Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe
-
Size
452KB
-
MD5
f2b2cef7fffe44e4b96bc20883a0c280
-
SHA1
26c24cb4e944023c1dd676813df174a9c4f1a502
-
SHA256
8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51a
-
SHA512
2ee4578ca489305f25298d570fe84b76ffe2393cac60de0bd341674dbfde050dea41a9a8fe539ac488422ed0003e1a5276ad450189589028f8704445937e4690
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1892-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-825-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-995-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-1074-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-1087-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1892 pjjdv.exe 1044 rxfxxlf.exe 5048 lfxlffl.exe 948 ntthtt.exe 3088 xrxrrlf.exe 2560 lllrxfl.exe 2320 bnnbtn.exe 4860 3lrflfl.exe 4716 nhnhhh.exe 4588 xrfxrlf.exe 4976 lflrlfx.exe 1968 jdpjp.exe 4380 lxrllfr.exe 4536 ttnhbb.exe 2716 djpjd.exe 1204 hnthtt.exe 2888 pjpdd.exe 3836 rxxlxrl.exe 3948 1pvpv.exe 5056 dvppj.exe 3092 rlrllfx.exe 1476 ntbbnt.exe 3320 pdvpj.exe 4684 rrrlxfx.exe 1904 nhbbtt.exe 3448 ddvvp.exe 1056 3rrxlff.exe 4792 llxrxxx.exe 2692 bnnnnn.exe 3216 frrrlrl.exe 3312 tnthbb.exe 4996 ppppj.exe 1928 7thbnh.exe 1488 pdddv.exe 3800 hnhthb.exe 4244 dppdv.exe 3628 tbhbtn.exe 1564 vppjj.exe 4596 rfllffr.exe 816 bnbbhh.exe 2908 tnnbth.exe 4600 lffxrrl.exe 1992 hbnbbn.exe 2444 djpjd.exe 2976 vjpjd.exe 3972 tnhtbt.exe 1892 nnthhb.exe 2120 vvdvp.exe 3224 flxfxrf.exe 1100 xrxfxlf.exe 768 nnhbnn.exe 2828 ddjdv.exe 2296 lrlxflr.exe 3632 btnntt.exe 1760 dvdvj.exe 1708 1fxfxxr.exe 3204 lrxrlfx.exe 1720 nnhbtn.exe 2964 jdjjp.exe 3864 5xxrxxx.exe 3524 5nnbnh.exe 3040 1ppjv.exe 2476 jvjdp.exe 3196 xflxrlx.exe -
resource yara_rule behavioral2/memory/1892-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-562-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xllrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3972 wrote to memory of 1892 3972 8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe 83 PID 3972 wrote to memory of 1892 3972 8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe 83 PID 3972 wrote to memory of 1892 3972 8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe 83 PID 1892 wrote to memory of 1044 1892 pjjdv.exe 84 PID 1892 wrote to memory of 1044 1892 pjjdv.exe 84 PID 1892 wrote to memory of 1044 1892 pjjdv.exe 84 PID 1044 wrote to memory of 5048 1044 rxfxxlf.exe 85 PID 1044 wrote to memory of 5048 1044 rxfxxlf.exe 85 PID 1044 wrote to memory of 5048 1044 rxfxxlf.exe 85 PID 5048 wrote to memory of 948 5048 lfxlffl.exe 86 PID 5048 wrote to memory of 948 5048 lfxlffl.exe 86 PID 5048 wrote to memory of 948 5048 lfxlffl.exe 86 PID 948 wrote to memory of 3088 948 ntthtt.exe 87 PID 948 wrote to memory of 3088 948 ntthtt.exe 87 PID 948 wrote to memory of 3088 948 ntthtt.exe 87 PID 3088 wrote to memory of 2560 3088 xrxrrlf.exe 88 PID 3088 wrote to memory of 2560 3088 xrxrrlf.exe 88 PID 3088 wrote to memory of 2560 3088 xrxrrlf.exe 88 PID 2560 wrote to memory of 2320 2560 lllrxfl.exe 89 PID 2560 wrote to memory of 2320 2560 lllrxfl.exe 89 PID 2560 wrote to memory of 2320 2560 lllrxfl.exe 89 PID 2320 wrote to memory of 4860 2320 bnnbtn.exe 90 PID 2320 wrote to memory of 4860 2320 bnnbtn.exe 90 PID 2320 wrote to memory of 4860 2320 bnnbtn.exe 90 PID 4860 wrote to memory of 4716 4860 3lrflfl.exe 91 PID 4860 wrote to memory of 4716 4860 3lrflfl.exe 91 PID 4860 wrote to memory of 4716 4860 3lrflfl.exe 91 PID 4716 wrote to memory of 4588 4716 nhnhhh.exe 92 PID 4716 wrote to memory of 4588 4716 nhnhhh.exe 92 PID 4716 wrote to memory of 4588 4716 nhnhhh.exe 92 PID 4588 wrote to memory of 4976 4588 xrfxrlf.exe 93 PID 4588 wrote to memory of 4976 4588 xrfxrlf.exe 93 PID 4588 wrote to memory of 4976 4588 xrfxrlf.exe 93 PID 4976 wrote to memory of 1968 4976 lflrlfx.exe 94 PID 4976 wrote to memory of 1968 4976 lflrlfx.exe 94 PID 4976 wrote to memory of 1968 4976 lflrlfx.exe 94 PID 1968 wrote to memory of 4380 1968 jdpjp.exe 95 PID 1968 wrote to memory of 4380 1968 jdpjp.exe 95 PID 1968 wrote to memory of 4380 1968 jdpjp.exe 95 PID 4380 wrote to memory of 4536 4380 lxrllfr.exe 96 PID 4380 wrote to memory of 4536 4380 lxrllfr.exe 96 PID 4380 wrote to memory of 4536 4380 lxrllfr.exe 96 PID 4536 wrote to memory of 2716 4536 ttnhbb.exe 97 PID 4536 wrote to memory of 2716 4536 ttnhbb.exe 97 PID 4536 wrote to memory of 2716 4536 ttnhbb.exe 97 PID 2716 wrote to memory of 1204 2716 djpjd.exe 98 PID 2716 wrote to memory of 1204 2716 djpjd.exe 98 PID 2716 wrote to memory of 1204 2716 djpjd.exe 98 PID 1204 wrote to memory of 2888 1204 hnthtt.exe 99 PID 1204 wrote to memory of 2888 1204 hnthtt.exe 99 PID 1204 wrote to memory of 2888 1204 hnthtt.exe 99 PID 2888 wrote to memory of 3836 2888 pjpdd.exe 100 PID 2888 wrote to memory of 3836 2888 pjpdd.exe 100 PID 2888 wrote to memory of 3836 2888 pjpdd.exe 100 PID 3836 wrote to memory of 3948 3836 rxxlxrl.exe 101 PID 3836 wrote to memory of 3948 3836 rxxlxrl.exe 101 PID 3836 wrote to memory of 3948 3836 rxxlxrl.exe 101 PID 3948 wrote to memory of 5056 3948 1pvpv.exe 102 PID 3948 wrote to memory of 5056 3948 1pvpv.exe 102 PID 3948 wrote to memory of 5056 3948 1pvpv.exe 102 PID 5056 wrote to memory of 3092 5056 dvppj.exe 103 PID 5056 wrote to memory of 3092 5056 dvppj.exe 103 PID 5056 wrote to memory of 3092 5056 dvppj.exe 103 PID 3092 wrote to memory of 1476 3092 rlrllfx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe"C:\Users\Admin\AppData\Local\Temp\8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\pjjdv.exec:\pjjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\rxfxxlf.exec:\rxfxxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\lfxlffl.exec:\lfxlffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\ntthtt.exec:\ntthtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\xrxrrlf.exec:\xrxrrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\lllrxfl.exec:\lllrxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\bnnbtn.exec:\bnnbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\3lrflfl.exec:\3lrflfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\nhnhhh.exec:\nhnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\lflrlfx.exec:\lflrlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\jdpjp.exec:\jdpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\lxrllfr.exec:\lxrllfr.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\ttnhbb.exec:\ttnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\djpjd.exec:\djpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\hnthtt.exec:\hnthtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\pjpdd.exec:\pjpdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\1pvpv.exec:\1pvpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\dvppj.exec:\dvppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\rlrllfx.exec:\rlrllfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\ntbbnt.exec:\ntbbnt.exe23⤵
- Executes dropped EXE
PID:1476 -
\??\c:\pdvpj.exec:\pdvpj.exe24⤵
- Executes dropped EXE
PID:3320 -
\??\c:\rrrlxfx.exec:\rrrlxfx.exe25⤵
- Executes dropped EXE
PID:4684 -
\??\c:\nhbbtt.exec:\nhbbtt.exe26⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ddvvp.exec:\ddvvp.exe27⤵
- Executes dropped EXE
PID:3448 -
\??\c:\3rrxlff.exec:\3rrxlff.exe28⤵
- Executes dropped EXE
PID:1056 -
\??\c:\llxrxxx.exec:\llxrxxx.exe29⤵
- Executes dropped EXE
PID:4792 -
\??\c:\bnnnnn.exec:\bnnnnn.exe30⤵
- Executes dropped EXE
PID:2692 -
\??\c:\frrrlrl.exec:\frrrlrl.exe31⤵
- Executes dropped EXE
PID:3216 -
\??\c:\tnthbb.exec:\tnthbb.exe32⤵
- Executes dropped EXE
PID:3312 -
\??\c:\ppppj.exec:\ppppj.exe33⤵
- Executes dropped EXE
PID:4996 -
\??\c:\7thbnh.exec:\7thbnh.exe34⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pdddv.exec:\pdddv.exe35⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hnhthb.exec:\hnhthb.exe36⤵
- Executes dropped EXE
PID:3800 -
\??\c:\dppdv.exec:\dppdv.exe37⤵
- Executes dropped EXE
PID:4244 -
\??\c:\tbhbtn.exec:\tbhbtn.exe38⤵
- Executes dropped EXE
PID:3628 -
\??\c:\vppjj.exec:\vppjj.exe39⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rfllffr.exec:\rfllffr.exe40⤵
- Executes dropped EXE
PID:4596 -
\??\c:\bnbbhh.exec:\bnbbhh.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:816 -
\??\c:\tnnbth.exec:\tnnbth.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lffxrrl.exec:\lffxrrl.exe43⤵
- Executes dropped EXE
PID:4600 -
\??\c:\hbnbbn.exec:\hbnbbn.exe44⤵
- Executes dropped EXE
PID:1992 -
\??\c:\djpjd.exec:\djpjd.exe45⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vjpjd.exec:\vjpjd.exe46⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe47⤵
- System Location Discovery: System Language Discovery
PID:964 -
\??\c:\tnhtbt.exec:\tnhtbt.exe48⤵
- Executes dropped EXE
PID:3972 -
\??\c:\nnthhb.exec:\nnthhb.exe49⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vvdvp.exec:\vvdvp.exe50⤵
- Executes dropped EXE
PID:2120 -
\??\c:\flxfxrf.exec:\flxfxrf.exe51⤵
- Executes dropped EXE
PID:3224 -
\??\c:\xrxfxlf.exec:\xrxfxlf.exe52⤵
- Executes dropped EXE
PID:1100 -
\??\c:\nnhbnn.exec:\nnhbnn.exe53⤵
- Executes dropped EXE
PID:768 -
\??\c:\ddjdv.exec:\ddjdv.exe54⤵
- Executes dropped EXE
PID:2828 -
\??\c:\lrlxflr.exec:\lrlxflr.exe55⤵
- Executes dropped EXE
PID:2296 -
\??\c:\btnntt.exec:\btnntt.exe56⤵
- Executes dropped EXE
PID:3632 -
\??\c:\dvdvj.exec:\dvdvj.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1fxfxxr.exec:\1fxfxxr.exe58⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe59⤵
- Executes dropped EXE
PID:3204 -
\??\c:\nnhbtn.exec:\nnhbtn.exe60⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jdjjp.exec:\jdjjp.exe61⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5xxrxxx.exec:\5xxrxxx.exe62⤵
- Executes dropped EXE
PID:3864 -
\??\c:\5nnbnh.exec:\5nnbnh.exe63⤵
- Executes dropped EXE
PID:3524 -
\??\c:\1ppjv.exec:\1ppjv.exe64⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jvjdp.exec:\jvjdp.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xflxrlx.exec:\xflxrlx.exe66⤵
- Executes dropped EXE
PID:3196 -
\??\c:\1ddpj.exec:\1ddpj.exe67⤵PID:3716
-
\??\c:\7rlxlfx.exec:\7rlxlfx.exe68⤵PID:2612
-
\??\c:\xlrrllf.exec:\xlrrllf.exe69⤵PID:3696
-
\??\c:\tnnbnh.exec:\tnnbnh.exe70⤵PID:1236
-
\??\c:\hbnbhb.exec:\hbnbhb.exe71⤵PID:1492
-
\??\c:\jvvjv.exec:\jvvjv.exe72⤵PID:3512
-
\??\c:\rxxrlfr.exec:\rxxrlfr.exe73⤵PID:2432
-
\??\c:\bbnhnn.exec:\bbnhnn.exe74⤵PID:4900
-
\??\c:\pjjdd.exec:\pjjdd.exe75⤵PID:3568
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe76⤵PID:4616
-
\??\c:\xrrllll.exec:\xrrllll.exe77⤵PID:860
-
\??\c:\3nbnhh.exec:\3nbnhh.exe78⤵PID:4688
-
\??\c:\jppdv.exec:\jppdv.exe79⤵PID:1184
-
\??\c:\xxfxllr.exec:\xxfxllr.exe80⤵PID:1864
-
\??\c:\7ttnhh.exec:\7ttnhh.exe81⤵PID:1924
-
\??\c:\tnbthb.exec:\tnbthb.exe82⤵PID:3720
-
\??\c:\dppjp.exec:\dppjp.exe83⤵PID:3408
-
\??\c:\rflffxx.exec:\rflffxx.exe84⤵PID:4712
-
\??\c:\htnnnn.exec:\htnnnn.exe85⤵PID:3448
-
\??\c:\hnnhbt.exec:\hnnhbt.exe86⤵PID:2044
-
\??\c:\ddvvp.exec:\ddvvp.exe87⤵PID:1664
-
\??\c:\xxlrlll.exec:\xxlrlll.exe88⤵PID:1616
-
\??\c:\7rxrffr.exec:\7rxrffr.exe89⤵PID:2616
-
\??\c:\9hbnhh.exec:\9hbnhh.exe90⤵PID:3380
-
\??\c:\3ppdv.exec:\3ppdv.exe91⤵PID:3164
-
\??\c:\xfxrlxr.exec:\xfxrlxr.exe92⤵PID:4124
-
\??\c:\ttnbht.exec:\ttnbht.exe93⤵PID:3112
-
\??\c:\jpvpj.exec:\jpvpj.exe94⤵PID:4872
-
\??\c:\xrlrffx.exec:\xrlrffx.exe95⤵PID:2780
-
\??\c:\5lrrrrr.exec:\5lrrrrr.exe96⤵PID:4528
-
\??\c:\tntnnn.exec:\tntnnn.exe97⤵PID:3680
-
\??\c:\vvvdv.exec:\vvvdv.exe98⤵PID:3628
-
\??\c:\lllxfxf.exec:\lllxfxf.exe99⤵PID:4772
-
\??\c:\bbnnnb.exec:\bbnnnb.exe100⤵PID:3160
-
\??\c:\jpppd.exec:\jpppd.exe101⤵PID:816
-
\??\c:\3xxrllf.exec:\3xxrllf.exe102⤵PID:2908
-
\??\c:\fxxlxrf.exec:\fxxlxrf.exe103⤵PID:4968
-
\??\c:\hhhhbb.exec:\hhhhbb.exe104⤵PID:3484
-
\??\c:\pvdpd.exec:\pvdpd.exe105⤵PID:2444
-
\??\c:\9pvpj.exec:\9pvpj.exe106⤵PID:1064
-
\??\c:\lllxlrl.exec:\lllxlrl.exe107⤵PID:4816
-
\??\c:\httnnh.exec:\httnnh.exe108⤵PID:3972
-
\??\c:\vjjdj.exec:\vjjdj.exe109⤵PID:1892
-
\??\c:\dppjv.exec:\dppjv.exe110⤵PID:2120
-
\??\c:\xrrrllf.exec:\xrrrllf.exe111⤵PID:3224
-
\??\c:\nbtnhh.exec:\nbtnhh.exe112⤵PID:1100
-
\??\c:\dddvp.exec:\dddvp.exe113⤵PID:768
-
\??\c:\5xfxflr.exec:\5xfxflr.exe114⤵PID:1808
-
\??\c:\tbhttt.exec:\tbhttt.exe115⤵PID:2296
-
\??\c:\1ddvp.exec:\1ddvp.exe116⤵PID:548
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe117⤵PID:1080
-
\??\c:\7hbbbh.exec:\7hbbbh.exe118⤵PID:1680
-
\??\c:\dpdpd.exec:\dpdpd.exe119⤵PID:1612
-
\??\c:\7rlxfxr.exec:\7rlxfxr.exe120⤵PID:868
-
\??\c:\1nbbnn.exec:\1nbbnn.exe121⤵PID:2328
-
\??\c:\jjjdj.exec:\jjjdj.exe122⤵PID:4416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-