Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 16:08
Behavioral task
behavioral1
Sample
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe
Resource
win7-20240903-en
General
-
Target
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe
-
Size
78KB
-
MD5
36fe4429aa9fe723066f85d27d8134f9
-
SHA1
118a2801451743b606ea3addc5a81a70bc34e7cc
-
SHA256
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a
-
SHA512
dfb518201b9e7c2caa108ced5641eeb85d44ce0458e0b3596fc6b02f8104da88f5fafc8bfe0105547a323665e962621a5814932c2edd53426dff4e19d15eca1d
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7kew:xhOmTsF93UYfwC6GIout03LzGFw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2372-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2816-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-605-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-931-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-956-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-1362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbnnbb.exepjvjv.exexxrrrrr.exehttbht.exepjjjp.exejdppd.exerrffxxx.exetbhbnt.exe7djdj.exerrxxlrx.exehbtbbb.exennnbbn.exepvvpp.exeffxrrlf.exe5hnhbb.exehnthbn.exepvvjd.exexlxxrxr.exelfxfxfx.exetbtbbh.exehbbtnt.exe5vjjv.exellllllr.exelfxxxxx.exe1hhhhn.exehhtthn.exeddjjd.exexxffxxx.exefllfflf.exeddvpp.exejdpvp.exerxxrllf.exehhntnt.exepjvpj.exepjpjj.exerrxrrrf.exetbhbtb.exehtbtnh.exe1djdd.exerfffflf.exerrxxlrf.exe7hnhhb.exebbtnnn.exexrllllf.exenbhnnt.exedvddp.exefrrxxxx.exehbbbhn.exe1ntttt.exejdvvp.exe5bbntb.exenttbbb.exerrrrrrr.exe7xllxfr.exetnnnnt.exedpvdd.exeppvvv.exefrffffl.exettbbbh.exepdppj.exefxfffrr.exe3tbbhh.exeddpjj.exevjvdd.exepid process 852 bbnnbb.exe 1320 pjvjv.exe 4388 xxrrrrr.exe 4564 httbht.exe 756 pjjjp.exe 4796 jdppd.exe 1996 rrffxxx.exe 4224 tbhbnt.exe 4144 7djdj.exe 940 rrxxlrx.exe 3636 hbtbbb.exe 3984 nnnbbn.exe 1052 pvvpp.exe 2616 ffxrrlf.exe 2352 5hnhbb.exe 3124 hnthbn.exe 2500 pvvjd.exe 2328 xlxxrxr.exe 3672 lfxfxfx.exe 3456 tbtbbh.exe 4592 hbbtnt.exe 4728 5vjjv.exe 3572 llllllr.exe 2348 lfxxxxx.exe 2288 1hhhhn.exe 4748 hhtthn.exe 4588 ddjjd.exe 4816 xxffxxx.exe 4944 fllfflf.exe 1044 ddvpp.exe 2640 jdpvp.exe 4536 rxxrllf.exe 1708 hhntnt.exe 5036 pjvpj.exe 540 pjpjj.exe 2292 rrxrrrf.exe 2356 tbhbtb.exe 1692 htbtnh.exe 3152 1djdd.exe 4548 rfffflf.exe 2624 rrxxlrf.exe 1628 7hnhhb.exe 4048 bbtnnn.exe 3620 xrllllf.exe 408 nbhnnt.exe 2816 dvddp.exe 2520 frrxxxx.exe 4980 hbbbhn.exe 3368 1ntttt.exe 1440 jdvvp.exe 2752 5bbntb.exe 4836 nttbbb.exe 2088 rrrrrrr.exe 5028 7xllxfr.exe 4388 tnnnnt.exe 4424 dpvdd.exe 3888 ppvvv.exe 756 frffffl.exe 2424 ttbbbh.exe 2920 pdppj.exe 1032 fxfffrr.exe 2060 3tbbhh.exe 4768 ddpjj.exe 376 vjvdd.exe -
Processes:
resource yara_rule behavioral2/memory/2372-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbnnbb.exe upx behavioral2/memory/2372-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvjv.exe upx behavioral2/memory/852-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrrrrr.exe upx behavioral2/memory/1320-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\httbht.exe upx behavioral2/memory/4388-24-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjjjp.exe upx behavioral2/memory/4564-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdppd.exe upx behavioral2/memory/756-35-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrffxxx.exe upx behavioral2/memory/4796-39-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbhbnt.exe upx behavioral2/memory/1996-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7djdj.exe upx behavioral2/memory/4224-53-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrxxlrx.exe upx behavioral2/memory/940-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbtbbb.exe upx C:\nnnbbn.exe upx behavioral2/memory/3636-71-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvvpp.exe upx behavioral2/memory/3984-74-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ffxrrlf.exe upx C:\5hnhbb.exe upx behavioral2/memory/1052-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnthbn.exe upx C:\pvvjd.exe upx behavioral2/memory/3124-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxxrxr.exe upx behavioral2/memory/2328-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbtbbh.exe upx behavioral2/memory/3672-110-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfxfxfx.exe upx behavioral2/memory/3456-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5vjjv.exe upx \??\c:\hbbtnt.exe upx behavioral2/memory/4592-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llllllr.exe upx behavioral2/memory/4728-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxxxxx.exe upx behavioral2/memory/3572-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1hhhhn.exe upx behavioral2/memory/2348-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhtthn.exe upx behavioral2/memory/4748-151-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddjjd.exe upx C:\xxffxxx.exe upx behavioral2/memory/4816-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4588-158-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fllfflf.exe upx \??\c:\ddvpp.exe upx \??\c:\rxxrllf.exe upx behavioral2/memory/2640-181-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdpvp.exe upx behavioral2/memory/1044-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1708-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5036-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/540-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2356-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4548-217-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rrxxrlr.exetbbbbh.exenthntt.exevddjj.exe1jpjp.exe9fffffl.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fffffl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exebbnnbb.exepjvjv.exexxrrrrr.exehttbht.exepjjjp.exejdppd.exerrffxxx.exetbhbnt.exe7djdj.exerrxxlrx.exehbtbbb.exennnbbn.exepvvpp.exeffxrrlf.exe5hnhbb.exehnthbn.exepvvjd.exexlxxrxr.exelfxfxfx.exetbtbbh.exehbbtnt.exedescription pid process target process PID 2372 wrote to memory of 852 2372 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe bbnnbb.exe PID 2372 wrote to memory of 852 2372 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe bbnnbb.exe PID 2372 wrote to memory of 852 2372 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe bbnnbb.exe PID 852 wrote to memory of 1320 852 bbnnbb.exe pjvjv.exe PID 852 wrote to memory of 1320 852 bbnnbb.exe pjvjv.exe PID 852 wrote to memory of 1320 852 bbnnbb.exe pjvjv.exe PID 1320 wrote to memory of 4388 1320 pjvjv.exe xxrrrrr.exe PID 1320 wrote to memory of 4388 1320 pjvjv.exe xxrrrrr.exe PID 1320 wrote to memory of 4388 1320 pjvjv.exe xxrrrrr.exe PID 4388 wrote to memory of 4564 4388 xxrrrrr.exe httbht.exe PID 4388 wrote to memory of 4564 4388 xxrrrrr.exe httbht.exe PID 4388 wrote to memory of 4564 4388 xxrrrrr.exe httbht.exe PID 4564 wrote to memory of 756 4564 httbht.exe pjjjp.exe PID 4564 wrote to memory of 756 4564 httbht.exe pjjjp.exe PID 4564 wrote to memory of 756 4564 httbht.exe pjjjp.exe PID 756 wrote to memory of 4796 756 pjjjp.exe jdppd.exe PID 756 wrote to memory of 4796 756 pjjjp.exe jdppd.exe PID 756 wrote to memory of 4796 756 pjjjp.exe jdppd.exe PID 4796 wrote to memory of 1996 4796 jdppd.exe rrffxxx.exe PID 4796 wrote to memory of 1996 4796 jdppd.exe rrffxxx.exe PID 4796 wrote to memory of 1996 4796 jdppd.exe rrffxxx.exe PID 1996 wrote to memory of 4224 1996 rrffxxx.exe tbhbnt.exe PID 1996 wrote to memory of 4224 1996 rrffxxx.exe tbhbnt.exe PID 1996 wrote to memory of 4224 1996 rrffxxx.exe tbhbnt.exe PID 4224 wrote to memory of 4144 4224 tbhbnt.exe 7djdj.exe PID 4224 wrote to memory of 4144 4224 tbhbnt.exe 7djdj.exe PID 4224 wrote to memory of 4144 4224 tbhbnt.exe 7djdj.exe PID 4144 wrote to memory of 940 4144 7djdj.exe rrxxlrx.exe PID 4144 wrote to memory of 940 4144 7djdj.exe rrxxlrx.exe PID 4144 wrote to memory of 940 4144 7djdj.exe rrxxlrx.exe PID 940 wrote to memory of 3636 940 rrxxlrx.exe hbtbbb.exe PID 940 wrote to memory of 3636 940 rrxxlrx.exe hbtbbb.exe PID 940 wrote to memory of 3636 940 rrxxlrx.exe hbtbbb.exe PID 3636 wrote to memory of 3984 3636 hbtbbb.exe nnnbbn.exe PID 3636 wrote to memory of 3984 3636 hbtbbb.exe nnnbbn.exe PID 3636 wrote to memory of 3984 3636 hbtbbb.exe nnnbbn.exe PID 3984 wrote to memory of 1052 3984 nnnbbn.exe pvvpp.exe PID 3984 wrote to memory of 1052 3984 nnnbbn.exe pvvpp.exe PID 3984 wrote to memory of 1052 3984 nnnbbn.exe pvvpp.exe PID 1052 wrote to memory of 2616 1052 pvvpp.exe ffxrrlf.exe PID 1052 wrote to memory of 2616 1052 pvvpp.exe ffxrrlf.exe PID 1052 wrote to memory of 2616 1052 pvvpp.exe ffxrrlf.exe PID 2616 wrote to memory of 2352 2616 ffxrrlf.exe 5hnhbb.exe PID 2616 wrote to memory of 2352 2616 ffxrrlf.exe 5hnhbb.exe PID 2616 wrote to memory of 2352 2616 ffxrrlf.exe 5hnhbb.exe PID 2352 wrote to memory of 3124 2352 5hnhbb.exe hnthbn.exe PID 2352 wrote to memory of 3124 2352 5hnhbb.exe hnthbn.exe PID 2352 wrote to memory of 3124 2352 5hnhbb.exe hnthbn.exe PID 3124 wrote to memory of 2500 3124 hnthbn.exe pvvjd.exe PID 3124 wrote to memory of 2500 3124 hnthbn.exe pvvjd.exe PID 3124 wrote to memory of 2500 3124 hnthbn.exe pvvjd.exe PID 2500 wrote to memory of 2328 2500 pvvjd.exe xlxxrxr.exe PID 2500 wrote to memory of 2328 2500 pvvjd.exe xlxxrxr.exe PID 2500 wrote to memory of 2328 2500 pvvjd.exe xlxxrxr.exe PID 2328 wrote to memory of 3672 2328 xlxxrxr.exe lfxfxfx.exe PID 2328 wrote to memory of 3672 2328 xlxxrxr.exe lfxfxfx.exe PID 2328 wrote to memory of 3672 2328 xlxxrxr.exe lfxfxfx.exe PID 3672 wrote to memory of 3456 3672 lfxfxfx.exe tbtbbh.exe PID 3672 wrote to memory of 3456 3672 lfxfxfx.exe tbtbbh.exe PID 3672 wrote to memory of 3456 3672 lfxfxfx.exe tbtbbh.exe PID 3456 wrote to memory of 4592 3456 tbtbbh.exe hbbtnt.exe PID 3456 wrote to memory of 4592 3456 tbtbbh.exe hbbtnt.exe PID 3456 wrote to memory of 4592 3456 tbtbbh.exe hbbtnt.exe PID 4592 wrote to memory of 4728 4592 hbbtnt.exe 5vjjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe"C:\Users\Admin\AppData\Local\Temp\d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\bbnnbb.exec:\bbnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\pjvjv.exec:\pjvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\httbht.exec:\httbht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\pjjjp.exec:\pjjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\jdppd.exec:\jdppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\rrffxxx.exec:\rrffxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\tbhbnt.exec:\tbhbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\7djdj.exec:\7djdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\rrxxlrx.exec:\rrxxlrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\hbtbbb.exec:\hbtbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\nnnbbn.exec:\nnnbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\pvvpp.exec:\pvvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\ffxrrlf.exec:\ffxrrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\5hnhbb.exec:\5hnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\hnthbn.exec:\hnthbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\pvvjd.exec:\pvvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\xlxxrxr.exec:\xlxxrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\tbtbbh.exec:\tbtbbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\hbbtnt.exec:\hbbtnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\5vjjv.exec:\5vjjv.exe23⤵
- Executes dropped EXE
PID:4728 -
\??\c:\llllllr.exec:\llllllr.exe24⤵
- Executes dropped EXE
PID:3572 -
\??\c:\lfxxxxx.exec:\lfxxxxx.exe25⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1hhhhn.exec:\1hhhhn.exe26⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hhtthn.exec:\hhtthn.exe27⤵
- Executes dropped EXE
PID:4748 -
\??\c:\ddjjd.exec:\ddjjd.exe28⤵
- Executes dropped EXE
PID:4588 -
\??\c:\xxffxxx.exec:\xxffxxx.exe29⤵
- Executes dropped EXE
PID:4816 -
\??\c:\fllfflf.exec:\fllfflf.exe30⤵
- Executes dropped EXE
PID:4944 -
\??\c:\ddvpp.exec:\ddvpp.exe31⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jdpvp.exec:\jdpvp.exe32⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rxxrllf.exec:\rxxrllf.exe33⤵
- Executes dropped EXE
PID:4536 -
\??\c:\hhntnt.exec:\hhntnt.exe34⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pjvpj.exec:\pjvpj.exe35⤵
- Executes dropped EXE
PID:5036 -
\??\c:\pjpjj.exec:\pjpjj.exe36⤵
- Executes dropped EXE
PID:540 -
\??\c:\rrxrrrf.exec:\rrxrrrf.exe37⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tbhbtb.exec:\tbhbtb.exe38⤵
- Executes dropped EXE
PID:2356 -
\??\c:\htbtnh.exec:\htbtnh.exe39⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1djdd.exec:\1djdd.exe40⤵
- Executes dropped EXE
PID:3152 -
\??\c:\rfffflf.exec:\rfffflf.exe41⤵
- Executes dropped EXE
PID:4548 -
\??\c:\rrxxlrf.exec:\rrxxlrf.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7hnhhb.exec:\7hnhhb.exe43⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bbtnnn.exec:\bbtnnn.exe44⤵
- Executes dropped EXE
PID:4048 -
\??\c:\xrllllf.exec:\xrllllf.exe45⤵
- Executes dropped EXE
PID:3620 -
\??\c:\nbhnnt.exec:\nbhnnt.exe46⤵
- Executes dropped EXE
PID:408 -
\??\c:\dvddp.exec:\dvddp.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\frrxxxx.exec:\frrxxxx.exe48⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hbbbhn.exec:\hbbbhn.exe49⤵
- Executes dropped EXE
PID:4980 -
\??\c:\1ntttt.exec:\1ntttt.exe50⤵
- Executes dropped EXE
PID:3368 -
\??\c:\jdvvp.exec:\jdvvp.exe51⤵
- Executes dropped EXE
PID:1440 -
\??\c:\lrrllll.exec:\lrrllll.exe52⤵PID:4400
-
\??\c:\5bbntb.exec:\5bbntb.exe53⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nttbbb.exec:\nttbbb.exe54⤵
- Executes dropped EXE
PID:4836 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe55⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7xllxfr.exec:\7xllxfr.exe56⤵
- Executes dropped EXE
PID:5028 -
\??\c:\tnnnnt.exec:\tnnnnt.exe57⤵
- Executes dropped EXE
PID:4388 -
\??\c:\dpvdd.exec:\dpvdd.exe58⤵
- Executes dropped EXE
PID:4424 -
\??\c:\ppvvv.exec:\ppvvv.exe59⤵
- Executes dropped EXE
PID:3888 -
\??\c:\frffffl.exec:\frffffl.exe60⤵
- Executes dropped EXE
PID:756 -
\??\c:\ttbbbh.exec:\ttbbbh.exe61⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pdppj.exec:\pdppj.exe62⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fxfffrr.exec:\fxfffrr.exe63⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3tbbhh.exec:\3tbbhh.exe64⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddpjj.exec:\ddpjj.exe65⤵
- Executes dropped EXE
PID:4768 -
\??\c:\vjvdd.exec:\vjvdd.exe66⤵
- Executes dropped EXE
PID:376 -
\??\c:\bhbbth.exec:\bhbbth.exe67⤵PID:5032
-
\??\c:\dvppp.exec:\dvppp.exe68⤵PID:3956
-
\??\c:\fffxrrl.exec:\fffxrrl.exe69⤵PID:3984
-
\??\c:\fxlxxrr.exec:\fxlxxrr.exe70⤵PID:1256
-
\??\c:\vvvpp.exec:\vvvpp.exe71⤵PID:4688
-
\??\c:\7rflrxx.exec:\7rflrxx.exe72⤵PID:2616
-
\??\c:\xxllllr.exec:\xxllllr.exe73⤵PID:2252
-
\??\c:\ppppp.exec:\ppppp.exe74⤵PID:2352
-
\??\c:\1pvvv.exec:\1pvvv.exe75⤵PID:1076
-
\??\c:\rlfrllf.exec:\rlfrllf.exe76⤵PID:3676
-
\??\c:\ttnnhn.exec:\ttnnhn.exe77⤵PID:2064
-
\??\c:\pvvvv.exec:\pvvvv.exe78⤵PID:2328
-
\??\c:\rxxxfll.exec:\rxxxfll.exe79⤵PID:4372
-
\??\c:\nthntt.exec:\nthntt.exe80⤵
- System Location Discovery: System Language Discovery
PID:5112 -
\??\c:\nthhhn.exec:\nthhhn.exe81⤵PID:3456
-
\??\c:\vpjjj.exec:\vpjjj.exe82⤵PID:4088
-
\??\c:\lllffll.exec:\lllffll.exe83⤵PID:452
-
\??\c:\tbtnnn.exec:\tbtnnn.exe84⤵PID:1644
-
\??\c:\jpppp.exec:\jpppp.exe85⤵PID:3572
-
\??\c:\djvvd.exec:\djvvd.exe86⤵PID:4364
-
\??\c:\rrxffll.exec:\rrxffll.exe87⤵PID:512
-
\??\c:\7tnnbh.exec:\7tnnbh.exe88⤵PID:3168
-
\??\c:\hbhhbh.exec:\hbhhbh.exe89⤵PID:4904
-
\??\c:\pjpjv.exec:\pjpjv.exe90⤵PID:3296
-
\??\c:\ffrxxxx.exec:\ffrxxxx.exe91⤵PID:4644
-
\??\c:\9bbnhh.exec:\9bbnhh.exe92⤵PID:3176
-
\??\c:\pvvdd.exec:\pvvdd.exe93⤵PID:3976
-
\??\c:\djjdv.exec:\djjdv.exe94⤵PID:1044
-
\??\c:\1rfxxxr.exec:\1rfxxxr.exe95⤵PID:2080
-
\??\c:\tbbtnn.exec:\tbbtnn.exe96⤵PID:1376
-
\??\c:\dpddd.exec:\dpddd.exe97⤵PID:3232
-
\??\c:\9rllllf.exec:\9rllllf.exe98⤵PID:1572
-
\??\c:\nhhhhn.exec:\nhhhhn.exe99⤵PID:1608
-
\??\c:\djpjj.exec:\djpjj.exe100⤵PID:3884
-
\??\c:\rrrrlfl.exec:\rrrrlfl.exe101⤵PID:3800
-
\??\c:\xrrlfff.exec:\xrrlfff.exe102⤵PID:2700
-
\??\c:\5bbnnn.exec:\5bbnnn.exe103⤵PID:2652
-
\??\c:\jvddd.exec:\jvddd.exe104⤵PID:60
-
\??\c:\jjjdv.exec:\jjjdv.exe105⤵PID:1936
-
\??\c:\9xffxrr.exec:\9xffxrr.exe106⤵PID:2624
-
\??\c:\xrflxll.exec:\xrflxll.exe107⤵PID:1628
-
\??\c:\hnnhbh.exec:\hnnhbh.exe108⤵PID:2268
-
\??\c:\jddvp.exec:\jddvp.exe109⤵PID:2576
-
\??\c:\frxlffx.exec:\frxlffx.exe110⤵PID:1776
-
\??\c:\rllfxxr.exec:\rllfxxr.exe111⤵PID:32
-
\??\c:\hnntbb.exec:\hnntbb.exe112⤵PID:4884
-
\??\c:\1nnhbb.exec:\1nnhbb.exe113⤵PID:3500
-
\??\c:\jjpjj.exec:\jjpjj.exe114⤵PID:3352
-
\??\c:\lfffxrl.exec:\lfffxrl.exe115⤵PID:1440
-
\??\c:\xrrrlll.exec:\xrrrlll.exe116⤵PID:2372
-
\??\c:\bttnhh.exec:\bttnhh.exe117⤵PID:4828
-
\??\c:\bbtnbb.exec:\bbtnbb.exe118⤵PID:4836
-
\??\c:\pjjjj.exec:\pjjjj.exe119⤵PID:4472
-
\??\c:\lxfffxx.exec:\lxfffxx.exe120⤵PID:4416
-
\??\c:\xfllrrl.exec:\xfllrrl.exe121⤵PID:2232
-
\??\c:\httthh.exec:\httthh.exe122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-