Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 15:45
Behavioral task
behavioral1
Sample
7b2b5ca308337dcbe131416471887f763fca1bd5a261575935a341efeec85306N.exe
Resource
win7-20241023-en
7 signatures
120 seconds
General
-
Target
7b2b5ca308337dcbe131416471887f763fca1bd5a261575935a341efeec85306N.exe
-
Size
71KB
-
MD5
96abf6db8ba955f5e2d59ff949fe8650
-
SHA1
e551dc3ad3ff9549a8e4c5def9648456f3504cbc
-
SHA256
7b2b5ca308337dcbe131416471887f763fca1bd5a261575935a341efeec85306
-
SHA512
52ecba3002b6098f9cab1184a1695153a049196e21a4e86a42b8fb236ba74205d8ba3221998f84fab9a1981ae4bb0094674e09b1ea464fd1d4274605bd4dc130
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8HglW8waWan:chOmTsF93UYfwC6GIout3t7an
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/3780-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-625-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-640-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-673-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-1185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-1459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/672-1472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4056 jjvvd.exe 2436 dvdvp.exe 396 1xlxrrl.exe 3672 llfffff.exe 3792 bbbttt.exe 4876 htbbtt.exe 4680 vjppp.exe 4964 xxlffff.exe 4996 1htnth.exe 4596 lfxrfff.exe 452 rflllll.exe 1428 nthhbh.exe 5092 pppjj.exe 1656 jpvvp.exe 4192 flffllx.exe 3668 llxrrrr.exe 2076 pjpjj.exe 3256 jdjdv.exe 3068 lfxrllf.exe 1476 tnnhhh.exe 4140 pjvdj.exe 2104 xxlrfll.exe 3236 vjppj.exe 4552 hbhhbb.exe 4900 pjvvp.exe 1560 lxffxfx.exe 1784 thbbtn.exe 3040 vvddv.exe 3048 9fxrfff.exe 4828 bnthnt.exe 4860 tntnhh.exe 2544 ppvpj.exe 2376 xffxlll.exe 4756 7hnnnn.exe 3976 1vpjj.exe 3204 ppvpp.exe 1868 lllfxll.exe 1036 htnttb.exe 2892 ntbbtn.exe 5060 dvppd.exe 4356 jdddv.exe 4652 1llfxfx.exe 4952 7bhhhn.exe 4464 nnnnnn.exe 2604 1vppj.exe 3220 rxfxllr.exe 4640 xrrrlll.exe 1176 9ntntb.exe 3080 jvvjd.exe 824 rxffrfl.exe 2728 flllflf.exe 1660 bbnntt.exe 508 vvpjd.exe 3828 9pppp.exe 4680 ppddj.exe 1640 xllfxfx.exe 1624 nhnnnh.exe 4996 9pjdv.exe 944 jjjdv.exe 2636 lxlfxrl.exe 3888 rlfxrrr.exe 668 hhnnbh.exe 4976 pvddp.exe 5092 vpvvv.exe -
resource yara_rule behavioral2/memory/3780-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023b80-3.dat upx behavioral2/memory/4056-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3780-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023c18-10.dat upx behavioral2/files/0x0008000000023c19-14.dat upx behavioral2/memory/4056-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2436-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c1a-24.dat upx behavioral2/memory/396-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c2c-28.dat upx behavioral2/memory/3672-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c32-34.dat upx behavioral2/files/0x0008000000023c33-39.dat upx behavioral2/memory/4876-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c34-45.dat upx behavioral2/files/0x0008000000023c35-50.dat upx behavioral2/memory/4964-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c36-56.dat upx behavioral2/memory/4996-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c37-63.dat upx behavioral2/memory/4596-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023c4c-68.dat upx behavioral2/memory/452-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0016000000023c4d-74.dat upx behavioral2/memory/1428-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c53-80.dat upx behavioral2/memory/1656-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c57-86.dat upx behavioral2/memory/4192-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5092-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c63-93.dat upx behavioral2/memory/3668-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c64-98.dat upx behavioral2/memory/3668-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2076-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c66-107.dat upx behavioral2/memory/3256-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c67-111.dat upx behavioral2/memory/3068-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c68-118.dat upx behavioral2/files/0x0008000000023c69-123.dat upx behavioral2/files/0x0008000000023c6a-126.dat upx behavioral2/memory/4140-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c6b-134.dat upx behavioral2/files/0x0008000000023c6c-138.dat upx behavioral2/memory/3236-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023c12-144.dat upx behavioral2/memory/4552-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c6d-150.dat upx behavioral2/memory/4900-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c76-158.dat upx behavioral2/files/0x0007000000023c77-161.dat upx behavioral2/memory/1784-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c78-167.dat upx behavioral2/memory/3040-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3048-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c79-174.dat upx behavioral2/files/0x0007000000023c7a-179.dat upx behavioral2/memory/4828-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4860-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c7b-186.dat upx behavioral2/memory/2544-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3976-201-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3780 wrote to memory of 4056 3780 7b2b5ca308337dcbe131416471887f763fca1bd5a261575935a341efeec85306N.exe 82 PID 3780 wrote to memory of 4056 3780 7b2b5ca308337dcbe131416471887f763fca1bd5a261575935a341efeec85306N.exe 82 PID 3780 wrote to memory of 4056 3780 7b2b5ca308337dcbe131416471887f763fca1bd5a261575935a341efeec85306N.exe 82 PID 4056 wrote to memory of 2436 4056 jjvvd.exe 83 PID 4056 wrote to memory of 2436 4056 jjvvd.exe 83 PID 4056 wrote to memory of 2436 4056 jjvvd.exe 83 PID 2436 wrote to memory of 396 2436 dvdvp.exe 84 PID 2436 wrote to memory of 396 2436 dvdvp.exe 84 PID 2436 wrote to memory of 396 2436 dvdvp.exe 84 PID 396 wrote to memory of 3672 396 1xlxrrl.exe 85 PID 396 wrote to memory of 3672 396 1xlxrrl.exe 85 PID 396 wrote to memory of 3672 396 1xlxrrl.exe 85 PID 3672 wrote to memory of 3792 3672 llfffff.exe 86 PID 3672 wrote to memory of 3792 3672 llfffff.exe 86 PID 3672 wrote to memory of 3792 3672 llfffff.exe 86 PID 3792 wrote to memory of 4876 3792 bbbttt.exe 87 PID 3792 wrote to memory of 4876 3792 bbbttt.exe 87 PID 3792 wrote to memory of 4876 3792 bbbttt.exe 87 PID 4876 wrote to memory of 4680 4876 htbbtt.exe 88 PID 4876 wrote to memory of 4680 4876 htbbtt.exe 88 PID 4876 wrote to memory of 4680 4876 htbbtt.exe 88 PID 4680 wrote to memory of 4964 4680 vjppp.exe 89 PID 4680 wrote to memory of 4964 4680 vjppp.exe 89 PID 4680 wrote to memory of 4964 4680 vjppp.exe 89 PID 4964 wrote to memory of 4996 4964 xxlffff.exe 90 PID 4964 wrote to memory of 4996 4964 xxlffff.exe 90 PID 4964 wrote to memory of 4996 4964 xxlffff.exe 90 PID 4996 wrote to memory of 4596 4996 1htnth.exe 91 PID 4996 wrote to memory of 4596 4996 1htnth.exe 91 PID 4996 wrote to memory of 4596 4996 1htnth.exe 91 PID 4596 wrote to memory of 452 4596 lfxrfff.exe 92 PID 4596 wrote to memory of 452 4596 lfxrfff.exe 92 PID 4596 wrote to memory of 452 4596 lfxrfff.exe 92 PID 452 wrote to memory of 1428 452 rflllll.exe 93 PID 452 wrote to memory of 1428 452 rflllll.exe 93 PID 452 wrote to memory of 1428 452 rflllll.exe 93 PID 1428 wrote to memory of 5092 1428 nthhbh.exe 94 PID 1428 wrote to memory of 5092 1428 nthhbh.exe 94 PID 1428 wrote to memory of 5092 1428 nthhbh.exe 94 PID 5092 wrote to memory of 1656 5092 pppjj.exe 95 PID 5092 wrote to memory of 1656 5092 pppjj.exe 95 PID 5092 wrote to memory of 1656 5092 pppjj.exe 95 PID 1656 wrote to memory of 4192 1656 jpvvp.exe 96 PID 1656 wrote to memory of 4192 1656 jpvvp.exe 96 PID 1656 wrote to memory of 4192 1656 jpvvp.exe 96 PID 4192 wrote to memory of 3668 4192 flffllx.exe 97 PID 4192 wrote to memory of 3668 4192 flffllx.exe 97 PID 4192 wrote to memory of 3668 4192 flffllx.exe 97 PID 3668 wrote to memory of 2076 3668 llxrrrr.exe 98 PID 3668 wrote to memory of 2076 3668 llxrrrr.exe 98 PID 3668 wrote to memory of 2076 3668 llxrrrr.exe 98 PID 2076 wrote to memory of 3256 2076 pjpjj.exe 99 PID 2076 wrote to memory of 3256 2076 pjpjj.exe 99 PID 2076 wrote to memory of 3256 2076 pjpjj.exe 99 PID 3256 wrote to memory of 3068 3256 jdjdv.exe 100 PID 3256 wrote to memory of 3068 3256 jdjdv.exe 100 PID 3256 wrote to memory of 3068 3256 jdjdv.exe 100 PID 3068 wrote to memory of 1476 3068 lfxrllf.exe 101 PID 3068 wrote to memory of 1476 3068 lfxrllf.exe 101 PID 3068 wrote to memory of 1476 3068 lfxrllf.exe 101 PID 1476 wrote to memory of 4140 1476 tnnhhh.exe 102 PID 1476 wrote to memory of 4140 1476 tnnhhh.exe 102 PID 1476 wrote to memory of 4140 1476 tnnhhh.exe 102 PID 4140 wrote to memory of 2104 4140 pjvdj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b2b5ca308337dcbe131416471887f763fca1bd5a261575935a341efeec85306N.exe"C:\Users\Admin\AppData\Local\Temp\7b2b5ca308337dcbe131416471887f763fca1bd5a261575935a341efeec85306N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\jjvvd.exec:\jjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\dvdvp.exec:\dvdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\1xlxrrl.exec:\1xlxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\llfffff.exec:\llfffff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\bbbttt.exec:\bbbttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\htbbtt.exec:\htbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\vjppp.exec:\vjppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\xxlffff.exec:\xxlffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\1htnth.exec:\1htnth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\lfxrfff.exec:\lfxrfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\rflllll.exec:\rflllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\nthhbh.exec:\nthhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\pppjj.exec:\pppjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\jpvvp.exec:\jpvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\flffllx.exec:\flffllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\llxrrrr.exec:\llxrrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\pjpjj.exec:\pjpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\jdjdv.exec:\jdjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\lfxrllf.exec:\lfxrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\tnnhhh.exec:\tnnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\pjvdj.exec:\pjvdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\xxlrfll.exec:\xxlrfll.exe23⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vjppj.exec:\vjppj.exe24⤵
- Executes dropped EXE
PID:3236 -
\??\c:\hbhhbb.exec:\hbhhbb.exe25⤵
- Executes dropped EXE
PID:4552 -
\??\c:\pjvvp.exec:\pjvvp.exe26⤵
- Executes dropped EXE
PID:4900 -
\??\c:\lxffxfx.exec:\lxffxfx.exe27⤵
- Executes dropped EXE
PID:1560 -
\??\c:\thbbtn.exec:\thbbtn.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vvddv.exec:\vvddv.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9fxrfff.exec:\9fxrfff.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\bnthnt.exec:\bnthnt.exe31⤵
- Executes dropped EXE
PID:4828 -
\??\c:\tntnhh.exec:\tntnhh.exe32⤵
- Executes dropped EXE
PID:4860 -
\??\c:\ppvpj.exec:\ppvpj.exe33⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xffxlll.exec:\xffxlll.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2376 -
\??\c:\7hnnnn.exec:\7hnnnn.exe35⤵
- Executes dropped EXE
PID:4756 -
\??\c:\1vpjj.exec:\1vpjj.exe36⤵
- Executes dropped EXE
PID:3976 -
\??\c:\ppvpp.exec:\ppvpp.exe37⤵
- Executes dropped EXE
PID:3204 -
\??\c:\lllfxll.exec:\lllfxll.exe38⤵
- Executes dropped EXE
PID:1868 -
\??\c:\htnttb.exec:\htnttb.exe39⤵
- Executes dropped EXE
PID:1036 -
\??\c:\ntbbtn.exec:\ntbbtn.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dvppd.exec:\dvppd.exe41⤵
- Executes dropped EXE
PID:5060 -
\??\c:\jdddv.exec:\jdddv.exe42⤵
- Executes dropped EXE
PID:4356 -
\??\c:\1llfxfx.exec:\1llfxfx.exe43⤵
- Executes dropped EXE
PID:4652 -
\??\c:\7bhhhn.exec:\7bhhhn.exe44⤵
- Executes dropped EXE
PID:4952 -
\??\c:\nnnnnn.exec:\nnnnnn.exe45⤵
- Executes dropped EXE
PID:4464 -
\??\c:\1vppj.exec:\1vppj.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rxfxllr.exec:\rxfxllr.exe47⤵
- Executes dropped EXE
PID:3220 -
\??\c:\xrrrlll.exec:\xrrrlll.exe48⤵
- Executes dropped EXE
PID:4640 -
\??\c:\9ntntb.exec:\9ntntb.exe49⤵
- Executes dropped EXE
PID:1176 -
\??\c:\jvvjd.exec:\jvvjd.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3080 -
\??\c:\rxffrfl.exec:\rxffrfl.exe51⤵
- Executes dropped EXE
PID:824 -
\??\c:\flllflf.exec:\flllflf.exe52⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bbnntt.exec:\bbnntt.exe53⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vvpjd.exec:\vvpjd.exe54⤵
- Executes dropped EXE
PID:508 -
\??\c:\9pppp.exec:\9pppp.exe55⤵
- Executes dropped EXE
PID:3828 -
\??\c:\ppddj.exec:\ppddj.exe56⤵
- Executes dropped EXE
PID:4680 -
\??\c:\xllfxfx.exec:\xllfxfx.exe57⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nhnnnh.exec:\nhnnnh.exe58⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9pjdv.exec:\9pjdv.exe59⤵
- Executes dropped EXE
PID:4996 -
\??\c:\jjjdv.exec:\jjjdv.exe60⤵
- Executes dropped EXE
PID:944 -
\??\c:\lxlfxrl.exec:\lxlfxrl.exe61⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe62⤵
- Executes dropped EXE
PID:3888 -
\??\c:\hhnnbh.exec:\hhnnbh.exe63⤵
- Executes dropped EXE
PID:668 -
\??\c:\pvddp.exec:\pvddp.exe64⤵
- Executes dropped EXE
PID:4976 -
\??\c:\vpvvv.exec:\vpvvv.exe65⤵
- Executes dropped EXE
PID:5092 -
\??\c:\djvpj.exec:\djvpj.exe66⤵PID:212
-
\??\c:\5fxxffr.exec:\5fxxffr.exe67⤵PID:220
-
\??\c:\bbnthh.exec:\bbnthh.exe68⤵PID:4628
-
\??\c:\ddppj.exec:\ddppj.exe69⤵PID:1432
-
\??\c:\1pppj.exec:\1pppj.exe70⤵PID:768
-
\??\c:\9fflflr.exec:\9fflflr.exe71⤵PID:3432
-
\??\c:\ttbbbb.exec:\ttbbbb.exe72⤵PID:2084
-
\??\c:\9tnntt.exec:\9tnntt.exe73⤵PID:3000
-
\??\c:\vpvpj.exec:\vpvpj.exe74⤵
- System Location Discovery: System Language Discovery
PID:3712 -
\??\c:\pjvvv.exec:\pjvvv.exe75⤵PID:3068
-
\??\c:\9xfffff.exec:\9xfffff.exe76⤵PID:4496
-
\??\c:\fflrlrr.exec:\fflrlrr.exe77⤵PID:1476
-
\??\c:\btttbb.exec:\btttbb.exe78⤵PID:1392
-
\??\c:\jjvvd.exec:\jjvvd.exe79⤵PID:3924
-
\??\c:\jjjdv.exec:\jjjdv.exe80⤵PID:5044
-
\??\c:\ppvvp.exec:\ppvvp.exe81⤵PID:3652
-
\??\c:\llrrfxx.exec:\llrrfxx.exe82⤵PID:4432
-
\??\c:\nnttnt.exec:\nnttnt.exe83⤵PID:3364
-
\??\c:\ntnnnt.exec:\ntnnnt.exe84⤵PID:3064
-
\??\c:\5djpv.exec:\5djpv.exe85⤵PID:2904
-
\??\c:\7xxrfll.exec:\7xxrfll.exe86⤵PID:1772
-
\??\c:\frxxrxx.exec:\frxxrxx.exe87⤵PID:4112
-
\??\c:\tttbhh.exec:\tttbhh.exe88⤵PID:2632
-
\??\c:\thhbtt.exec:\thhbtt.exe89⤵
- System Location Discovery: System Language Discovery
PID:1636 -
\??\c:\jpjdp.exec:\jpjdp.exe90⤵PID:2804
-
\??\c:\rllffll.exec:\rllffll.exe91⤵PID:4904
-
\??\c:\rrrllll.exec:\rrrllll.exe92⤵PID:4292
-
\??\c:\htbbbb.exec:\htbbbb.exe93⤵PID:1848
-
\??\c:\hbtttb.exec:\hbtttb.exe94⤵PID:4212
-
\??\c:\pjjdv.exec:\pjjdv.exe95⤵PID:3368
-
\??\c:\7ffrlxr.exec:\7ffrlxr.exe96⤵PID:4860
-
\??\c:\rrrffff.exec:\rrrffff.exe97⤵PID:3160
-
\??\c:\frfllrl.exec:\frfllrl.exe98⤵PID:4368
-
\??\c:\tntnnn.exec:\tntnnn.exe99⤵PID:4548
-
\??\c:\jdvvd.exec:\jdvvd.exe100⤵PID:5052
-
\??\c:\3flfxxr.exec:\3flfxxr.exe101⤵PID:1996
-
\??\c:\lrfffrl.exec:\lrfffrl.exe102⤵PID:3288
-
\??\c:\nbhhbb.exec:\nbhhbb.exe103⤵PID:2044
-
\??\c:\nnbbnn.exec:\nnbbnn.exe104⤵PID:2180
-
\??\c:\jvvvp.exec:\jvvvp.exe105⤵PID:1012
-
\??\c:\djvvp.exec:\djvvp.exe106⤵PID:5060
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe107⤵PID:4880
-
\??\c:\rxxfrrf.exec:\rxxfrrf.exe108⤵PID:4652
-
\??\c:\bnbttt.exec:\bnbttt.exe109⤵PID:3372
-
\??\c:\tnttnh.exec:\tnttnh.exe110⤵PID:1544
-
\??\c:\jdvpj.exec:\jdvpj.exe111⤵PID:2652
-
\??\c:\dddvv.exec:\dddvv.exe112⤵PID:4056
-
\??\c:\1xrxrxr.exec:\1xrxrxr.exe113⤵PID:4644
-
\??\c:\llxxllf.exec:\llxxllf.exe114⤵PID:396
-
\??\c:\htthbb.exec:\htthbb.exe115⤵PID:4108
-
\??\c:\bnnnbb.exec:\bnnnbb.exe116⤵PID:1480
-
\??\c:\9vvpp.exec:\9vvpp.exe117⤵PID:1164
-
\??\c:\vjvvd.exec:\vjvvd.exe118⤵PID:2600
-
\??\c:\pjvvp.exec:\pjvvp.exe119⤵PID:2320
-
\??\c:\dvpvp.exec:\dvpvp.exe120⤵PID:2072
-
\??\c:\lxffxrl.exec:\lxffxrl.exe121⤵PID:2644
-
\??\c:\9ttnhn.exec:\9ttnhn.exe122⤵PID:2020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-