped EXE
PID:1332 -
\??\c:\pvvjv.exec:\pvvjv.exe62⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jjvpp.exec:\jjvpp.exe63⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xxxrlrl.exec:\xxxrlrl.exe64⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7hbttt.exec:\7hbttt.exe65⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ppdpd.exec:\ppdpd.exe66⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3frlfff.exec:\3frlfff.exe67⤵
- System Location Discovery: System Language Discovery
PID:1900 -
\??\c:\5flllrl.exec:\5flllrl.exe68⤵PID:1992
-
\??\c:\bhttbb.exec:\bhttbb.exe69⤵PID:4496
-
\??\c:\jjvvj.exec:\jjvvj.exe70⤵PID:5040
-
\??\c:\jdddd.exec:\jdddd.exe71⤵PID:4452
-
\??\c:\fxfxrll.exec:\fxfxrll.exe72⤵PID:984
-
\??\c:\bnthhh.exec:\bnthhh.exe73⤵PID:916
-
\??\c:\vjppd.exec:\vjppd.exe74⤵PID:1152
-
\??\c:\pdjpj.exec:\pdjpj.exe75⤵PID:4036
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe76⤵PID:832
-
\??\c:\ttttnn.exec:\ttttnn.exe77⤵PID:948
-
\??\c:\pjjdv.exec:\pjjdv.exe78⤵PID:932
-
\??\c:\lfllllr.exec:\lfllllr.exe79⤵PID:4584
-
\??\c:\bttnnn.exec:\bttnnn.exe80⤵PID:4956
-
\??\c:\vppjv.exec:\vppjv.exe81⤵PID:2064
-
\??\c:\rffxlrr.exec:\rffxlrr.exe82⤵PID:2396
-
\??\c:\ffllffx.exec:\ffllffx.exe83⤵PID:2016
-
\??\c:\btnhtn.exec:\btnhtn.exe84⤵PID:4692
-
\??\c:\dvjvp.exec:\dvjvp.exe85⤵PID:3632
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe86⤵PID:856
-
\??\c:\lfrllxr.exec:\lfrllxr.exe87⤵PID:1476
-
\??\c:\hhbtnn.exec:\hhbtnn.exe88⤵PID:2224
-
\??\c:\dddvp.exec:\dddvp.exe89⤵PID:3512
-
\??\c:\dvjdv.exec:\dvjdv.exe90⤵PID:1680
-
\??\c:\xlllfxr.exec:\xlllfxr.exe91⤵PID:4912
-
\??\c:\hntbhn.exec:\hntbhn.exe92⤵PID:2124
-
\??\c:\vpvpp.exec:\vpvpp.exe93⤵PID:3352
-
\??\c:\jddvv.exec:\jddvv.exe94⤵PID:3004
-
\??\c:\lxrlfxl.exec:\lxrlfxl.exe95⤵PID:4852
-
\??\c:\9ttntt.exec:\9ttntt.exe96⤵PID:3032
-
\??\c:\dpvvp.exec:\dpvvp.exe97⤵PID:2344
-
\??\c:\djpjv.exec:\djpjv.exe98⤵PID:1324
-
\??\c:\fxxrlff.exec:\fxxrlff.exe99⤵PID:3324
-
\??\c:\hbhhtb.exec:\hbhhtb.exe100⤵PID:5048
-
\??\c:\vpjjd.exec:\vpjjd.exe101⤵PID:4752
-
\??\c:\vpddp.exec:\vpddp.exe102⤵PID:3572
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe103⤵PID:2960
-
\??\c:\bnthbt.exec:\bnthbt.exe104⤵PID:3088
-
\??\c:\dvdvv.exec:\dvdvv.exe105⤵PID:3112
-
\??\c:\flxrrrr.exec:\flxrrrr.exe106⤵PID:2312
-
\??\c:\frfxllf.exec:\frfxllf.exe107⤵PID:1804
-
\??\c:\thhhbt.exec:\thhhbt.exe108⤵PID:3264
-
\??\c:\pjjdp.exec:\pjjdp.exe109⤵PID:1972
-
\??\c:\lfrlflf.exec:\lfrlflf.exe110⤵PID:2780
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe111⤵PID:2808
-
\??\c:\vdjdv.exec:\vdjdv.exe112⤵PID:2156
-
\??\c:\pvdvj.exec:\pvdvj.exe113⤵PID:4840
-
\??\c:\9lrfxxr.exec:\9lrfxxr.exe114⤵PID:4808
-
\??\c:\hbhbbb.exec:\hbhbbb.exe115⤵PID:1288
-
\??\c:\5jvpd.exec:\5jvpd.exe116⤵PID:5084
-
\??\c:\jdpvd.exec:\jdpvd.exe117⤵PID:2440
-
\??\c:\xxxrrlf.exec:\xxxrrlf.exe118⤵PID:1748
-
\??\c:\thhhnn.exec:\thhhnn.exe119⤵PID:1872
-
\??\c:\3thbnn.exec:\3thbnn.exe120⤵PID:4296
-
\??\c:\1pjdv.exec:\1pjdv.exe121⤵PID:3544
-
\??\c:\rllxrrl.exec:\rllxrrl.exe122⤵PID:4972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-