Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:18
Behavioral task
behavioral1
Sample
afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe
-
Size
333KB
-
MD5
a0eb85e9d6df89a8fc4518fe28da4707
-
SHA1
5968e2d79f82b56d2d56c0ac24520aecf9c65abb
-
SHA256
afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392
-
SHA512
dba84fc36f880bb353058d68a32267e1d12e2b92164c4cd5dbf84efb835d450628eeb4dbe8c71b0ac55ca2eec92f39dc93b23558393e10c9b176602ce75a5798
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe8:R4wFHoSHYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2476-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/820-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1876-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/772-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2740-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1248-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-832-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-1241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 440 k40808.exe 1476 pvvpj.exe 4340 xfxrffr.exe 224 g0642.exe 3580 frlfxrl.exe 3404 c848260.exe 1328 1pjvj.exe 820 88866.exe 2356 6444422.exe 1656 5djdd.exe 2172 rlxxllr.exe 2100 0688268.exe 4808 bhnnbt.exe 800 480042.exe 4196 dvddd.exe 1904 0240004.exe 4948 628444.exe 3676 vppdp.exe 1876 8248888.exe 2800 nhbthb.exe 216 9vpjv.exe 1896 nnnhtn.exe 2628 7lxlfxl.exe 948 082082.exe 1960 nhbhtb.exe 4552 1pdpp.exe 1716 dvjvp.exe 1888 3pjdv.exe 4532 rlrfxrl.exe 3164 q88642.exe 412 tbhnhh.exe 1900 08626.exe 2764 w84826.exe 3984 hnbtnt.exe 452 9vpdv.exe 4852 c668000.exe 1660 htthtb.exe 1596 nbbthb.exe 2748 w28204.exe 4224 fxxlxrl.exe 772 6060826.exe 3372 e28848.exe 2496 846088.exe 3004 bnnnbh.exe 1828 s4664.exe 2024 82864.exe 624 i248604.exe 2516 bnhbnh.exe 464 9rrflfx.exe 4280 84480.exe 3764 q28260.exe 4204 0026486.exe 3616 9vdpj.exe 2740 5bnhth.exe 4000 1hhnhb.exe 2644 q02042.exe 4468 46860.exe 760 6044888.exe 3428 thbtnh.exe 4036 rrllxxf.exe 3980 vvdvv.exe 4120 22800.exe 4908 2460884.exe 228 m6264.exe -
resource yara_rule behavioral2/memory/2476-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023ba6-3.dat upx behavioral2/memory/2476-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c91-8.dat upx behavioral2/memory/440-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c96-13.dat upx behavioral2/memory/4340-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1476-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c97-20.dat upx behavioral2/memory/224-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c98-24.dat upx behavioral2/memory/3580-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c99-29.dat upx behavioral2/memory/3580-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9a-34.dat upx behavioral2/memory/3404-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9b-39.dat upx behavioral2/files/0x0007000000023c9c-44.dat upx behavioral2/memory/820-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9d-48.dat upx behavioral2/memory/2356-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9e-54.dat upx behavioral2/memory/2172-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c9f-58.dat upx behavioral2/files/0x0008000000023c92-62.dat upx behavioral2/memory/2100-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4808-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca2-67.dat upx behavioral2/files/0x0007000000023ca3-72.dat upx behavioral2/memory/4196-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca4-78.dat upx behavioral2/files/0x0007000000023ca5-82.dat upx behavioral2/memory/1904-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca6-86.dat upx behavioral2/files/0x0007000000023ca7-91.dat upx behavioral2/memory/1876-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca8-95.dat upx behavioral2/files/0x0007000000023ca9-99.dat upx behavioral2/files/0x0007000000023caa-103.dat upx behavioral2/memory/216-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cab-108.dat upx behavioral2/memory/1896-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cac-114.dat upx behavioral2/memory/2628-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cad-118.dat upx behavioral2/files/0x0007000000023cae-122.dat upx behavioral2/files/0x0007000000023caf-128.dat upx behavioral2/memory/1716-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4552-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1960-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb0-133.dat upx behavioral2/files/0x0007000000023cb1-138.dat upx behavioral2/memory/1888-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4532-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-142.dat upx behavioral2/memory/3164-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb3-149.dat upx behavioral2/files/0x0007000000023cb4-152.dat upx behavioral2/memory/1900-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2764-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3984-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1660-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2748-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4224-177-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0882606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 008422.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 268260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2022266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8028222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6486628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20608.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20208.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k84822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86608.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 440 2476 afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe 83 PID 2476 wrote to memory of 440 2476 afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe 83 PID 2476 wrote to memory of 440 2476 afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe 83 PID 440 wrote to memory of 1476 440 k40808.exe 84 PID 440 wrote to memory of 1476 440 k40808.exe 84 PID 440 wrote to memory of 1476 440 k40808.exe 84 PID 1476 wrote to memory of 4340 1476 pvvpj.exe 85 PID 1476 wrote to memory of 4340 1476 pvvpj.exe 85 PID 1476 wrote to memory of 4340 1476 pvvpj.exe 85 PID 4340 wrote to memory of 224 4340 xfxrffr.exe 86 PID 4340 wrote to memory of 224 4340 xfxrffr.exe 86 PID 4340 wrote to memory of 224 4340 xfxrffr.exe 86 PID 224 wrote to memory of 3580 224 g0642.exe 87 PID 224 wrote to memory of 3580 224 g0642.exe 87 PID 224 wrote to memory of 3580 224 g0642.exe 87 PID 3580 wrote to memory of 3404 3580 frlfxrl.exe 88 PID 3580 wrote to memory of 3404 3580 frlfxrl.exe 88 PID 3580 wrote to memory of 3404 3580 frlfxrl.exe 88 PID 3404 wrote to memory of 1328 3404 c848260.exe 89 PID 3404 wrote to memory of 1328 3404 c848260.exe 89 PID 3404 wrote to memory of 1328 3404 c848260.exe 89 PID 1328 wrote to memory of 820 1328 1pjvj.exe 90 PID 1328 wrote to memory of 820 1328 1pjvj.exe 90 PID 1328 wrote to memory of 820 1328 1pjvj.exe 90 PID 820 wrote to memory of 2356 820 88866.exe 91 PID 820 wrote to memory of 2356 820 88866.exe 91 PID 820 wrote to memory of 2356 820 88866.exe 91 PID 2356 wrote to memory of 1656 2356 6444422.exe 92 PID 2356 wrote to memory of 1656 2356 6444422.exe 92 PID 2356 wrote to memory of 1656 2356 6444422.exe 92 PID 1656 wrote to memory of 2172 1656 5djdd.exe 93 PID 1656 wrote to memory of 2172 1656 5djdd.exe 93 PID 1656 wrote to memory of 2172 1656 5djdd.exe 93 PID 2172 wrote to memory of 2100 2172 rlxxllr.exe 94 PID 2172 wrote to memory of 2100 2172 rlxxllr.exe 94 PID 2172 wrote to memory of 2100 2172 rlxxllr.exe 94 PID 2100 wrote to memory of 4808 2100 0688268.exe 95 PID 2100 wrote to memory of 4808 2100 0688268.exe 95 PID 2100 wrote to memory of 4808 2100 0688268.exe 95 PID 4808 wrote to memory of 800 4808 bhnnbt.exe 96 PID 4808 wrote to memory of 800 4808 bhnnbt.exe 96 PID 4808 wrote to memory of 800 4808 bhnnbt.exe 96 PID 800 wrote to memory of 4196 800 480042.exe 97 PID 800 wrote to memory of 4196 800 480042.exe 97 PID 800 wrote to memory of 4196 800 480042.exe 97 PID 4196 wrote to memory of 1904 4196 dvddd.exe 98 PID 4196 wrote to memory of 1904 4196 dvddd.exe 98 PID 4196 wrote to memory of 1904 4196 dvddd.exe 98 PID 1904 wrote to memory of 4948 1904 0240004.exe 99 PID 1904 wrote to memory of 4948 1904 0240004.exe 99 PID 1904 wrote to memory of 4948 1904 0240004.exe 99 PID 4948 wrote to memory of 3676 4948 628444.exe 100 PID 4948 wrote to memory of 3676 4948 628444.exe 100 PID 4948 wrote to memory of 3676 4948 628444.exe 100 PID 3676 wrote to memory of 1876 3676 vppdp.exe 101 PID 3676 wrote to memory of 1876 3676 vppdp.exe 101 PID 3676 wrote to memory of 1876 3676 vppdp.exe 101 PID 1876 wrote to memory of 2800 1876 8248888.exe 102 PID 1876 wrote to memory of 2800 1876 8248888.exe 102 PID 1876 wrote to memory of 2800 1876 8248888.exe 102 PID 2800 wrote to memory of 216 2800 nhbthb.exe 103 PID 2800 wrote to memory of 216 2800 nhbthb.exe 103 PID 2800 wrote to memory of 216 2800 nhbthb.exe 103 PID 216 wrote to memory of 1896 216 9vpjv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe"C:\Users\Admin\AppData\Local\Temp\afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\k40808.exec:\k40808.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\pvvpj.exec:\pvvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\xfxrffr.exec:\xfxrffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\g0642.exec:\g0642.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\frlfxrl.exec:\frlfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\c848260.exec:\c848260.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\1pjvj.exec:\1pjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\88866.exec:\88866.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\6444422.exec:\6444422.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\5djdd.exec:\5djdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\rlxxllr.exec:\rlxxllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\0688268.exec:\0688268.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\bhnnbt.exec:\bhnnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\480042.exec:\480042.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\dvddd.exec:\dvddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\0240004.exec:\0240004.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\628444.exec:\628444.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\vppdp.exec:\vppdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\8248888.exec:\8248888.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\nhbthb.exec:\nhbthb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\9vpjv.exec:\9vpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\nnnhtn.exec:\nnnhtn.exe23⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7lxlfxl.exec:\7lxlfxl.exe24⤵
- Executes dropped EXE
PID:2628 -
\??\c:\082082.exec:\082082.exe25⤵
- Executes dropped EXE
PID:948 -
\??\c:\nhbhtb.exec:\nhbhtb.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1pdpp.exec:\1pdpp.exe27⤵
- Executes dropped EXE
PID:4552 -
\??\c:\dvjvp.exec:\dvjvp.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3pjdv.exec:\3pjdv.exe29⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rlrfxrl.exec:\rlrfxrl.exe30⤵
- Executes dropped EXE
PID:4532 -
\??\c:\q88642.exec:\q88642.exe31⤵
- Executes dropped EXE
PID:3164 -
\??\c:\tbhnhh.exec:\tbhnhh.exe32⤵
- Executes dropped EXE
PID:412 -
\??\c:\08626.exec:\08626.exe33⤵
- Executes dropped EXE
PID:1900 -
\??\c:\w84826.exec:\w84826.exe34⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hnbtnt.exec:\hnbtnt.exe35⤵
- Executes dropped EXE
PID:3984 -
\??\c:\9vpdv.exec:\9vpdv.exe36⤵
- Executes dropped EXE
PID:452 -
\??\c:\c668000.exec:\c668000.exe37⤵
- Executes dropped EXE
PID:4852 -
\??\c:\htthtb.exec:\htthtb.exe38⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nbbthb.exec:\nbbthb.exe39⤵
- Executes dropped EXE
PID:1596 -
\??\c:\w28204.exec:\w28204.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\fxxlxrl.exec:\fxxlxrl.exe41⤵
- Executes dropped EXE
PID:4224 -
\??\c:\6060826.exec:\6060826.exe42⤵
- Executes dropped EXE
PID:772 -
\??\c:\e28848.exec:\e28848.exe43⤵
- Executes dropped EXE
PID:3372 -
\??\c:\846088.exec:\846088.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bnnnbh.exec:\bnnnbh.exe45⤵
- Executes dropped EXE
PID:3004 -
\??\c:\s4664.exec:\s4664.exe46⤵
- Executes dropped EXE
PID:1828 -
\??\c:\82864.exec:\82864.exe47⤵
- Executes dropped EXE
PID:2024 -
\??\c:\i248604.exec:\i248604.exe48⤵
- Executes dropped EXE
PID:624 -
\??\c:\bnhbnh.exec:\bnhbnh.exe49⤵
- Executes dropped EXE
PID:2516 -
\??\c:\9rrflfx.exec:\9rrflfx.exe50⤵
- Executes dropped EXE
PID:464 -
\??\c:\84480.exec:\84480.exe51⤵
- Executes dropped EXE
PID:4280 -
\??\c:\q28260.exec:\q28260.exe52⤵
- Executes dropped EXE
PID:3764 -
\??\c:\0026486.exec:\0026486.exe53⤵
- Executes dropped EXE
PID:4204 -
\??\c:\9vdpj.exec:\9vdpj.exe54⤵
- Executes dropped EXE
PID:3616 -
\??\c:\5bnhth.exec:\5bnhth.exe55⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1hhnhb.exec:\1hhnhb.exe56⤵
- Executes dropped EXE
PID:4000 -
\??\c:\q02042.exec:\q02042.exe57⤵
- Executes dropped EXE
PID:2644 -
\??\c:\46860.exec:\46860.exe58⤵
- Executes dropped EXE
PID:4468 -
\??\c:\6044888.exec:\6044888.exe59⤵
- Executes dropped EXE
PID:760 -
\??\c:\thbtnh.exec:\thbtnh.exe60⤵
- Executes dropped EXE
PID:3428 -
\??\c:\rrllxxf.exec:\rrllxxf.exe61⤵
- Executes dropped EXE
PID:4036 -
\??\c:\vvdvv.exec:\vvdvv.exe62⤵
- Executes dropped EXE
PID:3980 -
\??\c:\22800.exec:\22800.exe63⤵
- Executes dropped EXE
PID:4120 -
\??\c:\2460884.exec:\2460884.exe64⤵
- Executes dropped EXE
PID:4908 -
\??\c:\m6264.exec:\m6264.exe65⤵
- Executes dropped EXE
PID:228 -
\??\c:\06608.exec:\06608.exe66⤵PID:4712
-
\??\c:\1jdvp.exec:\1jdvp.exe67⤵PID:2384
-
\??\c:\206648.exec:\206648.exe68⤵PID:1720
-
\??\c:\624040.exec:\624040.exe69⤵PID:1248
-
\??\c:\8860488.exec:\8860488.exe70⤵PID:4016
-
\??\c:\02460.exec:\02460.exe71⤵PID:1368
-
\??\c:\thhnth.exec:\thhnth.exe72⤵PID:1328
-
\??\c:\4840444.exec:\4840444.exe73⤵PID:4364
-
\??\c:\1jppv.exec:\1jppv.exe74⤵PID:5096
-
\??\c:\0644664.exec:\0644664.exe75⤵PID:2356
-
\??\c:\00608.exec:\00608.exe76⤵PID:3264
-
\??\c:\200240.exec:\200240.exe77⤵PID:2172
-
\??\c:\g4624.exec:\g4624.exe78⤵PID:3688
-
\??\c:\5pdvd.exec:\5pdvd.exe79⤵
- System Location Discovery: System Language Discovery
PID:1968 -
\??\c:\dpjvj.exec:\dpjvj.exe80⤵PID:2452
-
\??\c:\frfrxxl.exec:\frfrxxl.exe81⤵
- System Location Discovery: System Language Discovery
PID:3856 -
\??\c:\w26806.exec:\w26806.exe82⤵PID:1156
-
\??\c:\088648.exec:\088648.exe83⤵PID:4196
-
\??\c:\6460666.exec:\6460666.exe84⤵PID:2112
-
\??\c:\2048266.exec:\2048266.exe85⤵PID:4948
-
\??\c:\m6488.exec:\m6488.exe86⤵PID:724
-
\??\c:\026624.exec:\026624.exe87⤵PID:1528
-
\??\c:\hbhbbn.exec:\hbhbbn.exe88⤵PID:3472
-
\??\c:\60628.exec:\60628.exe89⤵PID:1356
-
\??\c:\hbtnhb.exec:\hbtnhb.exe90⤵PID:3504
-
\??\c:\640426.exec:\640426.exe91⤵
- System Location Discovery: System Language Discovery
PID:752 -
\??\c:\3pvdv.exec:\3pvdv.exe92⤵PID:1896
-
\??\c:\djvdj.exec:\djvdj.exe93⤵PID:4360
-
\??\c:\1ddvv.exec:\1ddvv.exe94⤵PID:3736
-
\??\c:\6820486.exec:\6820486.exe95⤵PID:4828
-
\??\c:\pvpjd.exec:\pvpjd.exe96⤵PID:1960
-
\??\c:\28486.exec:\28486.exe97⤵PID:4660
-
\??\c:\42042.exec:\42042.exe98⤵PID:1652
-
\??\c:\44420.exec:\44420.exe99⤵PID:2780
-
\??\c:\42608.exec:\42608.exe100⤵PID:1044
-
\??\c:\nbbnnh.exec:\nbbnnh.exe101⤵PID:2904
-
\??\c:\26828.exec:\26828.exe102⤵PID:1216
-
\??\c:\066648.exec:\066648.exe103⤵PID:2236
-
\??\c:\1ttnbb.exec:\1ttnbb.exe104⤵PID:628
-
\??\c:\600420.exec:\600420.exe105⤵PID:2764
-
\??\c:\w08888.exec:\w08888.exe106⤵PID:1292
-
\??\c:\066088.exec:\066088.exe107⤵PID:756
-
\??\c:\9tbtnt.exec:\9tbtnt.exe108⤵PID:3368
-
\??\c:\8848608.exec:\8848608.exe109⤵PID:640
-
\??\c:\86608.exec:\86608.exe110⤵
- System Location Discovery: System Language Discovery
PID:3140 -
\??\c:\884266.exec:\884266.exe111⤵PID:2760
-
\??\c:\668866.exec:\668866.exe112⤵PID:2224
-
\??\c:\88420.exec:\88420.exe113⤵PID:1160
-
\??\c:\22264.exec:\22264.exe114⤵PID:1196
-
\??\c:\4442048.exec:\4442048.exe115⤵PID:1436
-
\??\c:\868862.exec:\868862.exe116⤵PID:4760
-
\??\c:\1bbthh.exec:\1bbthh.exe117⤵PID:1372
-
\??\c:\nnnhbb.exec:\nnnhbb.exe118⤵PID:3000
-
\??\c:\tbbnbt.exec:\tbbnbt.exe119⤵
- System Location Discovery: System Language Discovery
PID:5012 -
\??\c:\008422.exec:\008422.exe120⤵
- System Location Discovery: System Language Discovery
PID:684 -
\??\c:\846604.exec:\846604.exe121⤵PID:3124
-
\??\c:\3nnbtn.exec:\3nnbtn.exe122⤵PID:4048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-