Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 21:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0bdd94c7a2add866848b4da948c35dea4aeb8675dc69cbcc7500dfe3a3efc898.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
0bdd94c7a2add866848b4da948c35dea4aeb8675dc69cbcc7500dfe3a3efc898.exe
-
Size
343KB
-
MD5
2eea5f929dc560bd11ec586808ec4e3b
-
SHA1
f417759e4572e2bf842d27144326df8a9f927615
-
SHA256
0bdd94c7a2add866848b4da948c35dea4aeb8675dc69cbcc7500dfe3a3efc898
-
SHA512
6a9bf998d7f7dee47db2f6461b7ac1537581cc40634d8207caec8b1236980b26e45cbc190c8c6bdfb9c49d8c4e689cf11aea1157d53d4a8a46721fc305f79e72
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAa:l7TcbWXZshJX2VGda
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4980-5-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2328-14-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/540-27-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1968-24-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4948-37-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4456-12-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3296-52-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1320-58-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3720-64-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1252-81-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4988-89-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3920-87-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/760-99-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1100-114-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2196-127-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3848-122-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1864-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1604-149-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4528-181-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3992-193-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4920-197-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4152-204-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4412-208-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2284-219-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4264-215-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3148-227-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3148-222-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3636-186-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4808-243-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2296-176-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/560-108-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2888-75-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4484-271-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3940-281-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/956-286-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/604-295-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1924-299-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2292-306-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4336-319-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1576-329-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2340-358-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4524-368-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3752-382-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5020-389-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1176-402-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1364-418-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4692-425-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2100-447-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3988-460-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/856-479-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4768-495-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5004-499-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3608-506-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1732-555-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2100-583-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4832-635-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/904-708-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/116-715-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3736-725-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5008-750-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1188-775-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5116-843-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1904-889-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4692-950-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4456 jjvdp.exe 2328 xfllffx.exe 540 bhbbtb.exe 1968 jpvpp.exe 4948 rflfffl.exe 2412 rrllllf.exe 1668 1nttth.exe 3296 vdjjd.exe 1320 fxrxrll.exe 3720 nbtbnh.exe 1652 vddvv.exe 2888 bnbntt.exe 1252 bhnnbn.exe 4988 vdppv.exe 3920 lrrrfrx.exe 760 hhtttb.exe 2484 jdpjj.exe 560 xxxxfll.exe 1100 nbtbbh.exe 3848 dpvpp.exe 2428 1lrllrl.exe 2196 lfrrffl.exe 1864 thbbbh.exe 3716 vpjjj.exe 1604 bbttnn.exe 5040 hbnhhn.exe 3696 9ppjj.exe 4800 xrfffrr.exe 4236 jjddd.exe 2296 ffllrxx.exe 4528 lrxxxff.exe 3636 tnttbb.exe 3252 rlllxxx.exe 3992 fxlrrxf.exe 4920 tnnntt.exe 2396 ppvpp.exe 4152 vvpdp.exe 4412 xxrrrll.exe 4072 bnnhnt.exe 4264 ttnnnn.exe 2284 3djjp.exe 5032 rfxrffl.exe 3148 xlxxffl.exe 5112 hbhhnn.exe 4156 thhbbt.exe 4916 1jvpv.exe 1876 lxffxrr.exe 4808 ffrxrrl.exe 4032 bbbbbh.exe 1800 dvjdj.exe 4972 vjppj.exe 1944 7lxxxxl.exe 180 lflffll.exe 828 nbtthb.exe 1652 tntnnb.exe 3496 ppjjj.exe 4484 llffflx.exe 1252 xxfflll.exe 1796 7pvpp.exe 3940 jjjdd.exe 956 xlxxxxx.exe 5116 xxlrxxl.exe 3180 bhhbbb.exe 604 jjjjv.exe -
resource yara_rule behavioral2/memory/4980-5-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2328-14-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/540-27-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1968-24-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4948-31-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4948-37-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4456-12-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3296-52-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1320-58-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3720-64-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1252-81-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4988-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3920-87-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/760-99-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1100-114-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2196-127-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3848-122-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1864-136-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1604-149-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4528-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3992-193-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4920-197-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4152-204-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4412-208-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2284-219-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4264-215-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3148-227-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3148-222-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3636-186-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4808-243-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2296-176-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/180-256-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2296-170-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/560-108-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2888-75-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4484-271-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3940-281-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/956-286-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/604-295-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1924-299-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2292-306-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4336-319-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1576-329-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2340-358-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4524-368-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3752-382-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5020-389-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1176-402-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1364-418-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4692-425-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2100-447-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3988-460-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/856-479-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4768-495-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5004-499-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3608-506-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1732-555-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2100-583-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4832-635-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/904-708-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/116-715-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3736-725-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5008-750-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1188-775-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4456 4980 0bdd94c7a2add866848b4da948c35dea4aeb8675dc69cbcc7500dfe3a3efc898.exe 84 PID 4980 wrote to memory of 4456 4980 0bdd94c7a2add866848b4da948c35dea4aeb8675dc69cbcc7500dfe3a3efc898.exe 84 PID 4980 wrote to memory of 4456 4980 0bdd94c7a2add866848b4da948c35dea4aeb8675dc69cbcc7500dfe3a3efc898.exe 84 PID 4456 wrote to memory of 2328 4456 jjvdp.exe 85 PID 4456 wrote to memory of 2328 4456 jjvdp.exe 85 PID 4456 wrote to memory of 2328 4456 jjvdp.exe 85 PID 2328 wrote to memory of 540 2328 xfllffx.exe 86 PID 2328 wrote to memory of 540 2328 xfllffx.exe 86 PID 2328 wrote to memory of 540 2328 xfllffx.exe 86 PID 540 wrote to memory of 1968 540 bhbbtb.exe 87 PID 540 wrote to memory of 1968 540 bhbbtb.exe 87 PID 540 wrote to memory of 1968 540 bhbbtb.exe 87 PID 1968 wrote to memory of 4948 1968 jpvpp.exe 88 PID 1968 wrote to memory of 4948 1968 jpvpp.exe 88 PID 1968 wrote to memory of 4948 1968 jpvpp.exe 88 PID 4948 wrote to memory of 2412 4948 rflfffl.exe 89 PID 4948 wrote to memory of 2412 4948 rflfffl.exe 89 PID 4948 wrote to memory of 2412 4948 rflfffl.exe 89 PID 2412 wrote to memory of 1668 2412 rrllllf.exe 90 PID 2412 wrote to memory of 1668 2412 rrllllf.exe 90 PID 2412 wrote to memory of 1668 2412 rrllllf.exe 90 PID 1668 wrote to memory of 3296 1668 1nttth.exe 92 PID 1668 wrote to memory of 3296 1668 1nttth.exe 92 PID 1668 wrote to memory of 3296 1668 1nttth.exe 92 PID 3296 wrote to memory of 1320 3296 vdjjd.exe 93 PID 3296 wrote to memory of 1320 3296 vdjjd.exe 93 PID 3296 wrote to memory of 1320 3296 vdjjd.exe 93 PID 1320 wrote to memory of 3720 1320 fxrxrll.exe 94 PID 1320 wrote to memory of 3720 1320 fxrxrll.exe 94 PID 1320 wrote to memory of 3720 1320 fxrxrll.exe 94 PID 3720 wrote to memory of 1652 3720 nbtbnh.exe 141 PID 3720 wrote to memory of 1652 3720 nbtbnh.exe 141 PID 3720 wrote to memory of 1652 3720 nbtbnh.exe 141 PID 1652 wrote to memory of 2888 1652 vddvv.exe 97 PID 1652 wrote to memory of 2888 1652 vddvv.exe 97 PID 1652 wrote to memory of 2888 1652 vddvv.exe 97 PID 2888 wrote to memory of 1252 2888 bnbntt.exe 144 PID 2888 wrote to memory of 1252 2888 bnbntt.exe 144 PID 2888 wrote to memory of 1252 2888 bnbntt.exe 144 PID 1252 wrote to memory of 4988 1252 bhnnbn.exe 99 PID 1252 wrote to memory of 4988 1252 bhnnbn.exe 99 PID 1252 wrote to memory of 4988 1252 bhnnbn.exe 99 PID 4988 wrote to memory of 3920 4988 vdppv.exe 101 PID 4988 wrote to memory of 3920 4988 vdppv.exe 101 PID 4988 wrote to memory of 3920 4988 vdppv.exe 101 PID 3920 wrote to memory of 760 3920 lrrrfrx.exe 102 PID 3920 wrote to memory of 760 3920 lrrrfrx.exe 102 PID 3920 wrote to memory of 760 3920 lrrrfrx.exe 102 PID 760 wrote to memory of 2484 760 hhtttb.exe 103 PID 760 wrote to memory of 2484 760 hhtttb.exe 103 PID 760 wrote to memory of 2484 760 hhtttb.exe 103 PID 2484 wrote to memory of 560 2484 jdpjj.exe 104 PID 2484 wrote to memory of 560 2484 jdpjj.exe 104 PID 2484 wrote to memory of 560 2484 jdpjj.exe 104 PID 560 wrote to memory of 1100 560 xxxxfll.exe 152 PID 560 wrote to memory of 1100 560 xxxxfll.exe 152 PID 560 wrote to memory of 1100 560 xxxxfll.exe 152 PID 1100 wrote to memory of 3848 1100 nbtbbh.exe 106 PID 1100 wrote to memory of 3848 1100 nbtbbh.exe 106 PID 1100 wrote to memory of 3848 1100 nbtbbh.exe 106 PID 3848 wrote to memory of 2428 3848 dpvpp.exe 107 PID 3848 wrote to memory of 2428 3848 dpvpp.exe 107 PID 3848 wrote to memory of 2428 3848 dpvpp.exe 107 PID 2428 wrote to memory of 2196 2428 1lrllrl.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bdd94c7a2add866848b4da948c35dea4aeb8675dc69cbcc7500dfe3a3efc898.exe"C:\Users\Admin\AppData\Local\Temp\0bdd94c7a2add866848b4da948c35dea4aeb8675dc69cbcc7500dfe3a3efc898.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\jjvdp.exec:\jjvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\xfllffx.exec:\xfllffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\bhbbtb.exec:\bhbbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\jpvpp.exec:\jpvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\rflfffl.exec:\rflfffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\rrllllf.exec:\rrllllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\1nttth.exec:\1nttth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\vdjjd.exec:\vdjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\fxrxrll.exec:\fxrxrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\nbtbnh.exec:\nbtbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\vddvv.exec:\vddvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\bnbntt.exec:\bnbntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bhnnbn.exec:\bhnnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\vdppv.exec:\vdppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\lrrrfrx.exec:\lrrrfrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\hhtttb.exec:\hhtttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\jdpjj.exec:\jdpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\xxxxfll.exec:\xxxxfll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\nbtbbh.exec:\nbtbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\dpvpp.exec:\dpvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\1lrllrl.exec:\1lrllrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\lfrrffl.exec:\lfrrffl.exe23⤵
- Executes dropped EXE
PID:2196 -
\??\c:\thbbbh.exec:\thbbbh.exe24⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vpjjj.exec:\vpjjj.exe25⤵
- Executes dropped EXE
PID:3716 -
\??\c:\bbttnn.exec:\bbttnn.exe26⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hbnhhn.exec:\hbnhhn.exe27⤵
- Executes dropped EXE
PID:5040 -
\??\c:\9ppjj.exec:\9ppjj.exe28⤵
- Executes dropped EXE
PID:3696 -
\??\c:\xrfffrr.exec:\xrfffrr.exe29⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jjddd.exec:\jjddd.exe30⤵
- Executes dropped EXE
PID:4236 -
\??\c:\ffllrxx.exec:\ffllrxx.exe31⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lrxxxff.exec:\lrxxxff.exe32⤵
- Executes dropped EXE
PID:4528 -
\??\c:\tnttbb.exec:\tnttbb.exe33⤵
- Executes dropped EXE
PID:3636 -
\??\c:\rlllxxx.exec:\rlllxxx.exe34⤵
- Executes dropped EXE
PID:3252 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe35⤵
- Executes dropped EXE
PID:3992 -
\??\c:\tnnntt.exec:\tnnntt.exe36⤵
- Executes dropped EXE
PID:4920 -
\??\c:\ppvpp.exec:\ppvpp.exe37⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvpdp.exec:\vvpdp.exe38⤵
- Executes dropped EXE
PID:4152 -
\??\c:\xxrrrll.exec:\xxrrrll.exe39⤵
- Executes dropped EXE
PID:4412 -
\??\c:\bnnhnt.exec:\bnnhnt.exe40⤵
- Executes dropped EXE
PID:4072 -
\??\c:\ttnnnn.exec:\ttnnnn.exe41⤵
- Executes dropped EXE
PID:4264 -
\??\c:\3djjp.exec:\3djjp.exe42⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rfxrffl.exec:\rfxrffl.exe43⤵
- Executes dropped EXE
PID:5032 -
\??\c:\xlxxffl.exec:\xlxxffl.exe44⤵
- Executes dropped EXE
PID:3148 -
\??\c:\hbhhnn.exec:\hbhhnn.exe45⤵
- Executes dropped EXE
PID:5112 -
\??\c:\thhbbt.exec:\thhbbt.exe46⤵
- Executes dropped EXE
PID:4156 -
\??\c:\1jvpv.exec:\1jvpv.exe47⤵
- Executes dropped EXE
PID:4916 -
\??\c:\lxffxrr.exec:\lxffxrr.exe48⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ffrxrrl.exec:\ffrxrrl.exe49⤵
- Executes dropped EXE
PID:4808 -
\??\c:\bbbbbh.exec:\bbbbbh.exe50⤵
- Executes dropped EXE
PID:4032 -
\??\c:\dvjdj.exec:\dvjdj.exe51⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vjppj.exec:\vjppj.exe52⤵
- Executes dropped EXE
PID:4972 -
\??\c:\7lxxxxl.exec:\7lxxxxl.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lflffll.exec:\lflffll.exe54⤵
- Executes dropped EXE
PID:180 -
\??\c:\nbtthb.exec:\nbtthb.exe55⤵
- Executes dropped EXE
PID:828 -
\??\c:\tntnnb.exec:\tntnnb.exe56⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ppjjj.exec:\ppjjj.exe57⤵
- Executes dropped EXE
PID:3496 -
\??\c:\llffflx.exec:\llffflx.exe58⤵
- Executes dropped EXE
PID:4484 -
\??\c:\xxfflll.exec:\xxfflll.exe59⤵
- Executes dropped EXE
PID:1252 -
\??\c:\7pvpp.exec:\7pvpp.exe60⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jjjdd.exec:\jjjdd.exe61⤵
- Executes dropped EXE
PID:3940 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe62⤵
- Executes dropped EXE
PID:956 -
\??\c:\xxlrxxl.exec:\xxlrxxl.exe63⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bhhbbb.exec:\bhhbbb.exe64⤵
- Executes dropped EXE
PID:3180 -
\??\c:\jjjjv.exec:\jjjjv.exe65⤵
- Executes dropped EXE
PID:604 -
\??\c:\lxlllll.exec:\lxlllll.exe66⤵PID:1924
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe67⤵PID:1100
-
\??\c:\bnbttt.exec:\bnbttt.exe68⤵PID:2292
-
\??\c:\pdvvv.exec:\pdvvv.exe69⤵PID:2276
-
\??\c:\djvvv.exec:\djvvv.exe70⤵PID:512
-
\??\c:\rxlfffx.exec:\rxlfffx.exe71⤵PID:2376
-
\??\c:\hhnhbb.exec:\hhnhbb.exe72⤵PID:4336
-
\??\c:\pppjj.exec:\pppjj.exe73⤵PID:660
-
\??\c:\ddjjd.exec:\ddjjd.exe74⤵PID:3592
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe75⤵PID:1576
-
\??\c:\ttnntb.exec:\ttnntb.exe76⤵PID:1104
-
\??\c:\vvjjj.exec:\vvjjj.exe77⤵PID:3340
-
\??\c:\vjjdd.exec:\vjjdd.exe78⤵PID:1752
-
\??\c:\xxfffll.exec:\xxfffll.exe79⤵PID:2728
-
\??\c:\nnnbbn.exec:\nnnbbn.exe80⤵PID:4576
-
\??\c:\jjjpp.exec:\jjjpp.exe81⤵PID:4364
-
\??\c:\1djjj.exec:\1djjj.exe82⤵PID:4544
-
\??\c:\xlfrrxl.exec:\xlfrrxl.exe83⤵PID:4616
-
\??\c:\hhnnnh.exec:\hhnnnh.exe84⤵PID:2340
-
\??\c:\tbnnnn.exec:\tbnnnn.exe85⤵PID:3532
-
\??\c:\vjppj.exec:\vjppj.exe86⤵PID:1804
-
\??\c:\frlllrl.exec:\frlllrl.exe87⤵PID:4524
-
\??\c:\7frrrxf.exec:\7frrrxf.exe88⤵PID:4112
-
\??\c:\hhtbhh.exec:\hhtbhh.exe89⤵PID:4348
-
\??\c:\5pjdj.exec:\5pjdj.exe90⤵PID:8
-
\??\c:\ntbbbt.exec:\ntbbbt.exe91⤵PID:2264
-
\??\c:\tbtthh.exec:\tbtthh.exe92⤵PID:3752
-
\??\c:\1vjjj.exec:\1vjjj.exe93⤵PID:4120
-
\??\c:\rrlllrf.exec:\rrlllrf.exe94⤵PID:5020
-
\??\c:\ttttbn.exec:\ttttbn.exe95⤵PID:3024
-
\??\c:\pjppp.exec:\pjppp.exe96⤵PID:2108
-
\??\c:\7jvpp.exec:\7jvpp.exe97⤵PID:4156
-
\??\c:\1llxfxf.exec:\1llxfxf.exe98⤵PID:1176
-
\??\c:\rxlrrxx.exec:\rxlrrxx.exe99⤵PID:5016
-
\??\c:\pjdvj.exec:\pjdvj.exe100⤵PID:448
-
\??\c:\xxfxxfx.exec:\xxfxxfx.exe101⤵PID:3092
-
\??\c:\1xlfrrx.exec:\1xlfrrx.exe102⤵PID:5056
-
\??\c:\ntbthh.exec:\ntbthh.exe103⤵PID:1364
-
\??\c:\vppvp.exec:\vppvp.exe104⤵PID:2312
-
\??\c:\xxfffff.exec:\xxfffff.exe105⤵PID:4692
-
\??\c:\rllffff.exec:\rllffff.exe106⤵PID:4700
-
\??\c:\tnhhbh.exec:\tnhhbh.exe107⤵PID:1092
-
\??\c:\ddjjd.exec:\ddjjd.exe108⤵PID:2352
-
\??\c:\dvdvp.exec:\dvdvp.exe109⤵PID:1252
-
\??\c:\xlllxxx.exec:\xlllxxx.exe110⤵PID:3692
-
\??\c:\thtnht.exec:\thtnht.exe111⤵PID:3940
-
\??\c:\nhnnhh.exec:\nhnnhh.exe112⤵PID:2100
-
\??\c:\vvdvj.exec:\vvdvj.exe113⤵PID:4612
-
\??\c:\1xfxxxr.exec:\1xfxxxr.exe114⤵PID:4824
-
\??\c:\xfrlflf.exec:\xfrlflf.exe115⤵PID:2364
-
\??\c:\5bhhbb.exec:\5bhhbb.exe116⤵PID:3988
-
\??\c:\pppjd.exec:\pppjd.exe117⤵PID:4012
-
\??\c:\7llfflf.exec:\7llfflf.exe118⤵PID:1592
-
\??\c:\lfxrffl.exec:\lfxrffl.exe119⤵PID:2076
-
\??\c:\tnbtbb.exec:\tnbtbb.exe120⤵PID:1916
-
\??\c:\5jjdp.exec:\5jjdp.exe121⤵PID:4304
-
\??\c:\ddpjj.exec:\ddpjj.exe122⤵PID:856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-