Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 04:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe
-
Size
455KB
-
MD5
baf0de87168f5f8e4372bcd13873d8bf
-
SHA1
42ff17385708196ce129cc9802157220a8a5cdd5
-
SHA256
da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b
-
SHA512
de818867d5b440aee664e80c1524ecb01942da951be3114d1de4a1fd793fdff3325407ccabcd057c6f0c2351b6e9a3548e9eba326a8f46bf8fef1c88b82fbfda
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRy:q7Tc2NYHUrAwfMp3CDRy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3212-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/896-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/896-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-922-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-929-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-984-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-1057-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-1545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-1875-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2448 jjpjj.exe 2400 lxllflf.exe 4708 bnthtn.exe 3148 hbnnbh.exe 1240 fllffff.exe 4964 7pvpp.exe 3960 rrxxlrf.exe 2800 jdpvd.exe 3956 btthht.exe 4548 3nhbth.exe 896 dddpj.exe 2148 lxllfll.exe 4084 hhttbh.exe 4480 xrxxffr.exe 1052 llrllfl.exe 1304 vvpjd.exe 5024 nntntb.exe 1496 dppjp.exe 3116 tbbtnn.exe 1644 xflrxlr.exe 1296 btbthh.exe 1896 vdvdd.exe 4728 lffffxl.exe 1128 nbnnnh.exe 4556 vpjpj.exe 2576 vppjj.exe 60 lllxxff.exe 3600 nttttn.exe 3944 rxfxrlx.exe 2728 fxfxrxr.exe 3532 7jvvv.exe 4364 hbbbbb.exe 1184 fflffll.exe 3272 tthntt.exe 5032 dvpjp.exe 2368 xflfffx.exe 1568 3frlxxf.exe 3396 nnnhhh.exe 776 dpvpj.exe 1416 5lrlffx.exe 4392 3nnhhb.exe 4532 htnbnb.exe 4704 vvvpp.exe 4940 llrllll.exe 2920 flrlrlf.exe 4360 nbnnht.exe 1792 jdpjd.exe 4264 xrrlllr.exe 3508 nbbtnn.exe 1924 ppjjj.exe 4032 rfxxlrl.exe 1828 btnhhh.exe 2980 pjvpd.exe 2772 9dddv.exe 1240 llfxxfx.exe 1908 tttnhh.exe 1592 pdvvv.exe 220 1xfflxf.exe 4824 rrlxxxf.exe 3124 nntnht.exe 4672 djdvp.exe 4288 3lrrrrx.exe 1572 lxlxrrr.exe 1852 bbnnhb.exe -
resource yara_rule behavioral2/memory/3212-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/896-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/896-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-929-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3212 wrote to memory of 2448 3212 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 82 PID 3212 wrote to memory of 2448 3212 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 82 PID 3212 wrote to memory of 2448 3212 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 82 PID 2448 wrote to memory of 2400 2448 jjpjj.exe 83 PID 2448 wrote to memory of 2400 2448 jjpjj.exe 83 PID 2448 wrote to memory of 2400 2448 jjpjj.exe 83 PID 2400 wrote to memory of 4708 2400 lxllflf.exe 84 PID 2400 wrote to memory of 4708 2400 lxllflf.exe 84 PID 2400 wrote to memory of 4708 2400 lxllflf.exe 84 PID 4708 wrote to memory of 3148 4708 bnthtn.exe 85 PID 4708 wrote to memory of 3148 4708 bnthtn.exe 85 PID 4708 wrote to memory of 3148 4708 bnthtn.exe 85 PID 3148 wrote to memory of 1240 3148 hbnnbh.exe 86 PID 3148 wrote to memory of 1240 3148 hbnnbh.exe 86 PID 3148 wrote to memory of 1240 3148 hbnnbh.exe 86 PID 1240 wrote to memory of 4964 1240 fllffff.exe 87 PID 1240 wrote to memory of 4964 1240 fllffff.exe 87 PID 1240 wrote to memory of 4964 1240 fllffff.exe 87 PID 4964 wrote to memory of 3960 4964 7pvpp.exe 88 PID 4964 wrote to memory of 3960 4964 7pvpp.exe 88 PID 4964 wrote to memory of 3960 4964 7pvpp.exe 88 PID 3960 wrote to memory of 2800 3960 rrxxlrf.exe 89 PID 3960 wrote to memory of 2800 3960 rrxxlrf.exe 89 PID 3960 wrote to memory of 2800 3960 rrxxlrf.exe 89 PID 2800 wrote to memory of 3956 2800 jdpvd.exe 90 PID 2800 wrote to memory of 3956 2800 jdpvd.exe 90 PID 2800 wrote to memory of 3956 2800 jdpvd.exe 90 PID 3956 wrote to memory of 4548 3956 btthht.exe 91 PID 3956 wrote to memory of 4548 3956 btthht.exe 91 PID 3956 wrote to memory of 4548 3956 btthht.exe 91 PID 4548 wrote to memory of 896 4548 3nhbth.exe 92 PID 4548 wrote to memory of 896 4548 3nhbth.exe 92 PID 4548 wrote to memory of 896 4548 3nhbth.exe 92 PID 896 wrote to memory of 2148 896 dddpj.exe 93 PID 896 wrote to memory of 2148 896 dddpj.exe 93 PID 896 wrote to memory of 2148 896 dddpj.exe 93 PID 2148 wrote to memory of 4084 2148 lxllfll.exe 94 PID 2148 wrote to memory of 4084 2148 lxllfll.exe 94 PID 2148 wrote to memory of 4084 2148 lxllfll.exe 94 PID 4084 wrote to memory of 4480 4084 hhttbh.exe 95 PID 4084 wrote to memory of 4480 4084 hhttbh.exe 95 PID 4084 wrote to memory of 4480 4084 hhttbh.exe 95 PID 4480 wrote to memory of 1052 4480 xrxxffr.exe 96 PID 4480 wrote to memory of 1052 4480 xrxxffr.exe 96 PID 4480 wrote to memory of 1052 4480 xrxxffr.exe 96 PID 1052 wrote to memory of 1304 1052 llrllfl.exe 97 PID 1052 wrote to memory of 1304 1052 llrllfl.exe 97 PID 1052 wrote to memory of 1304 1052 llrllfl.exe 97 PID 1304 wrote to memory of 5024 1304 vvpjd.exe 98 PID 1304 wrote to memory of 5024 1304 vvpjd.exe 98 PID 1304 wrote to memory of 5024 1304 vvpjd.exe 98 PID 5024 wrote to memory of 1496 5024 nntntb.exe 99 PID 5024 wrote to memory of 1496 5024 nntntb.exe 99 PID 5024 wrote to memory of 1496 5024 nntntb.exe 99 PID 1496 wrote to memory of 3116 1496 dppjp.exe 100 PID 1496 wrote to memory of 3116 1496 dppjp.exe 100 PID 1496 wrote to memory of 3116 1496 dppjp.exe 100 PID 3116 wrote to memory of 1644 3116 tbbtnn.exe 101 PID 3116 wrote to memory of 1644 3116 tbbtnn.exe 101 PID 3116 wrote to memory of 1644 3116 tbbtnn.exe 101 PID 1644 wrote to memory of 1296 1644 xflrxlr.exe 102 PID 1644 wrote to memory of 1296 1644 xflrxlr.exe 102 PID 1644 wrote to memory of 1296 1644 xflrxlr.exe 102 PID 1296 wrote to memory of 1896 1296 btbthh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe"C:\Users\Admin\AppData\Local\Temp\da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\jjpjj.exec:\jjpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\lxllflf.exec:\lxllflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\bnthtn.exec:\bnthtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\hbnnbh.exec:\hbnnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\fllffff.exec:\fllffff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\7pvpp.exec:\7pvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\rrxxlrf.exec:\rrxxlrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\jdpvd.exec:\jdpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\btthht.exec:\btthht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\3nhbth.exec:\3nhbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\dddpj.exec:\dddpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\lxllfll.exec:\lxllfll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\hhttbh.exec:\hhttbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\xrxxffr.exec:\xrxxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\llrllfl.exec:\llrllfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\vvpjd.exec:\vvpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\nntntb.exec:\nntntb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\dppjp.exec:\dppjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\tbbtnn.exec:\tbbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\xflrxlr.exec:\xflrxlr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\btbthh.exec:\btbthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\vdvdd.exec:\vdvdd.exe23⤵
- Executes dropped EXE
PID:1896 -
\??\c:\lffffxl.exec:\lffffxl.exe24⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nbnnnh.exec:\nbnnnh.exe25⤵
- Executes dropped EXE
PID:1128 -
\??\c:\vpjpj.exec:\vpjpj.exe26⤵
- Executes dropped EXE
PID:4556 -
\??\c:\vppjj.exec:\vppjj.exe27⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lllxxff.exec:\lllxxff.exe28⤵
- Executes dropped EXE
PID:60 -
\??\c:\nttttn.exec:\nttttn.exe29⤵
- Executes dropped EXE
PID:3600 -
\??\c:\rxfxrlx.exec:\rxfxrlx.exe30⤵
- Executes dropped EXE
PID:3944 -
\??\c:\fxfxrxr.exec:\fxfxrxr.exe31⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7jvvv.exec:\7jvvv.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3532 -
\??\c:\hbbbbb.exec:\hbbbbb.exe33⤵
- Executes dropped EXE
PID:4364 -
\??\c:\fflffll.exec:\fflffll.exe34⤵
- Executes dropped EXE
PID:1184 -
\??\c:\tthntt.exec:\tthntt.exe35⤵
- Executes dropped EXE
PID:3272 -
\??\c:\dvpjp.exec:\dvpjp.exe36⤵
- Executes dropped EXE
PID:5032 -
\??\c:\xflfffx.exec:\xflfffx.exe37⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3frlxxf.exec:\3frlxxf.exe38⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nnnhhh.exec:\nnnhhh.exe39⤵
- Executes dropped EXE
PID:3396 -
\??\c:\dpvpj.exec:\dpvpj.exe40⤵
- Executes dropped EXE
PID:776 -
\??\c:\5lrlffx.exec:\5lrlffx.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1416 -
\??\c:\3nnhhb.exec:\3nnhhb.exe42⤵
- Executes dropped EXE
PID:4392 -
\??\c:\htnbnb.exec:\htnbnb.exe43⤵
- Executes dropped EXE
PID:4532 -
\??\c:\vvvpp.exec:\vvvpp.exe44⤵
- Executes dropped EXE
PID:4704 -
\??\c:\llrllll.exec:\llrllll.exe45⤵
- Executes dropped EXE
PID:4940 -
\??\c:\flrlrlf.exec:\flrlrlf.exe46⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nbnnht.exec:\nbnnht.exe47⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jdpjd.exec:\jdpjd.exe48⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xrrlllr.exec:\xrrlllr.exe49⤵
- Executes dropped EXE
PID:4264 -
\??\c:\nbbtnn.exec:\nbbtnn.exe50⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ppjjj.exec:\ppjjj.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rfxxlrl.exec:\rfxxlrl.exe52⤵
- Executes dropped EXE
PID:4032 -
\??\c:\btnhhh.exec:\btnhhh.exe53⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pjvpd.exec:\pjvpd.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9dddv.exec:\9dddv.exe55⤵
- Executes dropped EXE
PID:2772 -
\??\c:\llfxxfx.exec:\llfxxfx.exe56⤵
- Executes dropped EXE
PID:1240 -
\??\c:\tttnhh.exec:\tttnhh.exe57⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pdvvv.exec:\pdvvv.exe58⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1xfflxf.exec:\1xfflxf.exe59⤵
- Executes dropped EXE
PID:220 -
\??\c:\rrlxxxf.exec:\rrlxxxf.exe60⤵
- Executes dropped EXE
PID:4824 -
\??\c:\nntnht.exec:\nntnht.exe61⤵
- Executes dropped EXE
PID:3124 -
\??\c:\djdvp.exec:\djdvp.exe62⤵
- Executes dropped EXE
PID:4672 -
\??\c:\3lrrrrx.exec:\3lrrrrx.exe63⤵
- Executes dropped EXE
PID:4288 -
\??\c:\lxlxrrr.exec:\lxlxrrr.exe64⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bbnnhb.exec:\bbnnhb.exe65⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ddppd.exec:\ddppd.exe66⤵PID:3984
-
\??\c:\ffrlflf.exec:\ffrlflf.exe67⤵PID:3256
-
\??\c:\hhnhbb.exec:\hhnhbb.exe68⤵PID:1052
-
\??\c:\jpddv.exec:\jpddv.exe69⤵PID:5076
-
\??\c:\dvdvd.exec:\dvdvd.exe70⤵PID:4504
-
\??\c:\lfllfll.exec:\lfllfll.exe71⤵PID:1036
-
\??\c:\hhhhbb.exec:\hhhhbb.exe72⤵PID:4752
-
\??\c:\jvjdd.exec:\jvjdd.exe73⤵PID:2228
-
\??\c:\vpdvd.exec:\vpdvd.exe74⤵PID:2640
-
\??\c:\xrxrffx.exec:\xrxrffx.exe75⤵PID:4472
-
\??\c:\bttbhb.exec:\bttbhb.exe76⤵PID:3688
-
\??\c:\7dppp.exec:\7dppp.exe77⤵
- System Location Discovery: System Language Discovery
PID:512 -
\??\c:\1pjvp.exec:\1pjvp.exe78⤵PID:1896
-
\??\c:\fflffxx.exec:\fflffxx.exe79⤵PID:1580
-
\??\c:\bthbtt.exec:\bthbtt.exe80⤵PID:4416
-
\??\c:\7ttttb.exec:\7ttttb.exe81⤵PID:1588
-
\??\c:\5pvvp.exec:\5pvvp.exe82⤵PID:1928
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe83⤵PID:3336
-
\??\c:\hnbbhh.exec:\hnbbhh.exe84⤵PID:4564
-
\??\c:\9pvpj.exec:\9pvpj.exe85⤵PID:1648
-
\??\c:\3vdvv.exec:\3vdvv.exe86⤵PID:2040
-
\??\c:\1rxrrxr.exec:\1rxrrxr.exe87⤵PID:2948
-
\??\c:\nbnnhb.exec:\nbnnhb.exe88⤵PID:2200
-
\??\c:\vpvpj.exec:\vpvpj.exe89⤵PID:4108
-
\??\c:\7xlfffl.exec:\7xlfffl.exe90⤵PID:2856
-
\??\c:\rffxxlr.exec:\rffxxlr.exe91⤵PID:4848
-
\??\c:\hhhbtt.exec:\hhhbtt.exe92⤵PID:2588
-
\??\c:\1djdp.exec:\1djdp.exe93⤵PID:3472
-
\??\c:\vdpjd.exec:\vdpjd.exe94⤵PID:1564
-
\??\c:\flfxxrr.exec:\flfxxrr.exe95⤵PID:3396
-
\??\c:\bnttnn.exec:\bnttnn.exe96⤵PID:972
-
\??\c:\7btttb.exec:\7btttb.exe97⤵PID:4392
-
\??\c:\3ddvv.exec:\3ddvv.exe98⤵PID:876
-
\??\c:\flxfflx.exec:\flxfflx.exe99⤵PID:1832
-
\??\c:\nhtnhh.exec:\nhtnhh.exe100⤵PID:2752
-
\??\c:\bhbbtt.exec:\bhbbtt.exe101⤵PID:4560
-
\??\c:\1jdpv.exec:\1jdpv.exe102⤵PID:244
-
\??\c:\lffxflr.exec:\lffxflr.exe103⤵PID:3808
-
\??\c:\xxxrllf.exec:\xxxrllf.exe104⤵PID:4676
-
\??\c:\tbtnhh.exec:\tbtnhh.exe105⤵PID:4500
-
\??\c:\pjvvp.exec:\pjvvp.exe106⤵PID:3148
-
\??\c:\9fxrlll.exec:\9fxrlll.exe107⤵PID:3128
-
\??\c:\3nbbhh.exec:\3nbbhh.exe108⤵PID:2628
-
\??\c:\rxfrlff.exec:\rxfrlff.exe109⤵PID:456
-
\??\c:\rrrxfll.exec:\rrrxfll.exe110⤵PID:232
-
\??\c:\bnhbtn.exec:\bnhbtn.exe111⤵PID:1592
-
\??\c:\jvpjd.exec:\jvpjd.exe112⤵PID:1448
-
\??\c:\xllllrf.exec:\xllllrf.exe113⤵PID:964
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe114⤵PID:1672
-
\??\c:\btbtnn.exec:\btbtnn.exe115⤵PID:1964
-
\??\c:\5vddd.exec:\5vddd.exe116⤵PID:3616
-
\??\c:\jdjpd.exec:\jdjpd.exe117⤵PID:1652
-
\??\c:\rflfxrr.exec:\rflfxrr.exe118⤵PID:1572
-
\??\c:\bthbhb.exec:\bthbhb.exe119⤵PID:2512
-
\??\c:\9tnhbb.exec:\9tnhbb.exe120⤵PID:2616
-
\??\c:\djpjj.exec:\djpjj.exe121⤵PID:2004
-
\??\c:\xrxllxl.exec:\xrxllxl.exe122⤵PID:4984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-