Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 21:12
Static task
static1
Behavioral task
behavioral1
Sample
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe
Resource
win7-20240903-en
General
-
Target
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe
-
Size
332KB
-
MD5
c627dddffa7434e42384fbb2b307622c
-
SHA1
526fd0d28ae693bd9813ebbed46a5bfe297efac1
-
SHA256
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0
-
SHA512
3eb5903d056bddfdaf2e1dc693137b1b17bdd7401f0df856da09403aeb19ded80cd3aaa145369e3f7bb0a193d608cd58d70508cfd7c2eabc2e902a32dab720f6
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhP:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/244-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-855-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4052 jjpjj.exe 4576 jpjdv.exe 4756 ntbnnh.exe 4472 vjppp.exe 5008 llxxrxl.exe 4952 pjdpj.exe 3820 thbntb.exe 4800 dvvvp.exe 3964 lflllll.exe 1524 pvvvv.exe 1096 frxxxrl.exe 3992 btbnhb.exe 1624 xrxrrlf.exe 1896 ppdvp.exe 3092 nhtthh.exe 364 tntnbt.exe 1628 lrxxrrr.exe 2868 hhtntt.exe 5028 dvddv.exe 2888 xxfxxxr.exe 4988 vppvp.exe 2876 rxlfrfx.exe 1008 djvjd.exe 2016 pppjd.exe 452 rrrrlrl.exe 4296 xllrrxl.exe 2908 nbbbbt.exe 3352 nbhhtn.exe 1124 bhtnhh.exe 4216 xlrrlrl.exe 740 hbhhht.exe 3808 frxfxxl.exe 2788 frrllfl.exe 1640 ttbttn.exe 1492 9vdjj.exe 2752 hbbbnn.exe 4340 jvdvp.exe 2408 ffxrflr.exe 2432 nnthhh.exe 4444 jpdvp.exe 3596 7ntthn.exe 228 tnbttt.exe 2928 pdppp.exe 4432 lrlxfxl.exe 3136 nbhnbh.exe 2904 3dpjp.exe 3612 5dvjp.exe 1692 1llfxll.exe 1352 thnhbh.exe 2592 fllrrfx.exe 852 hbhhhn.exe 1216 dvddv.exe 4956 1vjdd.exe 4624 llffllx.exe 4576 3hbhbh.exe 1128 vjjdd.exe 4848 ddjjv.exe 3436 7fxlflf.exe 1984 hnbbbb.exe 4996 5dvpp.exe 4800 pjpvv.exe 4816 nbtttb.exe 2020 rrrrrxx.exe 4488 bttnnn.exe -
resource yara_rule behavioral2/memory/244-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-663-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnttb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 244 wrote to memory of 4052 244 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 83 PID 244 wrote to memory of 4052 244 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 83 PID 244 wrote to memory of 4052 244 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 83 PID 4052 wrote to memory of 4576 4052 jjpjj.exe 84 PID 4052 wrote to memory of 4576 4052 jjpjj.exe 84 PID 4052 wrote to memory of 4576 4052 jjpjj.exe 84 PID 4576 wrote to memory of 4756 4576 jpjdv.exe 85 PID 4576 wrote to memory of 4756 4576 jpjdv.exe 85 PID 4576 wrote to memory of 4756 4576 jpjdv.exe 85 PID 4756 wrote to memory of 4472 4756 ntbnnh.exe 86 PID 4756 wrote to memory of 4472 4756 ntbnnh.exe 86 PID 4756 wrote to memory of 4472 4756 ntbnnh.exe 86 PID 4472 wrote to memory of 5008 4472 vjppp.exe 87 PID 4472 wrote to memory of 5008 4472 vjppp.exe 87 PID 4472 wrote to memory of 5008 4472 vjppp.exe 87 PID 5008 wrote to memory of 4952 5008 llxxrxl.exe 88 PID 5008 wrote to memory of 4952 5008 llxxrxl.exe 88 PID 5008 wrote to memory of 4952 5008 llxxrxl.exe 88 PID 4952 wrote to memory of 3820 4952 pjdpj.exe 89 PID 4952 wrote to memory of 3820 4952 pjdpj.exe 89 PID 4952 wrote to memory of 3820 4952 pjdpj.exe 89 PID 3820 wrote to memory of 4800 3820 thbntb.exe 90 PID 3820 wrote to memory of 4800 3820 thbntb.exe 90 PID 3820 wrote to memory of 4800 3820 thbntb.exe 90 PID 4800 wrote to memory of 3964 4800 dvvvp.exe 91 PID 4800 wrote to memory of 3964 4800 dvvvp.exe 91 PID 4800 wrote to memory of 3964 4800 dvvvp.exe 91 PID 3964 wrote to memory of 1524 3964 lflllll.exe 92 PID 3964 wrote to memory of 1524 3964 lflllll.exe 92 PID 3964 wrote to memory of 1524 3964 lflllll.exe 92 PID 1524 wrote to memory of 1096 1524 pvvvv.exe 93 PID 1524 wrote to memory of 1096 1524 pvvvv.exe 93 PID 1524 wrote to memory of 1096 1524 pvvvv.exe 93 PID 1096 wrote to memory of 3992 1096 frxxxrl.exe 94 PID 1096 wrote to memory of 3992 1096 frxxxrl.exe 94 PID 1096 wrote to memory of 3992 1096 frxxxrl.exe 94 PID 3992 wrote to memory of 1624 3992 btbnhb.exe 95 PID 3992 wrote to memory of 1624 3992 btbnhb.exe 95 PID 3992 wrote to memory of 1624 3992 btbnhb.exe 95 PID 1624 wrote to memory of 1896 1624 xrxrrlf.exe 96 PID 1624 wrote to memory of 1896 1624 xrxrrlf.exe 96 PID 1624 wrote to memory of 1896 1624 xrxrrlf.exe 96 PID 1896 wrote to memory of 3092 1896 ppdvp.exe 97 PID 1896 wrote to memory of 3092 1896 ppdvp.exe 97 PID 1896 wrote to memory of 3092 1896 ppdvp.exe 97 PID 3092 wrote to memory of 364 3092 nhtthh.exe 98 PID 3092 wrote to memory of 364 3092 nhtthh.exe 98 PID 3092 wrote to memory of 364 3092 nhtthh.exe 98 PID 364 wrote to memory of 1628 364 tntnbt.exe 99 PID 364 wrote to memory of 1628 364 tntnbt.exe 99 PID 364 wrote to memory of 1628 364 tntnbt.exe 99 PID 1628 wrote to memory of 2868 1628 lrxxrrr.exe 100 PID 1628 wrote to memory of 2868 1628 lrxxrrr.exe 100 PID 1628 wrote to memory of 2868 1628 lrxxrrr.exe 100 PID 2868 wrote to memory of 5028 2868 hhtntt.exe 101 PID 2868 wrote to memory of 5028 2868 hhtntt.exe 101 PID 2868 wrote to memory of 5028 2868 hhtntt.exe 101 PID 5028 wrote to memory of 2888 5028 dvddv.exe 102 PID 5028 wrote to memory of 2888 5028 dvddv.exe 102 PID 5028 wrote to memory of 2888 5028 dvddv.exe 102 PID 2888 wrote to memory of 4988 2888 xxfxxxr.exe 103 PID 2888 wrote to memory of 4988 2888 xxfxxxr.exe 103 PID 2888 wrote to memory of 4988 2888 xxfxxxr.exe 103 PID 4988 wrote to memory of 2876 4988 vppvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe"C:\Users\Admin\AppData\Local\Temp\30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\jjpjj.exec:\jjpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\jpjdv.exec:\jpjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\ntbnnh.exec:\ntbnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\vjppp.exec:\vjppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\llxxrxl.exec:\llxxrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\pjdpj.exec:\pjdpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\thbntb.exec:\thbntb.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\dvvvp.exec:\dvvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\lflllll.exec:\lflllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\pvvvv.exec:\pvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\frxxxrl.exec:\frxxxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\btbnhb.exec:\btbnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\xrxrrlf.exec:\xrxrrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ppdvp.exec:\ppdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\nhtthh.exec:\nhtthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\tntnbt.exec:\tntnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\hhtntt.exec:\hhtntt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\dvddv.exec:\dvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\xxfxxxr.exec:\xxfxxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vppvp.exec:\vppvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\rxlfrfx.exec:\rxlfrfx.exe23⤵
- Executes dropped EXE
PID:2876 -
\??\c:\djvjd.exec:\djvjd.exe24⤵
- Executes dropped EXE
PID:1008 -
\??\c:\pppjd.exec:\pppjd.exe25⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe26⤵
- Executes dropped EXE
PID:452 -
\??\c:\xllrrxl.exec:\xllrrxl.exe27⤵
- Executes dropped EXE
PID:4296 -
\??\c:\nbbbbt.exec:\nbbbbt.exe28⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nbhhtn.exec:\nbhhtn.exe29⤵
- Executes dropped EXE
PID:3352 -
\??\c:\bhtnhh.exec:\bhtnhh.exe30⤵
- Executes dropped EXE
PID:1124 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe31⤵
- Executes dropped EXE
PID:4216 -
\??\c:\hbhhht.exec:\hbhhht.exe32⤵
- Executes dropped EXE
PID:740 -
\??\c:\frxfxxl.exec:\frxfxxl.exe33⤵
- Executes dropped EXE
PID:3808 -
\??\c:\frrllfl.exec:\frrllfl.exe34⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ttbttn.exec:\ttbttn.exe35⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9vdjj.exec:\9vdjj.exe36⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hbbbnn.exec:\hbbbnn.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jvdvp.exec:\jvdvp.exe38⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ffxrflr.exec:\ffxrflr.exe39⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nnthhh.exec:\nnthhh.exe40⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jpdvp.exec:\jpdvp.exe41⤵
- Executes dropped EXE
PID:4444 -
\??\c:\7ntthn.exec:\7ntthn.exe42⤵
- Executes dropped EXE
PID:3596 -
\??\c:\tnbttt.exec:\tnbttt.exe43⤵
- Executes dropped EXE
PID:228 -
\??\c:\pdppp.exec:\pdppp.exe44⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lrlxfxl.exec:\lrlxfxl.exe45⤵
- Executes dropped EXE
PID:4432 -
\??\c:\nbhnbh.exec:\nbhnbh.exe46⤵
- Executes dropped EXE
PID:3136 -
\??\c:\3dpjp.exec:\3dpjp.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5dvjp.exec:\5dvjp.exe48⤵
- Executes dropped EXE
PID:3612 -
\??\c:\1llfxll.exec:\1llfxll.exe49⤵
- Executes dropped EXE
PID:1692 -
\??\c:\thnhbh.exec:\thnhbh.exe50⤵
- Executes dropped EXE
PID:1352 -
\??\c:\fllrrfx.exec:\fllrrfx.exe51⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbhhhn.exec:\hbhhhn.exe52⤵
- Executes dropped EXE
PID:852 -
\??\c:\dvddv.exec:\dvddv.exe53⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1vjdd.exec:\1vjdd.exe54⤵
- Executes dropped EXE
PID:4956 -
\??\c:\llffllx.exec:\llffllx.exe55⤵
- Executes dropped EXE
PID:4624 -
\??\c:\3hbhbh.exec:\3hbhbh.exe56⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vjjdd.exec:\vjjdd.exe57⤵
- Executes dropped EXE
PID:1128 -
\??\c:\ddjjv.exec:\ddjjv.exe58⤵
- Executes dropped EXE
PID:4848 -
\??\c:\7fxlflf.exec:\7fxlflf.exe59⤵
- Executes dropped EXE
PID:3436 -
\??\c:\hnbbbb.exec:\hnbbbb.exe60⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5dvpp.exec:\5dvpp.exe61⤵
- Executes dropped EXE
PID:4996 -
\??\c:\pjpvv.exec:\pjpvv.exe62⤵
- Executes dropped EXE
PID:4800 -
\??\c:\nbtttb.exec:\nbtttb.exe63⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe64⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bttnnn.exec:\bttnnn.exe65⤵
- Executes dropped EXE
PID:4488 -
\??\c:\bnbbbh.exec:\bnbbbh.exe66⤵PID:1016
-
\??\c:\pjvpv.exec:\pjvpv.exe67⤵PID:768
-
\??\c:\fffxlxx.exec:\fffxlxx.exe68⤵PID:5060
-
\??\c:\vjjdd.exec:\vjjdd.exe69⤵PID:1796
-
\??\c:\vvjjj.exec:\vvjjj.exe70⤵PID:2388
-
\??\c:\5tbbtt.exec:\5tbbtt.exe71⤵PID:2028
-
\??\c:\tbhbtt.exec:\tbhbtt.exe72⤵PID:2420
-
\??\c:\jddvj.exec:\jddvj.exe73⤵PID:4540
-
\??\c:\5xllffx.exec:\5xllffx.exe74⤵PID:4976
-
\??\c:\tnhnnb.exec:\tnhnnb.exe75⤵PID:2368
-
\??\c:\vvppp.exec:\vvppp.exe76⤵PID:1620
-
\??\c:\ffrllxx.exec:\ffrllxx.exe77⤵PID:936
-
\??\c:\bnhbth.exec:\bnhbth.exe78⤵PID:4532
-
\??\c:\dpdvv.exec:\dpdvv.exe79⤵PID:3580
-
\??\c:\rxfxllf.exec:\rxfxllf.exe80⤵PID:1472
-
\??\c:\hhhhbh.exec:\hhhhbh.exe81⤵PID:1532
-
\??\c:\ddvvp.exec:\ddvvp.exe82⤵PID:1612
-
\??\c:\3ppvp.exec:\3ppvp.exe83⤵PID:4944
-
\??\c:\7rxrflr.exec:\7rxrflr.exe84⤵
- System Location Discovery: System Language Discovery
PID:2016 -
\??\c:\nbhbtt.exec:\nbhbtt.exe85⤵PID:3344
-
\??\c:\ddjjv.exec:\ddjjv.exe86⤵PID:3972
-
\??\c:\rrllrrr.exec:\rrllrrr.exe87⤵PID:1728
-
\??\c:\fffxrrx.exec:\fffxrrx.exe88⤵PID:3848
-
\??\c:\9nnbtb.exec:\9nnbtb.exe89⤵PID:1672
-
\??\c:\vpddv.exec:\vpddv.exe90⤵PID:2612
-
\??\c:\pdpjj.exec:\pdpjj.exe91⤵PID:2556
-
\??\c:\xrfxxll.exec:\xrfxxll.exe92⤵PID:2972
-
\??\c:\xrflrrf.exec:\xrflrrf.exe93⤵PID:632
-
\??\c:\bhtthn.exec:\bhtthn.exe94⤵PID:3624
-
\??\c:\9ppjj.exec:\9ppjj.exe95⤵PID:4200
-
\??\c:\llrrrll.exec:\llrrrll.exe96⤵PID:3920
-
\??\c:\hhtnnn.exec:\hhtnnn.exe97⤵PID:3884
-
\??\c:\pjddv.exec:\pjddv.exe98⤵PID:1224
-
\??\c:\5rrxrrr.exec:\5rrxrrr.exe99⤵PID:4748
-
\??\c:\flxrlff.exec:\flxrlff.exe100⤵PID:2032
-
\??\c:\9vddd.exec:\9vddd.exe101⤵PID:1528
-
\??\c:\9lllfxx.exec:\9lllfxx.exe102⤵PID:3272
-
\??\c:\hnbbbb.exec:\hnbbbb.exe103⤵PID:956
-
\??\c:\jvpjd.exec:\jvpjd.exe104⤵PID:3560
-
\??\c:\xllffff.exec:\xllffff.exe105⤵PID:4508
-
\??\c:\7nhbtt.exec:\7nhbtt.exe106⤵PID:1476
-
\??\c:\vjjvv.exec:\vjjvv.exe107⤵PID:4948
-
\??\c:\xrfffxf.exec:\xrfffxf.exe108⤵PID:4052
-
\??\c:\pdddd.exec:\pdddd.exe109⤵PID:4796
-
\??\c:\pppjj.exec:\pppjj.exe110⤵PID:3152
-
\??\c:\rxlffll.exec:\rxlffll.exe111⤵PID:3460
-
\??\c:\hhbbhh.exec:\hhbbhh.exe112⤵PID:3324
-
\??\c:\bbhbtt.exec:\bbhbtt.exe113⤵PID:4564
-
\??\c:\ddvpj.exec:\ddvpj.exe114⤵PID:3548
-
\??\c:\rrfxrrf.exec:\rrfxrrf.exe115⤵PID:2052
-
\??\c:\nnnhbb.exec:\nnnhbb.exe116⤵PID:3412
-
\??\c:\jpvvv.exec:\jpvvv.exe117⤵PID:4692
-
\??\c:\ffrlffx.exec:\ffrlffx.exe118⤵PID:4124
-
\??\c:\hntnbt.exec:\hntnbt.exe119⤵PID:4784
-
\??\c:\btbtnn.exec:\btbtnn.exe120⤵PID:1172
-
\??\c:\vdjdp.exec:\vdjdp.exe121⤵PID:2936
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe122⤵PID:4268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-