Analysis
-
max time kernel
109s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 19:18
Static task
static1
Behavioral task
behavioral1
Sample
007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe
Resource
win7-20240903-en
General
-
Target
007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe
-
Size
347KB
-
MD5
b4e5c9ebabf727f2d7bab7cea1d15e69
-
SHA1
a7bccbd9363215628f854dbbfa0cadfd62ef32a4
-
SHA256
007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed
-
SHA512
164d56802d0b1935d5ba2d46a9a62c33e063f95e9ffe0eb66a611215e6b03ebf111a865c7e05177dce4acf66d97a050d94f083c3bc0ee7bfe50b715b38cffc7a
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA4:l7TcbWXZshJX2VGd4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3424-6-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1548-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4964-13-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3764-29-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2184-34-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3632-42-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/452-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3632-47-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5008-55-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1452-58-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2856-66-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2648-70-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1592-76-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4248-88-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5068-98-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1632-104-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/948-113-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1708-141-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4696-152-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5088-190-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4140-195-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2508-186-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2176-208-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1036-215-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3892-219-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2196-175-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/528-222-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2004-229-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4616-235-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3540-245-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4932-164-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5056-159-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1988-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/452-255-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3632-259-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4652-263-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2868-279-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4780-283-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4484-302-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1632-309-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2876-319-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1544-323-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1988-330-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4768-340-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1380-372-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1916-376-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2092-392-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3116-399-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4964-412-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3656-437-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2908-462-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1416-469-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/772-563-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2884-567-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4276-598-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1416-641-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2740-645-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3096-688-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3968-701-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4540-750-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5044-830-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2896-1106-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1340-1205-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1988-1784-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppjvp.exe846000.exe4802280.exejvddv.exe22604.exepppjj.exeddvvd.exe46260.exeflxxffl.exeg6888.exelxffxxr.exe8420808.exe284826.exe400226.exe02682.exetnbtnh.exehtbhhh.exe2065dv.exe9xxlrrx.exehhbhnn.exepddjp.exe6428400.exerrrlfxx.exea2482.exe82622.exe82044.exejppjj.exe1lxxffx.exe866600.exe86860.exelfrrffx.exe2428400.exehnbttt.exe8404826.exee20822.exe262602.exebtbbnn.exe0660448.exe8288660.exek44284.exenbtnhb.exe4842822.exe5pvpj.exexflxrxr.exek40426.exedvddv.exe4848046.exe604680.exe662048.exenbbnhb.exe1jjvp.exefxxlxlf.exedvjvd.exe28042.exe5rxrffx.exe206004.exe0824082.exeddvjp.exe266048.exeq08484.exentnnbh.exe5djdp.exe64442.exe9hnhnn.exepid process 4964 ppjvp.exe 1548 846000.exe 3504 4802280.exe 3764 jvddv.exe 2184 22604.exe 452 pppjj.exe 3632 ddvvd.exe 5008 46260.exe 1452 flxxffl.exe 2856 g6888.exe 2648 lxffxxr.exe 1592 8420808.exe 1972 284826.exe 4248 400226.exe 4484 02682.exe 5068 tnbtnh.exe 1632 htbhhh.exe 948 2065dv.exe 4416 9xxlrrx.exe 2556 hhbhnn.exe 3904 pddjp.exe 2400 6428400.exe 1988 rrrlfxx.exe 1708 a2482.exe 2888 82622.exe 4696 82044.exe 5056 jppjj.exe 4932 1lxxffx.exe 3600 866600.exe 2196 86860.exe 2492 lfrrffx.exe 2508 2428400.exe 5088 hnbttt.exe 4140 8404826.exe 3516 e20822.exe 220 262602.exe 2176 btbbnn.exe 1936 0660448.exe 1036 8288660.exe 3892 k44284.exe 528 nbtnhb.exe 4580 4842822.exe 2004 5pvpj.exe 3192 xflxrxr.exe 4616 k40426.exe 1824 dvddv.exe 3652 4848046.exe 3540 604680.exe 1892 662048.exe 2184 nbbnhb.exe 452 1jjvp.exe 3632 fxxlxlf.exe 4652 dvjvd.exe 180 28042.exe 1112 5rxrffx.exe 2996 206004.exe 1504 0824082.exe 2868 ddvjp.exe 4780 266048.exe 5112 q08484.exe 1820 ntnnbh.exe 4936 5djdp.exe 4092 64442.exe 5072 9hnhnn.exe -
Processes:
resource yara_rule behavioral2/memory/3424-6-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1548-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4964-13-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3764-23-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3764-29-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2184-34-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3632-42-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/452-41-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5008-49-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3632-47-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5008-55-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1452-58-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2856-66-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2648-70-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1592-76-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4248-88-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5068-98-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1632-104-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/948-107-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2556-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/948-113-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1708-141-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4696-152-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5088-190-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4140-195-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2508-186-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2176-208-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1936-206-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1036-215-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3892-219-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2196-175-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/528-222-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2004-229-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4616-235-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3540-245-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4932-164-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5056-159-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1988-136-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/452-255-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3632-259-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4652-263-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2868-279-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4780-283-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4484-302-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1632-309-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2876-319-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1544-323-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1988-330-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4768-340-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1380-372-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1916-376-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2092-392-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3116-399-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4964-412-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3656-437-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2908-462-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1416-469-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/772-563-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2884-567-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4276-598-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1416-641-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2740-645-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3096-688-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3968-701-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
82044.exe280000.exe866048.exe668082.exe82484.exejpvpp.exe64260.exee20822.exe5djdp.exevvpdp.exe2808226.exe2048444.exe4882042.exe2808600.exeflllxrl.exe3nhthb.exe5vvpd.exe2844882.exe488088.exee28266.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 866048.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 668082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e20822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2808226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2048444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4882042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2808600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2844882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 488088.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e28266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exeppjvp.exe846000.exe4802280.exejvddv.exe22604.exepppjj.exeddvvd.exe46260.exeflxxffl.exeg6888.exelxffxxr.exe8420808.exe284826.exe400226.exe02682.exetnbtnh.exehtbhhh.exe2065dv.exe9xxlrrx.exehhbhnn.exepddjp.exedescription pid process target process PID 3424 wrote to memory of 4964 3424 007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe ppjvp.exe PID 3424 wrote to memory of 4964 3424 007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe ppjvp.exe PID 3424 wrote to memory of 4964 3424 007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe ppjvp.exe PID 4964 wrote to memory of 1548 4964 ppjvp.exe 846000.exe PID 4964 wrote to memory of 1548 4964 ppjvp.exe 846000.exe PID 4964 wrote to memory of 1548 4964 ppjvp.exe 846000.exe PID 1548 wrote to memory of 3504 1548 846000.exe 4802280.exe PID 1548 wrote to memory of 3504 1548 846000.exe 4802280.exe PID 1548 wrote to memory of 3504 1548 846000.exe 4802280.exe PID 3504 wrote to memory of 3764 3504 4802280.exe jvddv.exe PID 3504 wrote to memory of 3764 3504 4802280.exe jvddv.exe PID 3504 wrote to memory of 3764 3504 4802280.exe jvddv.exe PID 3764 wrote to memory of 2184 3764 jvddv.exe 22604.exe PID 3764 wrote to memory of 2184 3764 jvddv.exe 22604.exe PID 3764 wrote to memory of 2184 3764 jvddv.exe 22604.exe PID 2184 wrote to memory of 452 2184 22604.exe pppjj.exe PID 2184 wrote to memory of 452 2184 22604.exe pppjj.exe PID 2184 wrote to memory of 452 2184 22604.exe pppjj.exe PID 452 wrote to memory of 3632 452 pppjj.exe ddvvd.exe PID 452 wrote to memory of 3632 452 pppjj.exe ddvvd.exe PID 452 wrote to memory of 3632 452 pppjj.exe ddvvd.exe PID 3632 wrote to memory of 5008 3632 ddvvd.exe 46260.exe PID 3632 wrote to memory of 5008 3632 ddvvd.exe 46260.exe PID 3632 wrote to memory of 5008 3632 ddvvd.exe 46260.exe PID 5008 wrote to memory of 1452 5008 46260.exe flxxffl.exe PID 5008 wrote to memory of 1452 5008 46260.exe flxxffl.exe PID 5008 wrote to memory of 1452 5008 46260.exe flxxffl.exe PID 1452 wrote to memory of 2856 1452 flxxffl.exe g6888.exe PID 1452 wrote to memory of 2856 1452 flxxffl.exe g6888.exe PID 1452 wrote to memory of 2856 1452 flxxffl.exe g6888.exe PID 2856 wrote to memory of 2648 2856 g6888.exe lxffxxr.exe PID 2856 wrote to memory of 2648 2856 g6888.exe lxffxxr.exe PID 2856 wrote to memory of 2648 2856 g6888.exe lxffxxr.exe PID 2648 wrote to memory of 1592 2648 lxffxxr.exe 8420808.exe PID 2648 wrote to memory of 1592 2648 lxffxxr.exe 8420808.exe PID 2648 wrote to memory of 1592 2648 lxffxxr.exe 8420808.exe PID 1592 wrote to memory of 1972 1592 8420808.exe 284826.exe PID 1592 wrote to memory of 1972 1592 8420808.exe 284826.exe PID 1592 wrote to memory of 1972 1592 8420808.exe 284826.exe PID 1972 wrote to memory of 4248 1972 284826.exe 400226.exe PID 1972 wrote to memory of 4248 1972 284826.exe 400226.exe PID 1972 wrote to memory of 4248 1972 284826.exe 400226.exe PID 4248 wrote to memory of 4484 4248 400226.exe 02682.exe PID 4248 wrote to memory of 4484 4248 400226.exe 02682.exe PID 4248 wrote to memory of 4484 4248 400226.exe 02682.exe PID 4484 wrote to memory of 5068 4484 02682.exe tnbtnh.exe PID 4484 wrote to memory of 5068 4484 02682.exe tnbtnh.exe PID 4484 wrote to memory of 5068 4484 02682.exe tnbtnh.exe PID 5068 wrote to memory of 1632 5068 tnbtnh.exe htbhhh.exe PID 5068 wrote to memory of 1632 5068 tnbtnh.exe htbhhh.exe PID 5068 wrote to memory of 1632 5068 tnbtnh.exe htbhhh.exe PID 1632 wrote to memory of 948 1632 htbhhh.exe 2065dv.exe PID 1632 wrote to memory of 948 1632 htbhhh.exe 2065dv.exe PID 1632 wrote to memory of 948 1632 htbhhh.exe 2065dv.exe PID 948 wrote to memory of 4416 948 2065dv.exe 9xxlrrx.exe PID 948 wrote to memory of 4416 948 2065dv.exe 9xxlrrx.exe PID 948 wrote to memory of 4416 948 2065dv.exe 9xxlrrx.exe PID 4416 wrote to memory of 2556 4416 9xxlrrx.exe hhbhnn.exe PID 4416 wrote to memory of 2556 4416 9xxlrrx.exe hhbhnn.exe PID 4416 wrote to memory of 2556 4416 9xxlrrx.exe hhbhnn.exe PID 2556 wrote to memory of 3904 2556 hhbhnn.exe pddjp.exe PID 2556 wrote to memory of 3904 2556 hhbhnn.exe pddjp.exe PID 2556 wrote to memory of 3904 2556 hhbhnn.exe pddjp.exe PID 3904 wrote to memory of 2400 3904 pddjp.exe 6428400.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe"C:\Users\Admin\AppData\Local\Temp\007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\ppjvp.exec:\ppjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\846000.exec:\846000.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\4802280.exec:\4802280.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\jvddv.exec:\jvddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\22604.exec:\22604.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\pppjj.exec:\pppjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\ddvvd.exec:\ddvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\46260.exec:\46260.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\flxxffl.exec:\flxxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\g6888.exec:\g6888.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lxffxxr.exec:\lxffxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\8420808.exec:\8420808.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\284826.exec:\284826.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\400226.exec:\400226.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\02682.exec:\02682.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\tnbtnh.exec:\tnbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\htbhhh.exec:\htbhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\2065dv.exec:\2065dv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\9xxlrrx.exec:\9xxlrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\hhbhnn.exec:\hhbhnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\pddjp.exec:\pddjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\6428400.exec:\6428400.exe23⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rrrlfxx.exec:\rrrlfxx.exe24⤵
- Executes dropped EXE
PID:1988 -
\??\c:\a2482.exec:\a2482.exe25⤵
- Executes dropped EXE
PID:1708 -
\??\c:\82622.exec:\82622.exe26⤵
- Executes dropped EXE
PID:2888 -
\??\c:\82044.exec:\82044.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4696 -
\??\c:\jppjj.exec:\jppjj.exe28⤵
- Executes dropped EXE
PID:5056 -
\??\c:\1lxxffx.exec:\1lxxffx.exe29⤵
- Executes dropped EXE
PID:4932 -
\??\c:\866600.exec:\866600.exe30⤵
- Executes dropped EXE
PID:3600 -
\??\c:\86860.exec:\86860.exe31⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lfrrffx.exec:\lfrrffx.exe32⤵
- Executes dropped EXE
PID:2492 -
\??\c:\2428400.exec:\2428400.exe33⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hnbttt.exec:\hnbttt.exe34⤵
- Executes dropped EXE
PID:5088 -
\??\c:\8404826.exec:\8404826.exe35⤵
- Executes dropped EXE
PID:4140 -
\??\c:\e20822.exec:\e20822.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3516 -
\??\c:\262602.exec:\262602.exe37⤵
- Executes dropped EXE
PID:220 -
\??\c:\btbbnn.exec:\btbbnn.exe38⤵
- Executes dropped EXE
PID:2176 -
\??\c:\0660448.exec:\0660448.exe39⤵
- Executes dropped EXE
PID:1936 -
\??\c:\8288660.exec:\8288660.exe40⤵
- Executes dropped EXE
PID:1036 -
\??\c:\k44284.exec:\k44284.exe41⤵
- Executes dropped EXE
PID:3892 -
\??\c:\nbtnhb.exec:\nbtnhb.exe42⤵
- Executes dropped EXE
PID:528 -
\??\c:\4842822.exec:\4842822.exe43⤵
- Executes dropped EXE
PID:4580 -
\??\c:\5pvpj.exec:\5pvpj.exe44⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xflxrxr.exec:\xflxrxr.exe45⤵
- Executes dropped EXE
PID:3192 -
\??\c:\k40426.exec:\k40426.exe46⤵
- Executes dropped EXE
PID:4616 -
\??\c:\dvddv.exec:\dvddv.exe47⤵
- Executes dropped EXE
PID:1824 -
\??\c:\4848046.exec:\4848046.exe48⤵
- Executes dropped EXE
PID:3652 -
\??\c:\604680.exec:\604680.exe49⤵
- Executes dropped EXE
PID:3540 -
\??\c:\662048.exec:\662048.exe50⤵
- Executes dropped EXE
PID:1892 -
\??\c:\nbbnhb.exec:\nbbnhb.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1jjvp.exec:\1jjvp.exe52⤵
- Executes dropped EXE
PID:452 -
\??\c:\fxxlxlf.exec:\fxxlxlf.exe53⤵
- Executes dropped EXE
PID:3632 -
\??\c:\dvjvd.exec:\dvjvd.exe54⤵
- Executes dropped EXE
PID:4652 -
\??\c:\28042.exec:\28042.exe55⤵
- Executes dropped EXE
PID:180 -
\??\c:\5rxrffx.exec:\5rxrffx.exe56⤵
- Executes dropped EXE
PID:1112 -
\??\c:\206004.exec:\206004.exe57⤵
- Executes dropped EXE
PID:2996 -
\??\c:\0824082.exec:\0824082.exe58⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ddvjp.exec:\ddvjp.exe59⤵
- Executes dropped EXE
PID:2868 -
\??\c:\266048.exec:\266048.exe60⤵
- Executes dropped EXE
PID:4780 -
\??\c:\q08484.exec:\q08484.exe61⤵
- Executes dropped EXE
PID:5112 -
\??\c:\ntnnbh.exec:\ntnnbh.exe62⤵
- Executes dropped EXE
PID:1820 -
\??\c:\5djdp.exec:\5djdp.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4936 -
\??\c:\64442.exec:\64442.exe64⤵
- Executes dropped EXE
PID:4092 -
\??\c:\9hnhnn.exec:\9hnhnn.exe65⤵
- Executes dropped EXE
PID:5072 -
\??\c:\280000.exec:\280000.exe66⤵
- System Location Discovery: System Language Discovery
PID:4484 -
\??\c:\i428680.exec:\i428680.exe67⤵PID:4752
-
\??\c:\2680404.exec:\2680404.exe68⤵PID:1632
-
\??\c:\66024.exec:\66024.exe69⤵PID:948
-
\??\c:\tththh.exec:\tththh.exe70⤵PID:4464
-
\??\c:\4408260.exec:\4408260.exe71⤵PID:2876
-
\??\c:\224842.exec:\224842.exe72⤵PID:1544
-
\??\c:\4060488.exec:\4060488.exe73⤵PID:1020
-
\??\c:\c226002.exec:\c226002.exe74⤵PID:1988
-
\??\c:\tnbtnh.exec:\tnbtnh.exe75⤵PID:3112
-
\??\c:\bhhhhb.exec:\bhhhhb.exe76⤵PID:2736
-
\??\c:\tnbtnh.exec:\tnbtnh.exe77⤵PID:4768
-
\??\c:\3jdvj.exec:\3jdvj.exe78⤵PID:4604
-
\??\c:\llxrlfr.exec:\llxrlfr.exe79⤵PID:1396
-
\??\c:\hthtnh.exec:\hthtnh.exe80⤵PID:3600
-
\??\c:\rlfxrrx.exec:\rlfxrrx.exe81⤵PID:3016
-
\??\c:\2400202.exec:\2400202.exe82⤵PID:3968
-
\??\c:\rxffxlr.exec:\rxffxlr.exe83⤵PID:1724
-
\??\c:\62086.exec:\62086.exe84⤵PID:2972
-
\??\c:\228860.exec:\228860.exe85⤵PID:4140
-
\??\c:\jjvpj.exec:\jjvpj.exe86⤵PID:2180
-
\??\c:\w26606.exec:\w26606.exe87⤵PID:1380
-
\??\c:\xlrrffx.exec:\xlrrffx.exe88⤵PID:1916
-
\??\c:\vvjdv.exec:\vvjdv.exe89⤵PID:432
-
\??\c:\606648.exec:\606648.exe90⤵PID:2096
-
\??\c:\20426.exec:\20426.exe91⤵PID:3708
-
\??\c:\vvvpp.exec:\vvvpp.exe92⤵PID:1920
-
\??\c:\g4204.exec:\g4204.exe93⤵PID:2092
-
\??\c:\08666.exec:\08666.exe94⤵PID:4956
-
\??\c:\9jpjd.exec:\9jpjd.exe95⤵PID:3116
-
\??\c:\2486444.exec:\2486444.exe96⤵PID:4776
-
\??\c:\4684444.exec:\4684444.exe97⤵PID:1968
-
\??\c:\c020448.exec:\c020448.exe98⤵PID:2916
-
\??\c:\80846.exec:\80846.exe99⤵PID:4964
-
\??\c:\pddpd.exec:\pddpd.exe100⤵PID:3092
-
\??\c:\262666.exec:\262666.exe101⤵PID:4040
-
\??\c:\62882.exec:\62882.exe102⤵PID:1640
-
\??\c:\ddpjj.exec:\ddpjj.exe103⤵PID:1268
-
\??\c:\pdjjd.exec:\pdjjd.exe104⤵PID:3540
-
\??\c:\7xfxxrx.exec:\7xfxxrx.exe105⤵PID:1892
-
\??\c:\9vjdv.exec:\9vjdv.exe106⤵PID:3432
-
\??\c:\nthtnn.exec:\nthtnn.exe107⤵PID:3656
-
\??\c:\5ntnhh.exec:\5ntnhh.exe108⤵PID:3400
-
\??\c:\0282666.exec:\0282666.exe109⤵PID:5008
-
\??\c:\frxxrrl.exec:\frxxrrl.exe110⤵PID:1784
-
\??\c:\7lxlfff.exec:\7lxlfff.exe111⤵PID:3976
-
\??\c:\84044.exec:\84044.exe112⤵PID:2896
-
\??\c:\o060448.exec:\o060448.exe113⤵PID:512
-
\??\c:\1pdpv.exec:\1pdpv.exe114⤵PID:2032
-
\??\c:\btnhhh.exec:\btnhhh.exe115⤵PID:2908
-
\??\c:\06404.exec:\06404.exe116⤵PID:4780
-
\??\c:\e48422.exec:\e48422.exe117⤵PID:1416
-
\??\c:\2244400.exec:\2244400.exe118⤵PID:2304
-
\??\c:\0682486.exec:\0682486.exe119⤵PID:4092
-
\??\c:\0802626.exec:\0802626.exe120⤵PID:4560
-
\??\c:\88444.exec:\88444.exe121⤵PID:4752
-
\??\c:\jjjdv.exec:\jjjdv.exe122⤵PID:4948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-