Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe
-
Size
455KB
-
MD5
06f04c9fedab81839549ae9925be4022
-
SHA1
a4b3bca993f3a23c3a877e40a2a308d674522c57
-
SHA256
514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f
-
SHA512
97646e9ab16cbed9d57c2e64829767ffd8552c4785c32765fe4bf824ab0b83f6031e60cf3837f87315b2fdf1bc30fce26acad009236e269dc90fd2d4389483e2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/640-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-828-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-890-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-940-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-956-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4868 pdvjd.exe 4400 ntnnhb.exe 1260 hnnbtn.exe 3568 dppjv.exe 1656 pdvpj.exe 2128 htttnn.exe 1460 thnhhh.exe 2784 rlxrlrl.exe 2384 fxfrrfx.exe 4840 dvjjd.exe 2148 dvjdv.exe 3264 5tbtbb.exe 2184 lxfrrrx.exe 3716 1ntbtt.exe 1540 xflxrrl.exe 4040 tntnhb.exe 1440 xrxxrxr.exe 3160 httbht.exe 4852 dppdp.exe 404 djvpj.exe 704 1ntthn.exe 1580 pvdvp.exe 3556 1vpjd.exe 3948 rlxrrrr.exe 1308 hbnnth.exe 4048 vvdjd.exe 4876 1ppjv.exe 944 httnbt.exe 1848 jppjd.exe 2284 nhtnhh.exe 2056 xrxrllf.exe 1600 tbttnt.exe 3292 jvjdv.exe 512 bttnbt.exe 1032 ppvpj.exe 2832 rfrxrrl.exe 1820 5fllffx.exe 5040 bbbtbb.exe 4504 vjpdv.exe 4440 llffxrr.exe 3368 tthbtt.exe 1756 pjjdp.exe 1008 jdjjd.exe 1212 fxfxxxx.exe 4660 7btthn.exe 388 pjvjj.exe 2948 rxxfrrl.exe 2576 nhnhhb.exe 1040 jpvpd.exe 3028 vvvpj.exe 4476 fxflffx.exe 876 jdpjp.exe 400 vjdvj.exe 3420 lrrlfxf.exe 4336 hhhtnn.exe 2968 pjddv.exe 4192 rfrlffx.exe 5048 bnhbtt.exe 3568 ddvpp.exe 4376 7jvpj.exe 4828 xffrrfx.exe 3720 tbnbbn.exe 3980 vvpvj.exe 2288 rffxlfr.exe -
resource yara_rule behavioral2/memory/640-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-828-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfffx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 640 wrote to memory of 4868 640 514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe 82 PID 640 wrote to memory of 4868 640 514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe 82 PID 640 wrote to memory of 4868 640 514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe 82 PID 4868 wrote to memory of 4400 4868 pdvjd.exe 83 PID 4868 wrote to memory of 4400 4868 pdvjd.exe 83 PID 4868 wrote to memory of 4400 4868 pdvjd.exe 83 PID 4400 wrote to memory of 1260 4400 ntnnhb.exe 84 PID 4400 wrote to memory of 1260 4400 ntnnhb.exe 84 PID 4400 wrote to memory of 1260 4400 ntnnhb.exe 84 PID 1260 wrote to memory of 3568 1260 hnnbtn.exe 85 PID 1260 wrote to memory of 3568 1260 hnnbtn.exe 85 PID 1260 wrote to memory of 3568 1260 hnnbtn.exe 85 PID 3568 wrote to memory of 1656 3568 dppjv.exe 86 PID 3568 wrote to memory of 1656 3568 dppjv.exe 86 PID 3568 wrote to memory of 1656 3568 dppjv.exe 86 PID 1656 wrote to memory of 2128 1656 pdvpj.exe 87 PID 1656 wrote to memory of 2128 1656 pdvpj.exe 87 PID 1656 wrote to memory of 2128 1656 pdvpj.exe 87 PID 2128 wrote to memory of 1460 2128 htttnn.exe 88 PID 2128 wrote to memory of 1460 2128 htttnn.exe 88 PID 2128 wrote to memory of 1460 2128 htttnn.exe 88 PID 1460 wrote to memory of 2784 1460 thnhhh.exe 89 PID 1460 wrote to memory of 2784 1460 thnhhh.exe 89 PID 1460 wrote to memory of 2784 1460 thnhhh.exe 89 PID 2784 wrote to memory of 2384 2784 rlxrlrl.exe 90 PID 2784 wrote to memory of 2384 2784 rlxrlrl.exe 90 PID 2784 wrote to memory of 2384 2784 rlxrlrl.exe 90 PID 2384 wrote to memory of 4840 2384 fxfrrfx.exe 91 PID 2384 wrote to memory of 4840 2384 fxfrrfx.exe 91 PID 2384 wrote to memory of 4840 2384 fxfrrfx.exe 91 PID 4840 wrote to memory of 2148 4840 dvjjd.exe 92 PID 4840 wrote to memory of 2148 4840 dvjjd.exe 92 PID 4840 wrote to memory of 2148 4840 dvjjd.exe 92 PID 2148 wrote to memory of 3264 2148 dvjdv.exe 93 PID 2148 wrote to memory of 3264 2148 dvjdv.exe 93 PID 2148 wrote to memory of 3264 2148 dvjdv.exe 93 PID 3264 wrote to memory of 2184 3264 5tbtbb.exe 94 PID 3264 wrote to memory of 2184 3264 5tbtbb.exe 94 PID 3264 wrote to memory of 2184 3264 5tbtbb.exe 94 PID 2184 wrote to memory of 3716 2184 lxfrrrx.exe 95 PID 2184 wrote to memory of 3716 2184 lxfrrrx.exe 95 PID 2184 wrote to memory of 3716 2184 lxfrrrx.exe 95 PID 3716 wrote to memory of 1540 3716 1ntbtt.exe 96 PID 3716 wrote to memory of 1540 3716 1ntbtt.exe 96 PID 3716 wrote to memory of 1540 3716 1ntbtt.exe 96 PID 1540 wrote to memory of 4040 1540 xflxrrl.exe 97 PID 1540 wrote to memory of 4040 1540 xflxrrl.exe 97 PID 1540 wrote to memory of 4040 1540 xflxrrl.exe 97 PID 4040 wrote to memory of 1440 4040 tntnhb.exe 98 PID 4040 wrote to memory of 1440 4040 tntnhb.exe 98 PID 4040 wrote to memory of 1440 4040 tntnhb.exe 98 PID 1440 wrote to memory of 3160 1440 xrxxrxr.exe 99 PID 1440 wrote to memory of 3160 1440 xrxxrxr.exe 99 PID 1440 wrote to memory of 3160 1440 xrxxrxr.exe 99 PID 3160 wrote to memory of 4852 3160 httbht.exe 100 PID 3160 wrote to memory of 4852 3160 httbht.exe 100 PID 3160 wrote to memory of 4852 3160 httbht.exe 100 PID 4852 wrote to memory of 404 4852 dppdp.exe 101 PID 4852 wrote to memory of 404 4852 dppdp.exe 101 PID 4852 wrote to memory of 404 4852 dppdp.exe 101 PID 404 wrote to memory of 704 404 djvpj.exe 102 PID 404 wrote to memory of 704 404 djvpj.exe 102 PID 404 wrote to memory of 704 404 djvpj.exe 102 PID 704 wrote to memory of 1580 704 1ntthn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe"C:\Users\Admin\AppData\Local\Temp\514bce85cf93aa1748a13799e00edececbcebf6dfe6494c72b00c4e9d049ad6f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\pdvjd.exec:\pdvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\ntnnhb.exec:\ntnnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\hnnbtn.exec:\hnnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\dppjv.exec:\dppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\pdvpj.exec:\pdvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\htttnn.exec:\htttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\thnhhh.exec:\thnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\rlxrlrl.exec:\rlxrlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\fxfrrfx.exec:\fxfrrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\dvjjd.exec:\dvjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\dvjdv.exec:\dvjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\5tbtbb.exec:\5tbtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\lxfrrrx.exec:\lxfrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\1ntbtt.exec:\1ntbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\xflxrrl.exec:\xflxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\tntnhb.exec:\tntnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\httbht.exec:\httbht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\dppdp.exec:\dppdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\djvpj.exec:\djvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\1ntthn.exec:\1ntthn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\pvdvp.exec:\pvdvp.exe23⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1vpjd.exec:\1vpjd.exe24⤵
- Executes dropped EXE
PID:3556 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe25⤵
- Executes dropped EXE
PID:3948 -
\??\c:\hbnnth.exec:\hbnnth.exe26⤵
- Executes dropped EXE
PID:1308 -
\??\c:\vvdjd.exec:\vvdjd.exe27⤵
- Executes dropped EXE
PID:4048 -
\??\c:\1ppjv.exec:\1ppjv.exe28⤵
- Executes dropped EXE
PID:4876 -
\??\c:\httnbt.exec:\httnbt.exe29⤵
- Executes dropped EXE
PID:944 -
\??\c:\jppjd.exec:\jppjd.exe30⤵
- Executes dropped EXE
PID:1848 -
\??\c:\nhtnhh.exec:\nhtnhh.exe31⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xrxrllf.exec:\xrxrllf.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tbttnt.exec:\tbttnt.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jvjdv.exec:\jvjdv.exe34⤵
- Executes dropped EXE
PID:3292 -
\??\c:\bttnbt.exec:\bttnbt.exe35⤵
- Executes dropped EXE
PID:512 -
\??\c:\ppvpj.exec:\ppvpj.exe36⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rfrxrrl.exec:\rfrxrrl.exe37⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5fllffx.exec:\5fllffx.exe38⤵
- Executes dropped EXE
PID:1820 -
\??\c:\bbbtbb.exec:\bbbtbb.exe39⤵
- Executes dropped EXE
PID:5040 -
\??\c:\vjpdv.exec:\vjpdv.exe40⤵
- Executes dropped EXE
PID:4504 -
\??\c:\llffxrr.exec:\llffxrr.exe41⤵
- Executes dropped EXE
PID:4440 -
\??\c:\tthbtt.exec:\tthbtt.exe42⤵
- Executes dropped EXE
PID:3368 -
\??\c:\pjjdp.exec:\pjjdp.exe43⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jdjjd.exec:\jdjjd.exe44⤵
- Executes dropped EXE
PID:1008 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe45⤵
- Executes dropped EXE
PID:1212 -
\??\c:\7btthn.exec:\7btthn.exe46⤵
- Executes dropped EXE
PID:4660 -
\??\c:\pjvjj.exec:\pjvjj.exe47⤵
- Executes dropped EXE
PID:388 -
\??\c:\rxxfrrl.exec:\rxxfrrl.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nhnhhb.exec:\nhnhhb.exe49⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jpvpd.exec:\jpvpd.exe50⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vvvpj.exec:\vvvpj.exe51⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fxflffx.exec:\fxflffx.exe52⤵
- Executes dropped EXE
PID:4476 -
\??\c:\jdpjp.exec:\jdpjp.exe53⤵
- Executes dropped EXE
PID:876 -
\??\c:\vjdvj.exec:\vjdvj.exe54⤵
- Executes dropped EXE
PID:400 -
\??\c:\lrrlfxf.exec:\lrrlfxf.exe55⤵
- Executes dropped EXE
PID:3420 -
\??\c:\hhhtnn.exec:\hhhtnn.exe56⤵
- Executes dropped EXE
PID:4336 -
\??\c:\pjddv.exec:\pjddv.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rfrlffx.exec:\rfrlffx.exe58⤵
- Executes dropped EXE
PID:4192 -
\??\c:\bnhbtt.exec:\bnhbtt.exe59⤵
- Executes dropped EXE
PID:5048 -
\??\c:\ddvpp.exec:\ddvpp.exe60⤵
- Executes dropped EXE
PID:3568 -
\??\c:\7jvpj.exec:\7jvpj.exe61⤵
- Executes dropped EXE
PID:4376 -
\??\c:\xffrrfx.exec:\xffrrfx.exe62⤵
- Executes dropped EXE
PID:4828 -
\??\c:\tbnbbn.exec:\tbnbbn.exe63⤵
- Executes dropped EXE
PID:3720 -
\??\c:\vvpvj.exec:\vvpvj.exe64⤵
- Executes dropped EXE
PID:3980 -
\??\c:\rffxlfr.exec:\rffxlfr.exe65⤵
- Executes dropped EXE
PID:2288 -
\??\c:\htbhbb.exec:\htbhbb.exe66⤵PID:1824
-
\??\c:\nntttt.exec:\nntttt.exe67⤵PID:2040
-
\??\c:\vppjv.exec:\vppjv.exe68⤵PID:3404
-
\??\c:\lflfrrl.exec:\lflfrrl.exe69⤵PID:1616
-
\??\c:\nnbbtt.exec:\nnbbtt.exe70⤵PID:1524
-
\??\c:\vppvp.exec:\vppvp.exe71⤵PID:4568
-
\??\c:\pvpjv.exec:\pvpjv.exe72⤵PID:3264
-
\??\c:\lxfllfl.exec:\lxfllfl.exe73⤵PID:2688
-
\??\c:\hhtnhb.exec:\hhtnhb.exe74⤵PID:2184
-
\??\c:\jdjdv.exec:\jdjdv.exe75⤵PID:3516
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe76⤵PID:1340
-
\??\c:\nnnhtt.exec:\nnnhtt.exe77⤵PID:1872
-
\??\c:\hthtnn.exec:\hthtnn.exe78⤵PID:4932
-
\??\c:\dvjdj.exec:\dvjdj.exe79⤵PID:1716
-
\??\c:\xlrllff.exec:\xlrllff.exe80⤵PID:752
-
\??\c:\btttnn.exec:\btttnn.exe81⤵PID:832
-
\??\c:\nhhhbb.exec:\nhhhbb.exe82⤵PID:5000
-
\??\c:\1pjpj.exec:\1pjpj.exe83⤵PID:3796
-
\??\c:\flrfxff.exec:\flrfxff.exe84⤵PID:1944
-
\??\c:\llfxrlf.exec:\llfxrlf.exe85⤵PID:2460
-
\??\c:\1tnhhb.exec:\1tnhhb.exe86⤵PID:4184
-
\??\c:\vdvdv.exec:\vdvdv.exe87⤵PID:3856
-
\??\c:\rxrrxxx.exec:\rxrrxxx.exe88⤵PID:2612
-
\??\c:\nbbbbb.exec:\nbbbbb.exe89⤵PID:2520
-
\??\c:\3pjjd.exec:\3pjjd.exe90⤵PID:1948
-
\??\c:\bbbhbt.exec:\bbbhbt.exe91⤵PID:2268
-
\??\c:\lfffxxx.exec:\lfffxxx.exe92⤵PID:4328
-
\??\c:\hbbhtt.exec:\hbbhtt.exe93⤵PID:4324
-
\??\c:\jvpjd.exec:\jvpjd.exe94⤵PID:4108
-
\??\c:\7xxlrrx.exec:\7xxlrrx.exe95⤵PID:3628
-
\??\c:\thnnht.exec:\thnnht.exe96⤵PID:5108
-
\??\c:\5jpjv.exec:\5jpjv.exe97⤵PID:1324
-
\??\c:\rffxxxr.exec:\rffxxxr.exe98⤵PID:2056
-
\??\c:\9hbnbt.exec:\9hbnbt.exe99⤵PID:4556
-
\??\c:\3bhbnn.exec:\3bhbnn.exe100⤵PID:4696
-
\??\c:\pdjvp.exec:\pdjvp.exe101⤵PID:2304
-
\??\c:\flllfff.exec:\flllfff.exe102⤵PID:3744
-
\??\c:\nbhbnt.exec:\nbhbnt.exe103⤵PID:4664
-
\??\c:\vpppj.exec:\vpppj.exe104⤵PID:3464
-
\??\c:\jjjdv.exec:\jjjdv.exe105⤵PID:2412
-
\??\c:\rflxrlf.exec:\rflxrlf.exe106⤵PID:4480
-
\??\c:\1tttbn.exec:\1tttbn.exe107⤵PID:1148
-
\??\c:\hnhnht.exec:\hnhnht.exe108⤵PID:1328
-
\??\c:\ddvvv.exec:\ddvvv.exe109⤵PID:3368
-
\??\c:\llrrllx.exec:\llrrllx.exe110⤵PID:4320
-
\??\c:\tnbbnn.exec:\tnbbnn.exe111⤵PID:1008
-
\??\c:\vdpjd.exec:\vdpjd.exe112⤵PID:1212
-
\??\c:\rxflrll.exec:\rxflrll.exe113⤵PID:4668
-
\??\c:\flrlrxr.exec:\flrlrxr.exe114⤵PID:4584
-
\??\c:\hbtnhb.exec:\hbtnhb.exe115⤵PID:3172
-
\??\c:\jdjvp.exec:\jdjvp.exe116⤵
- System Location Discovery: System Language Discovery
PID:4256 -
\??\c:\fxllfff.exec:\fxllfff.exe117⤵PID:232
-
\??\c:\flfxrrl.exec:\flfxrrl.exe118⤵PID:4620
-
\??\c:\bhnnbt.exec:\bhnnbt.exe119⤵PID:4912
-
\??\c:\vpdvv.exec:\vpdvv.exe120⤵PID:876
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe121⤵PID:32
-
\??\c:\htbhbb.exec:\htbhbb.exe122⤵PID:2916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-