Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 19:39
Behavioral task
behavioral1
Sample
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe
Resource
win7-20241023-en
General
-
Target
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe
-
Size
331KB
-
MD5
0338c99c86b68b6963301fb49170f14c
-
SHA1
a18f6c295f1aeb0c77bb5439d6c4a954fd73957e
-
SHA256
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181
-
SHA512
13a1732b6fe58436abff3366cb369686f37150ffd3c0749a788376c2c6a29860c9217c4bda2cde90ccd4a8c85e6d2c966f808a219b84e9ea300ff6abfb3b0641
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tI:94wFHoStJdSjylh2b77BoTMA9gX59sTg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1668-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/564-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/984-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/724-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3084-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1668-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/244-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/848-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-870-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-1117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjdvp.exelfrllff.exexflffff.exe9xllrlx.exehthhhh.exebhthbt.exerllflrx.exedjddp.exerfrrrlx.exe3htnnn.exe3jppp.exejdjdv.exe7dddv.exentbtnn.exethnhbt.exepjjvp.exevppjj.exennhbhn.exejvjdv.exelllffxr.exenhtttt.exepjvjv.exexxrrrrr.exetttbbt.exejvddp.exeppvpj.exebhbhbt.exe1jjdv.exedpvpp.exexrrlxxl.exehtbbbn.exe9jjjj.exefrxffll.exe3pjpp.exeppjdv.exelrfxxfx.exehbnnhh.exe9nnhbh.exepvjdd.exeffxxxxx.exeffllflf.exetnbtnn.exerrxfxff.exethhttt.exedjjdv.exe9flxrrl.exehbbtnt.exeddvvd.exedjpdv.exelllfxxr.exe1bhhhh.exe9pjdd.exe5jpdp.exehtnbtn.exejpjdd.exe9xfllrr.exebttnnb.exehnbhtn.exe5ppdd.exe5flfffx.exe9bbthh.exevddjj.exe5frlxxf.exe3bhbhh.exepid process 4972 jjdvp.exe 1780 lfrllff.exe 3112 xflffff.exe 564 9xllrlx.exe 3600 hthhhh.exe 3892 bhthbt.exe 3380 rllflrx.exe 3592 djddp.exe 4300 rfrrrlx.exe 4480 3htnnn.exe 3152 3jppp.exe 4340 jdjdv.exe 1888 7dddv.exe 5080 ntbtnn.exe 1152 thnhbt.exe 2696 pjjvp.exe 1900 vppjj.exe 3596 nnhbhn.exe 3008 jvjdv.exe 1340 lllffxr.exe 3496 nhtttt.exe 4804 pjvjv.exe 4256 xxrrrrr.exe 4176 tttbbt.exe 2008 jvddp.exe 4996 ppvpj.exe 936 bhbhbt.exe 3664 1jjdv.exe 984 dpvpp.exe 2644 xrrlxxl.exe 2472 htbbbn.exe 3520 9jjjj.exe 3188 frxffll.exe 2148 3pjpp.exe 2880 ppjdv.exe 2652 lrfxxfx.exe 932 hbnnhh.exe 1836 9nnhbh.exe 1676 pvjdd.exe 5024 ffxxxxx.exe 756 ffllflf.exe 3584 tnbtnn.exe 1564 rrxfxff.exe 2332 thhttt.exe 3976 djjdv.exe 1224 9flxrrl.exe 2040 hbbtnt.exe 3916 ddvvd.exe 2224 djpdv.exe 844 lllfxxr.exe 1572 1bhhhh.exe 1664 9pjdd.exe 1912 5jpdp.exe 3176 htnbtn.exe 4988 jpjdd.exe 3512 9xfllrr.exe 4144 bttnnb.exe 3420 hnbhtn.exe 4380 5ppdd.exe 4348 5flfffx.exe 2440 9bbthh.exe 464 vddjj.exe 1364 5frlxxf.exe 1780 3bhbhh.exe -
Processes:
resource yara_rule behavioral2/memory/1668-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdvp.exe upx behavioral2/memory/1668-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4972-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1780-11-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfrllff.exe upx C:\xflffff.exe upx behavioral2/memory/1780-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3112-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/564-23-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9xllrlx.exe upx C:\hthhhh.exe upx C:\bhthbt.exe upx behavioral2/memory/3600-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rllflrx.exe upx behavioral2/memory/3892-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djddp.exe upx behavioral2/memory/3380-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3592-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4300-47-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rfrrrlx.exe upx \??\c:\3htnnn.exe upx \??\c:\3jppp.exe upx \??\c:\jdjdv.exe upx behavioral2/memory/3152-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4480-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7dddv.exe upx behavioral2/memory/4340-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ntbtnn.exe upx C:\thnhbt.exe upx behavioral2/memory/1152-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjjvp.exe upx behavioral2/memory/1888-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5080-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppjj.exe upx C:\nnhbhn.exe upx C:\jvjdv.exe upx behavioral2/memory/3008-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lllffxr.exe upx behavioral2/memory/1340-99-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtttt.exe upx behavioral2/memory/3496-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvjv.exe upx C:\xxrrrrr.exe upx behavioral2/memory/4256-116-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tttbbt.exe upx \??\c:\jvddp.exe upx \??\c:\ppvpj.exe upx \??\c:\bhbhbt.exe upx behavioral2/memory/3664-136-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dpvpp.exe upx behavioral2/memory/984-141-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrrlxxl.exe upx \??\c:\1jjdv.exe upx behavioral2/memory/4804-114-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbbbn.exe upx C:\9jjjj.exe upx behavioral2/memory/2472-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2148-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/932-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/756-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1564-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3976-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3916-193-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hhnttb.exevpppp.exexrxrllf.exevjdjj.exehthhhh.exehbhhtb.exenbtthh.exejvddv.exevdjpj.exexrfxrxx.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrxx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exejjdvp.exelfrllff.exexflffff.exe9xllrlx.exehthhhh.exebhthbt.exerllflrx.exedjddp.exerfrrrlx.exe3htnnn.exe3jppp.exejdjdv.exe7dddv.exentbtnn.exethnhbt.exepjjvp.exevppjj.exennhbhn.exejvjdv.exelllffxr.exenhtttt.exedescription pid process target process PID 1668 wrote to memory of 4972 1668 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe jjdvp.exe PID 1668 wrote to memory of 4972 1668 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe jjdvp.exe PID 1668 wrote to memory of 4972 1668 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe jjdvp.exe PID 4972 wrote to memory of 1780 4972 jjdvp.exe lfrllff.exe PID 4972 wrote to memory of 1780 4972 jjdvp.exe lfrllff.exe PID 4972 wrote to memory of 1780 4972 jjdvp.exe lfrllff.exe PID 1780 wrote to memory of 3112 1780 lfrllff.exe xflffff.exe PID 1780 wrote to memory of 3112 1780 lfrllff.exe xflffff.exe PID 1780 wrote to memory of 3112 1780 lfrllff.exe xflffff.exe PID 3112 wrote to memory of 564 3112 xflffff.exe 9xllrlx.exe PID 3112 wrote to memory of 564 3112 xflffff.exe 9xllrlx.exe PID 3112 wrote to memory of 564 3112 xflffff.exe 9xllrlx.exe PID 564 wrote to memory of 3600 564 9xllrlx.exe hthhhh.exe PID 564 wrote to memory of 3600 564 9xllrlx.exe hthhhh.exe PID 564 wrote to memory of 3600 564 9xllrlx.exe hthhhh.exe PID 3600 wrote to memory of 3892 3600 hthhhh.exe bhthbt.exe PID 3600 wrote to memory of 3892 3600 hthhhh.exe bhthbt.exe PID 3600 wrote to memory of 3892 3600 hthhhh.exe bhthbt.exe PID 3892 wrote to memory of 3380 3892 bhthbt.exe rllflrx.exe PID 3892 wrote to memory of 3380 3892 bhthbt.exe rllflrx.exe PID 3892 wrote to memory of 3380 3892 bhthbt.exe rllflrx.exe PID 3380 wrote to memory of 3592 3380 rllflrx.exe djddp.exe PID 3380 wrote to memory of 3592 3380 rllflrx.exe djddp.exe PID 3380 wrote to memory of 3592 3380 rllflrx.exe djddp.exe PID 3592 wrote to memory of 4300 3592 djddp.exe rfrrrlx.exe PID 3592 wrote to memory of 4300 3592 djddp.exe rfrrrlx.exe PID 3592 wrote to memory of 4300 3592 djddp.exe rfrrrlx.exe PID 4300 wrote to memory of 4480 4300 rfrrrlx.exe 3htnnn.exe PID 4300 wrote to memory of 4480 4300 rfrrrlx.exe 3htnnn.exe PID 4300 wrote to memory of 4480 4300 rfrrrlx.exe 3htnnn.exe PID 4480 wrote to memory of 3152 4480 3htnnn.exe 3jppp.exe PID 4480 wrote to memory of 3152 4480 3htnnn.exe 3jppp.exe PID 4480 wrote to memory of 3152 4480 3htnnn.exe 3jppp.exe PID 3152 wrote to memory of 4340 3152 3jppp.exe jdjdv.exe PID 3152 wrote to memory of 4340 3152 3jppp.exe jdjdv.exe PID 3152 wrote to memory of 4340 3152 3jppp.exe jdjdv.exe PID 4340 wrote to memory of 1888 4340 jdjdv.exe 7dddv.exe PID 4340 wrote to memory of 1888 4340 jdjdv.exe 7dddv.exe PID 4340 wrote to memory of 1888 4340 jdjdv.exe 7dddv.exe PID 1888 wrote to memory of 5080 1888 7dddv.exe ntbtnn.exe PID 1888 wrote to memory of 5080 1888 7dddv.exe ntbtnn.exe PID 1888 wrote to memory of 5080 1888 7dddv.exe ntbtnn.exe PID 5080 wrote to memory of 1152 5080 ntbtnn.exe thnhbt.exe PID 5080 wrote to memory of 1152 5080 ntbtnn.exe thnhbt.exe PID 5080 wrote to memory of 1152 5080 ntbtnn.exe thnhbt.exe PID 1152 wrote to memory of 2696 1152 thnhbt.exe pjjvp.exe PID 1152 wrote to memory of 2696 1152 thnhbt.exe pjjvp.exe PID 1152 wrote to memory of 2696 1152 thnhbt.exe pjjvp.exe PID 2696 wrote to memory of 1900 2696 pjjvp.exe vppjj.exe PID 2696 wrote to memory of 1900 2696 pjjvp.exe vppjj.exe PID 2696 wrote to memory of 1900 2696 pjjvp.exe vppjj.exe PID 1900 wrote to memory of 3596 1900 vppjj.exe nnhbhn.exe PID 1900 wrote to memory of 3596 1900 vppjj.exe nnhbhn.exe PID 1900 wrote to memory of 3596 1900 vppjj.exe nnhbhn.exe PID 3596 wrote to memory of 3008 3596 nnhbhn.exe jvjdv.exe PID 3596 wrote to memory of 3008 3596 nnhbhn.exe jvjdv.exe PID 3596 wrote to memory of 3008 3596 nnhbhn.exe jvjdv.exe PID 3008 wrote to memory of 1340 3008 jvjdv.exe lllffxr.exe PID 3008 wrote to memory of 1340 3008 jvjdv.exe lllffxr.exe PID 3008 wrote to memory of 1340 3008 jvjdv.exe lllffxr.exe PID 1340 wrote to memory of 3496 1340 lllffxr.exe nhtttt.exe PID 1340 wrote to memory of 3496 1340 lllffxr.exe nhtttt.exe PID 1340 wrote to memory of 3496 1340 lllffxr.exe nhtttt.exe PID 3496 wrote to memory of 4804 3496 nhtttt.exe pjvjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe"C:\Users\Admin\AppData\Local\Temp\0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\jjdvp.exec:\jjdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\lfrllff.exec:\lfrllff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\xflffff.exec:\xflffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\9xllrlx.exec:\9xllrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\hthhhh.exec:\hthhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\bhthbt.exec:\bhthbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\rllflrx.exec:\rllflrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\djddp.exec:\djddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\rfrrrlx.exec:\rfrrrlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\3htnnn.exec:\3htnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\3jppp.exec:\3jppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\jdjdv.exec:\jdjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\7dddv.exec:\7dddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\ntbtnn.exec:\ntbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\thnhbt.exec:\thnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\pjjvp.exec:\pjjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vppjj.exec:\vppjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\nnhbhn.exec:\nnhbhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\jvjdv.exec:\jvjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\lllffxr.exec:\lllffxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\nhtttt.exec:\nhtttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\pjvjv.exec:\pjvjv.exe23⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe24⤵
- Executes dropped EXE
PID:4256 -
\??\c:\tttbbt.exec:\tttbbt.exe25⤵
- Executes dropped EXE
PID:4176 -
\??\c:\jvddp.exec:\jvddp.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ppvpj.exec:\ppvpj.exe27⤵
- Executes dropped EXE
PID:4996 -
\??\c:\bhbhbt.exec:\bhbhbt.exe28⤵
- Executes dropped EXE
PID:936 -
\??\c:\1jjdv.exec:\1jjdv.exe29⤵
- Executes dropped EXE
PID:3664 -
\??\c:\dpvpp.exec:\dpvpp.exe30⤵
- Executes dropped EXE
PID:984 -
\??\c:\xrrlxxl.exec:\xrrlxxl.exe31⤵
- Executes dropped EXE
PID:2644 -
\??\c:\htbbbn.exec:\htbbbn.exe32⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9jjjj.exec:\9jjjj.exe33⤵
- Executes dropped EXE
PID:3520 -
\??\c:\frxffll.exec:\frxffll.exe34⤵
- Executes dropped EXE
PID:3188 -
\??\c:\3pjpp.exec:\3pjpp.exe35⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ppjdv.exec:\ppjdv.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lrfxxfx.exec:\lrfxxfx.exe37⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hbnnhh.exec:\hbnnhh.exe38⤵
- Executes dropped EXE
PID:932 -
\??\c:\9nnhbh.exec:\9nnhbh.exe39⤵
- Executes dropped EXE
PID:1836 -
\??\c:\pvjdd.exec:\pvjdd.exe40⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe41⤵
- Executes dropped EXE
PID:5024 -
\??\c:\ffllflf.exec:\ffllflf.exe42⤵
- Executes dropped EXE
PID:756 -
\??\c:\tnbtnn.exec:\tnbtnn.exe43⤵
- Executes dropped EXE
PID:3584 -
\??\c:\rrxfxff.exec:\rrxfxff.exe44⤵
- Executes dropped EXE
PID:1564 -
\??\c:\thhttt.exec:\thhttt.exe45⤵
- Executes dropped EXE
PID:2332 -
\??\c:\djjdv.exec:\djjdv.exe46⤵
- Executes dropped EXE
PID:3976 -
\??\c:\9flxrrl.exec:\9flxrrl.exe47⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hbbtnt.exec:\hbbtnt.exe48⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ddvvd.exec:\ddvvd.exe49⤵
- Executes dropped EXE
PID:3916 -
\??\c:\djpdv.exec:\djpdv.exe50⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lllfxxr.exec:\lllfxxr.exe51⤵
- Executes dropped EXE
PID:844 -
\??\c:\1bhhhh.exec:\1bhhhh.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\9pjdd.exec:\9pjdd.exe53⤵
- Executes dropped EXE
PID:1664 -
\??\c:\5jpdp.exec:\5jpdp.exe54⤵
- Executes dropped EXE
PID:1912 -
\??\c:\htnbtn.exec:\htnbtn.exe55⤵
- Executes dropped EXE
PID:3176 -
\??\c:\jpjdd.exec:\jpjdd.exe56⤵
- Executes dropped EXE
PID:4988 -
\??\c:\9xfllrr.exec:\9xfllrr.exe57⤵
- Executes dropped EXE
PID:3512 -
\??\c:\bttnnb.exec:\bttnnb.exe58⤵
- Executes dropped EXE
PID:4144 -
\??\c:\hnbhtn.exec:\hnbhtn.exe59⤵
- Executes dropped EXE
PID:3420 -
\??\c:\5ppdd.exec:\5ppdd.exe60⤵
- Executes dropped EXE
PID:4380 -
\??\c:\5flfffx.exec:\5flfffx.exe61⤵
- Executes dropped EXE
PID:4348 -
\??\c:\9bbthh.exec:\9bbthh.exe62⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vddjj.exec:\vddjj.exe63⤵
- Executes dropped EXE
PID:464 -
\??\c:\5frlxxf.exec:\5frlxxf.exe64⤵
- Executes dropped EXE
PID:1364 -
\??\c:\3bhbhh.exec:\3bhbhh.exe65⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pdpjv.exec:\pdpjv.exe66⤵PID:724
-
\??\c:\rfllxxr.exec:\rfllxxr.exe67⤵PID:536
-
\??\c:\lxllffx.exec:\lxllffx.exe68⤵PID:564
-
\??\c:\bbtntb.exec:\bbtntb.exe69⤵PID:4688
-
\??\c:\ppvvj.exec:\ppvvj.exe70⤵PID:1992
-
\??\c:\rlrlffl.exec:\rlrlffl.exe71⤵PID:2892
-
\??\c:\nhntbb.exec:\nhntbb.exe72⤵PID:400
-
\??\c:\7lrrrxr.exec:\7lrrrxr.exe73⤵PID:744
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe74⤵PID:3872
-
\??\c:\bbhbtt.exec:\bbhbtt.exe75⤵PID:3452
-
\??\c:\pjvpj.exec:\pjvpj.exe76⤵PID:852
-
\??\c:\rlrlffr.exec:\rlrlffr.exe77⤵PID:4992
-
\??\c:\nbnnbh.exec:\nbnnbh.exe78⤵PID:2500
-
\??\c:\5hnhnn.exec:\5hnhnn.exe79⤵PID:4388
-
\??\c:\vjpjv.exec:\vjpjv.exe80⤵PID:3028
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe81⤵PID:3940
-
\??\c:\1tttnn.exec:\1tttnn.exe82⤵PID:3984
-
\??\c:\hhttbb.exec:\hhttbb.exe83⤵PID:3064
-
\??\c:\rxxxllx.exec:\rxxxllx.exe84⤵PID:4332
-
\??\c:\bhtnhh.exec:\bhtnhh.exe85⤵PID:3768
-
\??\c:\tbhbtt.exec:\tbhbtt.exe86⤵PID:2244
-
\??\c:\pvvvd.exec:\pvvvd.exe87⤵PID:3408
-
\??\c:\pdvvv.exec:\pdvvv.exe88⤵PID:4488
-
\??\c:\flllfff.exec:\flllfff.exe89⤵PID:3116
-
\??\c:\1rxfxxr.exec:\1rxfxxr.exe90⤵PID:4540
-
\??\c:\hhhbbt.exec:\hhhbbt.exe91⤵PID:4912
-
\??\c:\ddjdd.exec:\ddjdd.exe92⤵PID:2116
-
\??\c:\lxflxxr.exec:\lxflxxr.exe93⤵PID:5116
-
\??\c:\3xxrrlf.exec:\3xxrrlf.exe94⤵PID:4168
-
\??\c:\hhhhbh.exec:\hhhhbh.exe95⤵PID:1352
-
\??\c:\vpvdv.exec:\vpvdv.exe96⤵PID:1144
-
\??\c:\5jjjj.exec:\5jjjj.exe97⤵PID:4456
-
\??\c:\rrrrrll.exec:\rrrrrll.exe98⤵PID:4492
-
\??\c:\ffrxxxx.exec:\ffrxxxx.exe99⤵PID:3384
-
\??\c:\bbbttn.exec:\bbbttn.exe100⤵PID:4336
-
\??\c:\9pppj.exec:\9pppj.exe101⤵PID:4920
-
\??\c:\xfrlflf.exec:\xfrlflf.exe102⤵PID:5100
-
\??\c:\5llfxxr.exec:\5llfxxr.exe103⤵PID:1452
-
\??\c:\1tbbbh.exec:\1tbbbh.exe104⤵PID:4824
-
\??\c:\tnttnt.exec:\tnttnt.exe105⤵PID:992
-
\??\c:\5pvvv.exec:\5pvvv.exe106⤵PID:4764
-
\??\c:\xlxrlrr.exec:\xlxrlrr.exe107⤵PID:4424
-
\??\c:\xfrrrxf.exec:\xfrrrxf.exe108⤵PID:756
-
\??\c:\nbhbbb.exec:\nbhbbb.exe109⤵PID:4592
-
\??\c:\pjjpj.exec:\pjjpj.exe110⤵PID:220
-
\??\c:\djjjj.exec:\djjjj.exe111⤵PID:2968
-
\??\c:\xlxxxxl.exec:\xlxxxxl.exe112⤵PID:4984
-
\??\c:\frfllll.exec:\frfllll.exe113⤵PID:2024
-
\??\c:\pvvvv.exec:\pvvvv.exe114⤵PID:3916
-
\??\c:\djjjd.exec:\djjjd.exe115⤵PID:3952
-
\??\c:\rlxxrlf.exec:\rlxxrlf.exe116⤵PID:1532
-
\??\c:\tnbtnn.exec:\tnbtnn.exe117⤵PID:3084
-
\??\c:\pjjdv.exec:\pjjdv.exe118⤵PID:4672
-
\??\c:\rlffxxf.exec:\rlffxxf.exe119⤵PID:2336
-
\??\c:\thtthn.exec:\thtthn.exe120⤵PID:1448
-
\??\c:\vvvjj.exec:\vvvjj.exe121⤵PID:2980
-
\??\c:\rlffxll.exec:\rlffxll.exe122⤵PID:3004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-