Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 20:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe
Resource
win7-20241023-en
7 signatures
150 seconds
General
-
Target
53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe
-
Size
458KB
-
MD5
9683bfdccf3ba351ee2d0e45d1ea2f45
-
SHA1
007580a6470dbd24a7b3f9446131f132d8107506
-
SHA256
53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40
-
SHA512
6c7a63b50d39f65117afda202ec37dbfe061631b7821c2fa8f858deb6b960e4f650bdc87880c6b9dc3be4928d4002c1c46f0f869761b9500dcefed105cfb0e81
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbebC:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/6116-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6020-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5296-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5972-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5560-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5464-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6060-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5164-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5496-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6096-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5572-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5300-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5296-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-949-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-1136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/6088-1188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-1751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4092 dpvvp.exe 5048 tbnnhh.exe 2528 jddvv.exe 6020 3rlfxxr.exe 116 hbhbbb.exe 5380 jjpjj.exe 5296 pjvvp.exe 3168 7llfxll.exe 400 pvjjp.exe 3156 hnbbtt.exe 4508 nnnhhh.exe 4624 jdvjv.exe 4756 9flxxxx.exe 5972 1ttbhh.exe 4492 vpvpv.exe 2312 thnhbt.exe 1004 vpppv.exe 5560 lflfllr.exe 4960 btnhbt.exe 4896 1bbbhn.exe 4800 pvjvv.exe 4804 7xrlfff.exe 3908 ttbtnh.exe 412 ppppj.exe 2532 9xffffx.exe 4708 nbbttt.exe 2488 llffffx.exe 5464 thhnhh.exe 3024 xllfxxr.exe 1176 jpjjd.exe 1484 rlfxrlf.exe 2736 1hnhhh.exe 4168 1rlrrrr.exe 6060 hbhhhh.exe 656 vdjjj.exe 1880 rflfxfx.exe 2188 hhbbth.exe 4080 vjpjd.exe 3916 lfxlxrl.exe 4412 thnnhh.exe 1864 9vdvp.exe 2200 frxrllf.exe 2580 nhhhtn.exe 1588 nbnnnh.exe 4848 ffffxfl.exe 3676 thhbtb.exe 5860 pvvdd.exe 752 flrxxxr.exe 5808 lfrxffl.exe 2712 nntthb.exe 5964 vvdvv.exe 2588 xxrlllf.exe 4484 9flrllf.exe 3840 nntttb.exe 5260 djpvj.exe 1664 xxxxxxr.exe 3008 1hbbtt.exe 4464 ddppj.exe 6080 vvppj.exe 2648 nhhbhb.exe 4444 vvjdp.exe 5664 frrrlxx.exe 5608 tntbth.exe 4972 fxffxxr.exe -
resource yara_rule behavioral2/memory/6116-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6020-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5296-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5972-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5560-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5560-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5464-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6060-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6080-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5164-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5496-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/6096-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5572-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5300-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5296-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-843-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6116 wrote to memory of 4092 6116 53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe 86 PID 6116 wrote to memory of 4092 6116 53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe 86 PID 6116 wrote to memory of 4092 6116 53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe 86 PID 4092 wrote to memory of 5048 4092 dpvvp.exe 87 PID 4092 wrote to memory of 5048 4092 dpvvp.exe 87 PID 4092 wrote to memory of 5048 4092 dpvvp.exe 87 PID 5048 wrote to memory of 2528 5048 tbnnhh.exe 88 PID 5048 wrote to memory of 2528 5048 tbnnhh.exe 88 PID 5048 wrote to memory of 2528 5048 tbnnhh.exe 88 PID 2528 wrote to memory of 6020 2528 jddvv.exe 89 PID 2528 wrote to memory of 6020 2528 jddvv.exe 89 PID 2528 wrote to memory of 6020 2528 jddvv.exe 89 PID 6020 wrote to memory of 116 6020 3rlfxxr.exe 90 PID 6020 wrote to memory of 116 6020 3rlfxxr.exe 90 PID 6020 wrote to memory of 116 6020 3rlfxxr.exe 90 PID 116 wrote to memory of 5380 116 hbhbbb.exe 92 PID 116 wrote to memory of 5380 116 hbhbbb.exe 92 PID 116 wrote to memory of 5380 116 hbhbbb.exe 92 PID 5380 wrote to memory of 5296 5380 jjpjj.exe 94 PID 5380 wrote to memory of 5296 5380 jjpjj.exe 94 PID 5380 wrote to memory of 5296 5380 jjpjj.exe 94 PID 5296 wrote to memory of 3168 5296 pjvvp.exe 95 PID 5296 wrote to memory of 3168 5296 pjvvp.exe 95 PID 5296 wrote to memory of 3168 5296 pjvvp.exe 95 PID 3168 wrote to memory of 400 3168 7llfxll.exe 96 PID 3168 wrote to memory of 400 3168 7llfxll.exe 96 PID 3168 wrote to memory of 400 3168 7llfxll.exe 96 PID 400 wrote to memory of 3156 400 pvjjp.exe 98 PID 400 wrote to memory of 3156 400 pvjjp.exe 98 PID 400 wrote to memory of 3156 400 pvjjp.exe 98 PID 3156 wrote to memory of 4508 3156 hnbbtt.exe 99 PID 3156 wrote to memory of 4508 3156 hnbbtt.exe 99 PID 3156 wrote to memory of 4508 3156 hnbbtt.exe 99 PID 4508 wrote to memory of 4624 4508 nnnhhh.exe 100 PID 4508 wrote to memory of 4624 4508 nnnhhh.exe 100 PID 4508 wrote to memory of 4624 4508 nnnhhh.exe 100 PID 4624 wrote to memory of 4756 4624 jdvjv.exe 101 PID 4624 wrote to memory of 4756 4624 jdvjv.exe 101 PID 4624 wrote to memory of 4756 4624 jdvjv.exe 101 PID 4756 wrote to memory of 5972 4756 9flxxxx.exe 102 PID 4756 wrote to memory of 5972 4756 9flxxxx.exe 102 PID 4756 wrote to memory of 5972 4756 9flxxxx.exe 102 PID 5972 wrote to memory of 4492 5972 1ttbhh.exe 103 PID 5972 wrote to memory of 4492 5972 1ttbhh.exe 103 PID 5972 wrote to memory of 4492 5972 1ttbhh.exe 103 PID 4492 wrote to memory of 2312 4492 vpvpv.exe 104 PID 4492 wrote to memory of 2312 4492 vpvpv.exe 104 PID 4492 wrote to memory of 2312 4492 vpvpv.exe 104 PID 2312 wrote to memory of 1004 2312 thnhbt.exe 105 PID 2312 wrote to memory of 1004 2312 thnhbt.exe 105 PID 2312 wrote to memory of 1004 2312 thnhbt.exe 105 PID 1004 wrote to memory of 5560 1004 vpppv.exe 106 PID 1004 wrote to memory of 5560 1004 vpppv.exe 106 PID 1004 wrote to memory of 5560 1004 vpppv.exe 106 PID 5560 wrote to memory of 4960 5560 lflfllr.exe 107 PID 5560 wrote to memory of 4960 5560 lflfllr.exe 107 PID 5560 wrote to memory of 4960 5560 lflfllr.exe 107 PID 4960 wrote to memory of 4896 4960 btnhbt.exe 108 PID 4960 wrote to memory of 4896 4960 btnhbt.exe 108 PID 4960 wrote to memory of 4896 4960 btnhbt.exe 108 PID 4896 wrote to memory of 4800 4896 1bbbhn.exe 109 PID 4896 wrote to memory of 4800 4896 1bbbhn.exe 109 PID 4896 wrote to memory of 4800 4896 1bbbhn.exe 109 PID 4800 wrote to memory of 4804 4800 pvjvv.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe"C:\Users\Admin\AppData\Local\Temp\53df8220bc38607147b39face1985dbb22914a172749c880601e332d2a1b5e40.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6116 -
\??\c:\dpvvp.exec:\dpvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\tbnnhh.exec:\tbnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\jddvv.exec:\jddvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\3rlfxxr.exec:\3rlfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
\??\c:\hbhbbb.exec:\hbhbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\jjpjj.exec:\jjpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
\??\c:\pjvvp.exec:\pjvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
\??\c:\7llfxll.exec:\7llfxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\pvjjp.exec:\pvjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\hnbbtt.exec:\hnbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\nnnhhh.exec:\nnnhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\jdvjv.exec:\jdvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\9flxxxx.exec:\9flxxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\1ttbhh.exec:\1ttbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
\??\c:\vpvpv.exec:\vpvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\thnhbt.exec:\thnhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\vpppv.exec:\vpppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\lflfllr.exec:\lflfllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
\??\c:\btnhbt.exec:\btnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\1bbbhn.exec:\1bbbhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\pvjvv.exec:\pvjvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\7xrlfff.exec:\7xrlfff.exe23⤵
- Executes dropped EXE
PID:4804 -
\??\c:\ttbtnh.exec:\ttbtnh.exe24⤵
- Executes dropped EXE
PID:3908 -
\??\c:\ppppj.exec:\ppppj.exe25⤵
- Executes dropped EXE
PID:412 -
\??\c:\9xffffx.exec:\9xffffx.exe26⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nbbttt.exec:\nbbttt.exe27⤵
- Executes dropped EXE
PID:4708 -
\??\c:\llffffx.exec:\llffffx.exe28⤵
- Executes dropped EXE
PID:2488 -
\??\c:\thhnhh.exec:\thhnhh.exe29⤵
- Executes dropped EXE
PID:5464 -
\??\c:\xllfxxr.exec:\xllfxxr.exe30⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jpjjd.exec:\jpjjd.exe31⤵
- Executes dropped EXE
PID:1176 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe32⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1hnhhh.exec:\1hnhhh.exe33⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1rlrrrr.exec:\1rlrrrr.exe34⤵
- Executes dropped EXE
PID:4168 -
\??\c:\hbhhhh.exec:\hbhhhh.exe35⤵
- Executes dropped EXE
PID:6060 -
\??\c:\vdjjj.exec:\vdjjj.exe36⤵
- Executes dropped EXE
PID:656 -
\??\c:\rflfxfx.exec:\rflfxfx.exe37⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hhbbth.exec:\hhbbth.exe38⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vjpjd.exec:\vjpjd.exe39⤵
- Executes dropped EXE
PID:4080 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe40⤵
- Executes dropped EXE
PID:3916 -
\??\c:\thnnhh.exec:\thnnhh.exe41⤵
- Executes dropped EXE
PID:4412 -
\??\c:\9vdvp.exec:\9vdvp.exe42⤵
- Executes dropped EXE
PID:1864 -
\??\c:\frxrllf.exec:\frxrllf.exe43⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nhhhtn.exec:\nhhhtn.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nbnnnh.exec:\nbnnnh.exe45⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ffffxfl.exec:\ffffxfl.exe46⤵
- Executes dropped EXE
PID:4848 -
\??\c:\thhbtb.exec:\thhbtb.exe47⤵
- Executes dropped EXE
PID:3676 -
\??\c:\pvvdd.exec:\pvvdd.exe48⤵
- Executes dropped EXE
PID:5860 -
\??\c:\flrxxxr.exec:\flrxxxr.exe49⤵
- Executes dropped EXE
PID:752 -
\??\c:\lfrxffl.exec:\lfrxffl.exe50⤵
- Executes dropped EXE
PID:5808 -
\??\c:\nntthb.exec:\nntthb.exe51⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vvdvv.exec:\vvdvv.exe52⤵
- Executes dropped EXE
PID:5964 -
\??\c:\xxrlllf.exec:\xxrlllf.exe53⤵
- Executes dropped EXE
PID:2588 -
\??\c:\9flrllf.exec:\9flrllf.exe54⤵
- Executes dropped EXE
PID:4484 -
\??\c:\nntttb.exec:\nntttb.exe55⤵
- Executes dropped EXE
PID:3840 -
\??\c:\djpvj.exec:\djpvj.exe56⤵
- Executes dropped EXE
PID:5260 -
\??\c:\xxxxxxr.exec:\xxxxxxr.exe57⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1hbbtt.exec:\1hbbtt.exe58⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ddppj.exec:\ddppj.exe59⤵
- Executes dropped EXE
PID:4464 -
\??\c:\vvppj.exec:\vvppj.exe60⤵
- Executes dropped EXE
PID:6080 -
\??\c:\nhhbhb.exec:\nhhbhb.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648 -
\??\c:\vvjdp.exec:\vvjdp.exe62⤵
- Executes dropped EXE
PID:4444 -
\??\c:\frrrlxx.exec:\frrrlxx.exe63⤵
- Executes dropped EXE
PID:5664 -
\??\c:\tntbth.exec:\tntbth.exe64⤵
- Executes dropped EXE
PID:5608 -
\??\c:\fxffxxr.exec:\fxffxxr.exe65⤵
- Executes dropped EXE
PID:4972 -
\??\c:\9tbbbh.exec:\9tbbbh.exe66⤵PID:404
-
\??\c:\nbbbbb.exec:\nbbbbb.exe67⤵PID:2528
-
\??\c:\xflllxf.exec:\xflllxf.exe68⤵PID:4404
-
\??\c:\frxxrll.exec:\frxxrll.exe69⤵PID:5184
-
\??\c:\nthttt.exec:\nthttt.exe70⤵PID:220
-
\??\c:\vppjd.exec:\vppjd.exe71⤵PID:5164
-
\??\c:\3jvvv.exec:\3jvvv.exe72⤵PID:5320
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe73⤵PID:2128
-
\??\c:\btttbh.exec:\btttbh.exe74⤵PID:1964
-
\??\c:\jppjd.exec:\jppjd.exe75⤵PID:4040
-
\??\c:\3vdjj.exec:\3vdjj.exe76⤵PID:3136
-
\??\c:\rlrffxr.exec:\rlrffxr.exe77⤵PID:5052
-
\??\c:\hhthth.exec:\hhthth.exe78⤵PID:920
-
\??\c:\vvdjd.exec:\vvdjd.exe79⤵PID:4536
-
\??\c:\lrxxfrr.exec:\lrxxfrr.exe80⤵PID:4648
-
\??\c:\nntbtt.exec:\nntbtt.exe81⤵PID:2296
-
\??\c:\ttthbt.exec:\ttthbt.exe82⤵PID:2956
-
\??\c:\1jvpd.exec:\1jvpd.exe83⤵PID:452
-
\??\c:\llffllr.exec:\llffllr.exe84⤵PID:4604
-
\??\c:\bnttnt.exec:\bnttnt.exe85⤵PID:4760
-
\??\c:\hhhhbb.exec:\hhhhbb.exe86⤵PID:4780
-
\??\c:\vddvv.exec:\vddvv.exe87⤵PID:392
-
\??\c:\llxxfrf.exec:\llxxfrf.exe88⤵PID:1564
-
\??\c:\nbhbbb.exec:\nbhbbb.exe89⤵PID:4164
-
\??\c:\bntbtn.exec:\bntbtn.exe90⤵PID:2284
-
\??\c:\3vpjj.exec:\3vpjj.exe91⤵PID:2208
-
\??\c:\9fllfff.exec:\9fllfff.exe92⤵PID:5424
-
\??\c:\3ttnhh.exec:\3ttnhh.exe93⤵PID:1432
-
\??\c:\jvppp.exec:\jvppp.exe94⤵PID:856
-
\??\c:\vvjpd.exec:\vvjpd.exe95⤵PID:4960
-
\??\c:\llrlfxr.exec:\llrlfxr.exe96⤵PID:4896
-
\??\c:\btnnbn.exec:\btnnbn.exe97⤵PID:4876
-
\??\c:\3jvpp.exec:\3jvpp.exe98⤵PID:700
-
\??\c:\rlrlfff.exec:\rlrlfff.exe99⤵PID:32
-
\??\c:\bhnnhh.exec:\bhnnhh.exe100⤵PID:2836
-
\??\c:\1hnnhh.exec:\1hnnhh.exe101⤵PID:5496
-
\??\c:\ddpdv.exec:\ddpdv.exe102⤵PID:1668
-
\??\c:\frrlfxx.exec:\frrlfxx.exe103⤵PID:2488
-
\??\c:\nhtbbn.exec:\nhtbbn.exe104⤵PID:3776
-
\??\c:\vjppj.exec:\vjppj.exe105⤵PID:6096
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe106⤵PID:3764
-
\??\c:\thbttt.exec:\thbttt.exe107⤵PID:2340
-
\??\c:\jdvpj.exec:\jdvpj.exe108⤵PID:784
-
\??\c:\3pjjj.exec:\3pjjj.exe109⤵PID:1940
-
\??\c:\ffllflf.exec:\ffllflf.exe110⤵PID:4036
-
\??\c:\httnnh.exec:\httnnh.exe111⤵PID:4616
-
\??\c:\dvjdv.exec:\dvjdv.exe112⤵PID:5572
-
\??\c:\pvjjd.exec:\pvjjd.exe113⤵PID:5400
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe114⤵PID:5300
-
\??\c:\5nnhtt.exec:\5nnhtt.exe115⤵PID:3336
-
\??\c:\djjdv.exec:\djjdv.exe116⤵PID:4016
-
\??\c:\xrfflrr.exec:\xrfflrr.exe117⤵PID:1820
-
\??\c:\flrxxxx.exec:\flrxxxx.exe118⤵PID:644
-
\??\c:\1tbtnb.exec:\1tbtnb.exe119⤵PID:2376
-
\??\c:\ddpjp.exec:\ddpjp.exe120⤵PID:2876
-
\??\c:\ffxrrxr.exec:\ffxrrxr.exe121⤵PID:4452
-
\??\c:\1ttnnn.exec:\1ttnnn.exe122⤵PID:5696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-