Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe
-
Size
455KB
-
MD5
5505c6c7744fdf3d51ed2b92d1059570
-
SHA1
c6bebe2c38f8f154042492afaf8302ccea46e621
-
SHA256
a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58
-
SHA512
22b88597cadcb10c3d2e1f4d56aaf68ee8aab042cf8f033bde1061154827aa90e2f98476854f9d013240a053ffb0aa735c6db4b2b3c64cf91b19daf4945fce9d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4376-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/728-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-786-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-906-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-1453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-1472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-1758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4724 pvpjj.exe 4028 rrffxrf.exe 4572 rflffrr.exe 1788 lrllxxr.exe 232 vpppp.exe 4996 hbhbbb.exe 3216 lflfxfx.exe 1424 9pvvp.exe 4900 btbbtb.exe 244 flxrlll.exe 4784 9jjvj.exe 1036 rfflxfx.exe 3332 nhtnnn.exe 1952 hbtntt.exe 1068 tnttnn.exe 4056 ddddj.exe 2004 xlfrrxr.exe 4508 dvvvv.exe 1780 bnbbhn.exe 2436 lxrxrlx.exe 3620 djpvv.exe 4296 tnbhbh.exe 1168 vpjjv.exe 3348 lflffxx.exe 4828 ttbbbh.exe 4472 xlrfflx.exe 2740 lfxrxxx.exe 4624 fffxffr.exe 3296 vddvv.exe 4792 nbhhhh.exe 2268 7bbthn.exe 2872 rrrrrrr.exe 1860 5btttt.exe 4924 9jjjd.exe 1752 rllxrlf.exe 380 ttbbbb.exe 2264 pjvvv.exe 740 9dddd.exe 2272 fxllllr.exe 1636 htbbtt.exe 2976 jvjdd.exe 3940 fffllll.exe 2064 hbbbbb.exe 3540 ddddd.exe 384 7jppd.exe 3992 rxxrrrr.exe 376 bttttt.exe 4856 vjjjd.exe 4260 xffrffx.exe 4248 7lxxlrf.exe 1308 hhnhnn.exe 4436 jpppj.exe 4148 frlfxxl.exe 2696 bbbtth.exe 4692 1dddj.exe 2088 pdjjj.exe 3828 rrxxxxx.exe 1616 ntbthn.exe 2856 vvppj.exe 3316 flfflxx.exe 3200 bbhhbb.exe 2592 bnttnn.exe 3684 vvddd.exe 4876 1flfxfx.exe -
resource yara_rule behavioral2/memory/4376-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/728-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-906-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 4724 4376 a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe 83 PID 4376 wrote to memory of 4724 4376 a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe 83 PID 4376 wrote to memory of 4724 4376 a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe 83 PID 4724 wrote to memory of 4028 4724 pvpjj.exe 84 PID 4724 wrote to memory of 4028 4724 pvpjj.exe 84 PID 4724 wrote to memory of 4028 4724 pvpjj.exe 84 PID 4028 wrote to memory of 4572 4028 rrffxrf.exe 85 PID 4028 wrote to memory of 4572 4028 rrffxrf.exe 85 PID 4028 wrote to memory of 4572 4028 rrffxrf.exe 85 PID 4572 wrote to memory of 1788 4572 rflffrr.exe 86 PID 4572 wrote to memory of 1788 4572 rflffrr.exe 86 PID 4572 wrote to memory of 1788 4572 rflffrr.exe 86 PID 1788 wrote to memory of 232 1788 lrllxxr.exe 87 PID 1788 wrote to memory of 232 1788 lrllxxr.exe 87 PID 1788 wrote to memory of 232 1788 lrllxxr.exe 87 PID 232 wrote to memory of 4996 232 vpppp.exe 88 PID 232 wrote to memory of 4996 232 vpppp.exe 88 PID 232 wrote to memory of 4996 232 vpppp.exe 88 PID 4996 wrote to memory of 3216 4996 hbhbbb.exe 89 PID 4996 wrote to memory of 3216 4996 hbhbbb.exe 89 PID 4996 wrote to memory of 3216 4996 hbhbbb.exe 89 PID 3216 wrote to memory of 1424 3216 lflfxfx.exe 90 PID 3216 wrote to memory of 1424 3216 lflfxfx.exe 90 PID 3216 wrote to memory of 1424 3216 lflfxfx.exe 90 PID 1424 wrote to memory of 4900 1424 9pvvp.exe 91 PID 1424 wrote to memory of 4900 1424 9pvvp.exe 91 PID 1424 wrote to memory of 4900 1424 9pvvp.exe 91 PID 4900 wrote to memory of 244 4900 btbbtb.exe 92 PID 4900 wrote to memory of 244 4900 btbbtb.exe 92 PID 4900 wrote to memory of 244 4900 btbbtb.exe 92 PID 244 wrote to memory of 4784 244 flxrlll.exe 93 PID 244 wrote to memory of 4784 244 flxrlll.exe 93 PID 244 wrote to memory of 4784 244 flxrlll.exe 93 PID 4784 wrote to memory of 1036 4784 9jjvj.exe 94 PID 4784 wrote to memory of 1036 4784 9jjvj.exe 94 PID 4784 wrote to memory of 1036 4784 9jjvj.exe 94 PID 1036 wrote to memory of 3332 1036 rfflxfx.exe 95 PID 1036 wrote to memory of 3332 1036 rfflxfx.exe 95 PID 1036 wrote to memory of 3332 1036 rfflxfx.exe 95 PID 3332 wrote to memory of 1952 3332 nhtnnn.exe 96 PID 3332 wrote to memory of 1952 3332 nhtnnn.exe 96 PID 3332 wrote to memory of 1952 3332 nhtnnn.exe 96 PID 1952 wrote to memory of 1068 1952 hbtntt.exe 97 PID 1952 wrote to memory of 1068 1952 hbtntt.exe 97 PID 1952 wrote to memory of 1068 1952 hbtntt.exe 97 PID 1068 wrote to memory of 4056 1068 tnttnn.exe 98 PID 1068 wrote to memory of 4056 1068 tnttnn.exe 98 PID 1068 wrote to memory of 4056 1068 tnttnn.exe 98 PID 4056 wrote to memory of 2004 4056 ddddj.exe 99 PID 4056 wrote to memory of 2004 4056 ddddj.exe 99 PID 4056 wrote to memory of 2004 4056 ddddj.exe 99 PID 2004 wrote to memory of 4508 2004 xlfrrxr.exe 100 PID 2004 wrote to memory of 4508 2004 xlfrrxr.exe 100 PID 2004 wrote to memory of 4508 2004 xlfrrxr.exe 100 PID 4508 wrote to memory of 1780 4508 dvvvv.exe 101 PID 4508 wrote to memory of 1780 4508 dvvvv.exe 101 PID 4508 wrote to memory of 1780 4508 dvvvv.exe 101 PID 1780 wrote to memory of 2436 1780 bnbbhn.exe 102 PID 1780 wrote to memory of 2436 1780 bnbbhn.exe 102 PID 1780 wrote to memory of 2436 1780 bnbbhn.exe 102 PID 2436 wrote to memory of 3620 2436 lxrxrlx.exe 103 PID 2436 wrote to memory of 3620 2436 lxrxrlx.exe 103 PID 2436 wrote to memory of 3620 2436 lxrxrlx.exe 103 PID 3620 wrote to memory of 4296 3620 djpvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe"C:\Users\Admin\AppData\Local\Temp\a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\pvpjj.exec:\pvpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\rrffxrf.exec:\rrffxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\rflffrr.exec:\rflffrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\lrllxxr.exec:\lrllxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\vpppp.exec:\vpppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\hbhbbb.exec:\hbhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\lflfxfx.exec:\lflfxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\9pvvp.exec:\9pvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\btbbtb.exec:\btbbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\flxrlll.exec:\flxrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\9jjvj.exec:\9jjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\rfflxfx.exec:\rfflxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\nhtnnn.exec:\nhtnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\hbtntt.exec:\hbtntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\tnttnn.exec:\tnttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\ddddj.exec:\ddddj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\xlfrrxr.exec:\xlfrrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\dvvvv.exec:\dvvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\bnbbhn.exec:\bnbbhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\lxrxrlx.exec:\lxrxrlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\djpvv.exec:\djpvv.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\tnbhbh.exec:\tnbhbh.exe23⤵
- Executes dropped EXE
PID:4296 -
\??\c:\vpjjv.exec:\vpjjv.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lflffxx.exec:\lflffxx.exe25⤵
- Executes dropped EXE
PID:3348 -
\??\c:\ttbbbh.exec:\ttbbbh.exe26⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xlrfflx.exec:\xlrfflx.exe27⤵
- Executes dropped EXE
PID:4472 -
\??\c:\lfxrxxx.exec:\lfxrxxx.exe28⤵
- Executes dropped EXE
PID:2740 -
\??\c:\fffxffr.exec:\fffxffr.exe29⤵
- Executes dropped EXE
PID:4624 -
\??\c:\vddvv.exec:\vddvv.exe30⤵
- Executes dropped EXE
PID:3296 -
\??\c:\nbhhhh.exec:\nbhhhh.exe31⤵
- Executes dropped EXE
PID:4792 -
\??\c:\7bbthn.exec:\7bbthn.exe32⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe33⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5btttt.exec:\5btttt.exe34⤵
- Executes dropped EXE
PID:1860 -
\??\c:\9jjjd.exec:\9jjjd.exe35⤵
- Executes dropped EXE
PID:4924 -
\??\c:\rllxrlf.exec:\rllxrlf.exe36⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ttbbbb.exec:\ttbbbb.exe37⤵
- Executes dropped EXE
PID:380 -
\??\c:\pjvvv.exec:\pjvvv.exe38⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9dddd.exec:\9dddd.exe39⤵
- Executes dropped EXE
PID:740 -
\??\c:\fxllllr.exec:\fxllllr.exe40⤵
- Executes dropped EXE
PID:2272 -
\??\c:\htbbtt.exec:\htbbtt.exe41⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jvjdd.exec:\jvjdd.exe42⤵
- Executes dropped EXE
PID:2976 -
\??\c:\fffllll.exec:\fffllll.exe43⤵
- Executes dropped EXE
PID:3940 -
\??\c:\hbbbbb.exec:\hbbbbb.exe44⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ddddd.exec:\ddddd.exe45⤵
- Executes dropped EXE
PID:3540 -
\??\c:\7jppd.exec:\7jppd.exe46⤵
- Executes dropped EXE
PID:384 -
\??\c:\rxxrrrr.exec:\rxxrrrr.exe47⤵
- Executes dropped EXE
PID:3992 -
\??\c:\bttttt.exec:\bttttt.exe48⤵
- Executes dropped EXE
PID:376 -
\??\c:\vjjjd.exec:\vjjjd.exe49⤵
- Executes dropped EXE
PID:4856 -
\??\c:\xffrffx.exec:\xffrffx.exe50⤵
- Executes dropped EXE
PID:4260 -
\??\c:\7lxxlrf.exec:\7lxxlrf.exe51⤵
- Executes dropped EXE
PID:4248 -
\??\c:\hhnhnn.exec:\hhnhnn.exe52⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jpppj.exec:\jpppj.exe53⤵
- Executes dropped EXE
PID:4436 -
\??\c:\frlfxxl.exec:\frlfxxl.exe54⤵
- Executes dropped EXE
PID:4148 -
\??\c:\bbbtth.exec:\bbbtth.exe55⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1dddj.exec:\1dddj.exe56⤵
- Executes dropped EXE
PID:4692 -
\??\c:\pdjjj.exec:\pdjjj.exe57⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe58⤵
- Executes dropped EXE
PID:3828 -
\??\c:\ntbthn.exec:\ntbthn.exe59⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vvppj.exec:\vvppj.exe60⤵
- Executes dropped EXE
PID:2856 -
\??\c:\flfflxx.exec:\flfflxx.exe61⤵
- Executes dropped EXE
PID:3316 -
\??\c:\bbhhbb.exec:\bbhhbb.exe62⤵
- Executes dropped EXE
PID:3200 -
\??\c:\bnttnn.exec:\bnttnn.exe63⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vvddd.exec:\vvddd.exe64⤵
- Executes dropped EXE
PID:3684 -
\??\c:\1flfxfx.exec:\1flfxfx.exe65⤵
- Executes dropped EXE
PID:4876 -
\??\c:\3hhhhh.exec:\3hhhhh.exe66⤵PID:2824
-
\??\c:\nbnhhh.exec:\nbnhhh.exe67⤵PID:4784
-
\??\c:\vpppv.exec:\vpppv.exe68⤵PID:1028
-
\??\c:\frfllrf.exec:\frfllrf.exe69⤵PID:3132
-
\??\c:\bnttth.exec:\bnttth.exe70⤵PID:1572
-
\??\c:\nntthn.exec:\nntthn.exe71⤵PID:1068
-
\??\c:\1pvpp.exec:\1pvpp.exe72⤵PID:4372
-
\??\c:\1lrlxxr.exec:\1lrlxxr.exe73⤵PID:2496
-
\??\c:\bttnnh.exec:\bttnnh.exe74⤵PID:4196
-
\??\c:\bbhhhn.exec:\bbhhhn.exe75⤵PID:1440
-
\??\c:\vjpjd.exec:\vjpjd.exe76⤵PID:3824
-
\??\c:\rlffxxx.exec:\rlffxxx.exe77⤵PID:3420
-
\??\c:\bhbtnt.exec:\bhbtnt.exe78⤵PID:2184
-
\??\c:\jjvvj.exec:\jjvvj.exe79⤵PID:4788
-
\??\c:\ppdvv.exec:\ppdvv.exe80⤵PID:4432
-
\??\c:\fxffxxr.exec:\fxffxxr.exe81⤵PID:1196
-
\??\c:\hhnhbb.exec:\hhnhbb.exe82⤵PID:2084
-
\??\c:\ddppp.exec:\ddppp.exe83⤵PID:3212
-
\??\c:\frfffff.exec:\frfffff.exe84⤵PID:3956
-
\??\c:\nnnnhn.exec:\nnnnhn.exe85⤵
- System Location Discovery: System Language Discovery
PID:728 -
\??\c:\jjdjv.exec:\jjdjv.exe86⤵PID:4916
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe87⤵PID:3864
-
\??\c:\tbntnn.exec:\tbntnn.exe88⤵PID:3464
-
\??\c:\vppjd.exec:\vppjd.exe89⤵PID:3576
-
\??\c:\fflllll.exec:\fflllll.exe90⤵
- System Location Discovery: System Language Discovery
PID:3296 -
\??\c:\7bhbtt.exec:\7bhbtt.exe91⤵PID:4936
-
\??\c:\7thbtt.exec:\7thbtt.exe92⤵PID:2724
-
\??\c:\ddddv.exec:\ddddv.exe93⤵PID:1060
-
\??\c:\lllflfx.exec:\lllflfx.exe94⤵PID:3256
-
\??\c:\thttnn.exec:\thttnn.exe95⤵PID:448
-
\??\c:\vvddd.exec:\vvddd.exe96⤵PID:4388
-
\??\c:\frxxxrl.exec:\frxxxrl.exe97⤵PID:4200
-
\??\c:\ffffllf.exec:\ffffllf.exe98⤵PID:4512
-
\??\c:\nnbthn.exec:\nnbthn.exe99⤵PID:4888
-
\??\c:\dvvdj.exec:\dvvdj.exe100⤵PID:2428
-
\??\c:\rxrrfff.exec:\rxrrfff.exe101⤵PID:2964
-
\??\c:\xfxrrrr.exec:\xfxrrrr.exe102⤵PID:4068
-
\??\c:\hbnhnn.exec:\hbnhnn.exe103⤵PID:4060
-
\??\c:\vvddd.exec:\vvddd.exe104⤵PID:3124
-
\??\c:\xflflrr.exec:\xflflrr.exe105⤵PID:2544
-
\??\c:\7bhbbn.exec:\7bhbbn.exe106⤵PID:1292
-
\??\c:\pdddj.exec:\pdddj.exe107⤵PID:4804
-
\??\c:\frxllll.exec:\frxllll.exe108⤵PID:3992
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe109⤵PID:3324
-
\??\c:\tntthn.exec:\tntthn.exe110⤵PID:4264
-
\??\c:\1dvvd.exec:\1dvvd.exe111⤵PID:3920
-
\??\c:\jdjjj.exec:\jdjjj.exe112⤵PID:2212
-
\??\c:\9lxfxrx.exec:\9lxfxrx.exe113⤵PID:4976
-
\??\c:\hhnhhh.exec:\hhnhhh.exe114⤵PID:224
-
\??\c:\nbhntn.exec:\nbhntn.exe115⤵PID:3708
-
\??\c:\5pvvp.exec:\5pvvp.exe116⤵PID:4848
-
\??\c:\xrxxlrl.exec:\xrxxlrl.exe117⤵PID:3424
-
\??\c:\tnnbbh.exec:\tnnbbh.exe118⤵PID:112
-
\??\c:\ddjdv.exec:\ddjdv.exe119⤵PID:4152
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe120⤵PID:4448
-
\??\c:\lrllxxr.exec:\lrllxxr.exe121⤵PID:464
-
\??\c:\nnbtnn.exec:\nnbtnn.exe122⤵PID:2716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-