Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 08:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe
-
Size
456KB
-
MD5
9a65aae4fa9eac71cae2710f281e08c6
-
SHA1
a24dac08a2860bc9a1a134248b2fbc9a10b1e7c3
-
SHA256
ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e
-
SHA512
54c91ef3e420a449692556f35d2d04f9da79850442c17bb267216614eb58971182fe59ee9969cd0525170bece10934d3562f660562d9e3788d47c57216b17efb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRZ:q7Tc2NYHUrAwfMp3CDRZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4720-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/984-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-819-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-856-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-1246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-1510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2092 pjpdv.exe 512 3nhhtn.exe 1544 vdvpj.exe 1036 rrxfxrf.exe 3432 frfxlfx.exe 984 1jpjv.exe 1224 rxxlxrl.exe 1172 htnbnb.exe 116 pppvv.exe 4336 bntbtb.exe 3680 jvddd.exe 3576 xrfxrlf.exe 2460 vdvvp.exe 3600 djppj.exe 2680 lfrxrrr.exe 4884 thnhnb.exe 4820 rllrlfl.exe 4752 jvdvp.exe 4880 bhbtnn.exe 2728 5vpdp.exe 2676 rflxlfr.exe 1384 5jjdv.exe 3168 xllfxrl.exe 3676 fffxlxr.exe 2236 ntbnbt.exe 392 dpjpj.exe 2496 9lffxfx.exe 4592 tnthbn.exe 3268 rrrrffr.exe 4732 3bbbbb.exe 3284 pjppj.exe 4780 lxrllrr.exe 2588 3thhbt.exe 4956 xlffrrf.exe 3392 rlrlrrr.exe 3880 jdddd.exe 1848 bnbtbt.exe 4888 1djdv.exe 3656 djjdd.exe 812 3flfxfl.exe 4844 htbttt.exe 4360 dpdvd.exe 2500 jdjjd.exe 1808 rrrrlrr.exe 4272 tbbbtn.exe 3144 btnbtn.exe 5008 dpjvv.exe 4720 rrlfxxx.exe 2092 9ttnnt.exe 4604 3hnnhh.exe 4800 vvjdj.exe 5040 ffrllrr.exe 2956 hthbtt.exe 3928 ddjjj.exe 2980 pjvpv.exe 4656 rrllflf.exe 4528 bbtnht.exe 3140 9jjdv.exe 2936 vjjjj.exe 3940 7bhnnn.exe 1044 ppjdd.exe 1060 jdjdv.exe 1984 9rxxrrr.exe 4952 bttbtn.exe -
resource yara_rule behavioral2/memory/4720-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/984-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-731-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4720 wrote to memory of 2092 4720 ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe 84 PID 4720 wrote to memory of 2092 4720 ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe 84 PID 4720 wrote to memory of 2092 4720 ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe 84 PID 2092 wrote to memory of 512 2092 pjpdv.exe 85 PID 2092 wrote to memory of 512 2092 pjpdv.exe 85 PID 2092 wrote to memory of 512 2092 pjpdv.exe 85 PID 512 wrote to memory of 1544 512 3nhhtn.exe 86 PID 512 wrote to memory of 1544 512 3nhhtn.exe 86 PID 512 wrote to memory of 1544 512 3nhhtn.exe 86 PID 1544 wrote to memory of 1036 1544 vdvpj.exe 87 PID 1544 wrote to memory of 1036 1544 vdvpj.exe 87 PID 1544 wrote to memory of 1036 1544 vdvpj.exe 87 PID 1036 wrote to memory of 3432 1036 rrxfxrf.exe 88 PID 1036 wrote to memory of 3432 1036 rrxfxrf.exe 88 PID 1036 wrote to memory of 3432 1036 rrxfxrf.exe 88 PID 3432 wrote to memory of 984 3432 frfxlfx.exe 89 PID 3432 wrote to memory of 984 3432 frfxlfx.exe 89 PID 3432 wrote to memory of 984 3432 frfxlfx.exe 89 PID 984 wrote to memory of 1224 984 1jpjv.exe 90 PID 984 wrote to memory of 1224 984 1jpjv.exe 90 PID 984 wrote to memory of 1224 984 1jpjv.exe 90 PID 1224 wrote to memory of 1172 1224 rxxlxrl.exe 91 PID 1224 wrote to memory of 1172 1224 rxxlxrl.exe 91 PID 1224 wrote to memory of 1172 1224 rxxlxrl.exe 91 PID 1172 wrote to memory of 116 1172 htnbnb.exe 92 PID 1172 wrote to memory of 116 1172 htnbnb.exe 92 PID 1172 wrote to memory of 116 1172 htnbnb.exe 92 PID 116 wrote to memory of 4336 116 pppvv.exe 93 PID 116 wrote to memory of 4336 116 pppvv.exe 93 PID 116 wrote to memory of 4336 116 pppvv.exe 93 PID 4336 wrote to memory of 3680 4336 bntbtb.exe 94 PID 4336 wrote to memory of 3680 4336 bntbtb.exe 94 PID 4336 wrote to memory of 3680 4336 bntbtb.exe 94 PID 3680 wrote to memory of 3576 3680 jvddd.exe 95 PID 3680 wrote to memory of 3576 3680 jvddd.exe 95 PID 3680 wrote to memory of 3576 3680 jvddd.exe 95 PID 3576 wrote to memory of 2460 3576 xrfxrlf.exe 96 PID 3576 wrote to memory of 2460 3576 xrfxrlf.exe 96 PID 3576 wrote to memory of 2460 3576 xrfxrlf.exe 96 PID 2460 wrote to memory of 3600 2460 vdvvp.exe 97 PID 2460 wrote to memory of 3600 2460 vdvvp.exe 97 PID 2460 wrote to memory of 3600 2460 vdvvp.exe 97 PID 3600 wrote to memory of 2680 3600 djppj.exe 98 PID 3600 wrote to memory of 2680 3600 djppj.exe 98 PID 3600 wrote to memory of 2680 3600 djppj.exe 98 PID 2680 wrote to memory of 4884 2680 lfrxrrr.exe 99 PID 2680 wrote to memory of 4884 2680 lfrxrrr.exe 99 PID 2680 wrote to memory of 4884 2680 lfrxrrr.exe 99 PID 4884 wrote to memory of 4820 4884 thnhnb.exe 100 PID 4884 wrote to memory of 4820 4884 thnhnb.exe 100 PID 4884 wrote to memory of 4820 4884 thnhnb.exe 100 PID 4820 wrote to memory of 4752 4820 rllrlfl.exe 101 PID 4820 wrote to memory of 4752 4820 rllrlfl.exe 101 PID 4820 wrote to memory of 4752 4820 rllrlfl.exe 101 PID 4752 wrote to memory of 4880 4752 jvdvp.exe 102 PID 4752 wrote to memory of 4880 4752 jvdvp.exe 102 PID 4752 wrote to memory of 4880 4752 jvdvp.exe 102 PID 4880 wrote to memory of 2728 4880 bhbtnn.exe 103 PID 4880 wrote to memory of 2728 4880 bhbtnn.exe 103 PID 4880 wrote to memory of 2728 4880 bhbtnn.exe 103 PID 2728 wrote to memory of 2676 2728 5vpdp.exe 104 PID 2728 wrote to memory of 2676 2728 5vpdp.exe 104 PID 2728 wrote to memory of 2676 2728 5vpdp.exe 104 PID 2676 wrote to memory of 1384 2676 rflxlfr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe"C:\Users\Admin\AppData\Local\Temp\ad12f01e744c964845b74500d3845a41a8cc897808037b5e76996a685f2e2c2e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\pjpdv.exec:\pjpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\3nhhtn.exec:\3nhhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\vdvpj.exec:\vdvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\rrxfxrf.exec:\rrxfxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\frfxlfx.exec:\frfxlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\1jpjv.exec:\1jpjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\htnbnb.exec:\htnbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\pppvv.exec:\pppvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\bntbtb.exec:\bntbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\jvddd.exec:\jvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\vdvvp.exec:\vdvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\djppj.exec:\djppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\lfrxrrr.exec:\lfrxrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\thnhnb.exec:\thnhnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\rllrlfl.exec:\rllrlfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\jvdvp.exec:\jvdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\bhbtnn.exec:\bhbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\5vpdp.exec:\5vpdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rflxlfr.exec:\rflxlfr.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\5jjdv.exec:\5jjdv.exe23⤵
- Executes dropped EXE
PID:1384 -
\??\c:\xllfxrl.exec:\xllfxrl.exe24⤵
- Executes dropped EXE
PID:3168 -
\??\c:\fffxlxr.exec:\fffxlxr.exe25⤵
- Executes dropped EXE
PID:3676 -
\??\c:\ntbnbt.exec:\ntbnbt.exe26⤵
- Executes dropped EXE
PID:2236 -
\??\c:\dpjpj.exec:\dpjpj.exe27⤵
- Executes dropped EXE
PID:392 -
\??\c:\9lffxfx.exec:\9lffxfx.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tnthbn.exec:\tnthbn.exe29⤵
- Executes dropped EXE
PID:4592 -
\??\c:\rrrrffr.exec:\rrrrffr.exe30⤵
- Executes dropped EXE
PID:3268 -
\??\c:\3bbbbb.exec:\3bbbbb.exe31⤵
- Executes dropped EXE
PID:4732 -
\??\c:\pjppj.exec:\pjppj.exe32⤵
- Executes dropped EXE
PID:3284 -
\??\c:\lxrllrr.exec:\lxrllrr.exe33⤵
- Executes dropped EXE
PID:4780 -
\??\c:\3thhbt.exec:\3thhbt.exe34⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xlffrrf.exec:\xlffrrf.exe35⤵
- Executes dropped EXE
PID:4956 -
\??\c:\rlrlrrr.exec:\rlrlrrr.exe36⤵
- Executes dropped EXE
PID:3392 -
\??\c:\jdddd.exec:\jdddd.exe37⤵
- Executes dropped EXE
PID:3880 -
\??\c:\bnbtbt.exec:\bnbtbt.exe38⤵
- Executes dropped EXE
PID:1848 -
\??\c:\1djdv.exec:\1djdv.exe39⤵
- Executes dropped EXE
PID:4888 -
\??\c:\djjdd.exec:\djjdd.exe40⤵
- Executes dropped EXE
PID:3656 -
\??\c:\3flfxfl.exec:\3flfxfl.exe41⤵
- Executes dropped EXE
PID:812 -
\??\c:\htbttt.exec:\htbttt.exe42⤵
- Executes dropped EXE
PID:4844 -
\??\c:\dpdvd.exec:\dpdvd.exe43⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jdjjd.exec:\jdjjd.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe45⤵
- Executes dropped EXE
PID:1808 -
\??\c:\tbbbtn.exec:\tbbbtn.exe46⤵
- Executes dropped EXE
PID:4272 -
\??\c:\btnbtn.exec:\btnbtn.exe47⤵
- Executes dropped EXE
PID:3144 -
\??\c:\dpjvv.exec:\dpjvv.exe48⤵
- Executes dropped EXE
PID:5008 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe49⤵
- Executes dropped EXE
PID:4720 -
\??\c:\9ttnnt.exec:\9ttnnt.exe50⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3hnnhh.exec:\3hnnhh.exe51⤵
- Executes dropped EXE
PID:4604 -
\??\c:\vvjdj.exec:\vvjdj.exe52⤵
- Executes dropped EXE
PID:4800 -
\??\c:\ffrllrr.exec:\ffrllrr.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5040 -
\??\c:\hthbtt.exec:\hthbtt.exe54⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ddjjj.exec:\ddjjj.exe55⤵
- Executes dropped EXE
PID:3928 -
\??\c:\pjvpv.exec:\pjvpv.exe56⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rrllflf.exec:\rrllflf.exe57⤵
- Executes dropped EXE
PID:4656 -
\??\c:\bbtnht.exec:\bbtnht.exe58⤵
- Executes dropped EXE
PID:4528 -
\??\c:\9jjdv.exec:\9jjdv.exe59⤵
- Executes dropped EXE
PID:3140 -
\??\c:\vjjjj.exec:\vjjjj.exe60⤵
- Executes dropped EXE
PID:2936 -
\??\c:\7bhnnn.exec:\7bhnnn.exe61⤵
- Executes dropped EXE
PID:3940 -
\??\c:\ppjdd.exec:\ppjdd.exe62⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jdjdv.exec:\jdjdv.exe63⤵
- Executes dropped EXE
PID:1060 -
\??\c:\9rxxrrr.exec:\9rxxrrr.exe64⤵
- Executes dropped EXE
PID:1984 -
\??\c:\bttbtn.exec:\bttbtn.exe65⤵
- Executes dropped EXE
PID:4952 -
\??\c:\1jjvp.exec:\1jjvp.exe66⤵PID:1584
-
\??\c:\9xfxrrl.exec:\9xfxrrl.exe67⤵PID:1816
-
\??\c:\hbhbnb.exec:\hbhbnb.exe68⤵PID:2780
-
\??\c:\vpddj.exec:\vpddj.exe69⤵PID:4580
-
\??\c:\xrxrxlf.exec:\xrxrxlf.exe70⤵PID:2248
-
\??\c:\1ffrlff.exec:\1ffrlff.exe71⤵PID:2320
-
\??\c:\nhbnbt.exec:\nhbnbt.exe72⤵PID:4756
-
\??\c:\3jvpj.exec:\3jvpj.exe73⤵PID:632
-
\??\c:\rrrrlll.exec:\rrrrlll.exe74⤵PID:2288
-
\??\c:\ntbbtb.exec:\ntbbtb.exe75⤵PID:5116
-
\??\c:\vdvpj.exec:\vdvpj.exe76⤵PID:3772
-
\??\c:\xrflxxx.exec:\xrflxxx.exe77⤵PID:768
-
\??\c:\btnhnn.exec:\btnhnn.exe78⤵PID:3872
-
\??\c:\dvddd.exec:\dvddd.exe79⤵PID:3416
-
\??\c:\vppjv.exec:\vppjv.exe80⤵PID:3508
-
\??\c:\frlfxxf.exec:\frlfxxf.exe81⤵PID:1548
-
\??\c:\hhbthh.exec:\hhbthh.exe82⤵PID:2324
-
\??\c:\dpppp.exec:\dpppp.exe83⤵PID:2584
-
\??\c:\5rrlfxr.exec:\5rrlfxr.exe84⤵PID:5108
-
\??\c:\hbhbbb.exec:\hbhbbb.exe85⤵PID:2204
-
\??\c:\pjvjd.exec:\pjvjd.exe86⤵PID:2836
-
\??\c:\llfrffl.exec:\llfrffl.exe87⤵PID:4628
-
\??\c:\tnthht.exec:\tnthht.exe88⤵PID:3464
-
\??\c:\ddjdv.exec:\ddjdv.exe89⤵PID:1592
-
\??\c:\fffxxxx.exec:\fffxxxx.exe90⤵PID:3308
-
\??\c:\fxrlffr.exec:\fxrlffr.exe91⤵PID:3696
-
\??\c:\nbbttn.exec:\nbbttn.exe92⤵PID:1104
-
\??\c:\vjjdp.exec:\vjjdp.exe93⤵PID:1440
-
\??\c:\lrlrrrl.exec:\lrlrrrl.exe94⤵PID:4780
-
\??\c:\thnhhn.exec:\thnhhn.exe95⤵PID:3868
-
\??\c:\nbhttn.exec:\nbhttn.exe96⤵PID:1776
-
\??\c:\xffffff.exec:\xffffff.exe97⤵PID:1836
-
\??\c:\nhhbbb.exec:\nhhbbb.exe98⤵PID:2208
-
\??\c:\pjjvj.exec:\pjjvj.exe99⤵PID:2148
-
\??\c:\1fflfrr.exec:\1fflfrr.exe100⤵PID:3716
-
\??\c:\rrlrlll.exec:\rrlrlll.exe101⤵PID:3340
-
\??\c:\9dddj.exec:\9dddj.exe102⤵PID:2196
-
\??\c:\jpvdv.exec:\jpvdv.exe103⤵PID:5032
-
\??\c:\llfxrrl.exec:\llfxrrl.exe104⤵PID:5052
-
\??\c:\thtttt.exec:\thtttt.exe105⤵PID:3816
-
\??\c:\jjvvp.exec:\jjvvp.exe106⤵PID:3324
-
\??\c:\rfrlxrr.exec:\rfrlxrr.exe107⤵PID:4644
-
\??\c:\hbtnhh.exec:\hbtnhh.exe108⤵PID:1704
-
\??\c:\htbnhb.exec:\htbnhb.exe109⤵PID:4304
-
\??\c:\jpdjd.exec:\jpdjd.exe110⤵PID:224
-
\??\c:\fxxlxxl.exec:\fxxlxxl.exe111⤵PID:4984
-
\??\c:\3nnbbb.exec:\3nnbbb.exe112⤵PID:4720
-
\??\c:\ppjdd.exec:\ppjdd.exe113⤵PID:400
-
\??\c:\5pvvj.exec:\5pvvj.exe114⤵PID:3468
-
\??\c:\5xxlxxl.exec:\5xxlxxl.exe115⤵PID:4800
-
\??\c:\7bbtnh.exec:\7bbtnh.exe116⤵PID:5068
-
\??\c:\5vpdp.exec:\5vpdp.exe117⤵PID:1292
-
\??\c:\pjvpd.exec:\pjvpd.exe118⤵PID:3928
-
\??\c:\rrxlxlx.exec:\rrxlxlx.exe119⤵PID:1416
-
\??\c:\3thbtt.exec:\3thbtt.exe120⤵PID:1224
-
\??\c:\5jdvj.exec:\5jdvj.exe121⤵PID:4092
-
\??\c:\9frfrlr.exec:\9frfrlr.exe122⤵PID:3140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-