Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 00:42
Behavioral task
behavioral1
Sample
29ff27a395353434d2354c7e9bb07210N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
29ff27a395353434d2354c7e9bb07210N.exe
-
Size
108KB
-
MD5
29ff27a395353434d2354c7e9bb07210
-
SHA1
7d99e5f759ac8c24421aea07782a46da0901300b
-
SHA256
1da63b71a784f60dbb44903bc42886b1fcb993566ebbcf822523d10aafbcc5dd
-
SHA512
e3f97d07ceec1cdae8e609846a02cc92ec1f5e65e86657ec2b531a2c99df69a3b7938395522ccd2ed76de0c7ef06ffade8438d0402a33bf18d51765ee9eb5ec4
-
SSDEEP
3072:chOmTsF93UYfwC6GIout5pi8rY9AABa1oZEQE7u6fjY:ccm4FmowdHoS5ddWBSRFfM
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3580-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2856-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/684-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/564-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/864-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3356-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/684-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/340-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4768-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/836-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-622-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-646-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-737-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-756-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-772-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-925-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-939-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-1087-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3580 9nhhbh.exe 3540 bthbtt.exe 2916 rrlfxfl.exe 8 4682604.exe 2820 0826004.exe 1868 lxfffxx.exe 2856 680044.exe 2292 62828.exe 2536 vvppj.exe 684 ppjjd.exe 4908 082260.exe 4036 8642604.exe 1792 282262.exe 4200 68000.exe 3984 lxxfxxx.exe 564 tnnbhb.exe 1648 84266.exe 4876 pvvpj.exe 864 06008.exe 396 48688.exe 3048 fxlfrrr.exe 2232 bhnnnt.exe 464 u460406.exe 2024 xfxlffx.exe 4332 htnnhn.exe 3716 nnnhhn.exe 4912 dvpvj.exe 1484 htnhtt.exe 2944 666000.exe 4800 6248888.exe 4948 ffxxrll.exe 3680 8200444.exe 4024 nbbhth.exe 3392 btnhhh.exe 3672 nbhthb.exe 3744 1hhthh.exe 736 1pvpv.exe 4780 hhnbnh.exe 964 66864.exe 836 pjdvp.exe 2496 42402.exe 2216 xxfrfxl.exe 3052 q26600.exe 2476 vjvvj.exe 4584 a0048.exe 3156 llxlrlf.exe 3356 08404.exe 3852 dpvpv.exe 2512 5xrfrrf.exe 1160 462804.exe 3516 8844266.exe 1948 htbnbb.exe 3676 640008.exe 2092 bhbthb.exe 3468 u682008.exe 872 40040.exe 684 0060204.exe 5072 8444448.exe 2700 xrlfxrr.exe 624 hbnhhb.exe 4844 thbnhb.exe 5024 vpppj.exe 4640 hbthtt.exe 340 9rxllrr.exe -
resource yara_rule behavioral2/memory/3360-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023450-3.dat upx behavioral2/memory/3580-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3360-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a00000002349d-10.dat upx behavioral2/files/0x00070000000234a5-13.dat upx behavioral2/memory/3540-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2916-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234a6-23.dat upx behavioral2/memory/8-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234a7-28.dat upx behavioral2/memory/8-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2820-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234a8-35.dat upx behavioral2/memory/2820-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234a9-41.dat upx behavioral2/memory/2856-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234aa-47.dat upx behavioral2/memory/2292-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ab-53.dat upx behavioral2/memory/2292-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ac-59.dat upx behavioral2/memory/2536-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ad-65.dat upx behavioral2/memory/684-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4908-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ae-71.dat upx behavioral2/memory/4036-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234af-78.dat upx behavioral2/files/0x00070000000234b0-83.dat upx behavioral2/memory/1792-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b1-90.dat upx behavioral2/memory/3984-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b2-94.dat upx behavioral2/memory/564-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b3-100.dat upx behavioral2/memory/1648-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b4-106.dat upx behavioral2/memory/4876-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b5-112.dat upx behavioral2/memory/864-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b6-119.dat upx behavioral2/memory/396-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234a2-123.dat upx behavioral2/memory/3048-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b7-129.dat upx behavioral2/files/0x00070000000234b8-135.dat upx behavioral2/memory/2232-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/464-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b9-142.dat upx behavioral2/memory/2024-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4332-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ba-150.dat upx behavioral2/files/0x00070000000234bb-154.dat upx behavioral2/files/0x00070000000234bc-161.dat upx behavioral2/memory/4912-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3716-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234bd-167.dat upx behavioral2/files/0x00070000000234be-170.dat upx behavioral2/files/0x00070000000234bf-177.dat upx behavioral2/files/0x00070000000234c0-181.dat upx behavioral2/memory/4800-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c1-189.dat upx behavioral2/memory/4948-188-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 802600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g2882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3360 wrote to memory of 3580 3360 29ff27a395353434d2354c7e9bb07210N.exe 83 PID 3360 wrote to memory of 3580 3360 29ff27a395353434d2354c7e9bb07210N.exe 83 PID 3360 wrote to memory of 3580 3360 29ff27a395353434d2354c7e9bb07210N.exe 83 PID 3580 wrote to memory of 3540 3580 9nhhbh.exe 84 PID 3580 wrote to memory of 3540 3580 9nhhbh.exe 84 PID 3580 wrote to memory of 3540 3580 9nhhbh.exe 84 PID 3540 wrote to memory of 2916 3540 bthbtt.exe 86 PID 3540 wrote to memory of 2916 3540 bthbtt.exe 86 PID 3540 wrote to memory of 2916 3540 bthbtt.exe 86 PID 2916 wrote to memory of 8 2916 rrlfxfl.exe 87 PID 2916 wrote to memory of 8 2916 rrlfxfl.exe 87 PID 2916 wrote to memory of 8 2916 rrlfxfl.exe 87 PID 8 wrote to memory of 2820 8 4682604.exe 88 PID 8 wrote to memory of 2820 8 4682604.exe 88 PID 8 wrote to memory of 2820 8 4682604.exe 88 PID 2820 wrote to memory of 1868 2820 0826004.exe 90 PID 2820 wrote to memory of 1868 2820 0826004.exe 90 PID 2820 wrote to memory of 1868 2820 0826004.exe 90 PID 1868 wrote to memory of 2856 1868 lxfffxx.exe 91 PID 1868 wrote to memory of 2856 1868 lxfffxx.exe 91 PID 1868 wrote to memory of 2856 1868 lxfffxx.exe 91 PID 2856 wrote to memory of 2292 2856 680044.exe 92 PID 2856 wrote to memory of 2292 2856 680044.exe 92 PID 2856 wrote to memory of 2292 2856 680044.exe 92 PID 2292 wrote to memory of 2536 2292 62828.exe 93 PID 2292 wrote to memory of 2536 2292 62828.exe 93 PID 2292 wrote to memory of 2536 2292 62828.exe 93 PID 2536 wrote to memory of 684 2536 vvppj.exe 94 PID 2536 wrote to memory of 684 2536 vvppj.exe 94 PID 2536 wrote to memory of 684 2536 vvppj.exe 94 PID 684 wrote to memory of 4908 684 ppjjd.exe 95 PID 684 wrote to memory of 4908 684 ppjjd.exe 95 PID 684 wrote to memory of 4908 684 ppjjd.exe 95 PID 4908 wrote to memory of 4036 4908 082260.exe 97 PID 4908 wrote to memory of 4036 4908 082260.exe 97 PID 4908 wrote to memory of 4036 4908 082260.exe 97 PID 4036 wrote to memory of 1792 4036 8642604.exe 98 PID 4036 wrote to memory of 1792 4036 8642604.exe 98 PID 4036 wrote to memory of 1792 4036 8642604.exe 98 PID 1792 wrote to memory of 4200 1792 282262.exe 99 PID 1792 wrote to memory of 4200 1792 282262.exe 99 PID 1792 wrote to memory of 4200 1792 282262.exe 99 PID 4200 wrote to memory of 3984 4200 68000.exe 100 PID 4200 wrote to memory of 3984 4200 68000.exe 100 PID 4200 wrote to memory of 3984 4200 68000.exe 100 PID 3984 wrote to memory of 564 3984 lxxfxxx.exe 101 PID 3984 wrote to memory of 564 3984 lxxfxxx.exe 101 PID 3984 wrote to memory of 564 3984 lxxfxxx.exe 101 PID 564 wrote to memory of 1648 564 tnnbhb.exe 102 PID 564 wrote to memory of 1648 564 tnnbhb.exe 102 PID 564 wrote to memory of 1648 564 tnnbhb.exe 102 PID 1648 wrote to memory of 4876 1648 84266.exe 103 PID 1648 wrote to memory of 4876 1648 84266.exe 103 PID 1648 wrote to memory of 4876 1648 84266.exe 103 PID 4876 wrote to memory of 864 4876 pvvpj.exe 104 PID 4876 wrote to memory of 864 4876 pvvpj.exe 104 PID 4876 wrote to memory of 864 4876 pvvpj.exe 104 PID 864 wrote to memory of 396 864 06008.exe 105 PID 864 wrote to memory of 396 864 06008.exe 105 PID 864 wrote to memory of 396 864 06008.exe 105 PID 396 wrote to memory of 3048 396 48688.exe 106 PID 396 wrote to memory of 3048 396 48688.exe 106 PID 396 wrote to memory of 3048 396 48688.exe 106 PID 3048 wrote to memory of 2232 3048 fxlfrrr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\29ff27a395353434d2354c7e9bb07210N.exe"C:\Users\Admin\AppData\Local\Temp\29ff27a395353434d2354c7e9bb07210N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\9nhhbh.exec:\9nhhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\bthbtt.exec:\bthbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\rrlfxfl.exec:\rrlfxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\4682604.exec:\4682604.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\0826004.exec:\0826004.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\lxfffxx.exec:\lxfffxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\680044.exec:\680044.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\62828.exec:\62828.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\vvppj.exec:\vvppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\ppjjd.exec:\ppjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\082260.exec:\082260.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\8642604.exec:\8642604.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\282262.exec:\282262.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\68000.exec:\68000.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\lxxfxxx.exec:\lxxfxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\tnnbhb.exec:\tnnbhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\84266.exec:\84266.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\pvvpj.exec:\pvvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\06008.exec:\06008.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\48688.exec:\48688.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\fxlfrrr.exec:\fxlfrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\bhnnnt.exec:\bhnnnt.exe23⤵
- Executes dropped EXE
PID:2232 -
\??\c:\u460406.exec:\u460406.exe24⤵
- Executes dropped EXE
PID:464 -
\??\c:\xfxlffx.exec:\xfxlffx.exe25⤵
- Executes dropped EXE
PID:2024 -
\??\c:\htnnhn.exec:\htnnhn.exe26⤵
- Executes dropped EXE
PID:4332 -
\??\c:\nnnhhn.exec:\nnnhhn.exe27⤵
- Executes dropped EXE
PID:3716 -
\??\c:\dvpvj.exec:\dvpvj.exe28⤵
- Executes dropped EXE
PID:4912 -
\??\c:\htnhtt.exec:\htnhtt.exe29⤵
- Executes dropped EXE
PID:1484 -
\??\c:\666000.exec:\666000.exe30⤵
- Executes dropped EXE
PID:2944 -
\??\c:\6248888.exec:\6248888.exe31⤵
- Executes dropped EXE
PID:4800 -
\??\c:\ffxxrll.exec:\ffxxrll.exe32⤵
- Executes dropped EXE
PID:4948 -
\??\c:\8200444.exec:\8200444.exe33⤵
- Executes dropped EXE
PID:3680 -
\??\c:\nbbhth.exec:\nbbhth.exe34⤵
- Executes dropped EXE
PID:4024 -
\??\c:\btnhhh.exec:\btnhhh.exe35⤵
- Executes dropped EXE
PID:3392 -
\??\c:\nbhthb.exec:\nbhthb.exe36⤵
- Executes dropped EXE
PID:3672 -
\??\c:\1hhthh.exec:\1hhthh.exe37⤵
- Executes dropped EXE
PID:3744 -
\??\c:\1pvpv.exec:\1pvpv.exe38⤵
- Executes dropped EXE
PID:736 -
\??\c:\hhnbnh.exec:\hhnbnh.exe39⤵
- Executes dropped EXE
PID:4780 -
\??\c:\66864.exec:\66864.exe40⤵
- Executes dropped EXE
PID:964 -
\??\c:\pjdvp.exec:\pjdvp.exe41⤵
- Executes dropped EXE
PID:836 -
\??\c:\42402.exec:\42402.exe42⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xxfrfxl.exec:\xxfrfxl.exe43⤵
- Executes dropped EXE
PID:2216 -
\??\c:\q26600.exec:\q26600.exe44⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vjvvj.exec:\vjvvj.exe45⤵
- Executes dropped EXE
PID:2476 -
\??\c:\a0048.exec:\a0048.exe46⤵
- Executes dropped EXE
PID:4584 -
\??\c:\llxlrlf.exec:\llxlrlf.exe47⤵
- Executes dropped EXE
PID:3156 -
\??\c:\08404.exec:\08404.exe48⤵
- Executes dropped EXE
PID:3356 -
\??\c:\dpvpv.exec:\dpvpv.exe49⤵
- Executes dropped EXE
PID:3852 -
\??\c:\5xrfrrf.exec:\5xrfrrf.exe50⤵
- Executes dropped EXE
PID:2512 -
\??\c:\462804.exec:\462804.exe51⤵
- Executes dropped EXE
PID:1160 -
\??\c:\8844266.exec:\8844266.exe52⤵
- Executes dropped EXE
PID:3516 -
\??\c:\htbnbb.exec:\htbnbb.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\640008.exec:\640008.exe54⤵
- Executes dropped EXE
PID:3676 -
\??\c:\bhbthb.exec:\bhbthb.exe55⤵
- Executes dropped EXE
PID:2092 -
\??\c:\u682008.exec:\u682008.exe56⤵
- Executes dropped EXE
PID:3468 -
\??\c:\40040.exec:\40040.exe57⤵
- Executes dropped EXE
PID:872 -
\??\c:\0060204.exec:\0060204.exe58⤵
- Executes dropped EXE
PID:684 -
\??\c:\8444448.exec:\8444448.exe59⤵
- Executes dropped EXE
PID:5072 -
\??\c:\xrlfxrr.exec:\xrlfxrr.exe60⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hbnhhb.exec:\hbnhhb.exe61⤵
- Executes dropped EXE
PID:624 -
\??\c:\thbnhb.exec:\thbnhb.exe62⤵
- Executes dropped EXE
PID:4844 -
\??\c:\vpppj.exec:\vpppj.exe63⤵
- Executes dropped EXE
PID:5024 -
\??\c:\hbthtt.exec:\hbthtt.exe64⤵
- Executes dropped EXE
PID:4640 -
\??\c:\9rxllrr.exec:\9rxllrr.exe65⤵
- Executes dropped EXE
PID:340 -
\??\c:\lxrlllf.exec:\lxrlllf.exe66⤵PID:4532
-
\??\c:\pjvpj.exec:\pjvpj.exe67⤵PID:1036
-
\??\c:\642626.exec:\642626.exe68⤵PID:388
-
\??\c:\ppdvj.exec:\ppdvj.exe69⤵PID:1860
-
\??\c:\e28604.exec:\e28604.exe70⤵PID:4232
-
\??\c:\5lllxxx.exec:\5lllxxx.exe71⤵PID:4768
-
\??\c:\3htnhn.exec:\3htnhn.exe72⤵PID:2420
-
\??\c:\xfxlfxr.exec:\xfxlfxr.exe73⤵PID:4244
-
\??\c:\02260.exec:\02260.exe74⤵PID:4668
-
\??\c:\vdvpv.exec:\vdvpv.exe75⤵PID:3988
-
\??\c:\bnbhnh.exec:\bnbhnh.exe76⤵PID:5036
-
\??\c:\jpjdv.exec:\jpjdv.exe77⤵PID:2128
-
\??\c:\640446.exec:\640446.exe78⤵PID:2828
-
\??\c:\66820.exec:\66820.exe79⤵PID:1512
-
\??\c:\6442486.exec:\6442486.exe80⤵PID:4056
-
\??\c:\nbnnnn.exec:\nbnnnn.exe81⤵PID:1952
-
\??\c:\82226.exec:\82226.exe82⤵PID:1616
-
\??\c:\88048.exec:\88048.exe83⤵PID:3736
-
\??\c:\7tbbnn.exec:\7tbbnn.exe84⤵PID:2612
-
\??\c:\244484.exec:\244484.exe85⤵PID:4004
-
\??\c:\8884800.exec:\8884800.exe86⤵PID:5096
-
\??\c:\8248226.exec:\8248226.exe87⤵PID:4372
-
\??\c:\0686660.exec:\0686660.exe88⤵PID:3560
-
\??\c:\9djjv.exec:\9djjv.exe89⤵PID:1348
-
\??\c:\hbbnnn.exec:\hbbnnn.exe90⤵PID:3264
-
\??\c:\9ntttt.exec:\9ntttt.exe91⤵PID:4024
-
\??\c:\4682600.exec:\4682600.exe92⤵PID:3392
-
\??\c:\8844888.exec:\8844888.exe93⤵PID:4816
-
\??\c:\4044488.exec:\4044488.exe94⤵PID:1336
-
\??\c:\c448888.exec:\c448888.exe95⤵PID:3420
-
\??\c:\9tnnnn.exec:\9tnnnn.exe96⤵PID:1388
-
\??\c:\vpvvp.exec:\vpvvp.exe97⤵PID:4664
-
\??\c:\8004882.exec:\8004882.exe98⤵PID:3084
-
\??\c:\8444880.exec:\8444880.exe99⤵PID:4288
-
\??\c:\o044006.exec:\o044006.exe100⤵PID:3360
-
\??\c:\44444.exec:\44444.exe101⤵PID:4540
-
\??\c:\nntnbb.exec:\nntnbb.exe102⤵PID:4544
-
\??\c:\hbbttt.exec:\hbbttt.exe103⤵PID:2476
-
\??\c:\bttnnh.exec:\bttnnh.exe104⤵PID:4584
-
\??\c:\jdjdd.exec:\jdjdd.exe105⤵PID:3156
-
\??\c:\3bnnhn.exec:\3bnnhn.exe106⤵PID:3200
-
\??\c:\pdpdp.exec:\pdpdp.exe107⤵PID:2820
-
\??\c:\006600.exec:\006600.exe108⤵PID:4296
-
\??\c:\0804888.exec:\0804888.exe109⤵PID:1868
-
\??\c:\662482.exec:\662482.exe110⤵PID:2412
-
\??\c:\7vjdp.exec:\7vjdp.exe111⤵PID:2104
-
\??\c:\8206044.exec:\8206044.exe112⤵PID:2292
-
\??\c:\28488.exec:\28488.exe113⤵PID:4508
-
\??\c:\480466.exec:\480466.exe114⤵PID:2000
-
\??\c:\3lfrllf.exec:\3lfrllf.exe115⤵PID:4276
-
\??\c:\802600.exec:\802600.exe116⤵
- System Location Discovery: System Language Discovery
PID:2724 -
\??\c:\ddvpj.exec:\ddvpj.exe117⤵PID:1100
-
\??\c:\g0260.exec:\g0260.exe118⤵PID:3256
-
\??\c:\4284260.exec:\4284260.exe119⤵PID:3720
-
\??\c:\66228.exec:\66228.exe120⤵PID:2012
-
\??\c:\hthtnh.exec:\hthtnh.exe121⤵PID:3136
-
\??\c:\w04826.exec:\w04826.exe122⤵PID:2540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-